Al-Ahmed v. Twitter, Inc.

Opinion

ALI AL-AHMED, Case No. 21-cv-08017-EMC

Plaintiff, ORDER GRANTING DEFENDANT v. TWITTER’S MOTION TO DISMISS

TWITTER, INC., et al., Docket No. 62 Defendants.

Plaintiff Al-Ahmed is a critic of the Kingdom of Saudi Arabia (“KSA”) who has been granted asylum in the United States. Between 2013 and 2015, two of Twitter’s (now former) employees accessed user information without authorization and provided it to KSA government officials. The employees were indicted in 2019. On October 13, 2021, Al-Ahmed sued the former employees and Twitter. Specifically, Al-Ahmed sued Twitter for violating the Electronics Communications Privacy Act (“EPCA”); the Computer Fraud and Abuse Act (“CFAA”); the Stored Communications Act (“SCA”); California’s Unfair Competition Law (“UCL”); breach of contract; intrusion upon seclusion; unjust enrichment; promissory estoppel; negligence; negligent hiring, supervision, and retention; civil conspiracy; and replevin. See Docket No. 1 (“original complaint”). In Al-Ahmed’s First Amended Complaint, he adds claims for breach of the duty of loyalty, aiding and abetting breach of fiduciary duty, an additional UCL claim, and interference with prospective economic advantage. See Docket No. 55 (“FAC”). Notably, Al-Ahmed does not add a claim under the Lanham Act, for which he was granted leave to amend after this Court led to the KSA targeting him and those around him. Furthermore, he alleges that Twitter’s suspension of his account in 2018 punishes him—the victim—and demonstrates that Twitter was complicit in their former employees’ conduct, or at least that Twitter ratified their conduct. The Court dismissed Al-Ahmed’s first complaint with leave to amend. See Al-Ahmed v. Twitter, Inc., No. 21-CV-08017-EMC, 2022 WL 1605673, at *5 (N.D. Cal. May 20, 2022). He filed an amended complaint. See FAC. Pending now is Twitter’s motion to dismiss Al-Ahmed’s FAC. See Docket No. 62 (“Mot.”). Twitter argues that (1) Al-Ahmed lacks Article III standing, (2) his claims are barred by the statute of limitations, (3) he does not plausibly plead that Twitter is vicariously liable for its rogue employees’ acts on behalf of the KSA, (4) the Community Decency Act (“CDA”) immunity bars many of his claims, (5) Twitter’s Terms of Service (“TOS”) bars many of his claims, and (6) individual actions fail for numerous claim-specific reasons. The Court only addresses Article III standing, the statute of limitations, and CDA immunity because each of Al-Ahmed’s claims fail for one of these three reasons. A. Factual Background Al-Ahmed alleges as follows in his FAC: Al-Ahmed is one of the leading critics of the KSA who resides and has been granted asylum in the United States. FAC ¶ 17. Between August 2013 and December 2015, Twitter employees accessed user data without authorization and provided the data to KSA government officials. Id. ¶¶ 22–23. Twitter failed to detect these breaches for more than a year. Id. ¶ 26. Al- Ahmed’s Arabic Twitter account, which has over 36,000 followers worldwide, was one of the accounts breached during this time. Id. ¶ 21. Al-Ahmed contends that Twitter’s conduct resulted in the compromising of his private information, including his “email addresses, contacts, phone numbers, birth dates, and internet protocol (“IP”) addresses;” and his “Tweets, private messages, direct message, online chats, friend requests, file transfers, file uploads, and file downloads.” Id. ¶¶ 24, 79. He also alleges confidential information provided by his followers and journalistic sources was compromised. Id. ¶ 4. Al-Ahmed alleges his private information was used by the attempting to kidnap and kill him on multiple occasions. Id. ¶ 18. Al-Ahmed alleges his followers on Twitter and those who otherwise contacted him using Twitter, have disappeared, been arrested, or have been executed. Id. ¶ 27. Examples of such third-party harms include the jailing of Saudi dissident Abdullah al-Hamid, whom the KSA jailed in 2013, and the murder of journalist Jamal Khashoggi in 2018, which Al-Ahmed alleges was not uncoincidental to the KSA’s espionage against Twitter. Id. ¶¶ 27, 57. According to the FAC, “the KSA managed to fully silence Al-Ahmed when [Twitter] . . . suspend[ed his] Arabic Twitter account, without explanation, warning, or justification. Id. ¶ 28. On November 19, 2019, the two Twitter employees allegedly responsible for hacking Al- Ahmed’s account were indicted for acting as agents of the KSA. Id. ¶ 7. Defendant Ahmad Abouammo (“Abouammo”) was the Media Partnerships Manager responsible for the Middle East and North Africa region at Twitter. Id. ¶ 5. Defendant Ali Hamad A. Alzabarah (“Alzabarah”) was a Site Reliability Engineer whose responsibility was maintaining Twitter’s hardware and software to ensure uninterrupted service. Id. ¶ 6. 1. Twitter’s Notice On or about December 11, 2015, Twitter sent the following notice to the users whose data was accessed by Abouammo and Alzabarah:

Dear @{{screen_name}}, As a precaution, we are alerting you that your Twitter account is one of a small group of accounts that may have been targeted by state-sponsored actors. We believe that these actors (possibly associated with a government) may have been trying to obtain information such as email addresses, IP addresses, and/or phone numbers. At this time, we have no evidence they obtained your account information, but we’re actively investigating this matter. We wish we had more we could share, but we don’t have any additional information we can provide at this time.

