K.K. v. TBMBM US, Inc.

Calendar Lines 12-13

Case Name: K.K. v. TBMBM US, Inc. Case No.: 25CV469704

This action arises from defendant TBMBM US, Inc.’s alleged conduct in permitting Google LLC (“Google”) to eavesdrop on communications sent and received by Plaintiff K.K. and Class Members on pinkcherry.com (the “Website”).6

Before the Court is Defendant’s demurrer to Plaintiff’s Complaint and motion to strike portions contained therein, which are both opposed. For reasons discussed below, the Court OVERRULES Defendant’s demurrer, DENIES its motion to strike, and ORDERS Plaintiff to move for an order seeking permission to proceed under a pseudonym within 20 days’ of this order.

I. BACKGROUND

According to the allegations of Plaintiff’s Complaint, she created a Gmail account around 2012. (Complaint, ¶ 4.)

In January 2025, she visited the Website on the same browser she used to access Gmail and she purchased a Svakom Chika Rabbit Vibe vibrator. (Ibid.) Each of the communications was intercepted in transit by Google—as enabled by Defendant— including communications that contained confidential information about Plaintiff’s sex toy purchase. (Ibid.) Neither Defendant nor Google obtained Plaintiff’s prior consent to the interception nor was she on notice of the interceptions. (Ibid.)

Google allegedly wiretapped the Website with its tracking technologies—including those associated with “Google Analytics,”—which Defendant purposely installed on the Website.7 (Complaint, ¶¶ 30, 32.) Google’s tracking technologies send secret instructions to a Website user’s browser, without alerting the individual that this is happening. The trackers then cause the browser to secretly and simultaneously duplicate the user’s Website communications, transmitting these communications to Google’s servers alongside additional information about the Website user’s identity. (Complaint, ¶¶ 31, 44-59.) Defendant never received users’ consent to disclose their data. (Complaint, ¶¶ 60-66.)

Based on the foregoing, Plaintiff initiated this action on July 1, 2025, with the filing of the operative Complaint, which asserts the following causes of action: (1) violation of the California Invasion of Privacy Act (“CIPA”) (Pen. Code § 631); and (2) violation of CIPA (Pen. Code § 632).

XLVI. DEMURRER

Defendant demurs to the Complaint entirely and to the first and second causes of action for failure to state facts sufficient to constitute a cause of action. (Code Civ. Proc., § 430.10, subd. (e).)

6 Defendant is a “place for all things sexual health, wellness, and pleasure.” (Complaint, ¶ 2.) 7 Google Analytics uses “identity spaces” to discern individual users through combinations of User-ID, user-provided data such as email, phone number, name, and address, device ID, and behavioral modelling. (Complaint, ¶ 35.)

C. Request for Judicial Notice

In support of its motion, Defendant requests judicial notice of the following items: (1) Defendant’s privacy policy, last updated in June 2024: Exhibit B; (2) Google’s privacy policy, effective September 16, 2024: Exhibit C; (3) Google’s webpage “Google Analytics Cookie Usage on Websites.”: Exhibit D.

Each of the exhibits is referenced in the Complaint, thus, the Court will take judicial notice of them. (See Complaint, ¶ 2-26, 42, 45; see also Ingram v. Flippo (1999) 74 Cal.App.4th 1280, 1285, fn. 3 [“Since the contents of the letter and media release form the basis of the allegations in the complaint, it is essential that we evaluate the complaint by reference to these documents.”].) Accordingly, Defendant’s request for judicial notice is GRANTED.

D.

Legal Standard

The function of a demurrer is to test the legal sufficiency of a pleading. (Trs. Of Capital Wholesale Elec. Etc. Fund v. Shearson Lehman Bros. (1990) 221 Cal.App.3d 617, 621.) Consequently, “[a] demurrer reaches only to the contents of the pleading and such matters as may be considered under the doctrine of judicial notice.” (South Shore Land Co. v. Petersen (1964) 226 Cal.App.2d 725, 732, internal citations and quotations omitted; see also Code Civ. Proc., § 430.30, subd. (a).) “It is not the ordinary function of a demurrer to test the truth of the plaintiff’s allegations or the accuracy with which he describes the defendant’s conduct. ... Thus, ... the facts alleged in the pleading are deemed to be true, however improbable they may be.” (Align Technology, Inc. v. Tran (2009) 179 Cal.App.4th 949, 958, internal citations and quotations omitted.)

