[00:00:01] Speaker 00:
Good morning, Your Honors, and may it please the Court.

[00:00:04] Speaker 00:
Nick Sansone on behalf of Amanda Dogley.

[00:00:07] Speaker 00:
With the Court's permission, I'll reserve two minutes for rebuttal.

[00:00:10] Speaker 00:
Thank you.

[00:00:12] Speaker 00:
Bloomingdale's operates a website that it uses to build up its client base in California, one of its principal markets.

[00:00:20] Speaker 00:
Relying on this Court's settled precedent, the district court correctly held

[00:00:25] Speaker 00:
that this website is expressly aimed into California because Bloomingdale's uses it to cultivate and serve a market there.

[00:00:35] Speaker 00:
But the district court then went on to hold that Ms.

[00:00:37] Speaker 00:
Doggaly's claims are unrelated to Bloomingdale's California contacts.

[00:00:42] Speaker 00:
This was error.

[00:00:44] Speaker 00:
Ms.

[00:00:44] Speaker 00:
Doggaly, a prospective California customer, claims that Bloomingdale's engaged in unlawful surveillance activity

[00:00:52] Speaker 00:
while she was browsing the website that Bloomingdale's expressly aims into California in order to market and sell goods to shoppers there.

[00:01:02] Speaker 03:
I have two things to say.

[00:01:03] Speaker 03:
One is that it might be wise to concentrate on the standing issue because the personal jurisdiction issue is going to be governed by a, likely governed by a case pending on bank.

[00:01:16] Speaker 03:
Related to that, what exactly are the

[00:01:20] Speaker 03:
allegations in the complaint about what Ms.

[00:01:24] Speaker 03:
Dagli was doing on this website and why her privacy interests were invaded?

[00:01:30] Speaker 00:
Certainly, Your Honor.

[00:01:31] Speaker 00:
So there are no allegations in the complaint about the specific content that Ms.

[00:01:36] Speaker 00:
Dagli entered onto the website, but the complaint alleges that

[00:01:41] Speaker 00:
Any time a user accesses the website, what happens is essentially a screen video of the activity, all of the mouse movements, clicks, et cetera, page resizes that occur on that website are recorded.

[00:01:57] Speaker 03:
What I'm asking is, where are the allegations about Ms.

[00:02:00] Speaker 03:
Dagley and what she was doing?

[00:02:03] Speaker 00:
So there are no specific allegations about exactly what she did on the website.

[00:02:09] Speaker 02:
Why not?

[00:02:10] Speaker 02:
Why didn't you allege that?

[00:02:12] Speaker 02:
I'm sorry?

[00:02:13] Speaker 02:
Why not?

[00:02:14] Speaker 02:
Why aren't there any specific allegations?

[00:02:17] Speaker 00:
Because essentially, the nature of the violation is that it's the video recording.

[00:02:24] Speaker 00:
It's not the fact that she put in any sort of specific, sensitive information.

[00:02:29] Speaker 00:
It's the fact that this website records

[00:02:32] Speaker 00:
everything you're doing, whether what you're doing is benign, whether it's.

[00:02:36] Speaker 03:
But I'm not even asking that.

[00:02:37] Speaker 03:
Tell me where in the complaint it says anything about Ms.

[00:02:41] Speaker 03:
Dagley.

[00:02:48] Speaker 00:
So at paragraphs 42 through 49,

[00:02:59] Speaker 00:
The complaint alleges sort of what happens when a user, including Ms.

[00:03:05] Speaker 00:
Dougley, logs on.

[00:03:07] Speaker 03:
Does she go on the website because she was thinking of buying something?

[00:03:10] Speaker 03:
It doesn't say that, right?

[00:03:13] Speaker 00:
That's not specifically alleged.

[00:03:16] Speaker 00:
The purpose of the website is to court shoppers, is to attract individuals to sell goods.

[00:03:24] Speaker 00:
And that is the conduct that is expressly aimed into the state of California.

[00:03:29] Speaker 00:
And so whether or not the reason that she's accessing the site doesn't go to the nature of the violation that she experienced, which was the recording of everything she did.

[00:03:41] Speaker 00:
And I think this court's decision in Eikenberger is helpful.

[00:03:45] Speaker 00:
That case concerned a federal statute that protected people's video rental history.

[00:03:54] Speaker 00:
And nothing in this court's opinion in Eichenberger suggested that the nature of one's video rentals, whether they were particularly sensitive titles or anything like that, bore on the extent of the privacy violation.

[00:04:06] Speaker 02:
Is there anything alleged about what she did?

[00:04:08] Speaker 02:
I mean, for all we know, she could have just gone to the website and said, oh, I didn't mean to go to Bloomingdale's.

[00:04:12] Speaker 02:
I wanted to go to Lord and Taylor and left.

[00:04:15] Speaker 00:
Certainly.

[00:04:16] Speaker 00:
If that is what happened, it would still be a privacy violation for Bloomingdale's to video record that happening.

[00:04:23] Speaker 02:
Just that she simply looked at the website without entering any data at all.

[00:04:28] Speaker 00:
Without entering data, but certainly her cursor would have had to have moved.

[00:04:32] Speaker 00:
She would have had to have gone and clicked out of the website.

[00:04:37] Speaker 00:
So there would have been something recorded, and it would have been whatever was going on on her screen at that time.

[00:04:43] Speaker 04:
And why is that a privacy violation?

