[00:00:11] Speaker 00: Hello again. [00:00:12] Speaker 00: Once again, Jameson Etzel for the appellant and cross-appellee. [00:00:17] Speaker 00: This time I'd like to reserve five minutes, please. [00:00:19] Speaker 04: Okay, please watch the clock. [00:00:21] Speaker 00: So in this one, the district court dismisses us by saying that we hadn't sufficiently alleged that the full story software intercepted the contents of Mikulski's communications with the Bloomingdale's website. [00:00:35] Speaker 00: That was there because our complaint alleges that Mikulski went through a full transaction, made purchases on the Bloomingdale's website, and also we allege that while on the website, everything she does is captured by the session replay code. [00:00:56] Speaker 00: So I would submit that it's not possible to buy a product from an online merchant [00:01:01] Speaker 00: without communicating a substantive message to that merchant. [00:01:06] Speaker 00: We listed some specific items of information, her name, address, credit card information, all the things you would need to make a payment, including her product selection. [00:01:17] Speaker 00: We didn't identify the specific product, but we said she bought a product. [00:01:21] Speaker 00: And the district court just said, all of this is record data. [00:01:26] Speaker 00: And the district court referenced the Inri Zenga case. [00:01:30] Speaker 00: But if you go and look at the facts of that case, there's a very much more limited set of information that was at issue in that case. [00:01:37] Speaker 00: It was just, I think, Facebook ID refer information. [00:01:42] Speaker 00: So there were no user-generated communications whatsoever at issue in that case. [00:01:47] Speaker 00: And we don't dispute the holding of NRIZENGA. [00:01:50] Speaker 00: We think it draws a fair line between contents on the one hand and record information or pen register-like information on the one hand, which is metadata about a communication. [00:02:03] Speaker 00: It's not the communication. [00:02:05] Speaker 00: But again, our case, we said everything, all text, all mouse movements, all clicks, product choices. [00:02:12] Speaker 00: I mean, it's throughout the record. [00:02:16] Speaker 00: and that all of that is captured. [00:02:19] Speaker 00: So you put two and two together, she went through, she bought something, she gave her credit card information, and meanwhile everything she does is intercepted by full story. [00:02:32] Speaker 00: 2 plus 2 equals 4, the contents of the communications were intercepted here. [00:02:37] Speaker 00: Full story violated 630, well, Bloomingdale's violated 631 by employing full story to learn and obtain the contents of her communications. [00:02:49] Speaker 00: Now this time, the specific allegations that [00:02:54] Speaker 00: under the fourth prong, the aiding and abetting. [00:02:59] Speaker 00: At ER 4243, I mean, we do use the specific word that Bloomingdale's employed or, I only wrote it part way down. [00:03:14] Speaker 00: That basically aids, we use the word aids, we use the word employed at ER 15, paragraphs four and five. [00:03:22] Speaker 00: uh... on that issue i think we've pretty clearly say the claim and on the contents issue i'd just i don't see any conclusion to draw except that the district court overly read what record data means and and took inri zenga and blew it up to cover basically everything uh... and in their response briefs on this issue bloomingdale's has done a couple things one they've tried to point out that full stories materials say there's a way to mask some fields some text fields [00:03:52] Speaker 00: That's all, and we weren't at summary judgment here, we were at rule 12. [00:03:56] Speaker 00: We allege that everything, including the credit card information, was captured by Full Story. [00:04:01] Speaker 00: They responded with the pamphlet that Full Story puts out that says, we ask our clients to, or we insist that our clients mask any sensitive information so we don't get it. [00:04:13] Speaker 00: But all this is beside the point because, [00:04:16] Speaker 00: Even if you took the credit card data out of the equation, there's still contents of communications here, which is her product selection, her name and address. [00:04:24] Speaker 00: Those are messages that she put into the website, transmitted to Bloomingdale's so that she could make her purchase, and the session replay code captured all of that. [00:04:34] Speaker 00: When she put something in her card, the mouse click, move it in. [00:04:37] Speaker 00: That's captured. [00:04:39] Speaker 00: She's communicating the message, I would like to buy this product, or I'm at least interested in this product. [00:04:44] Speaker 00: Then as she moves a little later, she'll start clicking like, I do want to buy this product. [00:04:48] Speaker 00: Here's how I'm going to pay for it. [00:04:50] Speaker 00: I'm going to do credit card. [00:04:51] Speaker 00: Where do I want to get