In ruling on a demurrer, the allegations of the complaint must be liberally construed, with a view to substantial justice between the parties. (Glennen v. Allergan, Inc. (2016) 247 Cal.App.4th 1, 6.) Nevertheless, while “[a] demurrer admits all facts properly pleaded, [it does] not [admit] contentions, deductions or conclusions of law or fact.” (George v. Automobile Club of Southern California (2011) 201 Cal.App.4th 1112, 1120.)

E.

Discussion

Defendant argues Plaintiff’s claims fail because she does not and cannot allege facts demonstrating a reasonable expectation of privacy, her allegations and the judicially noticeable facts establish that Google was a party to the communication—thus, it couldn’t eavesdrop, and the alleged visitation and purchase order information collected does not constitute “contents” of a purported communication within the meaning of CIPA. (Defendant’s Notice of Demurrer, what isp. 2:15-3:5.)

CIPA, which is codified in Penal Code section 630, et seq., regulates improper and unauthorized electronic surveillance. As relevant here subdivision (a) of Section 631 provides, (a) Any person who, by means of any machine, instrument, or contrivance, or in any other manner, (1) Intentionally taps, or makes any unauthorized connection whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communications system, or (2) Who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or (3) Who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or (4) Who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above this section.

Is punishable by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in the county jail not exceeding one year or by imprisonment pursuant to subdivision (h) of Section 1170, or by both a fine and imprisonment in the county jail or pursuant to subdivision (h) of Section 1170. (Pen. Code § 631, subd. (a).)

“The California Supreme Court has clarified that [the foregoing] provisions contains three operative clauses protecting against ‘three distinct and mutually independent patterns” of conduct”: (i) ‘intentional wiretapping,’ (ii) ‘willfully attempting to learn the contents or meaning of a communication in transit over a wire,’ and (iii) ‘attempting to use or communicate information obtained as a result of engaging in either of the two previous activities.’” (Cody v. Ring (N.D. Cal. 2024) 2024 U.S. Dist. LEXIS 30704 (Cody), *6, quoting Tavernetti v. Superior Court (1978) 22 Cal.3d 187, 192.)

Penal Code section 632, prohibits “intentionally and without the consent of all parties to a confidential communication, us[ing] an electronic amplifying or recording device to eavesdrop upon or record the confidential communication, whether the communication is carried on among the parties in the presence of one another or by means of a telegraph, telephone, or other device, except a radio.” (Pen. Code, § 632, subd. (a).)

1. Reasonable Expectation of Privacy

“Plaintiffs have a reasonable expectation of privacy where data is collected without their consent.” (In re Google Location Hist. Litig. (N.D. Cal. 2021) 514 F.Supp.3d 1147, 1156.)

Defendant argues that Plaintiff does not and cannot allege facts demonstrating a reasonable expectation of privacy or a lack of consent because the data collected was standard website data and purchase order information for analytic purposes and Defendant disclosed the data collection practice. (MPA, p. 5:21-27.) In opposition, Plaintiff argues that the information at issue is more private than typical browsing information as it divulges sexual preferences and adult product selection made on the Website. (Plaintiff’s Opposition (“Opp.”), p. 9:8-9.)

Neither party cites any binding authority and instead, they rely on federal cases, which are not binding upon this Court. (Central Laborer’s Pension Fund v. McAfee, Inc. (2017) 17 Cal.App.5th 292, 319, fn. 9 [“We note that although an unpublished California case opinion may not be cited or relied upon (Cal. Rules of Court, rule 8.1115), citing unpublished opinions from other jurisdictions for their persuasive value does not violate this rule.”].)