It’s possible your account may not have been an intended target of the suspected activity, but we wanted to alert you as soon as possible. We recognize that this may be of particular concern if you choose to Tweet using a pseudonym. For tips on protecting your identity online, you may want to visit the Tor Project or EFF’s Protecting Yourself on Social Networks. According to Al-Ahmed, this notice was insufficient to inform him of the scope and nature of the problem because it did not indicate that Abouammo and Alzabarah committed these data breaches at the direction of Twitter, and while located on Twitter’s premises, employed by Twitter, and using Twitter’s resources. Id. ¶ 46. Therefore, Al Ahmed alleges he did not, and could not have reason to know of Twitter’s involvement until the public indictment of the employees in 2019. Id. ¶ 47. Further, Al-Ahmed alleges for the first time in his FAC that he did not in fact receive the notice. Id. ¶ 48. 2. Twitter’s Alleged Actions in Aid of the KSA Al-Ahmed alleges that Twitter provided Abouammo and Alzabarah with access to Twitter’s resources with the full knowledge that they were improperly accessing user data, that Twitter helped them provide the information to the KSA, and Twitter helped them cover their tracks by purging its internal database of incriminating evidence. Id. ¶ 25. Al-Ahmed also alleges that Twitter’s Privacy Policy suggests that a user can adjust their account settings so their Tweets can only be viewed by the user’s Twitter followers. Id. ¶¶ 31–32. This created an illusion of security and safety relied upon by Al-Ahmed and others. Id. Al- Ahmed alleges that Twitter failed to safeguard user data, evidenced by its disclosure to the Securities and Exchange Commission in 2020 that it received a draft complaint from the Federal Trade Commission alleging “violations…[r]elate[d] to the Company’s use of phone number and/or email address data provided for safety and security purposes [ostensibly for targeted advertising] during periods between 2013 and 2019.” Id. ¶ 38. Thus, he argues Twitter negligently failed to implement policies, practices, and safeguards that would have prevented the acts of its former employees. Id. 3. Twitter’s Relationship with the KSA In 2011, Saudi Prince Alwaleed Bin Talal purchased $300 million worth of stock in Twitter. Id. ¶ 3. In 2015, Bin Talal made an additional investment, and now owns 5.2% of the company, more than Twitter’s founder and former CEO, Jack Dorsey (“Dorsey”). Id. Bin Talal later signed over many of his assets to Crown Prince of Saudi Arabia Mohammed Bin Salman. Id. mastermind” behind the Twitter spy scandal. Id. ¶ 39. He claims that Asaker is “Foreign Official- 1” in the United States Attorneys Offices’ indictment against Abouammo and Alzabarah. Id. ¶ 41. Al-Ahmed alleges that Asaker provided Abouammo and Alzabarah with “gifts, cash payments, and promises of future employment in exchange for nonpublic information about Twitter uses, which constituted valuable property...” Id. Furthermore, Dorsey met with both Asaker and Bin Salman at Twitter’s headquarters on June 25, 2016, and at least one additional time in Riyadh thereafter. Id. ¶ 43. Dorsey and Asaker follow each other on Twitter. Id. ¶ 44. 4. Twitter’s Suspension of Al-Ahmed’s Account In 2018, Al-Ahmed’s Twitter account was suspended, preventing him from accessing his followers. Id. ¶¶ 28, 30. The basis of his suspension was an allegedly abusive direct message (“DM”) Al-Ahmed sent using his Arabic language Twitter account. Id. ¶ 50. Al-Ahmed alleges that as a result, he lost significant revenue and earning potential related to his work as a journalist, as much of his work was contingent on his online presence. Id. ¶ 59. Al-Ahmed further alleges that his appeal of the suspension failed despite Alzabarah and Abouammo’s indictment. Id. ¶ 29. According to Al-Ahmed, preventing access to his account, punishes the victim and “ratifie[s] the actions of its supposedly errant employees and show[s] [Twitter’s] continuing allegiance to the KSA.” Id. Al-Ahmed also alleges that his suspension is the result of Twitter and the KSA’s campaign against him. Id. ¶ 50. He asserts “agents of the KSA or other Twitter employees accessed his “private Twitter accounts to read and manipulate content, including, but not limited to, purported private/direct exchange messages that were then used as a pretext by Twitter” to suspend his Arabic-language account. Id. Al-Ahmed claims he does not recognize the statement attributed to him, the message was a “fabrication,” and is an incorrect translation. Id. ¶¶ 50–51. The English translation of the message provided by Twitter reads, “Damn your mother, you Ahmari, you mountain monkey, you Ethiopian, you slave, you pagan, you cow, you beast of burden! … I see your face and your teeth sticking out. Damn your father and Khomeini, you slave, you beast of burden, you animal!” Id. ¶ 50; see Docket No. 31, Ex. 5. According to Al-Ahmed, “Twitter’s slang term in Arabic. Likewise, ‘I see your face’ is not accurate—it actually says, ‘look at yourself’; also, ‘your teeth sticking out’ is entirely inaccurate.” FAC ¶ 51. Lastly, Al-Ahmed alleges Twitter’s choice to suspend him from his Arabic-language account, not his English- language account, proves that “Twitter’s true intent” was to “censor Plaintiff on behalf of Twitter’s Saudi Arabian investors.” Id. ¶ 53. B. Procedural Background Twitter previously filed a request for judicial notice (“RJN”) and incorporation, as well as a motion to dismiss Al-Ahmed’s original complaint. See Docket No. 30 (“Twitter’s First Motion to Dismiss”); Docket No. 31 (“RJN”). 1. Request for Judicial Notice and Incorporation This Court granted Twitter’s RJN, taking notice and incorporating by reference the following:

(a) Twitter’s December 11, 2015 email and in-app notices. Docket No. 29-5 (“Srinivasan Declaration”), Ex. A (“Twitter Employee Declaration”), Ex. 1–2.

(b) Twitter’s records reflecting that the December 11, 2015 email notice and in-app notice were sent to Al-Ahmed. Twitter Employee Declaration, Ex. 3–4.

(c) A screenshot of Al-Ahmed’s active Twitter account. Srinivasan Declaration, Ex. B. (d) A publicly available Twitter post made by Ali Al-Ahmed that lists his phone number. Srinivasan Declaration, Ex. C.

