Gerber v. Twitter, Inc.

• Court: District Court, N.D. California
• Decided: March 29, 2024
• Docket: 4:23-cv-00186
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 STEPHEN GERBER, et al., Case No. 4:23-cv-00186-KAW

8 Plaintiffs, ORDER GRANTING IN PART AND DENYING IN PART MOTION TO 9 v. DISMISS CONSOLIDATED AMENDED CLASS ACTION COMPLAINT 10 TWITTER, INC., et al., Re: Dkt. No. 40 11 Defendants.

12 13 On June 6, 2023, Defendant X Corp., as successor in interest to Twitter, Inc. (collectively 14 “Twitter”), filed a motion to dismiss Plaintiffs’ consolidated class action complaint. 15 On February 15, 2023, the Court held a hearing, and, after considering the legal arguments 16 made, GRANTS IN PART AND DENIES IN PART Defendant’s motion to dismiss. 17 I. BACKGROUND 18 Twitter is a social media platform where users can post and engage with short-form 19 commentary, called “Tweets,” which may include text, images, or video. (Consolidated Class 20 Action Compl., “CCAC,” Dkt. No. 36 ¶¶ 2, 28-30.) Each user must create a username and display 21 name, which are displayed publicly and associate the user with their activity on the Twitter 22 platform. (CCAC ¶ 32.) Twitter invites users to operate on its platform by using pseudonymous 23 user and display names, thereby allowing users to share and access information and engage freely 24 and anonymously. (CCAC ¶¶ 41-44.) While Twitter does not charge its users, it realizes billions 25 of dollars in annual revenues from the highly valuable data generated by its users. (CCAC ¶ 31.) 26 In order to sign up for an account on the Twitter platform, a prospective user is required to: 27 (1) enter into a User Agreement, and (2) provide certain personal information, including name, 1 Agreement, includes the Terms of Service (“TOS”), the Privacy Policy, the Twitter Rules and 2 Policies, and all incorporated policies. (See CCAC ¶¶ 33-35.) As a result, prior to accessing the 3 Twitter platform and using Twitter’s services, Plaintiffs entered into the User Agreement with 4 Twitter, including the Privacy Policy, and provided Twitter with their PII, as requested by Twitter 5 and subject to Twitter’s representations set forth in the Privacy Policy. (CCAC ¶¶ 97, 118-34.) 6 The Privacy Policy states in detail how user data, including PII, will be used and who will have 7 access to that data. (CCAC ¶¶ 37-39, 122-26.) 8 From around June 2021 through January 2022, a defect in Twitter’s application 9 programming interface (“API”) allowed threat actors to access and obtain PII associated with an 10 estimated 200 million Twitter users. (CCAC ¶¶ 6, 19, 23, 26, 39, 46, 60.) It is unclear from 11 publicly available information whether the person(s) that took advantage of the API vulnerability 12 were external threat actors or had internal access at Twitter. (CCAC ¶¶ 46, 75(b), 75(g), 80, 83, 13 93, 97.) The information extracted through the API defect consists of information associated with 14 users’ Twitter account (username, display name, and account creation data), together with the 15 users’ PII (email address and phone number). (CCAC ¶ 46.) This data was offered for sale, on 16 more than one occasion, and/or leaked on the dark web between August 2022 and January 2023. 17 Id. 18 Plaintiffs contend that the Data Breach does not represent an isolated incident, but, rather, 19 was the foreseeable result of the reckless way that Twitter has chosen to operate its business. As 20 early as 2010, Twitter came under scrutiny from the Federal Trade Commission (“FTC”) for its 21 data privacy failures, resulting in the entry of a 2011 consent order (the “FTC Order”), which 22 Twitter has continued to violate (despite being subject to it for over a decade), including with 23 respect to the Data Breach. (CCAC ¶¶ 7, 83-90.) Recently, Twitter’s former Head of Security, 24 Peiter Zatko, filed a whistleblower complaint and testified before Congress regarding the 25 dangerous and pervasive lack of both internal and external data security at Twitter. (CCAC ¶¶ 73- 26 77.) Zatko provided comprehensive reports to the Twitter Board of Directors and executives 27 regarding his data security concerns, but Twitter allegedly failed and refused to implement even 1 giving rise to the Data Breach occurred. (CCAC ¶¶ 46, 73.) 