The Court is persuaded by Plaintiff’s arguments and supporting authorities because the Complaint alleges the Website contained intimate lifestyle products which users could browse, purchase, and review. (Complaint, ¶¶ 27-28.) When purchasing the items, users typed their personal information and payment details. (Complaint, ¶ 29.) Plaintiff further alleges that Google Analytics used reported identities, user-provided data, device IDs, and Google signals related to site activity with a Google account; that Defendant enabled Google signals in the United States; that the browser transmitted Google cookies associated with authentication, ad personalization, and profiling; and that Google linked the collected data to a unique Google account ID rather than receiving anonymous traffic data. (Complaint, ¶¶ 35, 36, 41, 45, 46, 55, 65.)

Thus, based on the allegations, the information collected revealed personal details that go beyond standard browsing data, which is sufficient at stage to support Plaintiff’s assertion of a reasonable expectation of privacy. (See Heerde v. Learfield Comms. LLC (C.D. Cal. 2024) 741 F.Supp.3d 849, 864.)

Defendant further argues that the language in its Privacy Policy precludes Plaintiff from alleges lack of consent. Defendant directs the Court to the following language in its Privacy Policy, (1) disclosure that it uses cookies to “track a customer through their sales process for statistical and shopping cart purposes...”; (2) “we may use trusted partners and platforms to help us provide services like marketing, analytics, and advertising,” and (3) “authenticated visitation data collected by Google signals and associated with Google user accounts may be shared with Google for analytical purposes.” (Defendant’s RJN, Exh.

B.) In opposition, Plaintiff directs the Court to the following language in Defendant’s Privacy Policy, “all sales information is kept confidential and is used only for reporting purposes at PinkCherry.com. we DO NOT sell or distribute this information in any form to 3rd parties. (Plaintiff’s Opposition (“Opp.”), p. 11:8-11.) This is sufficient to create ambiguity in the plain language of Defendant’s Privacy Policy. Consequently, whether the Privacy Policy constituted consent cannot be resolved on demurrer.

Based on the foregoing, the Defendant’s demurrer on the basis of lack of a reasonable expectation of privacy cannot be sustained.

2. The Party Exemption

Next, Defendant argues that the allegations and judicially noticed facts establish that Google was a party to any purported communications as opposed to a third party. (MPA, p. 12:20-25.) It further argues that Plaintiff concedes that Defendant used Google Analytics for its own business purposes and that Google was a party to the communication because Plaintiff invited Google to participate. (MPA, pp. 13:16-14:8.) In opposition, Plaintiff argues that Google was not a party to the communications and instead it was an “unannounced second auditor”. (Opp., p. 12:19-24.)

A “party” to the transmitted communication is exempt from direct liability under CIPA. (See In re Facebook, Inc. Internet Tracking Litigation (9th Cir. 2020) 956 F.3d 589, 607.) “California law is well[-]settled that a party to the communication is not liable for recording their own conversation under section 631(a), however, a party may be held vicariously liable under the fourth clause where it 'aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things' prohibited in the previous three clauses.” (Licea v. Am. Eagle Outfitters, Inc., (Licea) (C.D. Cal. 2023) 659 F. Supp. 3d 1072, 1081, quoting Cal. Penal Code § 631(a).)

When website code is used to merely store or relay information for the website itself, courts treat that code akin to a tape recorder or tool used by the site and thus find no third-party interception. (See Licea, supra, 659 F.Supp.3d at p. 1083 [finding that the party exception applied to the third-party chat software provider because its software operated more like a tape recorder and it was not alleged to have collected the data for its own use].) However, when the data is transmitted to an independent entity that uses or is capable of using the data for that entity’s own purposes, courts treat the third-party code as an eavesdropper and allow aiding and abetting claims to proceed against the owner of the website. (See Javier v.

Assurance IQ, LLC (N.D. Cal 2023) 649 F.Supp.3d 891, 900 [the court concluded the software provider was an eavesdropper because it could use the information it collected from the defendant for other purpose].) Thus, in order to state a claim, Plaintiff must allege that the third-party provider had the capability to user the intercepted communications for some purpose other than merely recording, storing, or furnishing them for the website owner. (See Heiting v. Taro Pharms. USA, Inc. (C.D. Cal 2023) 709 F.Supp.3d 1007, 1016-1017; see also Turner v.