(e) A publicly available press release listing Al-Ahmed’s phone number and e-mail address. Srinivasan Declaration, Ex. D. (f) Twitter’s current and prior terms of service. Srinivasan Declaration, Ex. E; Twitter Employee Declaration, Ex. 6A–6N. See Al-Ahmed, 2022 WL 1605673, at *5. Twitter also asked this Court to incorporate by reference the allegedly abusive Twitter message for which Al-Ahmed was suspended and a certified English translation of that message. See id.; Twitter Employee Declaration, Ex. 5. This Court DENIED Twitter’s motion because Al- Ahmed’s original complaint made “no reference to the message and Al-Ahmed’s claims were not 2. Motion to Dismiss This Court GRANTED Twitter’s motion to dismiss Al-Ahmed’s original complaint on the following grounds: (1) Al-Ahmed lacked Article III standing—excepting his claims based on invasion of privacy—because he failed to establish a causal nexus between Twitter’s actions and his injuries, and any such injury was not particularized to Al-Ahmed; (2) all of Al-Ahmed’s claims against Twitter related to the unauthorized intrusion of his Twitter account were barred by the statute of limitations; (3) Twitter’s CDA immunity extended to all of Al-Ahmed’s suspension- based claims; and (4) Al-Ahmed failed to articulate why Twitter’s failure to provide a justification for the suspension of his account constitutes a breach of contract. See Al-Ahmed, 2022 WL 1605673, at *7-8, 14 & 20. This Court GRANTED Al-Ahmed leave to amend the Complaint to allege a Lanham Act claim that falls within the scope of the CDA’s intellectual property exception. Id. at 20. As noted, Al-Ahmed has failed to add a claim under the Lanham Act in his FAC. Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A complaint that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). See Fed. R. Civ. P. 12(b)(6). To overcome a Fed. R. Civ. P. 12(b)(6) motion to dismiss after the Supreme Court’s decisions in Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corporation v. Twombly, 550 U.S. 544 (2007), a plaintiff’s “factual allegations [in the complaint] ‘must . . . suggest that the claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014). The court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). But “allegations in a complaint . . . may not simply recite the elements of a cause of action [and] must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap factual content that allows the court to draw the reasonable inference that the Defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556). A. Article III Standing Under Rule 12(b)(1), a party may move to dismiss for lack of subject matter jurisdiction. “[L]ack of Article III standing requires dismissal for lack of subject matter jurisdiction under [Rule] 12(b)(1).” Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). The “irreducible constitutional minimum” of standing requires that a “plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 136 S. Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). These three elements are referred to as, respectively, injury in fact, causation, and redressability. Planned Parenthood of Greater Was. & N. Idaho v. U.S. Dep’t of Health & Human Servs., 946 F.3d 1100, 1108 (9th Cir. 2020). The alleged injury in fact must be “concrete, particularized, and actual or imminent.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). “For an injury to be ‘particularized,’ it must affect the plaintiff in a personal and individual way” and “[o]nly those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court.” Spokeo, 136 S. Ct. at 1548 (internal quotation marks omitted); Ramirez, 141 S. Ct. at 2205. “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements[.]” Spokeo, 136 S. Ct. at 1547 (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). Al-Ahmed’s claims arise from two separate events: (1) the former Twitter employees’ unauthorized access into Twitter accounts at the behest of the KSA between 2013 and 2015, and (2) the May 2018 suspension of Al-Ahmed’s Arabic Twitter account. Mot. at 6. Twitter argues that Al-Ahmed lacks Article III standing relating to the KSA’s espionage, and therefore all claims against Twitter (except Replevin) must be dismissed. Id. Twitter’s first motion to dismiss: (1) an injury exists solely by virtue of statutes creating legal rights; (2) Twitter’s invasion of his privacy is a harm in itself; and (3) he has nevertheless alleged a concrete and particularized injury apart from the invasion to his privacy. See Docket No. 63 at 3–5 (“Opp’n”) (citing Havens Realty Corp. v. Coleman, 455 U.S. 363, 373 (1982) (internal quotations omitted)). 1. First and Third Arguments The first argument fails because it was explicitly rejected by the Supreme Court in 2016. Spokeo II, 136 S. Ct. at 1543 (“Article III standing requires a concrete injury even in the context of a statutory violation.”). The third argument fails because Al-Ahmed does not identify a concrete and personal injury separate from the invasion of privacy itself. While Al-Ahmed has amended his complaint to include the allegation that “as a freelance journalist and author this has cost me hundreds of thousands of dollars in lost revenue from writing articles and books and through podcasts,” FAC ¶ 60, this fails to establish standing because it lacks any causal connection to the alleged KSA-sponsored espionage claims. Instead, it was Twitter’s suspension of his account in 2018 that prevented him “from accessing the tens or thousands of KSA and other Arab-language followers and sources [that] curtailed [his] ability to report credibly and in real time on events unfolding in the KSA [and cost him his revenue.]” Id.; see also id. ¶¶ 58–61. “The hacking of his account is distinct from the termination of his account.” Al-Ahmed, 2022 WL 1605673, at *7. 2. Invasion of Privacy The remaining question is whether an invasion of privacy is sufficiently concrete and particularized to confer Article III standing. In its previous order on Twitter’s motion to dismiss, this Court said it did. Al-Ahmed, 2022 WL 1605673, at *8. Al-Ahmed alleges Twitter invaded his privacy by intercepting his “personal information regarding…email addresses, contacts, phone numbers, birth dates, and internet protocol (“IP”) addresses;” and his “Tweets, private messages, direct message, online chats, friend requests, file transfers, file uploads, and file downloads.” FAC ¶¶ 24, 79. The Supreme Court suggested such an invasion of privacy is within the scope of Article III standing in Ramirez: “Various intangible harms can also be concrete. Chief among for lawsuits in American courts. Those include, for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” Ramirez, 141 S. Ct. at 2204. In the years between Spokeo and Ramirez, the Ninth Circuit has consistently found Article III standing in privacy-related claims. See Campbell v. Facebook, Inc., 951 F.3d 1106 (9th Cir. 2020). Therefore, an invasion of privacy as a harm, particularly as analogous to that recognized in common law, is sufficient. See, e.g., Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017) (“Privacy torts do not always require additional consequences to be actionable . . . the ‘intrusion itself’ makes the defendant liable.” (citing Restatement (Second) of Torts § 652B cmt. b. (Am. Law Inst. 1977)); In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 599 (9th Cir. 2020) (“Plaintiffs have sufficiently alleged a clear invasion of the historically recognized right to privacy. Therefore, Plaintiffs have standing to pursue their