A federal judge has narrowed some of the claims in a class action alleging Apple surreptitiously logged iPhone user data.
U.S. District Judge Edward Davila pared but did not fully squash the consolidated lawsuit, through which named several named plaintiffs accused the tech giant of falsely assuring users they controlled the sharing of personal information when using proprietary software like Apple Music or Apple TV.
Following an original complaint in November 2022 with claims for unjust enrichment or breach of contract, alleged violation of the California Invasion of Privacy Act and a state law invasion of privacy claim, the consolidation process in October 2023 resulted in inclusion of several other state law claims, including from Pennsylvania, New York, New Jersey and Illinois.
Davila partially granted Apple’s motion to dismiss the complaint, which centered on two phone settings: One that allows software to request tracking permission and another that approves sharing of device analytics. In so doing, he first ruled in Apple’s favor on the admissibility of 18 pieces of evidence, all of which drew plaintiffs’ objections.
Among those items were software license agreements and privacy policies, which Apple successfully argued were incorporated by being referred to in the complaints. Also allowed into the record were welcome screens users encounter when first opening the applications the complaint discusses, seven different privacy disclosure documents and three settings screens germane to the allegations.
Apple failed to convince Davila the plaintiffs lacked standing. He determined the complaint adequately alleged violation of “a substantive privacy right” and said he wouldn’t grant dismissal based on the specificity of allegations concerning what specific data Apple purportedly collected.
However, he also determined “Apple sufficiently disclosed the challenged data collection in both the privacy policy and then subsequently in the welcome screen disclosures.” He said the company tells users it will log where they tap, what they search, what ads they see, how long they use a particular application along with device details such as screen resolution, keyboard language and means of internet connection.
The plaintiffs didn’t dispute whether they received notice but contended the disclosure licenses weren’t part of the complaint. They further said any disclosures Apple made were modified by language in the same policy allowing users to withdraw consent, specifically through the settings that would disable software’s ability to request permission to track or allow users to decline device analytics sharing.
Davila noted the “Allow Apps to Request to Track” setting explicitly notes the setting applies to “other companies’ apps and websites” and therefore doesn’t apply to native software. He said that reality is given further context to users who click on the “learn more” link for additional information and noted the complaint lacks an allegation explaining why a reasonable person might come to a different conclusion.
The plaintiffs had a stronger argument regarding the device tracking settings. Davila noted a disclosure clause stipulating users could “choose to disable the sharing of Device Analytics altogether” which could plausibly allow the inference plaintiffs alleged they reached. As such, he granted dismissal only to the extent the claims relied on the “request to track” setting.
Those distinctions echoed in Davila’s rulings regarding Apple’s request to dismiss plaintiffs’ contractual claims. Davila agreed to dismiss the breach of contract claim based on the “request to track” setting — but will allow the plaintiffs a chance to amend the complaint despite being skeptical of their ability to do so sufficiently — while refusing to do so in connection with device tracking settings.
Though little of the complaint remained, Davila did say the plaintiffs could still pursue damages on the surviving claims. However, he dismissed claims for breach of implied contract, unjust enrichment and breach of implied covenant. Davila similarly split the complaint as it relates to the California Invasion of Privacy Act and said Apple was wrong to argue its software isn’t a “device” under that law, but did say the plaintiffs didn’t show how the challenged data collection constituted “communication.”
Among state law claims, Davila allowed to survive those under New York, New Jersey and Illinois law because he said Apple didn’t establish how those allegations are insufficient. He granted the plaintiffs 30 days to file an amended complaint.
Apple did not respond to a request for comment.