it? [00:04:52] Speaker 00: She could choose either at home delivery, or she could go pick it up at a California Bloomingdale store. [00:04:58] Speaker 00: So throughout that process, she's obviously communicating messages of substance. [00:05:07] Speaker 00: I guess today I haven't addressed yet the personal jurisdiction issue at all, but I could do that. [00:05:14] Speaker 00: I believe, as I've said in our supplemental briefs, that after Briskin, there really aren't any arguments left for them. [00:05:21] Speaker 00: Not only have they done everything that Shopify was doing in Briskin. [00:05:26] Speaker 00: I mean, it's slightly different technology, but it's analogous in terms of the jurisdictional facts. [00:05:33] Speaker 00: Bloomingdale's here has a physical presence in California. [00:05:37] Speaker 00: They're selling products in California, both in person and online. [00:05:42] Speaker 00: And the claim arises out of or relates to that conduct, because our client was making a purchase when she was wiretapped. [00:05:49] Speaker 00: And she was wiretapped in California, because they sent the code onto her browser, which was in California. [00:05:55] Speaker 00: And we have clear allegations on all of those things. [00:05:58] Speaker 00: So I think personal jurisdiction recovered. [00:06:03] Speaker 00: The other argument they've made is that she consented to this at the very end of the transaction. [00:06:09] Speaker 00: I would agree with the Javier opinion. [00:06:11] Speaker 00: It just doesn't make sense to say that someone can consent to a wiretap at the end of the communication. [00:06:18] Speaker 00: Because what if she said no? [00:06:19] Speaker 00: What if she's all the way checking out, and she wants to buy the product, and then they're like, hey, by the way, [00:06:25] Speaker 00: Full story's been seeing everything that you've been doing. [00:06:28] Speaker 00: Do you agree? [00:06:30] Speaker 00: She could not agree, but it doesn't matter. [00:06:32] Speaker 00: They already did it. [00:06:33] Speaker 00: As we allege, this is instantaneous interception. [00:06:36] Speaker 00: So the cases that interpret California law as requiring prior consent for this type of eavesdropping, this type of third party listening, they're exactly correct, because it's just not fair to tell someone. [00:06:51] Speaker 03: Consent is not defined, I don't think, in the statute. [00:06:54] Speaker 03: So is there even an open question for us to think about there, or has California shut the door and just said prior consent period? [00:07:00] Speaker 00: I would take that position. [00:07:02] Speaker 00: That's my understanding of most of the cases that have gone there. [00:07:06] Speaker 00: There's not a ton out there, and I think there's one. [00:07:11] Speaker 03: I could see that California could do the opposite. [00:07:14] Speaker 03: I mean, you made the argument that, well, how could it be that you could consent after the fact? [00:07:18] Speaker 03: Well, we do that in the law all the time. [00:07:19] Speaker 03: It's called ratification, right? [00:07:20] Speaker 03: something that you didn't know or you didn't like or whatever, and then after the fact you say, fine. [00:07:24] Speaker 03: So that could be, California could say, consent encompasses that, it could be consent at any point, but if California's cases have said it must be before, then I don't know that there's a question here for us to wrestle with. [00:07:39] Speaker 00: is presented with the choice at the end, and they say no, there's no way for them to get that communication back from Full Story. [00:07:46] Speaker 00: They're not presented with that choice. [00:07:48] Speaker 00: Oh, do you want to delete all of the stuff that Full Story's been collecting while you've been on the website? [00:07:52] Speaker 00: They're not presented with that choice. [00:07:54] Speaker 00: So there's just no meaningful consent here at all. [00:08:00] Speaker 00: And furthermore, even if you do open up their policy, they're not actually describing what's going on here. [00:08:06] Speaker 00: They say some things like, we may collect, we may share, we may use cookies. [00:08:12] Speaker 00: They're not saying there's a third party that, even if you don't finish typing something in and submitting it to us, they're getting it as it happens. [00:08:19] Speaker 00: I think this type of technology is so much more of a live wire connection to a third party that [00:08:27] Speaker 00: You really need to be clear if you're going to use this technology, and we admit it has legitimate uses, but if a company is going to use something like this, they need to provide very clear upfront notice that while you're here, someone else is listening. [00:08:41] Speaker 00: And that's what people, that's what most reputable companies do in telephone communications. [00:08:46] Speaker 00: They say it at the beginning, this call may be recorded or monitored. [00:08:49] Speaker 00: Everyone's heard that a million