privacy claims under the Wiretap Act, SCA, and CIPA[.]”). Still, Twitter argues that even if invasion of privacy is a sufficient injury in some cases, it is not sufficient here for two reasons. First, Twitter claims Al-Ahmed’s invasion of privacy allegation is insufficient because the “information he alleges was exposed was already public.” Mot. at 8 (“[plaintiff] cannot assert any privacy claim as to information that she has already released to the public” (citing Wasson v. Sonoma Cnty. Jr. Coll. Dist., 4 F. Supp. 2d 893, 908 (N.D. Cal. 1997)). Second, Twitter argues that Al-Ahmed has not “pled sufficient facts to establish a concrete injury.” Id. (citing Shelton v. Hal Hays Constr., Inc., No. EDCV16360VAPKKX, 2016 WL 8904414, at *5 (C.D. Cal. July 29, 2016)). The private information Al-Ahmed alleges Twitter publicly exposed are his “personal information regarding…email addresses, contacts, phone numbers, birth dates, and internet protocol (“IP”) addresses;” and his “Tweets, private messages, direct message, online chats, friend requests, file transfers, file uploads, and file downloads.” FAC ¶¶ 24, 79. Twitter notes that Al-Ahmed’s “Twitter followers or contacts were publicly available on his Twitter profile[,]…his e-mail addresses and phone number have been publicly available on the Internet since as early as January 2014[,]…and it is [] implausible that the KSA did not already have his birthdate.” Mot. at 8. 80237 CRB (NC), 2013 WL 4536808, at *10 (N.D. Cal. Aug. 22, 2013). While it is debatable whether some of the information at issue is sufficiently “private,” the Supreme Court was clear in Ramirez that the common-law analogue of a plaintiff’s asserted injury need not be an exact duplicate. See Leonard v. McMenamins, Inc., No. 2:22-CV-00094-BJR, 2022 WL 4017674 (W.D. Wash. Sept. 2, 2022) (citing Bohnak v. Marsh & McLennan Cos., Inc., 580 F. Supp. 3d 21, 30 (S.D.N.Y. 2022) (“[I]n light of the TransUnion Court’s admonition that common-law analogs need not provide ‘an exact duplicate,’ as well as its explicit reference to [public disclosure of private information] as an example of traditionally judicially cognizable intangible harm, I find the fit sufficiently close.”). Thus, Al-Ahmed’s injury should not be negated simply because the privacy of his information is still in debate. More importantly, Twitter fails to explain how Al-Ahmed’s private messages, direct message, online chats, friend requests, file transfers, file uploads, and file downloads are not sufficiently private to confer standing. As construed in Al-Ahmed’s favor, the FAC sufficiently alleges private information not publicly available was hacked. As to Twitter’s claim that Al-Ahmed has not pled facts sufficient to establish an injury, the Court disagrees. The paragraphs in Al-Ahmed’s complaint which outline the information at issue may be sparse when viewed in isolation, but when viewed in the context of the entire complaint they plausibly allege invasion of privacy. Two Twitter employees targeted Al-Ahmed’s Twitter data while engaged in espionage for the KSA. See FAC. The FAC suggests that at the very least, Twitter, and Twitter employees (including Abouammo and Alzabarah), could access Al-Ahmed’s private messages and direct messages and provide them to the KSA, thereby putting Al-Ahmed personally at risk. See, e.g., id. ¶¶ 50, 62. Therefore, the Court maintains that “Al-Ahmed’s injury is sufficiently concrete and particularized.” Al-Ahmed, 2022 WL 1605673, at *8. Next, Twitter again argues that Al-Ahmed fails to establish that his alleged injury is “fairly traceable to Twitter.” Opp’n at 9. As before, to the extent that Al-Ahmed alleges that these breaches of privacy caused other harms such as the disappearance, arrest, or execution of his followers, his claims fail because he Twitter, Inc., No. 19-CV-06694-LB, 2020 WL 6947929, at *6 (N.D. Cal. Aug. 12, 2020). Any harm to Al-Ahmed, if alleged to be a result of the harm or disappearance of his followers, cannot be established due to lack of causation, and alleging harm to “several” Twitter users who either followed him on Twitter or have messaged him, out of the 36,000 followers that he had, is insufficient. Also, the specific examples Al-Ahmed provides remain unavailing. First, Al-Ahmed points to a follower of his Twitter account who was also a Saudi dissident and journalist. FAC ¶ 27. The article cited by Al-Ahmed describes him as “one of the kingdom’s most prominent and persistent dissidents” who had “frequent prison terms.” Id. ¶¶ 27–28, n.8. Next, Al-Ahmed comments that the journalist Jamal Khashoggi was “not uncoincidentally slain following” the hack of Al-Ahmed’s Twitter. Id. ¶ 57. Al-Ahmed’s belief is based on the KSA accessing “messages between Plaintiff and individuals still living in, and in close proximity to, Saudi Arabia who were in close contact with Jamal Khashoggi.” Id. However, these claims are conclusory and based on mere speculation. See Twombly, 550 U.S. at 570. As such, Al-Ahmed fails to plead any facts that suggest the breach of privacy led to either individual’s imprisonment or death. On the other hand, even if consequential harm is not sufficiently pled, the alleged harm to Al-Ahmed based on the unauthorized access of his Twitter account is traceable to Twitter because Abouammo and Alzabarah were Twitter employees and obtained unauthorized access as a result of Twitter’s failings. Opp’n at 5–6. Twitter counters that the privacy injury is not traceable to Twitter based on vicarious liability because a plaintiff must demonstrate standing for each claim he seeks…and for each form of relief that is sought,” and Al-Ahmed cannot, and has not, “asserted a vicarious liability claim for each cause of action he pleads.” Mot. at 9 (citing Davis v. Fed. Election Comm’n, 554 U.S. 724, 734 (2008)). Specifically, Twitter claims Al-Ahmed “(1) fails to sufficiently plead that Twitter is vicariously liable for Abouammo and Alzabarah’s conduct; and (2) even assuming arguendo that vicarious liability is adequately pled for certain claims, standing is not dispensed in gross, and vicarious liability is inapplicable to several of his causes of action.” See Docket No. 64 at 3 (“Reply”). However, Twitter conflates Article III standing with the merits arguments. Al-Ahmed has Whether Al-Ahmed may prevail on the merits on his vicarious liability claims as a matter of substantive law is a question separate from whether Al-Ahmed demonstrated traceability for standing purposes. As alleged, Abouammo and Alzabarah’s conduct is “fairly traceable” to Twitter. B. Statute of Limitations 1. Delayed Discovery Rule Twitter argues that Al-Ahmed’s claims accrued when he received the 2015 notices alerting him that his account information had been exposed. Mot. at 10–12; see also Twitter Employee Declaration, Ex. 3–4. Since Al-Ahmed’s original complaint was filed on October 13, 2021, more than 5 years have passed since the notice of the unauthorized intrusion of his Twitter account, and more than 3 years have passed since the suspension of his account. Therefore, Twitter contends that all Al-Ahmed’s claims, except his breach of contract and civil conspiracy claims (to the extent they are premised on his account suspension) are time-barred. Mot. at 10–12.1 Al-Ahmed argues that his claims did not accrue until the Abouammo and Alzabarah’s indictment in November 2019 and thus the statute did not start to run until then. He posits two reasons. First, he argues the notice was insufficient because it did not include the fact that these