2 Plaintiffs allege that had they known that Twitter failed to implement reasonable and 3 adequate data security measures, they would not have created Twitter accounts or would not have 4 provided their PII that was disclosed in the Data Breach to Twitter. (CCAC ¶¶ 19, 23, 26.) 5 Plaintiff Weitzman alleges that she has spent time monitoring her various accounts to detect and 6 prevent any misuses of her PII, which she would not have had to expend if not for the Data 7 Breach. (CACC ¶ 26.) Plaintiffs further contend that the Data Breach has also caused specific and 8 unique harm to Twitter’s impacted users that accepted its invitation to operate on its platform 9 anonymously through the use of pseudonyms, such as Plaintiffs Gerber and Cohen, as the data 10 available as a result enables any person with access to it to readily ascertain the identity of the 11 person associated with a pseudonymous Twitter account and their related activity on the platform. 12 (CCAC ¶¶ 49, 65, 104.) 13 On April 20, 2023, Plaintiffs filed the consolidated class action complaint alleging eight 14 causes of action for breach of contract, negligence, negligence per se, gross negligence, unjust 15 enrichment, violation of California Unfair Competition Law (Cal. Bus. & Prof. Code § 17200), 16 violation of the California Consumers Legal Remedies Act (Cal. Civil Code § 1750), and 17 declaratory judgment. On June 6, 2023, Defendant filed a motion to dismiss. (Def.’s Mot., Dkt. 18 No. 40.) On July 20, 2023, Plaintiffs filed an opposition. (Pls.’ Opp’n, Dkt. No. 45.) On 19 September 8, 2023, Defendant filed a reply. (Def.’s Reply, Dkt. No. 55.) 20 II. LEGAL STANDARD 21 A. Motion to Dismiss 22 Under Federal Rule of Civil Procedure 12(b)(6), a party may file a motion to dismiss based 23 on the failure to state a claim upon which relief may be granted. A motion to dismiss under Rule 24 12(b)(6) tests the legal sufficiency of the claims asserted in the complaint. Navarro v. Block, 250 25 F.3d 729, 732 (9th Cir. 2001). 26 In considering such a motion, a court must “accept as true all of the factual allegations 27 contained in the complaint,” Erickson v. Pardus, 551 U.S. 89, 94 (2007) (per curiam) (citation 1 there is an absence of “sufficient factual matter to state a facially plausible claim to relief.” 2 Shroyer v. New Cingular Wireless Servs., Inc., 622 F.3d 1035, 1041 (9th Cir. 2010) (citing 3 Ashcroft v. Iqbal, 556 U.S. 662, 677-78 (2009); Navarro, 250 F.3d at 732) (internal quotation 4 marks omitted). 5 A claim is plausible on its face when a plaintiff “pleads factual content that allows the 6 court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” 7 Iqbal, 556 U.S. at 678 (citation omitted). In other words, the facts alleged must demonstrate “more 8 than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not 9 do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). “Threadbare recitals of the elements of 10 a cause of action” and “conclusory statements” are inadequate. Iqbal, 556 U.S. at 678; see also 11 Epstein v. Wash. Energy Co., 83 F.3d 1136, 1140 (9th Cir. 1996) (“[C]onclusory allegations of 12 law and unwarranted inferences are insufficient to defeat a motion to dismiss for failure to state a 13 claim.”). “The plausibility standard is not akin to a probability requirement, but it asks for more 14 than a sheer possibility that a defendant has acted unlawfully . . . When a complaint pleads facts 15 that are merely consistent with a defendant's liability, it stops short of the line between possibility 16 and plausibility of entitlement to relief.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 17 557) (internal citations omitted). 18 Generally, if the court grants a motion to dismiss, it should grant leave to amend even if no 19 request to amend is made “unless it determines that the pleading could not possibly be cured by 20 the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (citations 21 omitted). 