times. [00:08:51] Speaker 00: And they hear it right at the beginning, because if somebody doesn't want to be recorded, that's their chance to say, I don't like this. [00:08:57] Speaker 00: I want to hang up. [00:08:58] Speaker 00: I'd rather not be recorded. [00:08:59] Speaker 00: Or ask, is there a way for you to not record? [00:09:02] Speaker 00: Give them the opportunity at the beginning. [00:09:05] Speaker 00: California legislature, they drew a line here. [00:09:07] Speaker 00: They said, no one may listen without the consent of all parties. [00:09:17] Speaker 00: At some point, not everyone needs to know everything about everyone. [00:09:21] Speaker 00: I think people have a right to say, enough's enough. [00:09:25] Speaker 00: I'm not comfortable with that. [00:09:27] Speaker 00: I don't want all of my data collected everywhere all the time. [00:09:31] Speaker 00: At least give them the choice. [00:09:33] Speaker 00: And that's really what most of these cases, the issue we're presenting is, give people fair notice and give them a choice. [00:09:43] Speaker 00: Because the contents issue was really the main basis of the court's dismissal, if the court doesn't have any further questions, I mean, I'm happy to just sit down and reserve the rest of the time. [00:09:54] Speaker 04: I think we got that. [00:10:07] Speaker 02: Good morning, Your Honors. [00:10:08] Speaker 02: May it please the Court. [00:10:09] Speaker 02: I'm going to start with personal jurisdiction, obviously taking into account our prior conversation. [00:10:14] Speaker 02: And in the last argument on Papa John's, we're focused on and asking questions about, you know, why would anyone visit Papa John's website other than to buy a pizza? [00:10:22] Speaker 02: And with respect to Bloomingdale's, I think the answer [00:10:25] Speaker 02: is clear and obvious why a lot of people would visit the Bloomingdale's website other than to purchase a product from a brick and mortar store that may not be near them. [00:10:33] Speaker 02: They want to see the latest fashions, the latest styles. [00:10:36] Speaker 02: They're comparing clothing across different locations. [00:10:39] Speaker 02: People browse clothing websites just like they browse clothing stores. [00:10:44] Speaker 02: And so while, you know, I'm not going to re-argue the last case. [00:10:46] Speaker 02: We didn't think that was dispositive. [00:10:48] Speaker 02: But here, that concern would not be present that there's no reason to go to the Bloomingdale's website [00:10:54] Speaker 02: Other than you want to interact with the brick-and-mortar store that may not be anywhere near you in many states There are none to one store yet their website visitors They're not questions on personal jurisdiction. [00:11:07] Speaker 02: I can I can turn to the merits and judge by me I think you were correct to point out that you know one of the issues with these types of claims is this is an antiquated statute the California legislature has passed in racing years a number of [00:11:21] Speaker 02: of statutes specifically addressing collection of online data. [00:11:25] Speaker 02: You think about the California Consumer Privacy Act. [00:11:29] Speaker 02: And there isn't any allegation that any of those statutes are violated. [00:11:33] Speaker 02: Instead, we're looking at the wiretapping. [00:11:35] Speaker 02: And so you have to think about this transaction. [00:11:38] Speaker 01: So let me interrupt you there. [00:11:40] Speaker 01: So in the prior case, which you did not participate in but heard, I was asking mostly about Section 1. [00:11:47] Speaker 01: Right. [00:11:47] Speaker 01: So I didn't see that you briefed or argued that Section 2 does not apply. [00:11:54] Speaker 02: That's correct. [00:11:56] Speaker 02: But we did not argue that. [00:11:58] Speaker 02: But I think the issue becomes in a lot of ways you're trying to fit a new technology [00:12:03] Speaker 02: into an old framework and it's in a lot of ways the square peg. [00:12:07] Speaker 02: into a round hole and so you really have to focus. [00:12:09] Speaker 01: Are you now prepared to argue to us that section two does not apply to the internet? [00:12:14] Speaker 02: No, but what we are arguing here is when you properly understand the conduct that section two was prohibiting in the context of a telephone communication and then when you look to the allegations of how session replay code works you will see that the allegations regarding [00:12:34] Speaker 02: The collection of data through session replay code doesn't state a violation of Section 2. [00:12:41] Speaker 02: And we get there, I think, through a number of ways. [00:12:43] Speaker 02: What we started with what Section 2 is aimed at. [00:12:47] Speaker 02: So you think of a telephone conversation. [00:12:50] Speaker 02: As the message is moving between one participant to the other, the third party is intercepting that communication. [00:12:59] Speaker 02: hear what's alleged that there are