[00:04:46] Speaker 00:
Because under the California Invasion of Privacy Act, California wrote this statute to protect online information or information conducted through the wires from being intercepted.

[00:05:01] Speaker 00:
And I think one thing that's important to keep in mind here is that the complaint doesn't just allege that Bloomingdale's is capturing this information and just sort of keeping it in a closet.

[00:05:11] Speaker 00:
Bloomingdale's is sending these videos, sending this information to Metta

[00:05:15] Speaker 00:
to full story to other third parties that then stitch that information into individualized person-specific profiles.

[00:05:24] Speaker 00:
And this court's opinion in the Facebook tracking litigation has made clear that that sort of ability to stitch together a composite picture of somebody's online activities implicates the sort of core Article III privacy requirements that this is.

[00:05:40] Speaker 02:
But she still has to have some sort of an injury.

[00:05:42] Speaker 02:
So if you were given an opportunity to amend,

[00:05:45] Speaker 02:
would she be able to say what it was she actually entered into the website?

[00:05:52] Speaker 00:
I'm not certain about that without consulting.

[00:05:55] Speaker 00:
But I do think that this court's privacy, the opinions of this court, Patel, Campbell, Facebook tracking litigation, Jones, in none of those cases did the court look to the plaintiff-specific information that was conveyed.

[00:06:13] Speaker 04:
But in the Facebook tracking case,

[00:06:15] Speaker 04:
Part of the allegations were that the conduct was tracked even when they were off the website, that it continued tracking you, which seems much more invasive than if perhaps all it was was going to Bloomingdale's and saying, oops, I meant Macy's, or I meant Lord and Taylor, or whatever.

[00:06:32] Speaker 04:
I'm not sure we have a case that's so minimal.

[00:06:35] Speaker 04:
Do you have any case that's as minimal as this?

[00:06:40] Speaker 00:
I can't think of a case that's sort of directly on all fours with this one.

[00:06:44] Speaker 00:
But what I will say is I think Your Honor's question goes to the extent of the injury rather than the nature of the injury.

[00:06:51] Speaker 00:
And so we can imagine if somebody is beaming a surveillance camera into somebody's apartment window and you just catch two seconds of somebody cooking dinner and they're not doing anything particularly personal or private, that is still an invasion of privacy.

[00:07:08] Speaker 00:
I mean, I think I would analogize

[00:07:10] Speaker 00:
to, for example, trespass cases, which have a long common law pedigree.

[00:07:14] Speaker 00:
Setting a toe over somebody's property line for a couple seconds, courts have not required anything beyond the invasion of that property in order to establish that there is a legal injury there.

[00:07:27] Speaker 00:
There is an injury that's cognizable.

[00:07:30] Speaker 00:
Damages may be minimal in that case, but it's the nature of the injury.

[00:07:36] Speaker 03:
The TransUnion and Philips and cases like that seem to be insisting that it isn't enough to have a legal insurance.

[00:07:48] Speaker 03:
It has to be, and this case may be on the other side of that because there's a privacy interest asserted and we have held that this statute protects privacy, but once you

[00:08:05] Speaker 03:
But you still have to demonstrate in some way that the allegations here, so the statute is one that protects privacy.

[00:08:13] Speaker 03:
But I don't think you can then go to the point that says, and therefore if it violates the statute, that's all that matters.

[00:08:20] Speaker 03:
She still has to allege an interest in privacy, right?

[00:08:25] Speaker 03:
The question is, I guess my reaction, this is a very strange plaintiff for a case like this.

[00:08:32] Speaker 03:
You'd think you'd have a plaintiff actually

[00:08:34] Speaker 03:
went on the website and bought something at Bloomingdale's or something like that.

[00:08:38] Speaker 03:
It's just a strange, minimalist way of pleading this.

[00:08:43] Speaker 00:
Well, I think the way to think about trans-union, and I'll point out that the cases like Patel, Campbell, Facebook, tracking litigation, they all post-stated Spokeo, which sort of laid out the governing legal standard that the court then went on to apply in trans-union.

[00:09:00] Speaker 03:
But it's clear that this statute is a privacy-protection statute.

[00:09:03] Speaker 03:
That's not the problem.

[00:09:05] Speaker 03:
So you are through one loop here.

[00:09:10] Speaker 03:
But the question is this plaintiff.

[00:09:13] Speaker 00:
And again, I think that because the statute is designed to protect against the interception of online communications, just like the statute in Eichenberger was designed to protect against the disclosure of video rental histories, no matter what that revealed about the plaintiff, no matter what the sort of extent

[00:09:34] Speaker 00:
of the violation was, it is the substance of the injury rather than the extent.

[00:09:41] Speaker 00:
And again, I would analogize it to a trespass case.

[00:09:44] Speaker 00:
There are countless cases from the Supreme Court saying that in the context of monetary injury,

[00:09:49] Speaker 00:
you know, 10 cents, 25 cents, that's enough to create standing, because the injury is concrete, even if it may not be particularly large.

[00:09:59] Speaker 02:
What differentiates Ms.

[00:10:01] Speaker 02:
Dougley from just anybody in the world who didn't even go on the website?

[00:10:10] Speaker 00:
Well, what would differentiate her from somebody who didn't go on the website is that her online conduct,

[00:10:17] Speaker 00:
was recorded.

[00:10:18] Speaker 02:
But we don't know what the online conduct is.