1 The ECPA, CFAA, SCA, promissory estoppel, intrusion upon seclusion, negligent hiring, and negligence claims each have two-year statutes of limitations. 18 U.S.C. § 2520(e) (two years for ECPA claims); 18 U.S.C. § 1030(g) (two years for CFAA claims); 18 U.S.C. § 2707(f) (two years for SCA claims); Calhoun v. Google LLC, 526 F. Supp. 3d 605, 624 (N.D. Cal. 2021) (two years limitation period for intrusion upon seclusion claims under Cal. Civ. Proc. Code § 335.1); So v. Shin, 212 Cal. App. 4th 652, 662 (2013) (two years for negligence claims under Cal. Civ. Proc. Code § 335.1); McGowan v. Weinstein, 505 F. Supp. 3d 1000, 1025 (C.D. Cal. 2020) (two years for negligent hiring claims under Cal. Civ. Proc. Code § 335.1). UCL and breach of contract claims have four-year statutes of limitations. Cal. Code of Civ. Proc. § 337(a) (four years for claims on written contracts); Cal. Bus. & Prof. Code § 17208 (four years for UCL claims). The statutes of limitations for unjust enrichment, promissory estoppel, and civil conspiracy are based on the underlying wrong. Duke Gerstel Shearer, LLP v. Pursiano, No. D060374, 2012 WL 4712102, at *5 (Cal. Ct. App. Oct. 4, 2012); Newport Harbor Ventures, LLC v. Morris Cerullo World Evangelism, 6 Cal. App. 5th 1207, 1224, n.5 (2016), aff’d, 4 Cal. 5th 637 (2018); Maheu v. CBS, Inc., 201 Cal. App. 3d 662, 673 (Ct. App. 1988). If founded on a quasi-contract theory, the claim is two years. Cal. Civ. Proc. Code § 339(1). If founded on conversion, fraud, or mistake, it is three years. Cal. Civ. Code § 338(d); Maheu, 201 Cal. App. 3d at 673. If founded on a written contract, it is 4 years under Cal. Civ. Proc. Code § 337). Replevin has a three-year statute of limitations. Cal. Code of Civ. Proc. § 338. Interference with prospective economic advantage “state-sponsored actors” were located on Twitter’s premises, employed by Twitter, used Twitter’s resources, and acted at the direction or tacit permission of Twitter. Id. at 9. Thus, Al-Ahmed claims he had no reason to know or believe that Twitter was complicit in, or, at the very least, negligent in its hiring, training, supervision and retention of Alzabarah and Abouammo, until their public indictment on November 19, 2019. Id. Second, Al-Ahmed argues that he never received an email or in-app notice from Twitter in December 2015, though he does not dispute the notice was sent. See Opp’n at 8. Thus, he could not discover, and had no reason to discover, any cause of action. Id. Pursuant to the “delayed discovery rule,” the accrual of a cause of action is postponed until the “plaintiff discovers, or has reason to discover, the cause of action.” Fox v. Ethicon Endo- Surgery, Inc., 35 Cal.4th 797, 807 (2005). For the discovery rule to apply, the plaintiff “must specifically plead facts to show (1) the time and manner of discovery and (2) the inability to have made earlier discovery despite reasonable diligence.” Id. at 808 (internal quotation marks omitted); see McGowan v. Weinstein, 505 F. Supp. 3d 1000, 1018–19 (C.D. Cal. 2020). A plaintiff is “charged with presumptive knowledge of an injury if they have information of circumstances to put [them] on inquiry or if they have the opportunity to obtain knowledge from sources open to [their] supervision.” Fox, 35 Cal.4th at 807–08 (internal quotation marks omitted). “Thus, in assessing the sufficiency of the allegations of delayed discovery, the court places the burden on the plaintiff to ‘show diligence’; ‘conclusory allegations will not withstand demurrer.’” Id. “Formal averments or general conclusions to the effect that the facts were not discovered until a stated date, and that plaintiff could not reasonably have made an earlier discovery, are useless.” Chione v. Medtronic, Inc., No. 14-CV-01043-BAS RBB, 2015 WL 2151889, at *4 (S.D. Cal. May 7, 2015) (quoting Anderson v. Brouwer, 99 Cal. App. 3d 176, 182 (1979)). As the Court explained in its first order granting dismissal, Al-Ahmed’s argument that Twitter’s notice was insufficient because it did not identify the “state-sponsored” actors as Twitter employees is unconvincing. In Fox, the Supreme Court of California explained that “failure to Cal.4th at 807. The Ninth Circuit has stated the same. Kyko Glob. Inc. v. Bhongir, No. 20-17526, 2021 WL 4958989 (9th Cir. Oct. 26, 2021) (“[The plaintiff] knew about its injury in 2013 when it discovered the fraudulent accounts. It did not need to know the exact legal claim it could bring against a specific defendant. Rather, it was enough that it had knowledge of the injury that gave rise to the claim. Any liability it now claims against [the defendant] is derived from that injury in 2013.”). Thus, “Al-Ahmed’s ignorance of the identity of the perpetrators (being Twitter employees) does not affect the statute of limitations…” Al-Ahmed, 2022 WL 1605673, at *11. The fact remains that by virtue of the 2015 notices, if received, he would have been made aware that he was injured as a result of unlawful hacking. While this Court previously discounted Al-Ahmed’s second argument that he did not receive the 2015 notices because his complaint failed to expressly allege that he did not receive Twitter’s notice, Al-Ahmed has cured this deficiency in his FAC by including an express allegation. FAC ¶¶ 48, 70. Nonetheless, as the Court previously found when it incorporated by reference Twitter Employee Declaration, Exs. 3–4, Twitter sent the notice. Al-Ahmed, 2022 WL 1605673, at *4. Exhibit 3 is a copy of a .txt file containing a list of User ID Numbers of users who were sent the notice by email. See Twitter Employee Declaration, Ex. 3. Exhibit 4 is a copy of a list of User ID Numbers of users who were sent the notice by in-app notification. See id. Ex. 4. Both exhibits include Al-Ahmed’s User ID Number, and both were created in December 2015 and have been maintained since. See id. Ex. A. The FAC does not dispute that the notice was sent to Al-Ahmed; it alleges Al-Ahmed did not receive it. Al-Ahmed is therefore “charged with presumptive knowledge of [his] injury” because given the undisputed evidence that Twitter’s notice was sent, Al-Ahmed had “the opportunity to obtain knowledge from [a] source[] open to [his] supervision.” Fox, 35 Cal.4th at 807–08. Thus, “in assessing the sufficiency of [Al- Ahmed’s] allegations of delayed discovery, the court places the burden on [Al-Ahmed] to ‘show diligence’; ‘conclusory allegations will not withstand demurrer.’” Id. In this regard, the FAC twice mentions that Al-Ahmed did not receive Twitter’s notice. First, the FAC provides:

Even had Mr. Al-Ahmed received this intentionally deceptive indirectly a beneficial owner of Twitter; and that this government, which is known for treating its critics with extreme prejudice, had unmasked pseudonyms and was the “suspected” culprit—a material omissions and lie of omission, which is no notice at all. It is a fictive to suggest otherwise. FAC ¶ 48. Second, the FAC provides:

Twitter, quick to warn its employee decided to not issue a press release nor notify the popular press, as it would do with other data breaches, and not Tweet about this incident. It waited at least nine days before sending any notice (which Plaintiff did not even receive). Id. ¶ 70. But these allegations fail to show due diligence sufficient to rebut presumptive knowledge. See Fox, 35 Cal.4th at 807–08. Therefore, Al-Ahmed cannot rely on the delayed discovery rule. Accordingly, all claims based on the unauthorized access of Al-Ahmed’s account are barred under the statute of limitations. This includes the following: ECPA (count 1); CFAA (count 2); SCA (count 3); promissory estoppel (count 8); intrusion upon seclusion (count 9); negligent hiring, supervision, and retention (count 10); negligence (count 12); UCL (counts 4 & 18); breach of contract (count 7); unjust enrichment (count 5); civil conspiracy (count 11); replevin (count 13); and interference with potential economic advantage (count 19).2

2 The ECPA, CFAA, SCA, promissory estoppel, intrusion upon seclusion, negligent hiring, and negligence claims each have two-year statutes of limitations. 18 U.S.C. § 2520(e) (two years for ECPA claims); 18 U.S.C. § 1030(g) (two years for CFAA claims); 18 U.S.C. § 2707(f) (two years for SCA claims); Calhoun v. Google LLC, 526 F. Supp. 3d 605, 624 (N.D. Cal. 2021) (two years limitation period for intrusion upon seclusion claims under Cal. Civ. Proc. Code § 335.1); So v. Shin, 212 Cal. App. 4th 652, 662 (2013) (two years for negligence claims under Cal. Civ. Proc. Code § 335.1); McGowan v. Weinstein, 505 F. Supp. 3d 1000, 1025 (C.D. Cal. 2020) (two years for negligent hiring claims under Cal. Civ. Proc. Code § 335.1). UCL and breach of contract claims have four-year statutes of limitations. Cal. Code of Civ. Proc. § 337(a) (four years for claims on written contracts); Cal. Bus. & Prof. Code § 17208 (four years for UCL claims). The statutes of limitations for unjust enrichment, promissory estoppel, and civil conspiracy are based on the underlying wrong. Duke Gerstel Shearer, LLP v. Pursiano, No. D060374, 2012 WL 4712102, at *5 (Cal. Ct. App. Oct. 4, 2012); Newport Harbor Ventures, LLC v. Morris Cerullo World Evangelism, 6 Cal. App. 5th 1207, 1224, n.5 (2016), aff’d, 4 Cal. 5th 637 (2018); Maheu v. CBS, Inc., 201 Cal. App. 3d 662, 673 (Ct. App. 1988). If founded on a quasi-contract theory, the claim is two years. Cal. Civ. Proc. Code § 339(1). If founded on conversion, fraud, or mistake, it is three years. Cal. Civ. Code § 338(d); Maheu, 201 Cal. App. 3d at 673. If founded on a written contract, it is 4 years under Cal. Civ. Proc. Code § 337). Replevin has a three-year statute of limitations. Cal. Code of Civ. Proc. § 338. Interference with prospective economic advantage Breach of fiduciary duty claims, which include breach of loyalty and aiding and abetting breach of fiduciary duty claims, have at most a four-year statute of limitations. Cal. Code of Civ. Proc. § 343. However, the “applicable statute of limitations is determined by…the nature of the right sued upon, the primary interest affected by the defendant’s wrongful conduct, or the gravamen of the action.” Hydro-Mill Co. v. Hayward, Tilton & Rolapp Ins. Assocs., Inc., 115 Cal. App. 4th 1145, 1158–59 (2004). Twitter argues “Al-Ahmed’s fiduciary duty claims amount to interference with prospective economic advantage claims, which carry a two-year statute of limitations.” Mot. at 10, n.9 (citing FAC ¶¶ 203–07, 214–15, 225–26 & 229). The Court agrees that the gravamen of Al-Ahmed’s breach of duty of loyalty claim (count 14) is based on interference with prospective economic advantage. See FAC ¶¶ 203–07. Thus, the breach of duty of loyalty claim adopts the interference with prospective economic advantage two- year statute of limitations and is time-barred. The gravamen of Al-Ahmed’s aiding and abetting breach of fiduciary duty claim (count 17) is not similarly related to interference with prospective economic advantage. See ¶¶ 231–39. Instead, the claim’s focus is Twitter’s alleged facilitation of Alzabarah and Abouammo’s conduct as part of a coordinated plan to silence KSA dissidents. Id. Here, the two-year statute of limitations for intrusion upon seclusion applies. Calhoun, 526 F. Supp. 3d at 624; Hydro-Mill Co., 115 Cal. App. 4th at 1158–59. All the claims are time-barred. 2. Continuous Accrual Doctrine Al-Ahmed relies on the continuous accrual doctrine to avoid the time-bar. “[U]nder the theory of continuous accrual, a series of wrongs or injuries may be viewed as each triggering its own limitations period, such that a suit for relief may be partially time-barred as to older events but timely as to those within the applicable limitations period.” Aryeh v. Canon Bus. Solutions, Inc., 55 Cal.4th 1185, 1192 (2013). Continuous accrual applies when there is a continuing or recurring obligation. Id. at 1199 (“When an obligation or liability arises on a recurring basis, a cause of action accrues each time a wrongful act occurs, triggering a new limitations period.”) (citation omitted). “[T]he theory of continuous accrual supports recovery only for damages arising from those breaches falling within the limitations period[,] ... limit[ing] the amount of retroactive limitations period.” Id. (citation omitted). Therefore, the continuous accrual doctrine “would permit [the plaintiff] to sue, but only for those discrete acts occurring within the [relevant limitations period] immediately preceding the filing of [the plaintiff’s] suit.” Id. at 1199–200. In claiming the continuous accrual doctrine makes portions of his claims timely, Al- Ahmed makes the exact arguments he did in opposition to Twitter’s first motion to dismiss. Opp’n at 9. According to Al-Ahmed, Twitter breached contractual obligations contained in its TOS (express and implied) including its obligation to preserve his confidential/privileged sources and list of followers, and its obligation to not unreasonably suspend his Arabic Twitter account in which he had a reasonable expectation of privacy. Opp’n at 9–10. Al-Ahmed argues that Twitter continues to breach its TOS by keeping Al-Ahmed’s Twitter account suspended. Id. at 10. Al- Ahmed contends that these actions constitute “separate, recurring invasions of the same right [that] can each trigger their own statute of limitations” and have caused ongoing harm to him. Id. at 11 (citing Aryeh at 1198). The Court adheres to its prior ruling. Twitter’s acts do not constitute the type of continuing or recurring obligation or liability required for the continuous accrual theory to apply. Rather, Twitter’s acts are the discrete incidents of (1) unauthorized intrusion of Al-Ahmed’s account between 2013 and 2015, and (2) the suspension of Al-Ahmed’s Twitter account in 2018. The unauthorized intrusion were discrete acts which did not recur after 2015. The suspension in 2018 is not part of a continuous act of unauthorized intrusion. See Ryan v. Microsoft Corp., 147 F. Supp. 3d 868, 896–97 (N.D. Cal. 2015) (declining to apply the continuous accrual doctrine where “alleged recurring injuries during the limitations period arose out of a single transaction that occurred before the limitations period”). Accordingly, the continuous accrual doctrine does not apply. The only surviving claims against Twitter are the breach of contract, UCL, and promissory estoppel claims based on Twitter’s suspension of Al-Ahmed’s account in 2018.3

