Javier v. Assurance IQ, LLC

Background

Florentino Javier sued Assurance IQ, LLC and ActiveProspect Inc. He alleged that, while he visited Assurance’s Nationalfamily.com website to obtain a life-insurance quote, ActiveProspect’s TrustedForm software secretly recorded his keystrokes, mouse clicks, data entry, and other electronic communications. Javier asserted a claim under Section 631 of the California Invasion of Privacy Act and a claim for invasion of privacy under the California Constitution.

The court noted that two earlier dismissals by Judge White had been based on the conclusion that Javier consented to information collection by accepting Assurance’s Privacy Policy. The Ninth Circuit reversed only the dismissal of the Section 631 claim, holding that Javier plausibly alleged that he did not consent to collection occurring before he assented to the Privacy Policy. The Ninth Circuit did not decide the defendants’ other arguments, including implied consent, whether ActiveProspect was a third party under Section 631, and the statute of limitations. The opinion also states that the earlier dismissal of the California constitutional claim was not disturbed because Javier did not appeal that claim.

Ruling

The court considered three arguments concerning Javier’s Section 631 claim.

First, the court rejected the defendants’ argument that Javier impliedly consented to the data collection from the moment he arrived at the website. The court stated that Javier might have consented to Assurance collecting information needed to provide an insurance quote, but the allegations did not show that he consented to ActiveProspect collecting the information. The court therefore found that implied consent did not support dismissal of the Section 631 claim against ActiveProspect at that stage. The court also stated that Assurance, as a participant in the communication, could not be liable under the second part of Section 631 for eavesdropping on its own communication.

Second, the court rejected the argument that ActiveProspect was merely an “extension” of Assurance and therefore could not be a third-party eavesdropper. The court concluded that Javier plausibly alleged that ActiveProspect was a third party because the software could use the recorded information for purposes beyond the ordinary function of a recorder, and Javier alleged that he did not know his communications would be disclosed to ActiveProspect.

Third, the court addressed the delayed discovery doctrine, which can postpone when a claim’s filing deadline begins if the plaintiff could not reasonably have discovered the injury earlier. The court explained that the California Invasion of Privacy Act has a one-year statute of limitations. Because the alleged violation occurred in January 2019 and Javier filed suit on April 24, 2020, he needed to plead facts supporting delayed discovery. The court found that he did not do so because he alleged that he knew Assurance was collecting his information and had constructive notice from the Privacy Policy that Assurance might use third-party vendors to monitor and analyze website activity. The court held that knowledge of the injury, rather than knowledge of the particular defendant’s identity, triggered the duty to investigate.

The court therefore dismissed Javier’s Section 631 claim as barred by the statute of limitations, granted the defendants’ motion to dismiss, and gave Javier leave to amend his delayed-discovery allegations. The order allowed him 21 days to file an amended complaint.