22 B. Request for Judicial Notice 23 As a general rule, a district court may not consider any material beyond the pleadings in 24 ruling on a motion to dismiss for failure to state a claim. Lee v. City of Los Angeles, 250 F.3d 668, 25 688 (9th Cir. 2001). A district court may take notice of facts not subject to reasonable dispute that 26 are “capable of accurate and ready determination by resort to sources whose accuracy cannot 27 reasonably be questioned.” Fed. R. Evid. 201(b); United States v. Bernal–Obeso, 989 F.2d 331, 1 F.3d at 689 (citing Mack v. S. Bay Beer Distrib., 798 F.2d 1279, 1282 (9th Cir. 1986)), and may 2 also consider “documents whose contents are alleged in a complaint and whose authenticity no 3 party questions, but which are not physically attached to the pleading” without converting a 4 motion to dismiss under Rule 12(b)(6) into a motion for summary judgment. Branch v. Tunnell, 5 14 F.3d 449, 454 (9th Cir. 1994), overruled on other grounds by Galbraith v. Cnty. of Santa Clara, 6 307 F.3d 1119 (9th Cir. 2002). The court need not accept as true allegations that contradict facts 7 which may be judicially noticed. See Mullis v. United States Bankruptcy Ct., 828 F.2d 1385, 1388 8 (9th Cir. 1987). 9 III. DISCUSSION 10 A. Request for Judicial Notice 11 As a preliminary matter, Defendant asks that the Court take judicial notice of 14 12 documents in support of its motion to dismiss. (Def.’s Req. for Judicial Notice, “RJN,” Dkt. No. 13 41.) The documents are purportedly true and correct copies of: 1) Twitter’s Privacy Policy 14 effective June 18, 2020, available at https://twitter.com/en/privacy/previous/version_16; 2) 15 Twitter’s Privacy Policy effective August 19, 2021, available at 16 https://twitter.com/en/privacy/previous/version_17; 3) Twitter’s Privacy Policy effective June 10, 17 2022, available at https://twitter.com/en/privacy/previous/version-18; 4) Twitter’s Terms of 18 Service effective June 18, 2020, available at https://twitter.com/en/tos/previous/version_15; 5) 19 Twitter’s Terms of Service effective as of August 19, 2021, available at 20 https://twitter.com/en/tos/previous/version_16; 6) Twitter’s Terms of Service effective June 10, 21 2022, available at https://twitter.com/en/tos/previous/version-17; 7) a blog post published on the 22 Twitter Privacy Center on August 5, 2022, titled “An incident impacting some accounts and 23 private information on Twitter,” available at https://privacy.twitter.com/en/blog/2022/an-issue- 24 affecting-some-anonymous-accounts; 8) a blog post published on the Twitter Privacy Center on 25 January 11, 2023, titled “Update about an alleged incident regarding Twitter user data being sold 26 online,” available at https://privacy.twitter.com/en/blog/2023/update-about-an-alleged-incident- 27 regarding-twitter-user-data-being-sold-online; 9) an article published on the Bleeping Computer 1 online,” available at https://www.bleepingcomputer.com/news/security/200-million-twitter-users- 2 email-addresses-allegedly-leaked-online/; 10) an article published on the KnowBe4 website on 3 March 7, 2013, titled “28 Percent of Data Breaches Lead to Fraud,” available at 4 https://blog.knowbe4.com/bid/252486/28-percent-of-data-breaches-lead-to-fraud; 11) a report 5 published by the United States Government Accountability Office on June 4, 2007, titled “Data 6 Breaches Are Frequent, But Evidence of Resulting Identity Theft is Limited; However, the Full 7 Extent is Unknown” (GAO–07-737), available at https://www.gao.gov/assets/gao-07-737.pdf; 12) 8 Twitter Help Center page titled “About your email and phone number discoverability privacy 9 settings,” available at https://help.twitter.com/en/safety-and-security/email-and-phone- 10 discoverability-settings; 13) Twitter Help Center page titled “How to Upload and Manage Your 11 Contacts,” available at https://help.twitter.com/en/using-twitter/upload-your-contacts-to-search- 12 for-friends; 14) Twitter Help Center page titled “About Twitter’s Account Suggestions,” available 13 at https://help.twitter.com/en/using-twitter/account-suggestions. (RJN at 1-3; Decl. of Stephen A. 14 Broome, Dkt. No. 40-1, Exs. 1-14.)1 15 Plaintiffs oppose Defendant’s request to judicial notice as to Exhibit Nos. 9, 11, 12, 13, 16 and 14 on the grounds that Defendant is seeking to establish the truth of the documents’ contents 17 to dispute the well-pleaded facts in the complaint. (Pl.’s RJN Opp’n, Dkt. No. 44 at 1.) Defendant 18 argues that these exhibits are all incorporated into the complaint by reference. (Def.’s RJN at 7-8.) 