Cdk Global LLC v. Mark Brnovich

FOR PUBLICATION

UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT

CDK GLOBAL LLC, a limited No. 20-16469
liability company; REYNOLDS AND
REYNOLDS COMPANY, a corporation, D.C. No.
Plaintiffs-Appellants, 2:19-cv-04849-
GMS
v.

MARK BRNOVICH, Attorney General, OPINION
Defendant-Appellee,

ARIZONA AUTOMOBILE DEALERS
ASSOCIATION,
Intervenor-Defendant-Appellee.

Appeal from the United States District Court
for the District of Arizona
G. Murray Snow, Chief District Judge, Presiding

Argued and Submitted February 5, 2021
Phoenix, Arizona

Filed October 25, 2021
2 CDK GLOBAL V. BRNOVICH

Before: William A. Fletcher, Eric D. Miller, and
Danielle J. Forrest, * Circuit Judges.

Opinion by Judge Miller

SUMMARY **

Copyright Preemption / Preliminary Injunction

The panel affirmed the district court’s order denying
plaintiffs’ motion for a preliminary injunction against
enforcement of the “Dealer Law,” an Arizona statute aimed
at strengthening privacy protections for consumers whose
data is collected by car dealers and restricting
anticompetitive business practices by technology companies
that provide database services for dealers.

The Dealer Law prevents database providers such as
plaintiffs from limiting access to dealer data by dealer-
authorized third parties and requires providers to create a
standardized framework to facilitate such access. Plaintiffs
sought declaratory and injunctive relief on the basis that the
Dealer Law is preempted by the Copyright Act and the
Computer Fraud and Abuse Act, violates the Contracts
Clause and the Takings Clause, and is void for vagueness.

The panel held that it had jurisdiction under 28 U.S.C.
§ 1292(a)(1) to review the district court’s order denying

*
Formerly known as Danielle J. Hunsaker.

**
This summary constitutes no part of the opinion of the court. It
has been prepared by court staff for the convenience of the reader.
 CDK GLOBAL V. BRNOVICH 3

injunctive relief, but it lacked pendent appellate jurisdiction
over the CFAA and vagueness claims, which the district
court dismissed before ruling on the preliminary injunction.

The panel affirmed the district court’s conclusion that
plaintiffs were unlikely to succeed on the merits of their
claims, and thus were not entitled to a preliminary
injunction. As to the Copyright Act preemption claim, the
panel held that there was no conflict preemption because the
state and federal laws were not irreconcilable. Plaintiffs
brought a facial challenge to the Dealer Law but could not
establish that every possible application of the statute would
conflict with the Copyright Act. In addition, the Dealer Law
did not conflict with 17 U.S.C. § 106(1), which grants the
owner of a copyrighted work the exclusive right “to
reproduce the copyrighted work in copies.”

The panel further concluded that plaintiffs were unlikely
to succeed on their Contracts Clause claim. First, plaintiffs
forfeited their claim that the Dealer Law impaired their
contracts with third-party vendors. Second, plaintiffs did not
show that the Dealer Law impaired their ability to discharge
their contractual duty to keep dealer data confidential.
Third, assuming, without deciding, that the Dealer Law
substantially impaired contractual third-party access
restrictions, the statute did not violate the Contracts Clause
because it was reasonably drawn to serve important public
purposes of promoting consumer data privacy and
competition.

Finally, the panel held that plaintiffs were unlikely to
succeed on their takings claim because the Dealer Law did
not effect a per se physical taking, and it did not constitute a
regulatory taking.
4 CDK GLOBAL V. BRNOVICH

COUNSEL

Michael A. Scodro (argued), Britt M. Miller, and Brett E.
Legner, Bayer Brown LLP, Chicago, Illinois; Thomas J.
Dillickrath (argued) and Jonathan R. DeFosse, Sheppard
Mullin Richter & Hampton LLP, Washington, D.C.; Brian
A. Howie and Lauren E. Stine, Quarles & Brady LLP,
Phoenix, Arizona; Molly C. Lorenzi, San Francisco,
California; Mark W. Ryan, Washington, D.C.; Aundrea K.
Gulley, Brice A. Wilkinson, and Denise Drake, Gibbs &
Bruns LLP, Houston, Texas; for Plaintiffs-Appellants.

Brunn (Beau) W. Roysden III (argued) and Rusty D.
Crandell, Office of the Attorney General, Phoenix, Arizona;
Mary O’Grady and William D. Furnish, Osborn Maledon
P.A., Phoenix, Arizona; for Defendants-Appellees.

Derek T. Ho (argued), Aaron M. Panner, Brendan J.
Crimmins, Daniel V. Dorris, Joshua Hafenbrack, Bethan R.
Jones, and Jayme L. Weber, Kellogg Hansen Todd Figel &
Frederick PLLC, Washington, D.C.; John C. Norling, John
J. Egbert, Jeffrey D. Gardner, and Jimmie W. Pursell Jr.,
Jennings Strouss & Salmon P.L.C., Phoenix, Arizona; for
Intervenor-Defendants-Appellees.

R.J. “Jim” Sewell Jr, Smith Law Firm P.C., Helena,
Montana, for Amicus Curiae Montana Automobile Dealers
Association.