[00:10:20] Speaker 02:
Let me ask you a specific question.

[00:10:22] Speaker 02:
Let's say I go onto this website and I realize it was a mistake and then I type in Macy's, you know, in the window where you type in the next website.

[00:10:33] Speaker 02:
Does this record where I'm going next?

[00:10:36] Speaker 02:
Or does it just record what I enter on the Bloomingdale's website?

[00:10:39] Speaker 02:
In other words, does it record what I put in my browser about where I want to go to from the Bloomingdale's website?

[00:10:44] Speaker 00:
I don't know the answer to that, as a matter of fact.

[00:10:47] Speaker 02:
So in theory, what could have happened here, for all we know, because the complaint doesn't say otherwise, is that Ms.

[00:10:53] Speaker 02:
Dougley could have gone on there, realized she made a mistake, typed in some other website, and we don't even know whether it recorded that.

[00:11:00] Speaker 02:
So if that's the situation, and we don't know that it is, and how is she different from anybody else in the world?

[00:11:06] Speaker 00:
Well, again, what would differentiate her is that that act of

[00:11:10] Speaker 00:
Being on the website, moving her mouse, whatever, was recorded.

[00:11:13] Speaker 02:
So it's the fact that she went onto the website that you're considering that public and private information?

[00:11:20] Speaker 00:
Yes.

[00:11:20] Speaker 00:
And whatever movements, sort of.

[00:11:24] Speaker 02:
But you're saying that even if there were no movements, it's still a violation?

[00:11:29] Speaker 02:
Just the fact that she went on the website, that's enough?

[00:11:34] Speaker 00:
I believe it would be, I mean, I believe that there would have to be some kind of movement to sort of click out or get out of the website.

[00:11:46] Speaker 00:
But again, it's the video recording and it is the transmission of that to other organizations, to other companies.

[00:11:54] Speaker 02:
So if I right now on my iPad type in blueingdale.com, go to the website, and do nothing more than type into the thing macy's.com,

[00:12:03] Speaker 02:
then I could be a plaintiff too.

[00:12:05] Speaker 00:
I think California has made that legislative policy choice.

[00:12:08] Speaker 02:
Yes.

[00:12:09] Speaker 02:
And all that's happened is they just went on the website.

[00:12:11] Speaker 02:
That's enough to be a privacy violation.

[00:12:14] Speaker 00:
I believe it would be.

[00:12:15] Speaker 00:
If that were recorded and then sent on to other companies that then use that information to contribute to a composite personal profile of you.

[00:12:26] Speaker 03:
Didn't she allege that she engaged in communications and entered data

[00:12:32] Speaker 03:
from these jails' website.

[00:12:33] Speaker 03:
So that's more than simply going there.

[00:12:36] Speaker 00:
That's correct.

[00:12:37] Speaker 00:
That's correct.

[00:12:38] Speaker 00:
So this case would not present your honor's hypothetical.

[00:12:44] Speaker 04:
If you could get, oh, sorry.

[00:12:45] Speaker 02:
Where does it say that?

[00:12:46] Speaker 02:
I'm looking at it.

[00:12:47] Speaker 02:
You said paragraphs 42 to 61.

[00:12:50] Speaker 02:
Which is the one that says that she entered something?

[00:12:55] Speaker 02:
42 just says she visited Bloomingdales.com while in California.

[00:12:59] Speaker 02:
Specifically, she accessed Bloomingdales.com via the web browser on her phone and computer.

[00:13:06] Speaker 00:
I can find the site for that and have it on rebuttal, Your Honor.

[00:13:11] Speaker 04:
If you could get past this issue about whether there's standing for some of the complaint, I think you also asserted in your brief that she doesn't even need to show standing for injunctive relief.

[00:13:19] Speaker 04:
She can just seek injunctive relief without showing standing for that remedy.

[00:13:24] Speaker 04:
That seems to conflict directly with TransUnion that says you have to show standing for each form of relief.

[00:13:30] Speaker 04:
Do you have any site other than DZ Reserve, which I don't think supports the proposition for that assertion in your brief?

[00:13:37] Speaker 00:
No, Your Honor.

[00:13:38] Speaker 00:
We're not contending that she does not need to have standing to see conjunctive relief.

[00:13:41] Speaker 00:
We agree that she does need to show standing to see conjunctive relief.

[00:13:48] Speaker 04:
OK.

[00:13:51] Speaker 04:
Then we've taken you over your time, but I'll still give you two minutes for rebuttal.

[00:13:54] Speaker 00:
OK.

[00:13:54] Speaker 00:
Thank you, Your Honor.

[00:14:04] Speaker 01:
Good morning, Your Honors.

[00:14:05] Speaker 01:
May it please the Court.

[00:14:06] Speaker 01:
The only allegation that we've identified in the complaint as to what happened with Ms.

[00:14:12] Speaker 01:
DeGali particularly is paragraph 42.

[00:14:16] Speaker 01:
All that is alleged there is that she visited the website from both her phone

[00:14:21] Speaker 01:
in her computer.

[00:14:22] Speaker 01:
I think as the questions suggested, and I think my friend may have conceded, within 30 seconds anyone in this courtroom could file the same complaint.

[00:14:31] Speaker 01:
It could be the name plaintiff in a putative class action seeking billions of dollars on behalf of everyone who's ever visited the Bloomingdale's website just by the very fact of going to the website.