19 The “incorporation by reference” doctrine “permits [a court] to take into account 20 documents whose contents are alleged in a complaint and whose authenticity no party questions, 21 but which are not physically attached to the plaintiff’s pleading.” Knievel v. ESPN, 393 F.3d 1068, 22 1076 (9th Cir. 2005). Thus, “[e]ven if a document is not attached to a complaint, it may be 23 incorporated by reference into a complaint if the plaintiff refers extensively to the document or the 24 document forms the basis of the plaintiff’s claim.” United States v. Richie, 342 F.3d 903, 908 (9th 25 Cir. 2003). The court, however, “is not required to incorporate documents by reference.” Davis v. 26 HSBC Bank Nev., N.A., 691 F.3d 1152, 1159 (9th Cir. 2012). The disputed exhibits are not 27 1 needed to resolve the pending motion, so the Court declines to incorporate them by reference. The 2 Court also declines to incorporate Exhibit 10 by reference, because it is also unnecessary. 3 As to the remaining Exhibit Nos. 1-8, the Court will take judicial notice of those exhibits 4 pursuant to the incorporation by reference doctrine. 5 Accordingly, Defendant’s request for judicial notice is GRANTED IN PART AND 6 DENIED IN PART. 7 B. Motion to Dismiss 8 i. Terms of Service 9 As an initial matter, Defendant argues that the first five causes of action for breach of 10 contract, negligence, negligence per se, gross negligence, and unjust enrichment are barred by the 11 Terms of Service (“TOS”) disclaimer and the limitation of liability clauses. (Def.’s Mot. at 6.) 12 Section 6 of the TOS provides that California law governs both the terms and any claim 13 that may arise between the consumer and Twitter. (RJN, Ex. 6 at 9-10.) “With respect to claims 14 for breach of contract, limitation of liability clauses are enforceable unless they are 15 unconscionable, that is, the improper result of unequal bargaining power or contrary to public 16 policy.” Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 209 Cal. App. 4th 1118, 1126 (2012). 17 Specifically, Section 5 of the TOS contained disclaimers and limitations of liability. First, users 18 were advised that the services were being made available “AS-IS”:

19 Your access to and use of the Services or any Content are at your own risk. . . . [T]he Services are provided to you on an “AS IS” . . . basis. 20 The Twitter Entities make no warranty or representation and disclaim all responsibility and liability for: (i) the . . security or reliability of 21 the Services or any Content; (ii) any harm to your computer system, loss of data, or other harm that results from your access to or use of 22 the Services or any content; . . . and (iv) whether the Services will meet your requirements or be available on an uninterrupted, secure, 23 or error-free basis. 24 (RJN, Ex. 6 at 8) (emphasis added). Next, the limitation of liability clause was as follows:

25 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TWITTER ENTITIES SHALL NOT BE LIABLE FOR 26 ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR 27 REVENUES, WHETHER INCURRED DIRECTLY OR TO OR USE OF OR INABILITY TO ACCESS OR USE THE 1 SERVICES; (ii) ANY CONDUCT OR CONTENT OF ANY THIRD PARTY ON THE SERVICES, INCLUDING WITHOUT 2 LIMITATION, ANY DEFAMATORY, OFFENSIVE OR ILLEGAL CONDUCT OF OTHER USERS OR THIRD PARTIES; (iii) ANY 3 CONTENT OBTAINED FROM THE SERVICES; OR (iv) UNAUTHORIZED ACCESS, USE OR ALTERATION OF YOUR 4 TRANSMISSIONS OR CONTENT… THE LIMITATIONS OF THIS SUBSECTION SHALL APPLY TO ANY THEORY OF 5 LIABILITY, WHETHER BASED ON WARRANTY, CONTRACT, STATUTE, TORT (INCLUDING NEGLIGENCE) 6 OR OTHERWISE…. 7 (RJN, Ex. 6 at 9) (emphasis added). 