Timothy C. Fox, Attorney General; Matthew T. Cochenour,
Acting Solicitor General; Jon Bennion, Chief Deputy
Attorney General; Office of the Attorney General, Helena,
Montana; for Amicus Curiae State of Montana.
 CDK GLOBAL V. BRNOVICH 5

Craig Nichols, Nichols Law Group LLP, Portland, Oregon;
Aaron H. Jacoby, Victor P. Danhi, Karen Van Essen, and
Franjo M. Dolenac, Arent Fox LLP, Los Angeles,
California; for Amici Curiae California New Care Dealers
Association and Oregon Auto Dealers Association.

OPINION

MILLER, Circuit Judge:

In 2019, the Arizona Legislature enacted a statute aimed
at strengthening privacy protections for consumers whose
data is collected by car dealers and restricting
anticompetitive business practices by technology companies
that provide database services for dealers. The statute’s key
provisions prevent database providers from limiting access
to dealer data by dealer-authorized third parties and require
providers to create a standardized framework to facilitate
such access. Two database providers subject to the statute
filed suit and sought a preliminary injunction against its
enforcement on the grounds that it is unconstitutional and
that it is preempted by numerous federal statutes. After
concluding that the plaintiffs were unlikely to succeed on the
merits of their claims, the district court denied a preliminary
injunction. We affirm.

I

To manage their operations, car dealers use specialized
software known as a dealer management system (DMS). The
core of a DMS is a database containing information about a
dealer’s customers, vehicles, accounting, parts, and services.
Some of that data, such as customers’ social-security
numbers and credit history, is highly sensitive. DMSs use the
6 CDK GLOBAL V. BRNOVICH

data to perform a variety of tasks, from sales and accounting
to financing and inventory management.

In addition, dealers often rely on separate software
applications for aspects of their business, such as managing
online marketing and customer relations. In order to
function, those third-party applications must be able to
access the data stored in a dealer’s DMS.

Plaintiffs CDK Global LLC and Reynolds and Reynolds
Co. are technology companies that license widely used
DMSs to dealers. Between them, they control a substantial
majority of the DMS market. They have litigated this case
together, and their business practices do not vary in any way
that matters to the case, so for simplicity we will refer to
them collectively as CDK.

In the past, CDK allowed dealers to share access to the
DMS with third-party data-integration companies that would
extract a dealer’s data from the DMS and reformat it for use
in the dealer’s other software applications. But a few years
ago, CDK began to prohibit that practice. It justified the
change as necessary to protect its intellectual property rights
and ensure robust system performance and security. CDK
now offers its own data-integration services to dealers, albeit
at significantly higher prices than independent data
integrators do.

Some competing DMS providers continue to permit
dealers to grant DMS access to third parties. But switching
to a new DMS provider can be costly, and many dealers are
locked into long-term contracts with CDK.

In 2019, the Arizona Legislature unanimously enacted a
statute—which we will refer to as the “Dealer Law”—to
ensure that dealers retain control over their data. See Ariz.
 CDK GLOBAL V. BRNOVICH 7

Rev. Stat. Ann. §§ 28-4651 to -4655. Two of its provisions
are central to this appeal.

First, the Dealer Law prohibits DMS providers from
“tak[ing] any action by contract, technical means or
otherwise to prohibit or limit a dealer’s ability to protect,
store, copy, share or use” data the dealer has stored in its
DMS. Ariz. Rev. Stat. Ann. §§ 28-4651(7), 28-4653(A)(3).
More specifically, DMS providers may not impose charges
“beyond any direct costs incurred” for database access. See
id. §§ 28-4651(5), 28-4653(A)(3)(a). And as long as a
dealer-authorized third-party integrator complies with
industry security standards, DMS providers may not prohibit
the third party “from integrating into the dealer’s data
system,” nor may they otherwise “plac[e] an unreasonable
restriction on integration.” Id. §§ 28-4651(1), (9), 28-
4653(A)(3)(b).

Second, the Dealer Law requires DMS providers to
“[a]dopt and make available a standardized framework for
the exchange, integration and sharing of data” with
authorized integrators. Ariz. Rev. Stat. Ann. § 28-
4654(A)(1). The law specifies that this framework must
comply with industry security standards and that it should be
implemented using an “open application programming
interface[],” or “API,” unless an API is “not the reasonable
commercial or technical standard for secure data
integration,” in which case a DMS provider may instead
“provide a similar open access integration method.” Id. § 28-
4654(A)(2). APIs are commonly used tools in software
development that provide for standardized communications
between computer systems. They allow developers to access
information and other resources on a remote computer
without having to understand the internal operations of the
system with which they are interacting. See generally
8 CDK GLOBAL V. BRNOVICH

Google LLC v. Oracle Am., Inc., 141 S. Ct. 1183, 1191–93
(2021).

CDK sued the Attorney General of Arizona for
declaratory and injunctive relief, asserting a wide range of
claims. As relevant here, it argued that the Dealer Law is
preempted by the Copyright Act, 17 U.S.C. § 101 et seq.,
and the Computer Fraud and Abuse Act (CFAA), Pub. L.
No. 99-474, 100 Stat. 1213 (1986) (codified at 18 U.S.C.
§ 1030); that it violates the Contracts Clause and the Takings
Clause; and that it is void for vagueness. CDK moved for a
preliminary injunction.

The Arizona Automobile Dealers Association intervened
in defense of the law and, together with the Attorney
General, moved to dismiss the complaint. The district court
dismissed most of the claims but allowed the copyright
preemption, Contracts Clause, and Takings Clause claims to
proceed. Following a hearing, the district court denied a
preliminary injunction.