[00:14:44] Speaker 01:
There's no case in this court that we're aware of that would support

[00:14:48] Speaker 01:
That result, an unpublished decision, the court's decision in Cahan versus Toyota, where two members of this panel were also on that panel, affirmed the dismissal for lack of standing when the plaintiff alleged that Toyota collected data from their vehicles and shared that data with third parties.

[00:15:06] Speaker 01:
The court affirmed the dismissal because there was no specific allegations as to why that data was sensitive or had individually identifiable information.

[00:15:16] Speaker 01:
The same reasoning applies here.

[00:15:18] Speaker 01:
We talk about the claim under SEPA.

[00:15:21] Speaker 01:
SEPA is called the California Invasion of Privacy Act.

[00:15:25] Speaker 01:
It may have extended privacy protections to online, to internet sites, to wires, but that was the extent of the expansion.

[00:15:35] Speaker 01:
It did not change the fundamental premise of an invasion of privacy claim, which is that you must allege an invasion to your privacy.

[00:15:44] Speaker 01:
You must allege that somebody obtained information that you have

[00:15:48] Speaker 01:
a reasonable expectation of privacy.

[00:15:50] Speaker 03:
Well, I mean, suppose she amended the complaint to say, while I was on the website, I looked at X product and Y product, and that information has been recorded and is being transmitted.

[00:16:06] Speaker 03:
Would that be a sufficient allegation of invasion of privacy?

[00:16:10] Speaker 01:
If she alleged that information that was collected, identified the information, and had an allegation

[00:16:17] Speaker 01:
that it was private or sensitive.

[00:16:19] Speaker 01:
Yes, that could give rise.

[00:16:20] Speaker 03:
That's why I'm asking.

[00:16:21] Speaker 03:
Is your concern that it's not private or sensitive enough?

[00:16:27] Speaker 03:
That is, the fact that she was looking at certain dresses or certain shoes?

[00:16:32] Speaker 03:
It's not a privacy problem.

[00:16:34] Speaker 03:
Is that what you're saying?

[00:16:35] Speaker 01:
We would say that if that was alleged.

[00:16:41] Speaker 01:
Let me step back and say why I think my friend didn't ask for a remand to plead more allegations.

[00:16:49] Speaker 01:
The issue that they run into in these cases, and as I'm sure the court's aware, there are a lot of these cases that have a varying degree of specificity, is that on the bottom of the home page, on the Bloomingdale's home page, there's a link to Bloomingdale's.

[00:17:01] Speaker 01:
privacy policy.

[00:17:03] Speaker 01:
It clearly discloses that it's going to collect information, it's going to share that information with third parties.

[00:17:09] Speaker 01:
When you make a purchase on the Bloomingdale's website, you have to agree to Bloomingdale's privacy policy.

[00:17:15] Speaker 01:
So anyone who makes a purchase on the Bloomingdale's website agrees that their information can be collected and shared with third parties.

[00:17:22] Speaker 01:
And so the reason that complaints like this are limited to the bare fact of visiting the website and the allegation is that the

[00:17:30] Speaker 01:
violation of privacy is complete upon arrival of the website, is it allows them to plead a violation before someone makes a purchase and consents to the collection.

[00:17:44] Speaker 01:
And so that would be the problem, I think, and a lot of plaintiffs, why they decide not to, or in a putative class action, not bring forth a named plaintiff that made a purchase.

[00:17:55] Speaker 01:
They would run into the privacy policy issue.

[00:17:58] Speaker 03:
I guess what I was asking was,

[00:18:00] Speaker 03:
Let's assume that, I think it's true, that the kind of allegations I suggested would set up a violation of SIPA, i.e., if you're collecting information about what somebody is doing on the website in terms of what they're looking at and what kinds of products and so on, even if they don't buy anything, right?

[00:18:25] Speaker 03:
Would that be a SIPA violation?

[00:18:26] Speaker 01:
I don't think all

[00:18:28] Speaker 01:
of them would.

[00:18:29] Speaker 01:
I think it would be a different case and you could make a different case if it collected medical information.

[00:18:33] Speaker 01:
If you alleged you went to WebMD and you clicked on a link that you then said disclosed information.

[00:18:37] Speaker 03:
But the fact that I'm looking at certain, I mean, I don't want people to know what kind of dresses I'm looking at or I'm looking at underwear.

[00:18:44] Speaker 03:
I don't want them to know what kind of underwear I'm looking at.

[00:18:49] Speaker 03:
That's not a privacy, that's not a SIPA violation, is that a SIPA violation?

[00:18:54] Speaker 01:
No.

[00:18:56] Speaker 01:
The information that's alleged here about the movements on the website, the clicks and scrolls.

[00:19:00] Speaker 01:
I'm not asking you.

[00:19:01] Speaker 03:
I'm asking about my hypothetical.

[00:19:03] Speaker 01:
Right.

[00:19:04] Speaker 03:
I'm trying to find out whether you're complaining.

[00:19:06] Speaker 03:
You're arguing that SIPA doesn't cover this or that there's some overriding other concept of privacy that requires that the information be sensitive and not just, not your business.

[00:19:18] Speaker 03:
It's not your business what underwear I'm looking at or what shoes I'm looking at.

[00:19:23] Speaker 03:
Okay, is that enough?

[00:19:25] Speaker 03:
Or does it have to be, you know, I'm looking at, you know, medical information?

[00:19:31] Speaker 01:
Our position is that that would not be enough, just that you are looking at shoes.