8 Courts in this district have found liability limitation provisions to be generally enforceable 9 for similar services. See, e.g., Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1038 (N.D. Cal. 10 2019) (contract claims barred by TOS). Broad provisions such as these, however, have also been 11 found to be unconscionable because they “are overly one-sided and bar any effective relief.” In re 12 Yahoo! Inc. Customer Data Sec. Breach Litig., 313 F. Supp. 3d 1113, 1137 (N.D. Cal. 2018). 13 Moreover, as Plaintiffs do allege, Defendant is obligated by law to maintain reasonable data 14 security systems. (CCAC ¶¶ 180-183.) Despite this obligation, Twitter allegedly “took minimal 15 action despite knowing about their inadequate security measures,” which would be adequate to 16 plead that the limitations of liability are substantively unconscionable. See In re Yahoo! Inc., 313 17 F. Supp. 3d at 1138. 18 Regardless, as Defendant argues, the operative complaint contains no specific allegations 19 regarding the unconscionability of the TOS. (See Def.’s Reply at 2.) At the hearing, Plaintiffs 20 conceded that the complaint was devoid of any such allegations and requested leave to amend to 21 allege unconscionability. 22 Even in the absence of such allegations, as Defendant conceded at the hearing, the gross 23 negligence claim would not be barred by the TOS, because “California law forbids limiting 24 liability for gross negligence.” In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. 25 Supp. 3d 767, 800 (N.D. Cal. 2019). 26 Accordingly, the first, second, third, and fifth causes of action for breach of contract, 27 negligence, negligence per se, and unjust enrichment are dismissed with leave to amend, so that 1 these causes of action. 2 ii. First and Fifth Causes of Action: Contract Claims 3 Plaintiffs first and fifth causes of action are for breach of contract and unjust enrichment. 4 (CCAC ¶¶ 118-134, 157-167.) Unjust enrichment is considered to be quasi-contract claim. See 5 Doe v. Meta Platforms, Inc., No. 22-CV-03580-WHO, 2023 WL 5837443, at *13 (N.D. Cal. Sept. 6 7, 2023). 7 These claims have already been dismissed, see discussion, supra, Part III.B.i, so the Court 8 will briefly address them together. At the hearing, Plaintiffs indicated a willingness to allege the 9 specific promises made within the TOS and related privacy policies. While Defendant’s argument 10 that Plaintiffs should have already done so is well taken, the Court will permit Plaintiffs to amend 11 these causes of action to allege the specific promises, but Plaintiffs are advised that the Court is 12 not inclined to give them another opportunity to amend should their next attempt prove to be 13 insufficient. 14 iii. Second through Fourth Causes of Action: Negligence claims 15 Plaintiffs second through fourth causes of action are for negligence, negligence per se, and 16 gross negligence. (CCAC ¶¶ 135-156.) As discussed above, Plaintiffs have failed to allege that 17 the TOS is unconscionable, so the negligence and negligence per se causes of action are dismissed 18 with leave to amend. Since negligence per se is not an independent cause of action, Plaintiffs’ 19 amended complaint should plead both theories as the single tort of negligence. See Moore v. 20 Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 521 n.2 (2022), review denied (Dec. 14, 2022). 21 To plead negligence, including gross negligence, Plaintiffs must show that Defendant 22 “owed [Plaintiffs] a legal duty, that it breached the duty, and that the breach was a proximate or 23 legal cause of [Plaintiffs’] injuries.” Merrill v. Navegar, Inc., 26 Cal. 4th 465, 477 (2001). 24 Defendant argues that the economic loss rule bars Plaintiffs’ claims. (Def.’s Mot. at 15- 25 16.) The economic loss rule provides that “there is no recovery in tort for negligently inflicted 26 ‘purely economic losses,’ meaning financial harm unaccompanied by physical or property 27 damage.” Sheen v. Wells Fargo Bank, N.A., 12 Cal. 5th 905, 922, 505 P.3d 625, 632 (2022), reh'g 1 claim arises from the contract (in other words, the claim is not independent of the contract).” 2 Moore v. Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 535, 299 Cal. Rptr. 3d 544, 561 3 (2022), review denied (Dec. 14, 2022) (citing Sheen, 12 Cal. 5th at 923). 