3 Al-Ahmed’s civil conspiracy and unjust enrichment claims are based on the underlying wrong C. CDA Section 230(c)(1) and Al-Ahmed’s Account Suspension-Related Claims Twitter seeks immunity from Al-Ahmed’s account-suspension-related claims under CDA Section 230(c)(1). Mot. at 15. Section 230(c) provides:

(1) Treatment of publisher or speaker No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider. (2) Civil liability No provider or user of an interactive computer service shall be held liable on account of— 1. any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or 2. any action taken to enable or make available to information content providers or others the technical means to restrict access to material described in paragraph (1). 47 U.S.C.A. § 230. In Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009), the Ninth Circuit explained that “Subsection (c)(1), by itself, shields from liability all publication decisions, whether to edit, to remove, or to post, with respect to content generated entirely by third parties.” To determine whether Section 230(c)(1) applies, the Ninth Circuit set a three-prong test. See Barnes, 570 F.3d 1096. Under this test, CDA immunity under Section 230(c)(1) applies only if the defendant is “(1) a provider or user of an interactive computer service (2) whom a plaintiff seeks to treat, under a state law cause of action, as a publisher or speaker (3) of information provided by another information content provider.” Lemmon, 995 F.3d at 1090–91. The first prong is met because Twitter is an information content provider. See Morton v. Twitter, Inc., No. CV 20-10434-GW-JEMX, 2021 WL 1181753, at *3 (C.D. Cal. Feb. 19, 2021). The second and third prongs are met because Al-Ahmed’s claims are related to the suspension of his account, and the suspension of a user account is generally considered a publishing decision related to information provided by the user. See Barnes, 570 F.3d at 1109 (finding that the removal of social media content falls under Section 230(c)(1)); see also King v. Facebook, Inc., relating to disabling of accounts fall under Section 230(c)(1)). In its previous order, this Court rejected Al-Ahmed’s arguments that § 230 should not apply to his claims. Al-Ahmed, 2022 WL 1605673, at *15–20. Al-Ahmed rehashes the same arguments in his opposition to Twitter’s motion to dismiss his FAC, and the Court remains unconvinced. Rather than engage in another extensive discussion of why these claims fail, the Court briefly summarizes its reasoning. First, Al-Ahmed cites Fair Hous. Council of San Fernando Valley v. Roommates.Com, LLC, 521 F.3d 1157, 1164 n.15 (9th Cir. 2008) for the proposition that the Ninth Circuit has been dubious of large Internet companies seeking special privileges under the CDA. Opp’n at 14. However, Al-Ahmed’s reliance on Roommates.Com is misplaced because the Ninth Circuit’s decision there was premised on the service provider “inducing third parties to express illegal preferences.” Id. at 1165. In contrast, Twitter’s suspension of Al-Ahmed’s account does not show any act by Twitter of inducing third parties to perform illegal acts.4 Second, Al-Ahmed argues that immunity, applied to this case, would run contrary to the policy of protecting children from exposure to pornographic and obscene material. Opp’n at 14– 16 (citing Section 230(b)(4)). But while it is true that Sections (b)(4)–(5) seek to enable filtering obscene and ensure their enforcement, Sections (b)(1)–(2) more broadly seek to “promote the continued development of the Internet” and “preserve the vibrant and competitive free market that presently exists for the Internet . . . unfettered by Federal or State regulation.” 47 U.S.C. § 230(b). Third, Al-Ahmed argues that Twitter’s suspension of his account suppresses the dissemination of free speech, which runs counters to the policy of “remov[ing] disincentives [to filter objectionable content.]” Id. However, this argument fails, because removing non- objectionable or inappropriate online material does not equate to disincentivizing the restriction of such material.

