DIANE YOUNG, et al., Plaintiffs, v. SALESFORCE, INC., Defendant Case No. 22-cv-09067-JST (LB) United States District Court, N.D. California Filed June 30, 2025 Beeler, Laurel, United States Magistrate Judge DISCOVERY ORDER INTRODUCTION Defendant Salesforce provides Chat, a customer-service tool hosted on its servers and integrated into websites of customers like Rite Aid and Kaiser Permanente to enable real-time consumer interaction and background analytics.[1] In this putative class action, the plaintiffs — users of Rite Aid's and Kaiser Permanente's websites — allege that Salesforce violates the California Invasion of Privacy Act, Cal. Penal Code §§ 631 and 632, and Pennsylvania's Wiretapping and Electronic Surveillance Control Act, 18 Pa. Const. Stat. § 5701 et seq., by intercepting their communications, including personally identifiable information and protected health information.[2][3] Salesforce denies reading the communications, asserting that it merely provides the tool, which its customers control.[4] The parties dispute whether the plaintiffs are entitled to the source code for Salesforce Chat. The plaintiffs argue that it reveals how data is intercepted and used. Salesforce counters that its disclosures about its software architecture are sufficient.[5] The court can decide the dispute without oral argument. Civil L. R. 7-1(b). The court denies the discovery because source-code disclosure is disproportionate under Fed. R. Civ. P. 26(b). ANALYSIS Parties may obtain discovery of any nonprivileged matter relevant to any party's claim or defense and proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties' relative access to relevant information, the parties' resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit. Information within this scope of discovery need not be admissible in evidence to be discoverable. Fed. R. Civ. P. 26(b). “Pretrial discovery is ordinarily accorded a broad and liberal treatment.” Peng v. Nw. Mut. Life Ins. Co., No. 17-cv-01760-SI, 2017 WL 3007030, at *1 (N.D. Cal. July 14, 2017) (cleaned up) (quoting Shoen v. Shoen, 5 F.3d 1289, 1292 (9th Cir. 1993)). The party moving to compel discovery “has the initial burden of establishing that the information sought is relevant to any party's claim or defense and proportional to the needs of the case.” Impinj, Inc. v. NXP USA, Inc., No. 19-cv-03161-YGR (AGT), 2022 WL 16586886, at *2 (N.D. Cal. Nov. 1, 2022) (cleaned up). The plaintiffs argue that the source code will reveal how Chat routes communications and Salesforce uses the data.[6] Salesforce counters that Chat's functionality — not its code — is relevant, it has provided discovery about its software architecture and capabilities, and the plaintiffs have sent their Rule 30(b)(6) topics, which will illuminate the issues.[7] Chat, an application-programming interface — prewritten code enabling customers to build functions into their programs — is configured by those customers (like Rite Aid and Kaiser), who control the data.[8] Also, disclosing proprietary source code risks competitive harm in Saleforce's software-as-a-service market.[9] On this record, discovery is disproportionate. Salesforce's documents and proposed depositions offer less burdensome alternatives to understanding Chat's functionality.[10] Saleh v. Nike, Inc., No. CV 20-09581-FLA (RAOX), 2021 WL 4434352, at *2 (C.D. Cal. Aug. 16, 2021) (denying source code in wiretapping case involving the same plaintiffs' counsel). The plaintiffs cite cases where source code was disclosed, but all involve the voluntary production of source code. See, e.g., In re Hulu Priv. Litig., No. 11-03716 LB, 2014 WL 3421036, at *1 (N.D. Cal. July 14, 2014) (Video Privacy Protection Act case).[11] Courts authorize alternatives like documents, diagrams, and testimony as less burdensome, proportional alternatives to source-code disclosure. See, e.g., Saleh, 2021 WL 4434352, at *2; Realtime Data, LLC v. MetroPCS Tex., LLC, No. 12cv1948-BTM (MDD), 2012 WL 1905080, at *1, 3 (S.D. Cal. May 25, 2012) (in patent case against wireless communication companies, held that non-infringing third-party's production of source code was burdensome; witnesses could more easily provide information about the software); Disney Enters., Inc. v. Hotfile Corp., No. 11-20427-CIV-JORDAN, 2011 WL 13100240, at *2 (S.D. Fla. Aug. 26, 2011) (in copyright-infringement case, the plaintiffs did not establish a need for the source code where it was possible to describe the computer program by means other than source code; distinguished cases where there was a dispute about the source code itself). Regarding hyperlinked documents, Salesforce need not produce publicly available material but must disclose all relevant Chat-related hyperlinked material about functionality and architecture.[12] The plaintiffs must specify any disputed hyperlinks, and the parties must meet and confer to resolve disputes, per the court's standing order (attached). IT IS SO ORDERED. Dated: June 29, 2025 Footnotes [1] Third Am. Compl. – ECF No. 93 at 3 (¶¶ 12–14); see Order – ECF No. 69 at 1–2. Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the ECF-generated page numbers at the top of documents. [2] Id. at 2 (¶ 1). [3] Id. [4] Joint Case-Mgmt. Statement – ECF No. 66 at 3. [5] Disc. Letter Br. – ECF No. 107 at 1–5. [6] Id. at 1. [7] Id. at 3. [8] Id. (citing Order – ECF No. 107 at 69 n.1) (cleaned up). [9] Id. (pointing out that the plaintiffs' counsel has other wiretapping litigation against it). [10] Id. [11] Id. at 4 (analyzing the plaintiffs' cited cases). [12] Id. at 5.