Silver v. Stripe, Inc.

Background

Jasen Silver, Jill Lienhard, Patricia Tysinger, Victoria Waters, and Alaina Jones brought an amended class action against Stripe Inc. The amended complaint asserted nine causes of action: two claims under the California Invasion of Privacy Act, claims under Florida and Washington wiretap statutes, a claim under Utah’s Notice of Intent to Sell Nonpublic Personal Information Act, California constitutional invasion of privacy, intrusion upon seclusion, California’s Unfair Competition Law, and unjust enrichment.

The complaint alleged that Stripe secretly tracked, collected, stored, and used website visitors’ personal and web-activity data through its payment-processing software. The alleged data included financial information, mouse movements, keystrokes, internet and device information, geolocation, transaction history, and information about declined or disputed charges. The complaint further alleged that Stripe correlated payments across its merchant network, assigned consumers risk scores, and shared information with merchants without informing consumers.

Stripe moved to dismiss all claims under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint adequately states a legal claim. The court considered the allegations in the amended complaint and the privacy policy used during Instacart checkout.

Consent and Wiretap Claims

The court held that considering consent was appropriate because the first four claims required the plaintiffs to show that the alleged interceptions or collection occurred without consent. Instacart’s checkout process used a “sign-in wrap” arrangement: users were told that placing an order meant agreeing to Instacart’s terms of service and privacy policy. The court found the privacy-policy link conspicuous because it appeared in bright green near the “Place Order” button. It concluded that a reasonably careful user would have noticed the policy and that plaintiffs consented to it each time they placed an order.

The court also found that the policy disclosed that Instacart could share information with payment-processing partners and that partners could use technology to collect information about online activity over time and across websites. The court concluded that these disclosures were sufficient to establish consent to Stripe’s collection of the data at issue, even though the policy was provided by Instacart and used the word “may.”

The court therefore granted Stripe’s motion to dismiss the first, second, third, and fourth causes of action, which asserted claims under the California, Florida, and Washington wiretap laws. The dismissal was without leave to amend.

Utah Notice Claim

The court found that the complaint adequately alleged an individual claim under Utah’s Notice of Intent to Sell Nonpublic Personal Information Act. It alleged that Stripe conducted business in Utah, collected plaintiffs’ personal information while they used Instacart for personal, family, or household purposes, and processed their payments as part of those transactions.

However, the statute provides that a person may not bring a class action for a violation. The court therefore denied the motion to dismiss as to Alaina Jones individually and granted the motion as to the Utah Class. The grant as to the Utah Class was without leave to amend.

Privacy Claims

The sixth and seventh causes of action alleged invasion of privacy under the California Constitution and intrusion upon seclusion under California common law. Both claims involve whether the plaintiff had a reasonable expectation of privacy and whether the intrusion was highly offensive. The court stated that whether conduct is highly offensive generally cannot be resolved at the pleading stage.

The court distinguished between plaintiffs’ consent to Stripe’s initial collection of information and consent to later disclosure. It found that the complaint adequately alleged that the privacy policy did not tell consumers that Stripe would compile their sensitive data, create risk profiles, and disclose that information to merchants and customers for purposes unrelated to fraud prevention or payment processing. The court therefore denied the motion to dismiss the sixth and seventh causes of action.

California Unfair Competition Law Claim

The eighth cause of action asserted that Stripe’s conduct violated the unlawful, fraudulent, and unfair prongs of California’s Unfair Competition Law.

The court granted the motion to dismiss the unlawful prong. The complaint did not adequately explain the alleged violations of the other laws on which that theory depended, and the court noted that the California Consumer Privacy Act does not provide the private right of action plaintiffs attempted to use. The dismissal of the unlawful prong was without leave to amend.

The court also granted the motion to dismiss the fraudulent prong, finding that the complaint did not plead deception with the required specificity and did not establish that Stripe had an affirmative duty to disclose its data-collection practices. The dismissal of the fraudulent prong was without leave to amend.

The court denied the motion as to the unfair prong to the extent it challenged Stripe’s alleged disclosure of plaintiffs’ information. The court stated that the allegations could support an unfairness theory based on disclosure, but that claims based only on Stripe’s collection of the information failed.

Unjust Enrichment

The court explained that California does not recognize unjust enrichment as a standalone cause of action, although a claim labeled unjust enrichment may sometimes be treated as a request for restitution based on fraud. Here, plaintiffs pursued tort and statutory claims rather than waiving those claims and seeking restitution under a quasi-contract theory. The court therefore concluded that the unjust-enrichment claim was duplicative and also failed in light of its analysis of the fraudulent UCL theory.

The court granted Stripe’s motion to dismiss the ninth cause of action, without leave to amend.

Disposition

The motion to dismiss was granted in part and denied in part. The first through fourth causes of action were dismissed without leave to amend. As to the fifth cause of action, the motion was denied for Alaina Jones individually and granted without leave to amend as to the Utah Class. The motion was denied as to the sixth and seventh causes of action. As to the eighth cause of action, the motion was denied regarding the unfair prong but granted without leave to amend regarding the unlawful and fraudulent prongs. The ninth cause of action was dismissed without leave to amend.

Stripe was ordered to answer the amended complaint within 21 days. Judge Yvonne Gonzalez Rogers also scheduled a case-management conference for August 30, 2021, and terminated the motion docketed as No. 48.