4 Al-Ahmed also cites Justice Thomas’s concurrence in Malwarebytes, Inc. v. Enigma Software Grp. USA, LLC, 141 S. Ct. 13, 18 (2020) where the Justice argued the scope of § 230 should be revisited in an appropriate case. “However, a concurrence is not legal authority and the reference Fourth, Al-Ahmed argues that because “the statute is intended to immunize an interactive service provider for engaging in tradition editorial functions in a public forum,” it “could never have been contemplated by the legislature to protect against or require the policing of private exchanges that are very much equivalent to private texts, phone calls or emails.” Opp’n at 15–16. However, as before, Al-Ahmed cites a single Second Circuit case, Force v. Facebook, Inc., 934 F.3d 53 (2d Cir. 2019), which merely notes that the word “publisher” is undefined by Section 230(c)(1), but does not use the words “public forum.” See id. Fifth, Al-Ahmed argues that Section 230 cannot protect Twitter for suspending his account because Twitter “specifically encourage[d] development of what was offensive about the content,” i.e., Al-Ahmed claims Twitter “planted” the offensive direct message which precipitated his suspension. Opp’n at 16 (citing Fed. Trade Comm’n v. LeadClick Media, LLC, 838 F.3d 158, 174 (2d Cir. 2016) (“A defendant, however, will not be held responsible unless it assisted in the development of what made the content unlawful.”); Roomates.com, LLC, 521 F.3d at 1167–68 (holding the defendant liable when it had questionnaires “not merely… augmenting the content generally, but…materially contributing to its alleged unlawfulness”). However, Al-Ahmed’s argument fails for two reasons. First, the allegation that Twitter “planted” or “manipulated” the direct message is highly speculative and conclusory; the FAC fails to allege specific facts which make this claim plausible. See Twombly, 550 U.S. at 570. Second, as the Court noted in its previous order, the cases cited by Al-Ahmed are inapposite because each involved a service provider participating in or inducing unlawful activity. See, e.g., Roomates.com, LLC, 521 F.3d at 1165. Here, Twitter seeks immunity for claims only in relation to its account-suspending activity—such activity is not on its face unlawful. Finally, Al-Ahmed argues that Twitter cannot claim immunity under Section 230 because it failed to demonstrate good faith. Opp’n at 17. However, Twitter seeks immunity under Section 230(c)(1) which does not contain a good faith requirement. Levitt v. Yelp! Inc., No. C-10-1321 EMC, 2011 WL 5079526, at *7 (N.D. Cal. Oct. 26, 2011), aff’d, 765 F.3d 1123 (9th Cir. 2014) (finding that while Section 230(c)(2) has a good-faith requirement, (c)(1) has no such Admittedly, this Court observes that a natural reading of the statute suggests Section 230(c)(1) should only immunize a provider based on content posted by third parties, whereas Section 230(c)(2) with its good faith requirement should immunize a provider whenever it restricts user content or user access. Otherwise, if Section 230(c)(1) immunizes a provider’s decision to remove content as well as a provider’s decision not to remove content, then Section (c)(2)’s specification that immunity also extends to “any action voluntarily taken [by the provider] in good faith to restrict access” would be rendered superfluous. On these grounds, courts in other districts have declined to immunize provider’s restriction of user access under Section 230(c)(1). See, e.g., e-ventures Worldwide, LLC v. Google, Inc., No. 214CV646FTMPAMCM, 2017 WL 2210029 (M.D. Fla. Feb. 8, 2017). If this Court were to write on a clean slate, it might well concur. However, despite the apparent import of the natural wording of Section 230(c)(1) and (2), it appears that in the Ninth Circuit, Section 230(c)(1) immunity attaches even where a provider restricts a plaintiff’s access. Sikhs for Just., Inc. v. Facebook, Inc., 697 F. App’x 526 (9th Cir. 2017); see also Riggs v. MySpace, Inc., 444 F. App’x 986, 987 (9th Cir. 2011) (affirming dismissal under Section 230(c)(1) based on the removal of the plaintiff’s user profile); King, 2021 WL 5279823, at *1 (holding Facebook has immunity under Section 230(c)(1) to the extent plaintiff’s claims were based on Facebook’s disabling plaintiff’s account). Thus, “[b]ecause Section 230(c)(1) applies here, Twitter is not required to demonstrate good faith.” Al-Ahmed, 2022 WL 1605673, at *19. Accordingly, Twitter’s immunity extends to Al-Ahmed’s following suspension-based claims: SCA, civil conspiracy, UCL, breach of contract, and promissory estoppel. Twitter’s immunity does not extend to Al-Ahmed’s breach of contract claim based on Twitter’s failure to provide an adequate justification for his suspension and to meaningfully address his appeal from the suspension of his account. See FAC ¶ 147. However, this claim fails as well. To adequately plead a breach of contract claim, the plaintiff must identify “the specific provision of the contract allegedly breached by the defendant.” King v. Facebook, Inc., No. 19-CV-01987-WHO, 2019 WL 6493968, at *2 (N.D. Cal. Dec. 3, 2019). Here, Al-Ahmed fails to do so. In fact, Twitter’s Terms suspensions at all. For the foregoing reasons, the Court GRANTS Twitter’s motion to dismiss in its entirety. Plaintiff is granted leave to amend his FAC with respect to pleading due diligence under the delayed discovery rule only. The Second Amended Complaint, if any, is due within thirty (30) days of the date of this order. This order disposes of Docket No. 62. Dated: January 3, 2023 ______________________________________ EDWARD M. CHEN United States District Judge