II

CDK appeals the denial of a preliminary injunction, and
the first issue we must resolve is the scope of its appeal.
Specifically, the parties disagree about whether we have
jurisdiction over CDK’s CFAA and vagueness claims,
which the district court dismissed before ruling on the
preliminary injunction and therefore did not address in its
order denying an injunction. Although 28 U.S.C.
§ 1292(a)(1) gives us jurisdiction to review an interlocutory
order denying injunctive relief, we generally lack
jurisdiction to review a non-final order dismissing claims
under Federal Rule of Civil Procedure 12(b)(6). Arc of
Cal. v. Douglas, 757 F.3d 975, 992 (9th Cir. 2014).
 CDK GLOBAL V. BRNOVICH 9

CDK invokes the doctrine of pendent appellate
jurisdiction, under which we may review an “otherwise non-
appealable ruling” in certain limited situations when it “is
inextricably intertwined with or necessary to ensure
meaningful review of the order properly before us on
interlocutory appeal.” Arc of Cal., 757 F.3d at 992–93
(quoting Melendres v. Arpaio, 695 F.3d 990, 996 (9th Cir.
2012)). This is not such a situation, however. The CFAA and
vagueness claims addressed in the district court’s dismissal
order are entirely separate from the claims addressed in the
preliminary-injunction order. Review of one order does not
require review of the other.

The separateness of the issues in the dismissal order and
the preliminary-injunction order is underscored by the
sequence of the filings in this case. After the district court
dismissed the CFAA and vagueness claims, but before it
ruled on the preliminary-injunction motion, CDK filed an
amended complaint omitting those claims. An amended
complaint “supersedes the original complaint,” so the
amended complaint was the operative pleading at the time
the district court ruled on the preliminary-injunction motion.
Pacific Bell Tel. Co. v. linkLine Commc’ns, Inc., 555 U.S.
438, 456 n.4 (2009). The district court could not possibly
have abused its discretion by denying an injunction on
claims that were not included in that complaint. See LA
Alliance for Hum. Rts. v. County of Los Angeles, No. 21-
55395, 2021 WL 4314791, at *7 (9th Cir. Sept. 23, 2021) (A
district court “does not have the authority to issue an
injunction based on claims not pled in the complaint.”
(internal quotation marks omitted)). It therefore would not
be appropriate for us to review those claims in reviewing the
denial of the injunction. We confine our review to the issues
addressed in the preliminary-injunction order.
10 CDK GLOBAL V. BRNOVICH

“A plaintiff seeking a preliminary injunction must
establish that he is likely to succeed on the merits, that he is
likely to suffer irreparable harm in the absence of
preliminary relief, that the balance of equities tips in his
favor, and that an injunction is in the public interest.”
Winter v. NRDC, Inc., 555 U.S. 7, 20 (2008). Because we
conclude that the first factor—likelihood of success on the
merits—is decisive, we need not address the other factors.
See Hall v. USDA, 984 F.3d 825, 835 (9th Cir. 2020). We
review the denial of a preliminary injunction for abuse of
discretion, but we review the district court’s underlying legal
conclusions de novo. Id.

III

CDK argues that the Dealer Law is preempted by the
Copyright Act because it “stands as an obstacle to the
accomplishment and execution of the full purposes and
objectives of Congress.” Puente Ariz. v. Arpaio, 821 F.3d
1098, 1103 (9th Cir. 2016) (quoting Arizona v. United
States, 567 U.S. 387, 399 (2012)). CDK faces a high bar:
“The mere fact that there is tension between federal and state
law is not enough to establish conflict preemption.”
MetroPCS Cal., LLC v. Picker, 970 F.3d 1106, 1118 (9th
Cir. 2020) (internal quotation marks and alteration omitted).
“In the absence of irreconcilability” between state and
federal law, “there is no conflict preemption.” United
States v. California, 921 F.3d 865, 882 (9th Cir. 2019).

Moreover, because CDK has brought a facial challenge
to the Dealer Law, it “must show that ‘no set of
circumstances exists under which [it] would be valid.’”
Puente Ariz., 821 F.3d at 1104 (quoting United States v.
Salerno, 481 U.S. 739, 745 (1987)); accord MetroPCS,
970 F.3d at 1122. In other words, it must establish that every
possible application of the Dealer Law would conflict with
 CDK GLOBAL V. BRNOVICH 11

the Copyright Act. See Puente Ariz., 821 F.3d at 1104.
Because CDK cannot carry that burden, the district court
correctly concluded that it is unlikely to succeed on its
Copyright Act preemption claim.

CDK contends that the Dealer Law conflicts with the
Copyright Act because it grants dealers and their authorized
integrators the right to access CDK’s systems and create
unlicensed copies of (1) its DMS, (2) its APIs, and (3) its
data compilations. In all three respects, it says, the statute
conflicts with 17 U.S.C. § 106(1), which grants the owner of
a copyrighted work the exclusive right “to reproduce the
copyrighted work in copies.”

As a preliminary matter, the defendants argue that CDK
forfeited these arguments by not raising them in the motion
for a preliminary injunction. But although CDK did not
advance the first two arguments until its reply in support of
the motion for a preliminary injunction, it raised all three
arguments at the hearing, and the district court ruled on all
three. “[W]hen a party takes a position and the district court
rules on it,” the argument is preserved. Yamada v. Nobel
Biocare Holding AG, 825 F.3d 536, 543 (9th Cir. 2016).