[00:19:35] Speaker 03:
And that being under SIPA or that there's a privacy override under TransUnion and so on?

[00:19:41] Speaker 03:
Go ahead.

[00:19:43] Speaker 01:
Our position would be both.

[00:19:45] Speaker 01:
Under SIPA, we would rely on the distinction between the contents of the communication and record information that's not

[00:19:51] Speaker 01:
required under SIPA.

[00:19:53] Speaker 01:
Going back to even the allegation that you viewed a particular piece of item, the actual communications that a plaintiff sends in order to be able to view that, as they talk about, is a click or movement on the website.

[00:20:08] Speaker 01:
Our position is that sort of information is the sort of routing information that the court has said you don't have a reasonable expectation in privacy.

[00:20:16] Speaker 01:
In order to make the Bloomingdale's website function.

[00:20:19] Speaker 03:
Where is the court sent that?

[00:20:21] Speaker 01:
I think the best case for us would be United States versus Forrester.

[00:20:26] Speaker 01:
That involved, it was a Fourth Amendment case, but the court in cases

[00:20:30] Speaker 01:
like in Ray Facebook, have pointed out the similarities between for an intrusion upon seclusion, the requirement is a legitimate expectation of privacy, Fourth Amendment, reasonable expectation of privacy.

[00:20:40] Speaker 01:
But what the court said in the United States versus Forrester, you don't have a reasonable expectation of privacy in the email address that you're sending an email to, the from address, an IP address of the computer.

[00:20:52] Speaker 01:
And it says, people who use the internet understand that if I want my email,

[00:20:56] Speaker 01:
to reach its intended recipient, I need to disclose the email address.

[00:21:01] Speaker 01:
That's the same logic the Supreme Court used all the way.

[00:21:04] Speaker 02:
So let me tweak Judge Berzon's hypothetical a little bit.

[00:21:06] Speaker 02:
So let's say that I go onto Bloomingdale's website and I look for women's underwear in a size that wouldn't fit my wife.

[00:21:13] Speaker 02:
Right.

[00:21:14] Speaker 02:
And the reason I go on the website is that I don't want to go into a store and do it because then people would see me.

[00:21:20] Speaker 02:
And I don't buy anything, so the privacy policy you say

[00:21:24] Speaker 02:
applies when you buy something doesn't ever kick in.

[00:21:26] Speaker 02:
Isn't what I was doing private, I mean if somebody was looking over my shoulder while I was doing it, I would certainly consider that a privacy violation.

[00:21:34] Speaker 02:
Would that count?

[00:21:35] Speaker 01:
Yeah, you would have a strong argument that that would be a privacy violation.

[00:21:38] Speaker 01:
There's a footnote in the court's decision in NRA Facebook talking about a general rule that the page that you visit on a website wouldn't, you wouldn't have a reasonable expectation of privacy in that, but there could be something about the page that disclosed private or sensitive information.

[00:21:56] Speaker 01:
I don't think it's enough, and I think that footnote in NRA Facebook makes it clear it's not enough that it discloses information, it has to

[00:22:03] Speaker 01:
be an invasion of privacy, and so it has to be something that is private.

[00:22:07] Speaker 01:
That's our position here.

[00:22:09] Speaker 01:
We are not asking the court to adopt a categorical rule that the things you view on a website could never give rise to a privacy violation.

[00:22:19] Speaker 01:
We're asking the court, where we started this discussion, what is in this complaint?

[00:22:23] Speaker 01:
There is nothing in this complaint of anything she did other than visit the website.

[00:22:29] Speaker 04:
Can I ask you?

[00:22:30] Speaker 04:
This hypothetical, it sounds like you're conceding that there could be Article III standing in that situation.

[00:22:36] Speaker 04:
As a matter of SIPA, I think Judge Berzon was also asking you, as a statutory matter, what is covered by SIPA.

[00:22:43] Speaker 04:
What in SIPA covers that but not more benign pages?

[00:22:49] Speaker 01:
So I think I think we would take the position that that would not be covered under sepa there is the distinction so in sepa says the particular provision that's alleged to be violated here is that the person who intercepts the communication has to read attempt to read or learn.

[00:23:05] Speaker 01:
the contents of the communication.

[00:23:07] Speaker 01:
So even a communication, the courts have distinguished between the contents and then the record information.

[00:23:13] Speaker 04:
But the content of looking at underwear is content.

[00:23:15] Speaker 04:
The content of looking at sneakers is content.

[00:23:17] Speaker 04:
So what in SIPA says it covers underwear but not sneakers?

[00:23:20] Speaker 01:
But the looking isn't the communication, right?

[00:23:24] Speaker 01:
I mean, I think that's what our position and what courts have held this is the information you send, your communication, the website user's communication,

[00:23:32] Speaker 01:
to the website operator.

[00:23:34] Speaker 04:
OK, so the communication is searching women's underwear or searching sneakers.

[00:23:37] Speaker 04:
Both of those are content.

[00:23:39] Speaker 04:
And you're saying SIPA covers underwear but not sneakers, or it covers both?

[00:23:43] Speaker 01:
SIPA would cover both.

[00:23:45] Speaker 01:
If you're typing it in, that could be a different case.

[00:23:48] Speaker 01:
We don't have allegations of information typed in here.

[00:23:50] Speaker 01:
That runs the plaintiffs into it.