communications between the website operator and the website. [00:13:05] Speaker 02: So if you're making a purchase, you're telling the website what you're ordering. [00:13:09] Speaker 02: But what they're challenging, it's a separate stream of data they're alleging is being sent from the website to the session replay code provider. [00:13:21] Speaker 02: The vast majority [00:13:22] Speaker 02: of what is collected, as they allege in the complaint, in which we don't dispute, has to do with clicks, scrolls, mouse movements, screen resizes, because what happens is the session replay code provider uses your navigation and your movements to recreate the way you used the website. [00:13:43] Speaker 02: That, I don't see them have any argument in their brief that that isn't record information, the way you navigate. [00:13:50] Speaker 02: Is not record information they are focused on text being entered into text fields But you know they said this was just the you know the way session replay code operates and the document That we referred to as more of a summary judgment issue because we brought it up, but a couple points to that the complaint paragraph 44 recognizes that that there is masking of text fields and what they alleged there is a [00:14:19] Speaker 02: that because of the masking of text fields, they don't know what information is being collected. [00:14:27] Speaker 02: If they can't allege that they know that the contents of communications are being collected, they can't state a claim. [00:14:35] Speaker 02: Going to the the guide and it's called the definitive guide to session replay code that is cited a dozen times in the complaint if you look at the introduction to the complaint the first six sites are all direct quotes from that document it's referred to throughout the complaint and what that says is that for sensitive information like passwords not collected [00:15:00] Speaker 02: at all for text fields, by default it's masked. [00:15:04] Speaker 02: Because if you think of the way the session replay code operates and the function it serves, it's to show a website operator how users are moving around their websites. [00:15:15] Speaker 02: the way they're using it. [00:15:17] Speaker 02: And so the focus is on recreating the movement. [00:15:20] Speaker 02: It's not collecting the specifics of information. [00:15:24] Speaker 02: Bloomingdale's is getting that information, processing a transaction if somebody purchases them, sends them the product they want. [00:15:31] Speaker 02: The session replay code provider isn't doing that. [00:15:33] Speaker 02: It's tracking the navigation on the website. [00:15:36] Speaker 02: And that's why, by default, any text fields are masked. [00:15:39] Speaker 02: We cite a couple district court decisions in our brief, and I know they're not binding in any sort of way, but I think they understood the technology and what both of those district court decisions say in granting motions to dismiss. [00:15:52] Speaker 02: If you don't have allegations of how session replay code is configured on the website, then you can't allege that it's collecting private information [00:16:04] Speaker 02: or the contents of communication. [00:16:06] Speaker 03: I understand that argument. [00:16:07] Speaker 03: It makes a lot of sense to me. [00:16:08] Speaker 03: What I'm trying to figure out is how would a plaintiff ever be able to bring a claim? [00:16:12] Speaker 03: Because even the document that you're citing suggests that the ability to collect the text is possible. [00:16:19] Speaker 03: So the masking is the default, but it's not the only way this system works. [00:16:23] Speaker 03: How is a plaintiff ever going to know how this thing is configured for a particular website client? [00:16:30] Speaker 03: until they get into litigation. [00:16:32] Speaker 03: That's not something that you're ever going to just find out as a consumer. [00:16:35] Speaker 02: So a couple of responses to that. [00:16:37] Speaker 02: One, I think it is possible and could be possible to understand how it works. [00:16:42] Speaker 02: Another document they cite throughout their complaint was a study that a researcher did in 2017 when he looked at a number of websites that use session replay code. [00:16:52] Speaker 02: And they identified two websites that they thought [00:16:57] Speaker 02: collected personal information. [00:16:58] Speaker 02: So there is an instance of a third party looking at the way session replay code was instituted and recognizing out of hundreds of websites they looked at, they found one or two that was collecting personal information. [00:17:11] Speaker 03: Why can't it meet the plausibility standard to allege this is a system that's being used? [00:17:16] Speaker 03: This system has this capability to see this content that would meet the definition of content for the statute. [00:17:24] Speaker 03: and get past pleading and then resolve whether that's actually happening at summary judgment. [00:17:28] Speaker 02: I would say it's not sufficiently plausible under Twombly and Nick Ball where the factual allegations is that in eight years ago in 2017, somebody was able to identify two websites that collect this information. [00:17:41] Speaker 02: I mean, I think of, you know, all of the websites that I use, I enter personal information. [00:17:46] Speaker 02: I check the box that I don't want them to share that with other people. [00:17:50] Speaker 02: I have no way to know. [00:17:51] Speaker 02: Whether they do that or not, but I can't sue them all and say, you might have shared it. [00:17:56] Speaker 02: We'll go through discovery to see that you did that. [00:17:59] Speaker 02: You have to have some factual allegation to raise it beyond the level of possibility to the level of plausible. [00:18:06] Speaker 02: That is the holding of Twombly and Iqbal. [00:18:10] Speaker 02: It's not enough just to say, it could be possible. [00:18:14] Speaker 02: That Papa John's or sorry it's the last case, but vote Bloomingdale's hadn't installed session replay code using the default configurations, but there's no allegations. [00:18:27] Speaker 02: that they didn't, and so to raise this to the level of plausible, you would need allegations of that sort, that it wasn't, you know, there was something about the way Bloomingdale's was using session replay code that allowed the session replay code provider to see that information. [00:18:47] Speaker 02: There's no allegations of that sort in the complaint. [00:18:50] Speaker 02: I think where the consent I think is relevant and comes in is, [00:18:55] Speaker 02: You know, a lot of the information they're focusing on that they're saying is the contents of the communication are the information that is entered when you make the purchase. [00:19:06] Speaker 02: And of course, that's the time in which you are consenting. [00:19:09] Speaker 02: Another thing I think that's important about the consent argument is it's clear under this statute, unlike a lot of other statutes, you know, we often think of consent as more of an affirmative defense. [00:19:21] Speaker 02: Here it is an element of the cause of action because what you have to allege is that the defendant acted without authorization, without the consent, and so the case law is clear. [00:19:31] Speaker 02: That's an element you need to plead. [00:19:34] Speaker 02: So there's no factual allegation here that Miss McCloskey didn't know about the practice. [00:19:42] Speaker 02: I think it's telling what the allegation she has a section where she said she didn't consent and what she says in there. [00:19:47] Speaker 02: is that a reasonable user of the website wouldn't have known about the collection. [00:19:53] Speaker 02: I think that's telling because Ms. [00:19:55] Speaker 02: Mikulski is one of the plaintiffs who has brought a number of these cases against session replay code providers and so she didn't allege, I didn't know about it. [00:20:04] Speaker 02: She alleges other people may not have known about it and that we would suggest was not sufficient to allege the lack of consent here which is a required element under the statute. [00:20:19] Speaker 01: You're not disputing that Bloomingdale's is collecting, let's take credit card information as something very sensitive and private. [00:20:26] Speaker 01: They're collecting private information and they have made, they've given Full Story some access to information and we don't, do we know that they haven't shared the credit card information? [00:20:41] Speaker 01: So we just don't know whether Full Story read it. [00:20:43] Speaker 02: Now, a couple points on that. [00:20:45] Speaker 02: We don't dispute that they have alleged that Bloomingdale's receives the credit card information that could be considered private information, but that is different than whether or not that is record information or the contents of a communication. [00:21:03] Speaker 02: That's a separate question with respect to Bloomingdale's. [00:21:06] Speaker 02: But with respect to the information that is going to the session replay code provider, [00:21:12] Speaker 02: What we're saying is there is no factual allegation that makes it plausible that Session Replay Code providers received the credit card number. [00:21:23] Speaker 02: The only Session Replay Code provider that's identified in the complaint is Full Story. [00:21:30] Speaker 02: It's discussed throughout. [00:21:31] Speaker 02: It's referenced Full Story's definitive guide to Session Replay Code. [00:21:37] Speaker 02: In there, it says that they don't collect credit card numbers. [00:21:40] Speaker 02: So there's no allegation. [00:21:42] Speaker 02: that the session replay code provider receives the credit card number. [00:21:45] Speaker 02: And then back with Bloomingdale's district court's... Yeah, the address. [00:21:50] Speaker 04: Is this also applied to the address and phone number? [00:21:54] Speaker 02: Correct. [00:21:54] Speaker 02: So the address, that is one