A

CDK first argues that the Dealer Law interferes with its
exclusive right to reproduce its copyrighted DMS. That is so,
it says, because every time a third party uses the “open
access integration method” prescribed by the Dealer Law to
integrate with its systems, that party causes a copy of CDK’s
DMS software to be created in the memory of CDK’s
servers.

States retain the power to regulate market practices even
when those practices relate to copyrighted material. See, e.g.,
12 CDK GLOBAL V. BRNOVICH

Watson v. Buck, 313 U.S. 387, 404 (1941); Associated Film
Distrib. Corp. v. Thornburgh, 800 F.2d 369, 375 (3d Cir.
1986); Allied Artists Picture Corp. v. Rhodes, 679 F.2d 656,
662–63 (6th Cir. 1982). Thus, the Copyright Act does not
preempt market regulations that merely “touch copyrighted
works indirectly.” Orson, Inc. v. Miramax Film Corp.,
189 F.3d 377, 385 (3d Cir. 1999) (en banc). For at least two
reasons, the Dealer Law touches CDK’s copyrighted works
only indirectly, if at all.

First, the district court found that third-party use of an
“open access integration method” would not necessarily
require a copy of the DMS to be created in memory on
CDK’s servers. To be sure, CDK presented a witness who
testified that “[e]ach time a party sends a request through an
API, that party would cause a copy of [the] DMS software
to be made in the memory of DMS servers in order to process
the request.” But for purposes of a facial challenge, the
current design of the system is irrelevant—CDK must show
that no set of circumstances exists under which the Dealer
Law could be valid. And the district court heard testimony
that whether a DMS provider would be required to create a
copy of its executable code in the memory of its own systems
to respond to third-party requests “[d]epends on the
implementation.” According to one expert witness, if a copy
of the code were already running on a provider’s system, the
provider would not necessarily need to create a new copy but
could instead reuse the existing copy. It therefore may be
possible for CDK to comply with the Dealer Law without
being forced to create a new copy of its software to process
third-party requests.

Second, even if CDK were forced to create new copies
of its DMS on its own server in response to third-party
requests, it has not established that those copies would
 CDK GLOBAL V. BRNOVICH 13

infringe its reproduction right. The copies that CDK finds
objectionable would be copies of its own software running
on its own servers and not shared with anyone else. Like
other property rights, the right granted by a copyright is the
right to exclude others. See 17 U.S.C. § 106. We are unaware
of any authority suggesting that causing a copyright holder
to make a copy of its own copyrighted work and keep it
within the copyright holder’s exclusive possession would
violate the Copyright Act. In addition, it is possible that
causing a DMS provider to copy its software on its own
server in these circumstances would constitute fair use. See
Assessment Techs. of WI, LLC v. WIREdata, Inc., 350 F.3d
640, 644–45 (7th Cir. 2003); Association of Am. Med. Colls.
v. Cuomo, 928 F.2d 519, 523 (2d Cir. 1991) (holding that
fair use is relevant to conflict preemption under the
Copyright Act).

But we need not resolve those issues because there is
another problem with CDK’s theory. The reproduction right
extends only to the creation of “copies,” which are defined
by the Copyright Act as “material objects, . . . in which a
work is fixed . . . and from which the work can be perceived,
reproduced, or otherwise communicated.” 17 U.S.C. § 101.
A work is “‘fixed’ in a tangible medium of expression when
its embodiment . . . is sufficiently permanent or stable to
permit it to be perceived, reproduced, or otherwise
communicated for a period of more than transitory
duration.” Id.; see Cartoon Network LP, LLLP v. CSC
Holdings, Inc., 536 F.3d 121, 127 (2d Cir. 2008) (explaining
that the statute “imposes two distinct but related
requirements: . . . the ‘embodiment requirement’” and “the
‘duration requirement’”).

Loading software into a computer’s memory satisfies the
embodiment requirement because a computer’s memory is a
14 CDK GLOBAL V. BRNOVICH

medium from which software “can be ‘perceived,
reproduced, or otherwise communicated.’” MAI Sys.
Corp. v. Peak Comput., Inc., 991 F.2d 511, 518–19 (9th Cir.
1993) (quoting 17 U.S.C. § 101). But embodiment alone
does not result in the creation of a copy; the embodiment
must also persist for a period of more than transitory
duration. We have not previously considered what is
required for a copy to persist for more than a transitory
period. In MAI, the duration requirement was not disputed,
but it seems likely to have been met because the copy at issue
remained fixed for a period long enough for a human
technician “to view the system error log and diagnose the
problem with the computer.” Id.; accord, e.g., Perfect 10,
Inc. v. Amazon.com, Inc., 508 F.3d 1146, 1160 (9th Cir.
2007) (thumbnail versions of copyrighted images were
stored long enough to repeatedly “communicate copies of
those thumbnails to [the defendant’s] users”); Triad Sys.
Corp. v. Southeastern Express Co., 64 F.3d 1330, 1333 (9th
Cir. 1995) (copy of operating system remained in memory
while computer was “in use” by a human technician). We
agree with the Second Circuit’s characterization of our
decisions: MAI and the cases following it establish only that
“loading a program into a computer’s [memory] can result
in copying that program,” not that “loading a program into a
form of [memory] always results in copying.” Cartoon
Network, 536 F.3d at 128; accord CoStar Grp., Inc. v.
LoopNet, Inc., 373 F.3d 544, 551 (4th Cir. 2004).