[00:23:52] Speaker 03:
So it took this long to get an answer to the question.

[00:23:56] Speaker 03:
So then the question is, if that's the case, is there then

[00:24:02] Speaker 03:
an override Article III privacy concept that says that that isn't enough for Article III purposes?

[00:24:11] Speaker 01:
Yes.

[00:24:11] Speaker 01:
For Article III, you have to allege a concrete injury.

[00:24:15] Speaker 01:
It has to be a concrete injury to privacy.

[00:24:18] Speaker 03:
I've heard that before.

[00:24:19] Speaker 03:
Yes.

[00:24:21] Speaker 03:
What I'm asking you is, since SIPA would cover, we've now established finally, the typing in

[00:24:29] Speaker 03:
to a search engine on the webbing, search piece on the Webbingtales website, underwear.

[00:24:39] Speaker 03:
It would cover that.

[00:24:40] Speaker 03:
Sipper would.

[00:24:41] Speaker 04:
And sneakers.

[00:24:42] Speaker 04:
Let's use sneakers.

[00:24:43] Speaker 03:
And sneakers.

[00:24:44] Speaker 03:
All right.

[00:24:45] Speaker 03:
So it would cover typing in sneakers, right?

[00:24:48] Speaker 03:
All right.

[00:24:48] Speaker 03:
Now, is it your position that that's still not enough for Article III standing?

[00:24:53] Speaker 01:
The sneakers, I think our position would be that that would be, unless they articulated a reason why.

[00:24:59] Speaker 01:
And that's what the court said in Cahan.

[00:25:01] Speaker 03:
So we're supposed to sit around and figure out that sneakers are, that underwear is private, but sneakers isn't private.

[00:25:07] Speaker 01:
No, the court does not need to see that.

[00:25:09] Speaker 01:
At a minimum, you need an allegation from the plaintiff of what they searched for and why they think that that's private and private and sensitive information.

[00:25:19] Speaker 03:
And private because I don't want people to know them by sneakers.

[00:25:22] Speaker 03:
Is that good enough?

[00:25:23] Speaker 01:
That may be good enough.

[00:25:25] Speaker 01:
But it may not be, because the case law is clear that it has to be an objective.

[00:25:29] Speaker 01:
It's a reasonable expectation of privacy.

[00:25:31] Speaker 01:
So it's not a subjective view.

[00:25:33] Speaker 01:
You would then look to the case law for analogous information to see whether that would be treated as quite.

[00:25:39] Speaker 03:
It's kind of a very strange role for courts to make decisions about what is objectively, quote, private.

[00:25:50] Speaker 03:
when it's all about purchasing things that nobody else would know about.

[00:25:54] Speaker 03:
I mean, no one's going to know what I bought ordinarily.

[00:25:59] Speaker 03:
So why isn't that just enough?

[00:26:01] Speaker 03:
It's private what I bought.

[00:26:03] Speaker 01:
Well, so two things.

[00:26:05] Speaker 03:
Where am I as a judge supposed to get some other principle that says that buying underwear is private, buying sneakers isn't private?

[00:26:12] Speaker 01:
You start with the common law.

[00:26:13] Speaker 01:
You start with the tradition of torts.

[00:26:15] Speaker 03:
Is there a common law about underwear as private and sneakers aren't private?

[00:26:21] Speaker 01:
There is a common law about what types of information do you have a reasonable expectation of privacy in.

[00:26:31] Speaker 01:
And in fact, the restatement of torts on intrusion upon seclusion has an example that specifically calls out that underwear

[00:26:40] Speaker 01:
private it says when you're in public you generally don't have any reasonable expectation of privacy the comment I think this is comment B says but there's an exception to that even when you're in public you have a reasonable expectation in your underwear it is very fact-specific

[00:26:56] Speaker 01:
But that what the Supreme Court has said in Spokio and TransUnion, we start by looking at the common law.

[00:27:04] Speaker 01:
You try to identify a harm that was recognized at common law.

[00:27:08] Speaker 01:
They point to intrusion upon seclusion.

[00:27:10] Speaker 01:
And when you're dealing with intrusion upon seclusion.

[00:27:14] Speaker 03:
We already have case law that says that this statute is a substantive protection of privacy.

[00:27:19] Speaker 03:
It doesn't distinguish between what in the statute.

[00:27:23] Speaker 03:
The statute is substantively protecting privacy.

[00:27:27] Speaker 03:
with regard to any communication that's in the statute.

[00:27:30] Speaker 03:
So isn't this just established case law in the circuit with regard to that question?

[00:27:38] Speaker 03:
I mean, we still have the problem of the plaintiff here, whether she's said enough even to get back for it.

[00:27:44] Speaker 03:
But it seems that under our case law, anything that violates ZIPA is an invasion of privacy.

[00:27:52] Speaker 03:
If it's specifically an affliction, is that not true?

[00:27:54] Speaker 01:
No, the case law is clear that under the court's case law, it's SIPA protects the violations of the right of privacy.

[00:28:04] Speaker 01:
It's called the California Invasion of Privacy Act.

[00:28:06] Speaker 01:
And the court has distinguished.

[00:28:10] Speaker 01:
cases in which the court has said enough has been alleged for standing private information was at issue.

[00:28:17] Speaker 01:
The court's decision in Campbell versus Facebook, Judge Friedland, in your footnote nine, you said it would be a different case and we are emphasizing it would be a different case

[00:28:29] Speaker 01:
if what was alleged to have been captured was aggregated anonymized data, because it still requires that the information at issue is private.

