Katz-Lacabe v. Oracle America, Inc.

Background

Three individual plaintiffs—Michael Katz-Lacabe, Dr. Jennifer Golbeck, and Dr. Johnny Ryan—filed a proposed class action against Oracle America, Inc. They allege that Oracle collected web-browsing and other activity, combined information from multiple sources, created electronic profiles, and made personal information available to third parties through its Oracle Data Marketplace and Oracle ID Graph. The complaint asserts seven causes of action: invasion of privacy under the California Constitution; intrusion upon seclusion under California common law; violation of California’s Unfair Competition Law; violation of the California Invasion of Privacy Act; violation of the federal Wiretap Act; unjust enrichment; and declaratory judgment and injunctive relief.

The proposed groups included worldwide, United States, California, California Wiretap Act, and federal Wiretap Act subclasses. Oracle moved to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6), arguing that the plaintiffs lacked Article III standing and failed to state claims. Oracle also moved to strike portions of the complaint under Rule 12(f) and sought judicial notice of documents.

Standing

The court held that the plaintiffs alleged enough injury and causation to establish Article III standing at the pleading stage. Katz-Lacabe allegedly received a document from Oracle indicating that Oracle had tracked and analyzed his activity and created a profile. Golbeck allegedly discovered Oracle tracking devices on multiple computers, and the complaint made similar allegations about Ryan. The court concluded that the alleged collection and profiling of personal information could constitute an invasion of privacy and that the claimed connection between Oracle’s conduct and the alleged harm was not too speculative.

Claims that survived dismissal

The court allowed the California constitutional privacy and California common-law intrusion-upon-seclusion claims to proceed based on the allegations that Oracle collected and combined substantial amounts of personal information, including alleged health, race, and political information. At the pleading stage, the court found that the allegations were sufficient to plausibly show a reasonable expectation of privacy and a highly offensive intrusion.

The California Invasion of Privacy Act claim also survived. The court concluded that Oracle was not a party to the communications at issue and that the allegations about data entered into web forms were just sufficient to allege interception of “contents” under the relevant statutes. The court separately held that the website operators’ alleged consent defeated the federal Wiretap Act claim, but not the California claim at this stage.

The declaratory judgment claim survived to the extent that other claims survived. The court also denied Oracle’s request to dismiss the claims for equitable relief, explaining that the plaintiffs could plead equitable remedies in the alternative and that the issue could be revisited later.

Claims dismissed

The court dismissed the Unfair Competition Law claims because the plaintiffs did not allege a specific monetary or economic loss, as required for standing under that law. This was separate from the court’s conclusion that the plaintiffs had Article III standing.

The court dismissed the unjust-enrichment claim because the plaintiffs did not show that Oracle unjustly retained a benefit at their expense. The court treated the claim as potentially seeking restitution under a quasi-contract theory rather than rejecting it solely because California does not recognize unjust enrichment as a standalone cause of action.

The court also dismissed the federal Wiretap Act claim because Oracle’s customers—the websites using Oracle’s tools—allegedly gave one-party consent to interception. The court rejected the plaintiffs’ argument that an exception for conduct intended to injure them applied.

Finally, the court dismissed the California common-law intrusion-upon-seclusion claim as asserted for the proposed nationwide and worldwide classes. It found meaningful differences between California law, Florida law, and the General Data Protection Regulation, and concluded that California law could not be applied nationwide or globally on the allegations presented.

Other rulings and disposition

The court’s order states that the motion to dismiss was granted in part and denied in part. The Unfair Competition Law, federal Wiretap Act, unjust-enrichment, and intrusion-upon-seclusion claims for the worldwide and United States subclasses were dismissed without prejudice. The invasion-of-privacy claim, the California-subclass intrusion-upon-seclusion claim, the California Invasion of Privacy Act claim, the declaratory judgment claim, and the equitable-relief claims survived.

The request for judicial notice was granted in part and denied in part. The court denied incorporation by reference except for Exhibits J and H, which were clearly identified and linked in the complaint. The motion to strike allegations in specified complaint paragraphs was denied. Plaintiffs were given 30 days to file an amended complaint. The order was entered by Chief United States District Judge Richard Seeborg on April 6, 2023.