Nuance Communications, Inc. (N.D. Cal. 2024) 735 F.Supp.3d 1169, 1184 [collection of cases that applied “capability approach”].)

Here, the Complaint alleges the type of information collected by Google. (See Complaint, ¶¶ 32-33.) Moreover, the Complaint alleges that Google has the capability to use the collected information for its own purposes. (See Complaint, ¶¶ 41, 58-59, 79.) These allegations are sufficient to satisfy the capability test. Thus, the party exception is not applicable here.

Defendant further argues that Plaintiff invited Google to participate in the communication because she alleges she has a Gmail account and was logged in while she placed her order on Defendant’s Website. (MPA, p. 14:7-10.) It directs the Court to Google’s Privacy Policy, which disclosed the collection of Plaintiff’s activity information and the fac that “websites and apps that integrate Google service like ads and analytics share information with us.” (MPA, p. 14:10-19.) Thus, Defendant asserts that Plaintiff invited Google’s participation to use the collected information for Google’s purposes (MPA, p. 14:19-22.)

This argument is unavailing because the fact that Plaintiff accepted Google’s Privacy Policy for use of the Gmail account does not constitute consent to Google’s purported interception of her communications on another website. Moreover, the question of whether Plaintiff had notice of the language in Google’s Privacy Policy or of Google’s Trackers requires a factual analysis that goes beyond the scope of demurrer and as a result, this issue cannot be resolved at this time.

Based on the foregoing, Defendant’s demurrer based on the party exemption cannot be sustained.

3. Whether Google Intercepted “Contents” of Any Purported Communications Within the Meaning of CIPA

Lastly, Defendant argues that Plaintiff cannot allege Google intercepted any “contents” within the meaning of CIPA. Defendant argues the act of placing items into the shopping cart and placing a purchase order does not constitute “contents” of any communication.

Section 631 does not provide clarity on the definition of “contents.” Thus, “courts have found that the contact information of the communicating parties and the geolocation of the communicating parties are not the “contents” under [Section 631]. On the other hand, information about particular activity conducted and search terms used on an app qualify as the “contents” of communication.” (Greenley v. Kochava, Inc. (S.D. Cal. 2023) 684 F.Supp.3d 1024, 1051-1052 (Greenley).)

Defendant’s relies on People v. Drennan (2000) 84 Cal.App.4th 1349 (Drennan), in which a school superintendent installed a hidden camera in a principal’s office that took soundless photographs every 3 seconds. (Id. at p. 1351.) The appellate court reversed his conviction under Penal Code section 632 on the ground that the photographs did not capture communicative content and thus, it was not an intentional act of recording a confidential communication. (Id. at p. 1353.) The appellate reasoned that, at most, the photographs could provide that a communication occurred. (Ibid.)

Here, Plaintiff alleges the collected communications included her activities in browsing the Website, the specific product selected, and purchasing it. (See Complaint, ¶¶ 4, 26-29.) Thus, the conduct at issue in this action is distinguishable from that in Drennan. Moreover, Drennan did not involve Penal Code section 631. Consequently, Defendant’s reliance of Drennan is unavailing.

As noted above, the product purchased is an intimate lifestyle product. (Complaint, ¶¶ 2, 23.) Defendant took efforts to ship out orders in “discreet brown boxes.” (Complaint, ¶ 24.) Plaintiff alleges communications regarding sexual preferences and other intimate information. Thus, for purposes of demurrer, Plaintiff alleges sufficient facts to establish that the communications intercepted were communicative. (See Greenley, supra, 684 F.Supp.3d at pp. 1051-1052.) Consequently, the demurrer cannot be sustained on this basis.

Based on the foregoing, Defendant’s demurrer to the first and second causes of action is OVERRULED.

XLVII. MOTION TO STRIKE

Defendant moves to strike the unverified Complaint in its entirety.

A.

Legal Standard

Under section 436, a court may strike out any irrelevant, false, or improper matter inserted into any pleading or strike out all or part of any pleading not drawn or filed in conformity with the laws of this state, a court rule, or an order of the court. (Code Civ. Proc., § 436.) The grounds for a motion to strike must appear on the face of the challenged pleading or from matters of which the court may take judicial notice. (Code Civ. Proc., § 437, subd. (a); see also City and County of San Francisco v.