Of course, embodiments in a computer’s memory may
perform some useful function despite being transitory.
Cartoon Network, 536 F.3d at 130; CoStar, 373 F.3d at 551.
Here, for example, the embodiment would allow the DMS to
process the request of the dealer or authorized integrator
using it. But the Copyright Act does not provide copyright
owners the exclusive right to use their works. See 17 U.S.C.
 CDK GLOBAL V. BRNOVICH 15

§ 106. Such a right “can only be secured, if it can be secured
at all, by letters-patent.” Baker v. Selden, 101 U.S. 99, 105
(1879); accord Google LLC v. Oracle Am., Inc., 141 S. Ct.
1183, 1196 (2021) (“[U]nlike patents, which protect novel
and useful ideas, copyrights protect ‘expression’ but not the
‘ideas’ that lie behind it.”).

CDK has presented no evidence that the Dealer Law will
require the embodiments of its DMS to persist for a period
of more than transitory duration. Because this is a facial
challenge, it is CDK’s burden to show that every possible
application of the law would conflict with the Copyright Act.
CDK has not established a likelihood of success on the
merits of that claim.

B

CDK next argues that the Dealer Law conflicts with the
Copyright Act because it requires CDK to create APIs that
will be used by authorized integrators. Because an
authorized integrator must “copy” the API’s specified
command names in order to communicate with the DMS,
CDK argues that the Dealer Law vitiates its exclusive rights
in the API.

As an initial matter, we note that the Dealer Law does
not require a provider to use an API; a provider may instead
use “a similar open access integration method” if “the [APIs]
are not the reasonable commercial or technical standard for
secure data integration.” Ariz. Rev. Stat. Ann. § 28-
4654(A)(2). And if a provider chooses to use an API, it need
not develop its own organizational scheme or set of
commands. Instead, as the district court noted, it could
implement an industry-standard interface. In either case, the
provider would not have created any original expression, so
there would be no prospect of infringing any copyright.
16 CDK GLOBAL V. BRNOVICH

Even if a provider does create an API, it is not clear that
the API would be subject to copyright protection. See
Google, 141 S. Ct. at 1202. Nevertheless, because the
argument fails either way, we will assume, without deciding,
that at least some of the code defining a provider’s API
would be subject to copyright protection.

We base our analysis on the Supreme Court’s decision in
Google. In that case, Google was accused of infringing
Oracle’s copyright in Java SE, a computer platform that
allowed developers to use the widely employed Java
programming language to develop programs that could run
on any computer, regardless of the underlying hardware.
Google, 141 S. Ct. at 1190. The Court explained that the Java
API comprised “a vast library of prewritten code to carry out
complex tasks” that programmers confront in the course of
software development. Id. at 1191. Programmers could call
upon those prewritten building blocks to save time in writing
programs. Id. Google sought to create its own development
platform for smartphones, and in doing so, it copied some
code from Java’s APIs so that programmers who were
familiar with Java would be able to work with its new
platform. Id.

The Court divided the relevant code into three
categories: implementing code, method calls, and declaring
code. Google, 141 S. Ct. at 1191–92. Implementing code is
the prewritten code provided in the Java API that “tells the
computer how to execute the particular task you have asked
it to perform.” Id. at 1191. It makes up the vast majority of
the code in an API. See id. at 1204–05. Method calls are the
commands that individual programmers using the Java API
type into their own programs that “tell the computer which
of the implementing code programs it should choose” to run,
that is, “which task it should carry out.” Id. at 1191–92.
 CDK GLOBAL V. BRNOVICH 17

Finally, declaring code “provides both the name for each
task and the location of each task within the API’s overall
organizational system.” Id. at 1192. It is the part of the API
that recognizes the method calls written by a programmer
and links them with the corresponding implementing code to
carry out the task the programmer has requested. Id.

Because Google wrote all of its own implementing code,
that code was not in dispute. Google, 141 S. Ct. at 1201.
Similarly undisputed were the method calls: Oracle did not
argue that the mere use by programmers of method calls in
their own programs would violate any copyright. Id. Instead,
the case turned on whether Google’s reuse of the same
declaring code contained in the Java API constituted
copyright infringement. Id. Assuming that that code was
copyrightable, see id. at 1197, the Court held that because
“Google reimplemented a user interface, taking only what
was needed to allow users to put their accrued talents to work
in a new and transformative program, Google’s copying of
the . . . Java API was a fair use of that material as a matter of
law.” Id. at 1209.

CDK argues that the Dealer Law frees dealers’
authorized integrators to copy its API’s declaring code; in
CDK’s view, the integrators are therefore analogous to
Google. Setting aside that the Supreme Court ultimately
ruled in favor of Google on the basis of fair use, the analogy
is inapt. As the district court found, authorized integrators
need not copy any of the API’s declaring and implementing
code. They have no need to do so—unlike Google,
authorized integrators are not attempting to replicate DMS
providers’ APIs to create their own complementary
platforms. All an authorized integrator needs to write is an
API request, which is analogous to a method call. Thus,
authorized integrators are analogous not to Google, but to
18 CDK GLOBAL V. BRNOVICH

the individual programmers in Google who used the Java
API. As the Supreme Court noted, Oracle did not even
attempt to argue that the mere use of an API by programmers
writing method calls would infringe its copyrights—and for
good reason. Google, 141 S. Ct. at 1201. Programmers
writing method calls do not engage in verbatim copying of
API source code. CDK cannot show that the use of its API
would necessarily infringe any copyright it might hold.