[00:28:39] Speaker 03:
The applicant said anonymized data would presumably not violate SIPA.

[00:28:44] Speaker 01:
It could.

[00:28:44] Speaker 01:
There's nothing in SIPA that distinguishes between anonymized and anonymized.

[00:28:49] Speaker 04:
I don't think this complaint is talking about anonymized, though, as I understand it.

[00:28:53] Speaker 04:
I mean, it at least alleges that it's, I guess, from the IP address gathered into some personal

[00:28:59] Speaker 04:
personally identifiable profile.

[00:29:02] Speaker 01:
It alleges the capability of that happening.

[00:29:06] Speaker 01:
There's no allegation that that happened to her.

[00:29:09] Speaker 01:
There's no allegation of any information that Ms.

[00:29:12] Speaker 01:
DiGali provided.

[00:29:14] Speaker 01:
So there's no basis for this plaintiff.

[00:29:16] Speaker 01:
We're not

[00:29:17] Speaker 01:
asking the court to hold that no plaintiff could plead facts that would suggest both a SIPA violation and standing.

[00:29:27] Speaker 01:
I think going back to Judge Berzon's point is the question about hasn't this circuit said as long as you allege a violation of SIPA that's enough

[00:29:37] Speaker 01:
I don't think the court has said that.

[00:29:39] Speaker 01:
I don't think the court could say that in light of TransUnion and Spokeo.

[00:29:43] Speaker 01:
In cases like NRA, Facebook, the court still, after interpreting SIPA and the Federal Wiretap Act to codify a right to privacy, it then went on and looked at the allegations to see if there were allegations that the information that was captured was private, whether there was a private interest.

[00:30:02] Speaker 04:
But I think the question that's confusing, and I had the same question, it seems like Judge Berzon is asking,

[00:30:08] Speaker 04:
OK, the analysis says this statute codifies a common law principle, so that passes that part of Spokeo.

[00:30:14] Speaker 04:
But then when the court goes on and says, and this plaintiff has the privacy, is it just saying that plaintiff falls within SIPA, or is it saying something more?

[00:30:23] Speaker 04:
Like, not just do they fall within SIPA, but they do it the right way or something.

[00:30:28] Speaker 01:
Yeah, and I don't think it's clear from what the court is saying, whether it is interpreting SIPA to only that in order to plead a violation of SIPA, you have to plead that the contents of the communication that were intercepted are themselves private.

[00:30:46] Speaker 01:
But regardless of whether that's what the court is saying, it's clear.

[00:30:49] Speaker 04:
Because SIPA could be over-broad, right?

[00:30:51] Speaker 04:
SIPA could, like.

[00:30:52] Speaker 04:
be okay to protect privacy.

[00:30:54] Speaker 04:
You could have a CIPA claim that would satisfy Article 3, but perhaps you could also have a CIPA claim that doesn't satisfy Article 3.

[00:31:00] Speaker 04:
I don't know that our cases do resolve that.

[00:31:02] Speaker 01:
I don't think there's a clear answer to that, but I think what the cases make clear is that in order to get over both the CIPA pleading hurdle

[00:31:10] Speaker 01:
and the Article III hurdle, as interpreted both by Spokio and TransUnion, the information that you allege has to be private.

[00:31:18] Speaker 01:
I think that was kind of fundamental to the court's affirmance in Cahan.

[00:31:23] Speaker 01:
And I realize that was unpublished.

[00:31:25] Speaker 01:
But a lot of times, the reason it was unpublished and the way the opinion was written, it started with settled circuit precedent.

[00:31:31] Speaker 01:
It looked at the allegations.

[00:31:33] Speaker 03:
But it's not precedent.

[00:31:33] Speaker 03:
So forget it.

[00:31:34] Speaker 01:
Yeah, but it was really focused on the allegations there and pointed out there was no allegation in that complaint that the plaintiff alleged that the information that was collected and shared with third parties was sensitive.

[00:31:47] Speaker 01:
I know I'm over my time.

[00:31:48] Speaker 01:
If I could take one minute to address the personal jurisdiction issue and really focus on one reason why we think this case is different than Briskin and that decision may not be controlling, in these cases, you can't have

[00:32:02] Speaker 01:
alleged violation of SIPA with just two parties.

[00:32:06] Speaker 01:
If it's just the website operator and the user, there's no SIPA violation because there's a party exemption.

[00:32:12] Speaker 01:
So the third party sort of back-in data collector is critical to an allegation of a SIPA violation.

[00:32:19] Speaker 01:
And so the allegation in these cases is... But here they say that they

[00:32:23] Speaker 04:
They shared the information with someone else, these profiles with someone else.

[00:32:26] Speaker 04:
Doesn't that get you the third party?

[00:32:28] Speaker 01:
No.

[00:32:28] Speaker 01:
So what they allege here is that Bloomingdale's violated SIPA by aiding and embedding the third parties and conspiring with them.

[00:32:40] Speaker 01:
And so I think the key point is that what the court is looking at in Briskin is what allegations and what conduct is sufficient to establish personal jurisdiction over the third party itself.

[00:32:52] Speaker 01:
Right, the website operator's not at issue in Briskin.

[00:32:55] Speaker 01:
Here, we're dealing with the website operator.

[00:32:57] Speaker 01:
And so even though it's kind of the same.

