Yockey v. Salesforce, Inc.

Background

Salesforce provides Chat, an application programming interface that companies can place on their websites. The complaint alleged that chat communications were routed through Salesforce servers, automatically transcribed in real time, and made available for viewing by customer-service supervisors. It also alleged that Salesforce’s “Sneak Peek” feature allowed an agent to see the contents of a customer’s message while the customer was typing it, before the message was sent.

Patrick Yockey used Chat on the Rite Aid website to discuss his prescription history and customer rewards. Pearl Magpayo used Chat on the Kaiser Permanente website to discuss insurance and medical information. The plaintiffs sued individually and on behalf of a proposed class, alleging violations of California’s Invasion of Privacy Act (CIPA), California Penal Code Sections 631 and 632, and Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA).

Salesforce moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint states a legally sufficient claim. It argued that the plaintiffs lacked standing, had not stated claims under either statute, and had consented to Salesforce’s collection and monitoring of their communications.

Standing

The court held that both plaintiffs had Article III standing. It explained that privacy violations involving intrusion into private communications can constitute a concrete injury even without an allegation that the information was shared, disclosed, or sold to third parties. Because the plaintiffs alleged that Salesforce collected communications containing personal health information, the court concluded that the alleged conduct deprived them of control over that information.

California Section 631 claim

Magpayo’s Section 631 claim alleged that Salesforce improperly read communications while they were in transit. The court rejected the view that a software provider automatically becomes a party to communications merely by providing the technology that records or transmits them. It held that the relevant question was whether Salesforce had the ability to use the communications for purposes beyond furnishing them to Kaiser Permanente.

The court concluded that the complaint did not support a reasonable inference that Salesforce could use the communications for any purpose other than furnishing them to Kaiser Permanente. Based on the allegations, Chat was more like a tape recorder used by a participant in the communication than an undisclosed third-party listener. The court therefore found that Magpayo failed to state a Section 631 claim.

California Section 632 claim

Section 632 prohibits intentionally recording or eavesdropping on a confidential communication without the consent of all parties. The court held that Magpayo’s communications about prescription history, medical conditions, and insurance information in a health-care context were confidential because she could reasonably expect that they would not be overheard or recorded by an undisclosed party.

The court also rejected Salesforce’s consent argument. It concluded that Salesforce had not established, based on the complaint, that Magpayo consented to the monitoring and recording. The court therefore denied Salesforce’s motion to dismiss the Section 632 claim.

Pennsylvania WESCA claim

The court held that Yockey plausibly alleged that Salesforce intercepted his communications under WESCA. The statute defines interception as acquiring the contents of a communication through an electronic, mechanical, or other device. The court concluded that Salesforce’s receipt and storage of communications on its servers could satisfy that definition.

The court rejected Salesforce’s arguments that Chat fell within WESCA’s telephone-related exception and that the complaint failed to allege contemporaneous interception. The complaint plausibly alleged that Salesforce received communications in real time, created live transcripts, allowed Rite Aid supervisors to view them, and obtained message contents while Yockey was typing through the Sneak Peek feature.

The court also rejected Salesforce’s argument that statutory exceptions protected its conduct. It was unclear whether Salesforce qualified as the relevant service provider, and the alleged monitoring went beyond mechanical or service-quality checks. The court further concluded that the privacy policy did not clearly disclose the alleged conduct, including obtaining communications while users typed them. The court therefore concluded that Yockey stated a WESCA claim.

Disposition

Judge Jon S. Tigar granted in part and denied in part Salesforce’s motion to dismiss. The court dismissed Magpayo’s CIPA Section 631 claim with leave to amend because Salesforce had not shown that amendment would be prejudicial, sought in bad faith, unduly delayed, or futile. The plaintiffs could file an amended complaint within 21 days, solely to cure the deficiencies identified in the order. If they did not timely amend, Magpayo’s Section 631 claim would be dismissed with prejudice. The court denied Salesforce’s other requests for judicial notice because it did not need the materials to resolve the motion.