C

Finally, CDK argues that the Dealer Law conflicts with
the Copyright Act because, it says, the law gives dealers and
authorized integrators the right to copy and distribute its
copyrighted data compilations. But although the Dealer Law
bars DMS providers from limiting access to “protected
dealer data,” Ariz. Rev. Stat. Ann. § 28-4653(A)(3), it
nowhere requires or permits the copying of any copyrighted
data compilations.

Significantly, providers do not hold a copyright in the
data itself, which consists of facts about dealers’ customers
and business operations. Ariz. Rev. Stat. Ann. § 28-4651(7).
Copyright protects expression, not facts. Feist Publ’ns, Inc.
v. Rural Tel. Serv. Co., 499 U.S. 340, 344–45 (1991);
Experian Info. Sols., Inc. v. Nationwide Mktg. Servs., Inc.,
893 F.3d 1176, 1181–86 (9th Cir. 2018). To be sure, an
arrangement of facts can enjoy copyright protection, but
only if the arrangement displays some creativity; an obvious
arrangement, such as using alphabetical order for a listing of
names in the phone book, does not qualify. Feist, 499 U.S.
at 362–64. And even if an arrangement is creative, so that it
is entitled to some measure of copyright protection, that
protection “is severely limited”—infringement requires
“‘unauthorized use of substantially the entire item,’” not
merely a part of it. Experian, 893 F.3d at 1186 (quoting
 CDK GLOBAL V. BRNOVICH 19

Harper House, Inc. v. Thomas Nelson, Inc., 889 F.2d 197,
205 (9th Cir. 1989)).

For that reason, dealers and authorized integrators would
not infringe a DMS provider’s copyright by making copies
of the raw data in DMS databases, or even by copying
subsets of that data arranged in particular ways by the
provider. To infringe a copyright, they would, at a minimum,
have to copy substantially all of a database that the provider
had structured in some creative way. CDK has not shown
that such an application of the Dealer Law is likely, let alone
inevitable, and in the context of a facial challenge, that
failure of proof is fatal to its preemption claim.

IV

We now turn to CDK’s constitutional claims, beginning
with its argument that the Dealer Law violates the Contracts
Clause. The Contracts Clause provides that “[n]o State shall
. . . pass any . . . Law impairing the Obligation of Contracts.”
U.S. Const. art. I, § 10, cl. 1. A state law violates the clause
if it (1) “operate[s] as a substantial impairment of a
contractual relationship,” and (2) is not “drawn in an
appropriate and reasonable way to advance a significant and
legitimate public purpose.” Sveen v. Melin, 138 S. Ct. 1815,
1821–22 (2018) (internal quotation marks and citations
omitted); see Apartment Ass’n of L.A. Cnty., Inc. v. City of
Los Angeles, 10 F.4th 905, 913 (9th Cir. 2021). CDK
advances three different theories of Contracts Clause
violations. We conclude that none is likely to succeed.

First, CDK argues that the Dealer Law impairs various
contracts that it has with third-party vendors. The district
court declined to address that claim because CDK did not
raise it in its complaint or in its motion for a preliminary
injunction but instead mentioned it for the first time at the
20 CDK GLOBAL V. BRNOVICH

preliminary-injunction hearing. CDK responds that it
attached the third-party contracts as exhibits to the
preliminary-injunction motion, but that is not enough to
preserve the claim. See Smith v. Marsh, 194 F.3d 1045, 1052
n.5 (9th Cir. 1999). We agree with the district court that the
claim was forfeited.

Second, CDK argues that the Dealer Law impairs its
ability to discharge its contractual duty to keep dealer data
confidential. To establish a substantial impairment of a
contractual relationship, a party must show, at a minimum,
that a law effects an “alteration of contractual obligations”—
in other words, that it alters the rights or duties created by a
contract. Allied Structural Steel Co. v. Spannaus, 438 U.S.
234, 245 (1978). Even under CDK’s view, the Dealer Law
does not do that. At most, it makes it more difficult for CDK
to perform its contracts, which continue to exist unmodified.
But legislation routinely affects a party’s cost of performing
contracts. Imagine an owner of a factory who has a long-
term contract to sell the goods it produces. If new
environmental regulations make it more expensive to
operate the factory, that does not raise an issue under the
Contracts Clause even though it might make it more difficult
for the owner to perform. As Justice Holmes put it, “[o]ne
whose rights, such as they are, are subject to state restriction,
cannot remove them from the power of the State by making
a contract about them.” Hudson Cnty. Water Co. v.
McCarter, 209 U.S. 349, 357 (1908). That principle controls
here.

In any event, CDK has not shown even that the statute
impairs its ability to perform its contracts. The statute allows
DMS providers to impose reasonable limitations on access
and to restrict access to third parties who comply with
industry security standards. Ariz. Rev. Stat. Ann. §§ 28-
 CDK GLOBAL V. BRNOVICH 21

4653(A)(3)(b), 28-4654(A)(1). Based on those provisions,
the district court found that CDK “could still fulfill [its] data-
security obligations while complying with the statute’s
mandate.” We see no clear error in that finding.