4 As an initial matter, it is unclear to the Court what economic losses Plaintiffs have 5 suffered, if any. Defendant cites to Moore in support of their argument that the economic loss rule 6 bars Plaintiffs’ negligence claims. (Def.’s Mot. at 16.) There, the California Court of Appeal 7 found that the economic loss rule barred the appellants’ negligence claim because their 8 complaint’s allegations “implicitly referr[ed] to their time’s financial value” rather than being 9 “accompanied by any personal injury or property damage.” Moore v. Centrelake Med. Grp., Inc., 10 83 Cal. App. 5th 515, 535-36, 299 Cal. Rptr. 3d 544, 561 (2022), review denied (Dec. 14, 2022). 11 In sum, the Moore plaintiffs failed to allege their loss of time as a personal injury, which would 12 have presumably allowed their negligence claim to survive the pleadings stage. Id. at 536. Here, 13 unlike Moore, Plaintiffs do allege non-economic injuries in spending “time monitoring [their] 14 various accounts in an effort to detect and prevent any misuses of [their] PII….” (CCAC ¶ 26.) 15 “Various California courts have referred to privacy-based causes of action as actions for 16 ‘personal injury.’” Greenley v. Avis Budget Grp. Inc., No. 19-cv-00421-GPC-AHG, 2020 WL 17 1493618, at *13 (S.D. Cal. Mar. 27, 2020) (collecting cases); Medoff v. Minka Lighting, LLC, No. 18 22-cv-08885-SVW-PVC, 2023 WL 4291973, at *8 (C.D. Cal. May 8, 2023) (quoting same 19 language from Greenley). Courts in this district have found that loss of time allegations are 20 sufficient to state a harm that is not a “pure economic loss.” Bass v. Facebook, Inc., 394 F. Supp. 21 3d 1024, 1039 (N.D. Cal. 2019). The Court agrees and finds that the economic loss rule would not 22 bar the remaining negligence claim should Plaintiffs sufficiently allege that the TOS is 23 unconscionable. See discussion, supra, Part III.B.i. 24 Accordingly, Plaintiffs adequately state a claim for gross negligence, and the motion to 25 dismiss is denied as to the fourth cause of action.2 26 2 The Court notes that the harm allegation is not explicitly cited in the claim itself, which merely 27 incorporates preceding paragraphs by reference. In an effort to clarify their allegations and comply 1 iv. Sixth Cause of Action: Unfair Competition Law, Bus. & Prof. Code § 17200 2 In order to establish standing for the UCL Claim, plaintiffs must show that they personally 3 lost money or property “as a result of the unfair competition.” CAL. BUS. & PROF. CODE § 17204; 4 Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 330 (2011). Under California law: [t]here are innumerable ways in which economic injury from unfair 5 competition may be shown. A plaintiff may (1) surrender in a transaction more, or acquire in a transaction less, than he or she 6 otherwise would have; (2) have a present or future property interest diminished; (3) be deprived of money or property to which he or she 7 has a cognizable claim; (4) be required to enter into a transaction, costing money or property, that would otherwise have been 8 unnecessary. 9 Kwikset, 51 Cal. 4th at 323. 10 Here, Plaintiffs allege two harms: (1) loss of the monetary value of the personal 11 information, and (2) failure to receive the benefit of their bargain with Twitter. (CCAC ¶¶ 185, 12 192.) If either harm is plausibly alleged, Plaintiffs would satisfy the standing requirement for 13 these two causes of action. Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1040 (N.D. Cal. 2019). 14 Plaintiffs contend that the complaint adequately alleges how and when Plaintiffs’ PII was 15 offered for sale and the monetary value and market for PII. (CCAC ¶¶ 46, 48, 50-52, 56-57, 59- 16 60, 102, 185.) Plaintiffs position that the sale of their PII on the dark web satisfies the “lost-value- 17 of-PII” theory has been rejected by courts in this district, because the existence of a nefarious 18 market does not equate to an allegation that Plaintiffs “attempted or intended to participate in this 19 market, or otherwise to derive economic value from their PII.” Doe v. Meta Platforms, Inc., No. 20 22-CV-03580-WHO, 2023 WL 5837443, at *16 (N.D. Cal. Sept. 7, 2023) (quoting Moore v. 21 Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 538 (2022), review denied (Dec. 14, 2022)). To 22 the extent that Plaintiffs rely on Brown v. Google LLC, No. 20-CV-03664-LHK, 2021 WL 23 6064009 (N.D. Cal. Dec. 22, 2021), for the proposition that the future value of their data was 24 diminished by the unauthorized sale of that data, that reliance is misplaced. (Pls.’ Opp’n at 15.) 25 Brown is factually inapposite because that case involved allegations that Plaintiffs had been 26 induced to give Google their data without payment, and that they would have demanded payment 27 had they known that Google had previously paid individuals for their browsing histories. Brown, 1 is dismissed with prejudice, because any amendment would be futile. 2 Plaintiffs, however, do have the potential to sufficiently allege economic injury based on 3 “benefit of the bargain.” (See Pls.’ Opp’n at 15.) Business and Professions Code § 22576 4 prohibits “an operator of a commercial website” that collects PII from consumers from violating 5 “its posted privacy policy.” Plaintiffs argue that they have UCL standing based on a breach of the 6 contractual privacy protections governing the sales in violation of Section 22576. (Id.; see also 7 CCAC ¶ 183.) Thus, Plaintiffs have standing so long as they have adequately alleged that 8 Defendant breached the terms of its privacy agreement. See In re Anthem, Inc. Data Breach Litig., 9 No. 15-md-2617-LHK, 2016 WL 3029783, at *13, *30 (N.D. Cal. 2016) (finding defendant’s 10 breach of privacy policies incorporated into customers’ insurance contracts deprived plaintiffs of 11 the benefit of their bargain and caused economic injury sufficient to establish UCL standing). 12 Plaintiffs are, therefore, granted leave to amend to clearly allege violations of the privacy policy, 13 which, if adequately pled, will satisfy the harm requirement for the UCL claim. 14 Thus, the sixth cause of action is dismissed with leave to amend. 15 v. Seventh Cause of Action: California Consumers Legal Remedies Act 16 The seventh cause of action is for violation of the California Consumers Legal Remedies 17 Act (“CLRA”). (CCAC ¶¶ 186-193.) Defendant argues that the CLRA claim fails because 18 Plaintiffs fail to allege that the parties engaged in a transaction for the “sale or lease of goods or 19 services to any consumer.” (Def.’s Mot. at 22 (quoting Cal. Civ. Code § 1770(a)).) At the hearing, 20 Plaintiffs conceded this cause of action. 21 Accordingly, the seventh cause of action is dismissed with prejudice. 22 vi. Eighth Cause of Action: Declaratory Judgment 23 The eighth cause of action is for declaratory judgment. (CCAC ¶¶ 194-201.) Specifically, 24 Plaintiffs allege that Twitter’s data security measures remain inadequate, and they seek a 25 declaratory judgment that Twitter owes a legal duty to secure consumers’ PII and to timely notify 26 them of a data breach, and that it continues to breach that duty by failing to employ reasonable 27 measures to secure consumers’ PII. (CCAC ¶¶ 196-197.) 1 (Def.’s Mot. at 23.) Plaintiffs’ claim for gross negligence is sufficiently pled. Furthermore, a 2 || dispute exists as to the continued risk Plaintiffs and similarly situated users face, rendering the 3 dismissal of the declaratory judgment claim premature. See Bass v. Facebook, Inc., 394 F. Supp. 4 |} 3d 1024, 1040 (N.D. Cal. 2019). 5 Accordingly, the motion to dismiss is denied as to the eighth cause of action. 6 IV. CONCLUSION 7 For the reasons set forth above, Defendant’s motion to dismiss is GRANTED IN PART 8 AND DENIED IN PART. Consistent with this order, the motion is granted with leave to amend 9 as to first, second, third, fifth, and sixth causes of action. The motion is granted with prejudice 10 || regarding the seventh cause of action for violation of the California Consumers Legal Remedies 11 Act. The motion is denied as to the fourth and eighth causes of action. 12 Plaintiffs shall file a second amended complaint within 21 days of this order. 13 IT IS SO ORDERED. 14 || Dated: March 29, 2024

A 16 United States Magistrate Judge

18 19 20 21 22 23 24 25 26 27 28