[00:32:59] Speaker 04:
Why would it not be worse for Bloomingdale's instead of better?

[00:33:01] Speaker 04:
I don't really understand your argument.

[00:33:03] Speaker 01:
Sure, because to establish personal jurisdiction, you look only at the conduct of the defendant.

[00:33:09] Speaker 01:
And what is alleged here, how Bloomingdale's is alleged to have violated SIPA, is by embedding session replay code

[00:33:17] Speaker 01:
into its website.

[00:33:19] Speaker 01:
The intentional act, so you would apply the Calder effects test.

[00:33:23] Speaker 01:
The step one is like what is the intentional act of the defendant?

[00:33:25] Speaker 01:
This is paragraphs 10, 85, and 94.

[00:33:28] Speaker 01:
The allegation is by embedding code into the website,

[00:33:33] Speaker 01:
Bloomingdale's has aided and embedded third parties who do the intercepting, who actually intercept the data.

[00:33:39] Speaker 01:
So in Briskin, the court's looking at what are Shopify, the third party, what's their contacts with the forum.

[00:33:45] Speaker 01:
Here, the only alleged acts and conduct of Bloomingdale's that is part of the violation is

[00:33:54] Speaker 01:
is embedding software into its website, and there's no allegation of where that happened.

[00:33:58] Speaker 01:
So the court doesn't have to reach that.

[00:34:00] Speaker 04:
I think we should cut you off, because brisket will happen, and we can deal with that then.

[00:34:05] Speaker 01:
Thank you.

[00:34:05] Speaker 04:
So we took him way over his time, so let's do three minutes instead of just two.

[00:34:15] Speaker 00:
Thank you, Your Honors.

[00:34:16] Speaker 00:
Just quickly before I begin, the citation to where the complaint alleges that Ms.

[00:34:21] Speaker 00:
Dougley entered data as well as visiting the website is at paragraph 11.

[00:34:27] Speaker 00:
And so where I would start is, just as I wouldn't want somebody pointing a video camera and watching what I'm doing at home, regardless of what I'm doing, I don't want somebody to look at it.

[00:34:38] Speaker 04:
I don't know if 11 really does that.

[00:34:39] Speaker 04:
I mean, defendants knew that plaintiff and the other class members visited and entered data.

[00:34:43] Speaker 04:
Does that really say that?

[00:34:45] Speaker 04:
Plaintiff did do?

[00:34:46] Speaker 04:
I don't know.

[00:34:47] Speaker 04:
It's pretty roundabout as a way to allege that.

[00:34:51] Speaker 00:
Well, I do think at the motion to dismiss stage, the complaint is construed in the light most favorable to the plaintiff.

[00:34:56] Speaker 00:
I'll also say Bloomingdale's raised this standing argument for the first time on appeal.

[00:35:01] Speaker 00:
Certainly, it is jurisdictional.

[00:35:03] Speaker 00:
So we're not contesting that it's proper to do that.

[00:35:06] Speaker 00:
But we didn't have the opportunity in the district court to consider whether the complaint could be amended.

[00:35:12] Speaker 00:
To provide more specific allegations to the extent they're necessary so at minimum.

[00:35:16] Speaker 00:
We would urge the court to Remand of the district court to the extent it believes that more specific allegations about her specific conduct on the website are Necessary would be to remand rather than dismiss altogether But you can't tell us today that you could actually do that I'm not certain as I stand here today but again we

[00:35:38] Speaker 00:
Because the issue was never raised in the district court where we had the opportunity to amend, we didn't examine whether or not that would be viable at that stage.

[00:35:50] Speaker 00:
But to sort of return to the broader point, none of this court's cases have required that the specific information that is captured when a defendant violates a statutorily protected privacy right, Eichenberger

[00:36:06] Speaker 00:
Patel, Campbell, Facebook tracking litigation, Jones, none of them have looked to whether the specific plaintiff's information was embarrassing to that plaintiff.

[00:36:17] Speaker 00:
It looked to whether that plaintiff alleged something that was at the core of traditional privacy rights.

[00:36:24] Speaker 00:
And here, again, when you go online, when you are browsing around,

[00:36:29] Speaker 00:
You're expecting that what you're doing is your own and not necessarily being filmed and transmitted to private to other third parties.

[00:36:38] Speaker 00:
To the question of anonymity at a record of excerpt page 20, it's clearly alleged that this data collection was not anonymous.

[00:36:48] Speaker 00:
This data collection, everything that was captured on the website,

[00:36:52] Speaker 00:
was sent to Metta, was sent to Full Story.

[00:36:55] Speaker 00:
And Metta stitches this information together into a broader composite picture.

[00:37:00] Speaker 00:
That's exactly the sort of conduct that this court held in Facebook tracking litigation did implicate core privacy concerns.

[00:37:08] Speaker 00:
And the only sort of difference between that case and this case is that the extent of the privacy violation is this was sort of one brick in the privacy wall that the court considered

[00:37:22] Speaker 00:
Facebook tracking litigation.

[00:37:23] Speaker 00:
But again, that goes to the sort of extent of the violation and not the nature of the violation.

[00:37:28] Speaker 04:
Thank you.

[00:37:31] Speaker 00:
Thank you very much, Your Honors.

[00:37:32] Speaker 04:
Thank you both sides for the helpful arguments.

[00:37:34] Speaker 04:
This case is submitted.