Third, CDK argues that the statute will impair its
agreements with dealers because those agreements specify
that dealers may not allow any third-party software to access
the DMS. Assuming, without deciding, that the Dealer Law
substantially impairs contractual third-party access
restrictions, it still does not violate the Contracts Clause
because it is reasonably drawn to serve an important public
purpose.

Where, as here, a State is not a party to a contract, “courts
properly defer to legislative judgment as to the necessity and
reasonableness of a particular measure.” Apartment Ass’n of
L.A., 10 F.4th at 913 (quoting Energy Rsrvs. Grp., Inc. v.
Kansas Power & Light Co., 459 U.S. 400, 413 (1983));
accord Seltzer v. Cochrane (In re Seltzer), 104 F.3d 234, 236
(9th Cir. 1996). CDK bears the burden of proving that the
Dealer Law “does not serve a valid public purpose” or that
it is not drawn in a reasonable and appropriate way. Seltzer,
104 F.3d at 236. CDK has not carried that burden.

Promoting consumer data privacy and competition
plainly qualify as legitimate public purposes. See Energy
Rsrvs., 459 U.S. at 411–12, 417. CDK points out that the
Arizona Legislature did not make findings specifying that
those were the purposes motivating the enactment of the
statute, but it was not required to do so. The purposes are
apparent on the face of the law. The Dealer Law contains
multiple provisions that further consumer data privacy. See,
e.g., Ariz. Rev. Stat. Ann. §§ 28-4653(A)(1), (D), 28-
4654(B), 28-4655(2). Others address potential
anticompetitive business practices. See, e.g., id. §§ 28-4652,
22 CDK GLOBAL V. BRNOVICH

28-4653(A)(3), (B), (E), 28-4654(A). That is sufficient to
show a public purpose.

CDK asserts that the law unfairly targets its business, but
its discussion of the legislative history of the statute falls far
short of establishing that the State’s “political process had
broken down.” Energy Rsrvs. Grp., 459 U.S. at 417 n.25.
And nothing in the statute itself supports CDK’s assertion.
The law applies to all DMS providers that store protected
dealer data, “regardless of whether they happen[] to be
parties to . . . contracts that contain[] a provision” affected
by the law. Exxon Corp. v. Eagerton, 462 U.S. 176, 191
(1983). The Contracts Clause does not disable a State from
enacting such “a generally applicable rule of conduct
designed to advance ‘a broad societal interest.’” Id. (quoting
Allied Structural Steel Co., 438 U.S. at 249). Although the
statute regulates the dealer data industry rather than some
broader segment of the economy, that does not make it
suspect. CDK’s own witnesses explained that DMSs store
highly sensitive data like social-security numbers and
consumer credit applications, and that DMS providers are
attractive targets for hackers, on a par with major financial
institutions. It is therefore unsurprising that the Arizona
Legislature would be particularly interested in regulating the
industry to safeguard Arizonans’ privacy. Likewise, the
State could reasonably determine that anticompetitive
practices were of particular concern in that industry and
decide to focus its efforts at reform there. Several other
States have enacted similar legislation, further undermining
the suggestion that the Arizona Legislature acted with an
improper purpose. See, e.g., Act of July 19, 2019, SL 2019-
125, 2019 N.C. Sess. Laws 569; Act of June 25, 2019,
ch. 500, 2019 Or. Laws 1508; Act of May 3, 2019, ch. 283,
2019 Mont. Laws 1004. Cf. Seltzer, 104 F.3d at 236.
 CDK GLOBAL V. BRNOVICH 23

The law advances its purposes in a reasonable way. The
record shows that contractual restrictions on third-party
access to DMSs have led many dealers to download their
data in plain text and email it in an unsecured format to their
application providers. By ensuring that third-party providers
have direct access to dealer data through a secure API, the
Dealer Law eliminates the incentive for dealers to resort to
unsecured email transfers. Ariz. Rev. Stat. Ann. § 28-
4653(A)(3). At the same time, as the district court explained,
the law advances its pro-competitive purpose by prohibiting
a provider “from monopolizing data that is not its own to its
great financial advantage.”

CDK objects that the law does not promote privacy
because, it says, requiring it to give access to integrators will
weaken data security. But the law requires DMS providers
to give access only to those authorized integrators that
comply with industry security standards. Ariz. Rev. Stat.
Ann. §§ 28-4653(A)(3)(b), 28-4654(A)(1). It also permits
DMS providers to place reasonable restrictions on such
access, id. § 28-4653(A)(3)(b), including restrictions to
ensure that third parties access only the data necessary to
“carry out the specified function” for which they were
granted access, id. § 28-4651(1). CDK may disagree with the
State’s policy choice, but that does not mean that the law
violates the Constitution.

V

Finally, CDK argues that the law takes property without
compensation, in violation of the Takings Clause. See U.S.
Const. amend. V; Chicago, B. & Q.R. Co. v. City of Chicago,
166 U.S. 226, 247 (1897) (applying the Takings Clause to
States through the Fourteenth Amendment). We disagree.
24 CDK GLOBAL V. BRNOVICH

The Supreme Court has recognized two kinds of claims
under the Takings Clause. When the government carries out
“a physical appropriation of property, a per se taking has
occurred.” Cedar Point Nursery v. Hassid, 141 S. Ct. 2063,
2072 (2021). But when the government “has instead
restricted a property owner’s ability to use his own
property,” id., a court must evaluate the action under the
three-factor test announced in Penn Central Transportation
Co. v. City of New York, 438 U.S. 104 (1978), to determine
whether it constitutes a “regulatory taking.”

