Digital marketers in California can breathe a sigh of relief in light of the dismissal of a putative class action lawsuit against The Gap, Inc (“Gap”). The case, Ramos v. The Gap, Inc., Case No. 23-CV-04715-HSG (N.D. Cal. Oct. 09, 2024), centered around alleged privacy violations stemming from the retailer’s use of a marketing optimization software provided by third-party vendor, Bluecore, Inc (“Bluecore”). The Court granted Gap’s motion to dismiss, providing much needed clarity on the application of the California Invasion of Privacy Act (“CIPA”).

Plaintiff’s Claims

Plaintiff Efren Ramos alleged that Gap, in conjunction with Bluecore, invaded customer privacy by embedding unique, trackable URLs in marketing emails. When clicked, these URLs allegedly allowed Bluecore to capture customer data such as email address, device type, geolocation, IP address and click location. This data, in conjunction with cookies used to monitor customer behavior on Gap’s website, was purportedly used to create personalized customer profiles, enabling Gap to send targeted marketing emails.

Ramos claimed this tracking and recording occurred without consent, violating the CIPA [Cal Penal Code §§ 631(a) and 635], constituting statutory larceny [Cal. Penal Code §§ 486 and 496], and violating the California Unfair Competition Law (“UCL”) [Cal. Bus. & Prof. Code §§ 17200].

Court’s Analysis and Dismissal

The Court systemically dismantled Ramos’s arguments, focusing primarily on the CIPA claims.

For some background, CIPA § 631(a) contains four distinct clauses, imposing liability on “any person” who:

1. “by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps . . . any telegraph or telephone wire, line, cable, or instrument”;
2. “willfully reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit”;
3. “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained”; and
4. “aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above.”

Direct Liability And “Party To The Communication”

Gap argued that it cannot be held directly liable under § 631(a) because it was a party to the communications at issue here. Both Ramos and the Court acknowledged established precedent exempting a party to the communication from liability under § 631(a).

However, Ramos urged that Gap was not necessarily a party to all the communications challenged in the complaint, alleging that Bluecore’s tracking software allowed Gap to view information about third-party emails.

The Court observed that while the argument that tracking extended beyond Gap’s emails may have given rise to liability, there were no supporting allegations in the complaint. Rather, the complaint explicitly defined the relevant emails as communications between Gap and its customers from Gap’s email domain. The Court concluded that the complaint’s description of “email open rates” plausibly referred only to the rate at which customers opened emails from Gap, not third-party emails.

Therefore, the Court dismissed Ramos’s claims as to Gap’s direct liability under CIPA and moved on to address its liability as an “aider and abettor” under clause four of § 631(a).

Internet Communications Under CIPA’s First Clause

Notably, the Court refused to extend the first clause of CIPA, which prohibits the intentional tapping of “any telegraph or telephone,” to cover internet communications. Despite Ramos’s arguments to the contrary, the Court aligned with existing case law that has consistently restricted this clause to traditional telephone communications, not internet traffic.

While the Court acknowledged the California Supreme Court’s decision in Apple Inc. v. Superior Ct., 56 Cal. 4th 128, 137 (Cal. 2013), allowing it to apply existing statutes to new technologies, it highlighted one important caveat – such an expansion is only appropriate if it does not conflict with the statute’s plain language. Here, the Court found that it could not ignore § 631(a)’s explicit statutory language limiting it to “telegraph or telephone” communications.

Further, the Ramos’s reliance on Kauffman v. Papa John’s Int’l, Inc., No. 22-CV-1492-L-MSB, 2024 WL 171363 (S.D. Cal. Jan. 12, 2024) for the proposition that the first clause of § 631(a) should apply to internet communications was found to be misplaced, as Kauffman relied on cases that only addressed the second clause of § 631(a).

Contents Of Communications

Next, the Court addressed whether the information allegedly intercepted constituted protected “contents” under CIPA, which shares a definition with the Electronic Communications Privacy Act (“ECPA”). The Court relied on the Ninth Circuit’s interpretation of the definition under ECPA in In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014) – “contents” refers to intended message of a communication, not record information about its characteristics.

The Court agreed with Gap’s assertion that the complaint described Bluecore capturing only record information related to Gap’s emails, such as time, date, device type, and click location, but not the email content itself. Ramos’s vague and conclusory assertions about capturing “email open rates” and URLS were deemed insufficient to allege the interception of protected content. As to “email open rates” and “click rates”, Ramos failed to explain how such information constitutes protected content under the statute. His attempt to argue that URLs are content also fails, as, while the Court acknowledges that this may be true, the complaint does not allege that the software reads these URLs.

#BBD0E0 »