Katz-Lacabe v. Oracle America, Inc.

Background

Two named plaintiffs, Michael Katz-Lacabe and Dr. Jennifer Golbeck, brought a putative class action against Oracle America, Inc. They alleged that Oracle used tools including cookies, JavaScript, tracking pixels, device identification, cross-device tracking, AddThis widgets, and Datalogix to collect internet, location, financial, and other personal information. They alleged that Oracle compiled and analyzed this information into electronic profiles and made it available to third parties through its Oracle Data Marketplace and Oracle ID Graph without the plaintiffs’ consent.

The First Amended Class Action Complaint asserted nine causes of action: California constitutional invasion of privacy; intrusion upon seclusion under California law; intrusion upon seclusion under Florida law; violations of the California Invasion of Privacy Act (CIPA); violations of the Florida Security of Communications Act (FSCA); a federal Wiretap Act claim under the Electronic Communications Privacy Act (ECPA); unjust enrichment under California law; unjust enrichment under Florida law; and declaratory and injunctive relief. Oracle moved under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint states a legally sufficient claim, to dismiss most of the claims. The plaintiffs also sought to seal portions of reports that Oracle had provided about their offline-access requests.

Motion to Dismiss

The court dismissed the California-law intrusion-upon-seclusion claim to the extent it was brought for the nationwide United States Class. The court concluded that California law did not apply nationwide because the alleged interception of a non-California resident’s data occurred in that resident’s state, and the amended allegations did not change the court’s earlier conclusion. This claim was dismissed without leave to amend.

The court dismissed the Florida-law intrusion-upon-seclusion claim with leave to amend. Under Florida law, the plaintiffs had to plausibly allege an intrusion into a private place or private quarter that would be highly offensive to a reasonable person. The court held that the allegations did not identify a particular electronic space in which Golbeck had a reasonable expectation of privacy and did not plausibly allege an intrusion into her home.

The CIPA claim survived. The court held that the plaintiffs sufficiently alleged that Oracle knew to a substantial certainty that its bk-coretag.js tool would record confidential communications. The claim also survived to the extent it alleged that referrer URLs and data entered into forms were “content.” The court noted that webpage titles, webpage keywords, website-visit dates and times, Internet Protocol addresses, page visits, purchase-intent signals, and add-to-cart actions were not content.

The FSCA claim also survived. The court held that the plaintiffs plausibly alleged that at least some information captured by bk-coretag.js—such as data entered into online forms and referrer URLs—qualified as electronic communications. The court further held that the plaintiffs plausibly alleged a reasonable expectation of privacy in at least some of the information Oracle collected, while noting that it was assuming rather than deciding that the FSCA required such an expectation.

The ECPA claim was dismissed with leave to amend. The court held that the plaintiffs had not alleged enough facts to show that Oracle’s primary motivation or purpose was to commit torts against internet users. The court rejected reliance on comments by Oracle’s chief executive and the allegation that Oracle sought to make money as insufficient to establish the required wrongful intent.

The California unjust-enrichment claim survived. The court held that the amended allegations were just sufficient to allege that Oracle received and unjustly retained information about the plaintiffs’ online and real-world lives at their expense. However, the California-law unjust-enrichment claim for the nationwide United States Class was dismissed with leave to amend. California and Florida had materially different unjust-enrichment standards, and Florida had a stronger interest in applying its law to its own residents and transactions occurring there.

The alternative Florida unjust-enrichment claim survived. The court held that the plaintiffs plausibly alleged that they directly conferred a benefit on Oracle, even though third-party websites served as intermediaries, and that personal data could qualify as a benefit under Florida law.

The claim for declaratory judgment and injunctive relief survived because not all of the other claims had been dismissed.

Motion to Seal

The court granted the plaintiffs’ motion to seal as to the category-by-category redactions proposed for Exhibits E and F to the Maher Declaration. It found that the detailed reports revealed intimate information about the plaintiffs’ daily lives and that the plaintiffs’ privacy interests in the redacted portions outweighed the public’s interest in full disclosure. The court found those redactions sufficiently tailored, rather than sealing the reports in their entirety. The plaintiffs were ordered to file public versions of both exhibits consistent with the order by October 20, 2023.

Disposition

The motion to dismiss was granted in part and denied in part. The Florida intrusion-upon-seclusion claim was dismissed with leave to amend; the nationwide California intrusion-upon-seclusion claim was dismissed without leave to amend; the nationwide California unjust-enrichment claim was dismissed with leave to amend; and the ECPA claim was dismissed with leave to amend. The remaining identified claims survived. The motion to seal was granted for the specified redactions in Exhibits E and F. The plaintiffs were given 20 days to file an amended complaint.