Gershzon v. Meta Platforms, Inc.

Background

Mikhail Gershzon filed a class action against Meta Platforms, Inc., alleging violations of the federal Driver’s Privacy Protection Act (DPPA) and the California Invasion of Privacy Act (CIPA). He alleged that Meta knowingly obtained personal information and communications through a hidden tracking code called the Meta Pixel, which was installed on the California Department of Motor Vehicles (DMV) website.

According to the complaint, the Pixel transmitted information to Meta while users interacted with the DMV website. The alleged information included users’ names, email addresses, disability information, account activity, search queries, URLs, and other information about their health, disability status, immigration status, and interests. Gershzon alleged that Meta used this information for advertising, profiling, and audience targeting without his consent.

Gershzon alleged that he had used the DMV website, including to apply for a disabled parking placard, and that the Pixel transmitted his first name, email address, and disability information to Meta. He brought the case for himself and proposed class members who accessed their MyDMV accounts or checked the status of certain DMV applications.

Motion to Dismiss Standard

Meta moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), arguing that the complaint did not state a legally sufficient claim. At this stage, the court accepted the complaint’s factual allegations as true and considered whether those allegations plausibly showed that Gershzon was entitled to relief. The court did not decide the ultimate truth of the allegations or Meta’s ultimate liability.

Driver’s Privacy Protection Act Claim

The court held that Gershzon plausibly alleged the three elements of a DPPA claim: that Meta knowingly obtained personal information, that the information came from a motor-vehicle record, and that Meta obtained it for a purpose not permitted by the statute.

First, the court held that the alleged information qualified as “personal information” under the DPPA. The statute includes names, email addresses, and medical or disability information. The court concluded that a first name is a name, that an email address can identify an individual, and that information showing that someone applied for a disability parking placard is disability information.

Second, the court held that the complaint plausibly alleged that the information came from a motor-vehicle record. The court reasoned that a disabled parking placard, and an application for one, pertains to a motor-vehicle operator’s permit. The court also rejected Meta’s argument that information transmitted through website requests could not come from a record. The court found that the complaint alleged that the DMV maintained the information after Gershzon provided it through his online DMV account.

Third, the court held that Gershzon plausibly alleged an impermissible purpose. The complaint alleged that Meta obtained the information to create customized advertising audiences, target advertisements, improve profiling and categorization systems, and advance its advertising business. Whether Meta had a permitted purpose or whether Gershzon consented presented factual questions that could not be resolved on a motion to dismiss.

The court also held that the complaint adequately alleged that Meta acted knowingly. The allegations that Meta assigned identifiers to the Pixels, tracked where they operated, and knew that information exchanged with the DMV was being transmitted to Meta were sufficient at this stage. The court concluded that “knowingly” applied to Meta’s obtaining, disclosing, or using the information, not necessarily to knowledge that the conduct violated the DPPA.

California Invasion of Privacy Act Claim

The court also held that Gershzon plausibly stated a claim under CIPA. The complaint alleged that Meta tracked and intercepted communications between users and the DMV without the consent of all parties, intended to learn the meaning of those communications, and used the information it obtained.

The court rejected Meta’s argument that the allegations showed only accidental receipt of information. The complaint alleged that Meta designed the Pixel to maximize the private information it transmitted, knew that the Pixel operated on the DMV website, and intended to learn and did learn the meaning of communications. The court stated that whether Meta acted willfully was a factual question.

The court also rejected Meta’s arguments about consent. It found that the complaint’s allegations were sufficient and that the consent issue could not be resolved from the pleadings.

The court concluded that at least some of the information allegedly transmitted—such as information showing that a person had a disability or sought a disability parking placard—could constitute the “contents” of communications under CIPA. The court distinguished general record information from substantive information revealed by URLs, search queries, and website activity. It also held that the question whether the statute of limitations was extended because Meta allegedly concealed its conduct could not be decided on the pleadings.

Requests for Judicial Notice

Meta asked the court to take judicial notice of Meta’s privacy and cookies policies and the DMV’s conditions of use. The court denied those requests because it would not consider documents outside the complaint and draw factual inferences from them in Meta’s favor at the pleading stage.

Disposition

The court concluded that Gershzon stated claims under both the DPPA and CIPA. It therefore denied Meta’s motion to dismiss and denied Meta’s requests for judicial notice. The court stated that a pretrial schedule would be set at the September 1, 2023 case-management conference.