of the features, the address that this court said in Zynga is record information, name, address. [00:22:04] Speaker 04: Zynga applies to a federal statute, not to the statute before us. [00:22:08] Speaker 02: So, but the courts have interpreted them the same way because the state wiretap statutes were passed around the same time and largely mirror in large. [00:22:19] Speaker 04: Has California interpreted it that way? [00:22:23] Speaker 02: They have not that specific provision, but there are cases from California that say that we look to the federal wiretap statute to interpret the statute. [00:22:35] Speaker 02: And of course, this court did that in Henry. [00:22:38] Speaker 02: Facebook it interpreted the party exception under the federal wiretap act and SIPA in the same way and noted the courts had Interpreted them the same way so it is true that as a general matter California courts in interpreting SIPA have looked to the federal wiretap act But I think a large part of the court's analysis to in in Razinga is [00:23:00] Speaker 02: was based, as the court said, on the plain meaning of the statutory terms. [00:23:05] Speaker 04: It was defined in the statute, if I recall it right. [00:23:09] Speaker 04: It's not defined in the statute here. [00:23:11] Speaker 02: Correct, but the court also looked at dictionary [00:23:14] Speaker 02: definitions of the term. [00:23:16] Speaker 02: And so the statutory definition didn't really depart from the plain meaning when the court looked to the contents of a communication was the meaning that was intended to be conveyed by the communication. [00:23:31] Speaker 02: So it's true that Zingo is interpreting the federal statute. [00:23:35] Speaker 02: It has the same terms. [00:23:37] Speaker 02: Certainly the contents of a communication are the same terms that we see in the Federal Wiretap Act, the State Wiretap Act, [00:23:44] Speaker 02: They have been interpreted similarly and also given their plain meaning. [00:23:49] Speaker 01: So what's the implication of what you're telling us? [00:23:51] Speaker 01: That the session replay code would allow Full Story to have the name and address of Ms. [00:23:57] Speaker 01: Mikulski? [00:23:59] Speaker 02: What we are saying is that as an initial matter, name and address that is typed into the website by default would be masked when it goes to the session replay code. [00:24:11] Speaker 02: They don't have an allegation that Bloomingdale's did anything to unmask that. [00:24:17] Speaker 01: So because of that absence... But you're telling us that after Zynga, that that's record information, that there'd be nothing wrong if they were sharing that. [00:24:23] Speaker 02: Is that right? [00:24:23] Speaker 02: Right. [00:24:24] Speaker 02: That's my second point. [00:24:25] Speaker 02: So my first point is that there's no allegation to plausibly allege that the session replay code [00:24:31] Speaker 02: read the contents of the communication, because if the text entry is masked, they can't read it. [00:24:38] Speaker 02: That's point one. [00:24:39] Speaker 02: Point two is that even if there was no masking, the name and address would be treated as record information. [00:24:48] Speaker 01: So if we thought that Zinke didn't apply to this case, the federal act wasn't persuasive here, and that name and address was not mere record information, [00:25:00] Speaker 02: Then does the complaint survive if we disagree with that with that point no because of the masking point, but I will point out This is not this is not an argument. [00:25:08] Speaker 02: They've pushed they have accepted that Zynga controls the interpretation of SIPA the district court applied Zynga that said it controls the interpretation of Zynga in their brief on appeal here, they have relied on Zynga and said they accept that [00:25:26] Speaker 02: the framework set forth in Zynga of what's record information and what is content. [00:25:32] Speaker 02: So no one before the court has pushed for a definition or an approach in which Zynga doesn't apply here. [00:25:42] Speaker 02: But as I said, here [00:25:44] Speaker 02: The focus of the information is not the information going to the website operator. [00:25:48] Speaker 02: It is the information being conveyed to the session replay code provider. [00:25:54] Speaker 02: The vast majority of that, of what was alleged in the complaint, are scrolls, clicks, mouse movements. [00:26:00] Speaker 02: That's what's needed to kind of recreate the navigation of the website. [00:26:06] Speaker 02: I didn't see anything in their appellate brief. [00:26:08] Speaker 02: and I didn't hear anything this morning taking issue with the fact that that is properly treated as record information. [00:26:15] Speaker 02: What they are focused on is text entered into text fields. [00:26:20] Speaker 02: Our primary position based on paragraph 44 of the complaint is that by default text fields are masked and they say in paragraph 44, they don't know. [00:26:33] Speaker 02: If