Strahlendorf (1992) 7 Cal.App.4th 1911, 1913.) In ruling on a motion to strike, the court reads the complaint as a whole, all parts in their context, and assuming the truth of all well-pleaded allegations. (See Turman v. Turning Point of Central California, Inc. (2010) 191 Cal.App.4th 53, 63 (Turman), citing Clauson v. Super. Ct. (1998) 67 Cal.App.4th 1253, 1255.) “Thus, for example, defendant cannot base a motion to strike the complaint on affidavits or declarations containing extrinsic evidence showing that the allegations are ‘false’ or ‘sham.’” (Weil & Brown, Cal.

Practice Guide: Civil Procedure Before Trial (The Rutter Group 2020) 7.169.) At the same time, the California Court of Appeal has emphasized “[w]e have no intention of creating a procedural ‘line item veto’ for the civil defendant.” (PH II, Inc. v. Superior Court (1995) 33 Cal.App.4th 1680, 1683.)

B.

Discussion

Defendant argues that Plaintiff’s use of a pseudonym is procedurally and substantively improper. (Defendant’s Memorandum of Points and Authorities (“MPA”), p. 5:21-24.) It further argues that Penal Code sections 631 and 632 do not permit a plaintiff to proceed anonymously. (MPA, p. 5:25-26.) Additionally, Defendant argues the Complaint fails to meet the overriding interest test in order to allow her to proceed anonymously. (MPA, p. 5:26-28.) In opposition, Plaintiff moves for an order to proceed under a pseudonym. (Plaintiff’s Opposition (“Opp.”), p. 7:1-3.)

Generally, the names of all parties to a civil action must be included in the complaint. (Civ. Proc. Code § 422.40.) "Because of the inherently sensitive nature of some proceedings, statutes specifically allow for keeping certain parties' identities confidential." (Santa Ana Police Officers Assn. v. City of Santa Ana (2025) 109 Cal.App.5th 296, 306 (Santa Ana Police Officers Assn).) “Unless a statute specifically allows a plaintiff to sue under a pseudonym, a plaintiff must obtain court authorization in order to appear anonymously.

Before a party to a civil action can be permitted to use a pseudonym, the trial court must conduct a hearing and apply the overriding interest test: A party's request for anonymity should be granted only if the court finds that an overriding interest will likely be prejudiced without use of a pseudonym, and that it is not feasible to protect the interest with less impact on the constitutional right of access.” (Id. at pp. 306-307.)

Here, Penal Code sections 631 and 632 do not specifically permit parties to keep their identities confidential. Thus, Plaintiff was required to obtain court authorization before appearing using a pseudonym. However, Plaintiff failed to obtain court authorization prior to filing this action. While Plaintiff contends her opposition cures the defect, however, her reliance on Santa Ana Police Officers Assn, supra, is without merit because the appellate court affirmed the judgment as to the Doe Officers on the ground that they could not proceed pseudonymously. (See Santa Ana Police Officers Assn., supra, 109 Cal.App.5th at p. 308 [emphasis added].)

Moreover, in order for the Court to analyze the overriding interest test, it must consider evidence and make findings of fact and risks specific to the case. (See Department of Fair Employment & Housing v. Superior Court (2022) 82 Cal.App.5th 105, 112 (Department of Fair Employment & Housing).) The Court is unable to do that in the context of a motion to strike, which does not involve the consideration of evidence. (See Code Civ. Proc., § 437, subd. (a).) Plaintiff must properly move for permission to proceed under a pseudonym so that Court can consider the necessary materials before making its finding.

Accordingly, Defendant’s motion to strike is DENIED. However, Plaintiff is ordered to move for an order seeking permission to proceed under a pseudonym within 20 days’ of this order.

XLVIII. CONCLUSION

Defendant’s demurrer is OVERRULED, its motion to strike is DENIED, and Plaintiff is ordered to move for an order seeking permission to proceed under a pseudonym within 20 days’ of this order.

The Court will prepare the order.

- oo0oo -

- oo0oo -

29