CDK argues that the Dealer Law effects a per se physical
taking because, as CDK describes it, the law requires DMS
providers to allow authorized integrators “to enter, use, and
occupy” their DMSs. CDK relies on Loretto v. Teleprompter
Manhattan CATV Corp., 458 U.S. 419 (1982), which
involved a New York statute requiring the owner of a
building to allow cable television facilities to be installed
there, id. at 422–24. Although the invasion was “minor,” the
Court held that because it was a “permanent physical
occupation” of part of the building, it constituted a per se
taking. Id. at 421. But the analogy between Loretto and this
case is misplaced for two reasons.

First, the district court found that authorized integrators
merely exchange messages with DMS providers’ systems
and do not physically invade the systems at all. CDK objects
that indirect access to their systems via an API is still a form
of access, but for purposes of a per se takings analysis, the
lack of any physical invasion is dispositive. Regulations
commonly require regulated entities to disclose certain
information. This could be described as a requirement to
allow “access,” but no one conceives of such requirements
as physical takings. To be sure, there can be property
interests in information, and those interests are protected by
 CDK GLOBAL V. BRNOVICH 25

the Takings Clause. Ruckelshaus v. Monsanto Co., 467 U.S.
986, 1003–04 (1984). But CDK does not argue that such
property interests—trade secrets, for example—are subject
to a taking here.

Second, “[t]he government effects a physical taking only
where it requires the [property owner] to submit to the
physical occupation of his [property].” Yee v. City of
Escondido, 503 U.S. 519, 527 (1992). Although CDK
objects that the Dealer Law permits authorized integrators to
write data to a DMS on a dealer’s behalf, CDK voluntarily
licenses its DMS to dealers, and nothing in the Dealer Law
compels it to continue doing so. In particular, the law does
not limit DMS providers’ ability to terminate contracts with
dealers. See id. at 528 (explaining that landlords’ ability to
evict tenants “with 6 or 12 months notice” undermined any
notion of compulsion). It is no answer that CDK may not
wish to open its DMS to any particular authorized integrator.
Once property owners “voluntarily open their property to
occupation by others,” they “cannot assert a per se right to
compensation based on their inability to exclude particular
individuals.” Id. at 530; PruneYard Shopping Ctr. v. Robins,
447 U.S. 74, 82–84 (1980); Heart of Atlanta Motel, Inc. v.
United States, 379 U.S. 241, 261 (1964); see also Cedar
Point Nursery, 141 S. Ct. at 2076–77 (reaffirming
PruneYard).

That leaves the argument that the statute constitutes a
regulatory taking. Determining whether a regulatory taking
has occurred entails an “ad hoc, factual inquir[y]” into
(1) “[t]he economic impact of the regulation on the [property
owner],” (2) “the extent to which the regulation has
interfered with distinct investment-backed expectations,”
and (3) “the character of the governmental action.” Penn
Central, 438 U.S. at 124. We agree with the district court
26 CDK GLOBAL V. BRNOVICH

that CDK is unlikely to succeed on its regulatory takings
claim.

First, we discern no clear error in the district court’s
finding that the economic impact of the Dealer Law is
“minimal.” The district court noted that the cost of building
an API is “very small in comparison to building a DMS” and
that DMS providers are entitled to recoup their “direct costs
incurred . . . in providing dealer data access to an authorized
integrator.” Ariz. Rev. Stat. Ann. §§ 28-4651(5), 28-
4653(A)(3)(a); see City of Portland v. United States,
969 F.3d 1020, 1049 (9th Cir. 2020) (A regulation that
“allows for the recovery of actual costs . . . does not
constitute a regulatory taking.”).

Second, the Dealer Law does not impermissibly interfere
with distinct investment-backed expectations. As a general
matter, “in the case of personal property, by reason of the
State’s traditionally high degree of control over commercial
dealings, [a property owner] ought to be aware of the
possibility that new regulation might even render his
property economically worthless.” Lucas v. South Carolina
Coastal Council, 505 U.S. 1003, 1027–28 (1992); see Horne
v. Department of Agric., 576 U.S. 350, 361 (2015). And as
the district court found, there was never any “customary
practice of charging authorized third-party integrators
significant fees to access a dealer’s protected data.”

Third, the character of the law is more akin to an
“interference aris[ing] from some public program adjusting
the benefits and burdens of economic life to promote the
common good” than “a physical invasion by government.”
Penn Central, 438 U.S. at 124. CDK argues that the statute
does not serve public purposes, but that is not “an
independent means to challenge an alleged regulatory
taking.” Rancho de Calistoga v. City of Calistoga, 800 F.3d
 CDK GLOBAL V. BRNOVICH 27

1083, 1092 (9th Cir. 2015). In any event, the Dealer Law
applies to all DMS providers, not just CDK, see Ariz. Rev.
Stat. Ann. § 28-4651(4), and as we discussed in the context
of the Contracts Clause claim, we see no basis to question
the judgment of the Arizona Legislature that the statute
promotes the common good through the advancement of
consumer privacy and competition. See Penn Central,
438 U.S. at 134–35.

AFFIRMED.