any of that information was collected and without a plausible and allegation that was collected they haven't stated a claim And then yes, even without masking our position is that under zenga which is applies here fields like the name and address would be treated as record information Or does have any questions [00:27:05] Speaker 00: Okay, I'll try to be quick here, but on this issue of like we don't know what they're collecting, I think that [00:27:14] Speaker 00: The way to read paragraph 44 is website visitors don't know what's being collected. [00:27:19] Speaker 00: We also make very clear allegations because we did an investigation. [00:27:25] Speaker 00: So we used the developer tools that allow you to see a little more detail about what's going on here. [00:27:32] Speaker 00: And if you look at ER34, ER35, we pulled up some examples. [00:27:37] Speaker 00: So this was from Bloomingdale's website. [00:27:41] Speaker 00: If you searched for a specific type of watch, that packet, that bit of information that you just typed gets sent to full story. [00:27:50] Speaker 00: So right there, paragraph 76 alone, we're showing that contents are being intercepted. [00:27:57] Speaker 00: Because that is a text entry, and whichever field that was was not properly masked because it was sent to full story. [00:28:04] Speaker 00: But the allegations of the complaint start by saying everything is captured. [00:28:10] Speaker 00: We admit that there's a possibility for some masking, but our allegations are actually that the masking doesn't work that well. [00:28:17] Speaker 00: And ER 36, paragraph 82, ER 37, paragraph 83, we say even at the heightened settings of masking, because everything else is still being captured, you're still getting the contents of communications. [00:28:33] Speaker 00: If you decide you want to buy a watch by clicking on a button, you don't necessarily have to type a text field to say, I want to buy this watch. [00:28:42] Speaker 00: The way we use websites, clicking and scrolling and moving things around with your mouse [00:28:47] Speaker 00: is also communicative. [00:28:48] Speaker 00: You pick what you want. [00:28:50] Speaker 00: It moves forward into the cart. [00:28:52] Speaker 00: You say, yeah, now I'm ready to check out. [00:28:55] Speaker 00: And then you can pick, like, well, pick up a delivery. [00:28:57] Speaker 00: It might just be a little radio button. [00:28:59] Speaker 00: And you pick one. [00:29:00] Speaker 00: You've communicated that way. [00:29:01] Speaker 00: So the clicks themselves, even if that was all we had, clicks can still be communicative. [00:29:07] Speaker 00: But I want to emphasize, [00:29:08] Speaker 00: We are alleging very clearly that there are text fields that are not masked on this website. [00:29:14] Speaker 00: And things like address. [00:29:17] Speaker 00: So just to go back to the Zynga case and what it defines as record information. [00:29:23] Speaker 00: I believe that was mostly talking about IP addresses. [00:29:27] Speaker 00: In our case, in Bloomingdale's, when I say address, I'm going to specifically say Mikulski's billing address and her physical address. [00:29:39] Speaker 00: At least one of those we specifically said she entered because she was making a purchase, so that implied that she had to put one in. [00:29:45] Speaker 00: That's not something generated by the system. [00:29:48] Speaker 00: That's something she had to type in to communicate to Bloomingdale's. [00:29:52] Speaker 00: Bloomingdale's doesn't know where she lives, so when she's buying a product, she has to tell them, [00:29:56] Speaker 00: That is the contents of the communication. [00:29:58] Speaker 00: She is telling Bloomingdale's, I live at XYZ, Palm Street, whatever. [00:30:04] Speaker 00: So the complaint here, when we start with the overall statements that every single thing a person is doing in the environment on the website is tracked, [00:30:14] Speaker 00: And yes, masking exists, but it doesn't work. [00:30:16] Speaker 00: And we don't know exactly what the configuration was here. [00:30:19] Speaker 00: But regardless, there's still contents being captured. [00:30:23] Speaker 00: We have a stated claim here. [00:30:25] Speaker 00: And maybe through discovery, they can narrow down exactly which fields were masked or not masked. [00:30:31] Speaker 00: But no matter what, our allegations that have to be taken as true at this point have said that contents were intercepted here. [00:30:40] Speaker 00: If there are no further questions, I'm happy to end there. [00:30:44] Speaker 04: All right. [00:30:45] Speaker 04: Thank you. [00:30:45] Speaker 04: I think we have your argument. [00:30:46] Speaker 04: We thank both sides for their argument. [00:30:48] Speaker 04: The case of Erica Mikulski versus Bloomingdale LLC and Bloomingdale.com is submitted and we're for this session, we stand adjourned. [00:31:02] Speaker 03: All rise. [00:31:08] Speaker 04: This court for this session stands adjourned.