Gerber v. Twitter, Inc.

Opinion

STEPHEN GERBER, et al., Case No. 4:23-cv-00186-KAW

Plaintiffs, ORDER GRANTING IN PART AND DENYING IN PART MOTION TO v. DISMISS CONSOLIDATED AMENDED CLASS ACTION COMPLAINT TWITTER, INC., et al., Re: Dkt. No. 40 Defendants.

On June 6, 2023, Defendant X Corp., as successor in interest to Twitter, Inc. (collectively “Twitter”), filed a motion to dismiss Plaintiffs’ consolidated class action complaint. On February 15, 2023, the Court held a hearing, and, after considering the legal arguments made, GRANTS IN PART AND DENIES IN PART Defendant’s motion to dismiss. Twitter is a social media platform where users can post and engage with short-form commentary, called “Tweets,” which may include text, images, or video. (Consolidated Class Action Compl., “CCAC,” Dkt. No. 36 ¶¶ 2, 28-30.) Each user must create a username and display name, which are displayed publicly and associate the user with their activity on the Twitter platform. (CCAC ¶ 32.) Twitter invites users to operate on its platform by using pseudonymous user and display names, thereby allowing users to share and access information and engage freely and anonymously. (CCAC ¶¶ 41-44.) While Twitter does not charge its users, it realizes billions of dollars in annual revenues from the highly valuable data generated by its users. (CCAC ¶ 31.) In order to sign up for an account on the Twitter platform, a prospective user is required to: (1) enter into a User Agreement, and (2) provide certain personal information, including name, Agreement, includes the Terms of Service (“TOS”), the Privacy Policy, the Twitter Rules and Policies, and all incorporated policies. (See CCAC ¶¶ 33-35.) As a result, prior to accessing the Twitter platform and using Twitter’s services, Plaintiffs entered into the User Agreement with Twitter, including the Privacy Policy, and provided Twitter with their PII, as requested by Twitter and subject to Twitter’s representations set forth in the Privacy Policy. (CCAC ¶¶ 97, 118-34.) The Privacy Policy states in detail how user data, including PII, will be used and who will have access to that data. (CCAC ¶¶ 37-39, 122-26.) From around June 2021 through January 2022, a defect in Twitter’s application programming interface (“API”) allowed threat actors to access and obtain PII associated with an estimated 200 million Twitter users. (CCAC ¶¶ 6, 19, 23, 26, 39, 46, 60.) It is unclear from publicly available information whether the person(s) that took advantage of the API vulnerability were external threat actors or had internal access at Twitter. (CCAC ¶¶ 46, 75(b), 75(g), 80, 83, 93, 97.) The information extracted through the API defect consists of information associated with users’ Twitter account (username, display name, and account creation data), together with the users’ PII (email address and phone number). (CCAC ¶ 46.) This data was offered for sale, on more than one occasion, and/or leaked on the dark web between August 2022 and January 2023. Id. Plaintiffs contend that the Data Breach does not represent an isolated incident, but, rather, was the foreseeable result of the reckless way that Twitter has chosen to operate its business. As early as 2010, Twitter came under scrutiny from the Federal Trade Commission (“FTC”) for its data privacy failures, resulting in the entry of a 2011 consent order (the “FTC Order”), which Twitter has continued to violate (despite being subject to it for over a decade), including with respect to the Data Breach. (CCAC ¶¶ 7, 83-90.) Recently, Twitter’s former Head of Security, Peiter Zatko, filed a whistleblower complaint and testified before Congress regarding the dangerous and pervasive lack of both internal and external data security at Twitter. (CCAC ¶¶ 73- 77.) Zatko provided comprehensive reports to the Twitter Board of Directors and executives regarding his data security concerns, but Twitter allegedly failed and refused to implement even giving rise to the Data Breach occurred. (CCAC ¶¶ 46, 73.) Plaintiffs allege that had they known that Twitter failed to implement reasonable and adequate data security measures, they would not have created Twitter accounts or would not have provided their PII that was disclosed in the Data Breach to Twitter. (CCAC ¶¶ 19, 23, 26.) Plaintiff Weitzman alleges that she has spent time monitoring her various accounts to detect and prevent any misuses of her PII, which she would not have had to expend if not for the Data Breach. (CACC ¶ 26.) Plaintiffs further contend that the Data Breach has also caused specific and unique harm to Twitter’s impacted users that accepted its invitation to operate on its platform anonymously through the use of pseudonyms, such as Plaintiffs Gerber and Cohen, as the data available as a result enables any person with access to it to readily ascertain the identity of the person associated with a pseudonymous Twitter account and their related activity on the platform. (CCAC ¶¶ 49, 65, 104.) On April 20, 2023, Plaintiffs filed the consolidated class action complaint alleging eight causes of action for breach of contract, negligence, negligence per se, gross negligence, unjust enrichment, violation of California Unfair Competition Law (Cal. Bus. & Prof. Code § 17200), violation of the California Consumers Legal Remedies Act (Cal. Civil Code § 1750), and declaratory judgment. On June 6, 2023, Defendant filed a motion to dismiss. (Def.’s Mot., Dkt. No. 40.) On July 20, 2023, Plaintiffs filed an opposition. (Pls.’ Opp’n, Dkt. No. 45.) On September 8, 2023, Defendant filed a reply. (Def.’s Reply, Dkt. No. 55.) A. Motion to Dismiss Under Federal Rule of Civil Procedure 12(b)(6), a party may file a motion to dismiss based on the failure to state a claim upon which relief may be granted. A motion to dismiss under Rule 12(b)(6) tests the legal sufficiency of the claims asserted in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). In considering such a motion, a court must “accept as true all of the factual allegations contained in the complaint,” Erickson v. Pardus, 551 U.S. 89, 94 (2007) (per curiam) (citation there is an absence of “sufficient factual matter to state a facially plausible claim to relief.” Shroyer v. New Cingular Wireless Servs., Inc., 622 F.3d 1035, 1041 (9th Cir. 2010) (citing Ashcroft v. Iqbal, 556 U.S. 662, 677-78 (2009); Navarro, 250 F.3d at 732) (internal quotation marks omitted). A claim is plausible on its face when a plaintiff “pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (citation omitted). In other words, the facts alleged must demonstrate “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). “Threadbare recitals of the elements of a cause of action” and “conclusory statements” are inadequate. Iqbal, 556 U.S. at 678; see also Epstein v. Wash. Energy Co., 83 F.3d 1136, 1140 (9th Cir. 1996) (“[C]onclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss for failure to state a claim.”). “The plausibility standard is not akin to a probability requirement, but it asks for more than a sheer possibility that a defendant has acted unlawfully . . . When a complaint pleads facts that are merely consistent with a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 557) (internal citations omitted). Generally, if the court grants a motion to dismiss, it should grant leave to amend even if no request to amend is made “unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (citations omitted). B. Request for Judicial Notice As a general rule, a district court may not consider any material beyond the pleadings in ruling on a motion to dismiss for failure to state a claim. Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001). A district court may take notice of facts not subject to reasonable dispute that are “capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b); United States v. Bernal–Obeso, 989 F.2d 331, F.3d at 689 (citing Mack v. S. Bay Beer Distrib., 798 F.2d 1279, 1282 (9th Cir. 1986)), and may also consider “documents whose contents are alleged in a complaint and whose authenticity no party questions, but which are not physically attached to the pleading” without converting a motion to dismiss under Rule 12(b)(6) into a motion for summary judgment. Branch v. Tunnell, 14 F.3d 449, 454 (9th Cir. 1994), overruled on other grounds by Galbraith v. Cnty. of Santa Clara, 307 F.3d 1119 (9th Cir. 2002). The court need not accept as true allegations that contradict facts which may be judicially noticed. See Mullis v. United States Bankruptcy Ct., 828 F.2d 1385, 1388 (9th Cir. 1987). A. Request for Judicial Notice As a preliminary matter, Defendant asks that the Court take judicial notice of 14 documents in support of its motion to dismiss. (Def.’s Req. for Judicial Notice, “RJN,” Dkt. No. 41.) The documents are purportedly true and correct copies of: 1) Twitter’s Privacy Policy effective June 18, 2020, available at https://twitter.com/en/privacy/previous/version_16; 2) Twitter’s Privacy Policy effective August 19, 2021, available at https://twitter.com/en/privacy/previous/version_17; 3) Twitter’s Privacy Policy effective June 10, 2022, available at https://twitter.com/en/privacy/previous/version-18; 4) Twitter’s Terms of Service effective June 18, 2020, available at https://twitter.com/en/tos/previous/version_15; 5) Twitter’s Terms of Service effective as of August 19, 2021, available at https://twitter.com/en/tos/previous/version_16; 6) Twitter’s Terms of Service effective June 10, 2022, available at https://twitter.com/en/tos/previous/version-17; 7) a blog post published on the Twitter Privacy Center on August 5, 2022, titled “An incident impacting some accounts and private information on Twitter,” available at https://privacy.twitter.com/en/blog/2022/an-issue- affecting-some-anonymous-accounts; 8) a blog post published on the Twitter Privacy Center on January 11, 2023, titled “Update about an alleged incident regarding Twitter user data being sold online,” available at https://privacy.twitter.com/en/blog/2023/update-about-an-alleged-incident- regarding-twitter-user-data-being-sold-online; 9) an article published on the Bleeping Computer online,” available at https://www.bleepingcomputer.com/news/security/200-million-twitter-users- email-addresses-allegedly-leaked-online/; 10) an article published on the KnowBe4 website on March 7, 2013, titled “28 Percent of Data Breaches Lead to Fraud,” available at https://blog.knowbe4.com/bid/252486/28-percent-of-data-breaches-lead-to-fraud; 11) a report published by the United States Government Accountability Office on June 4, 2007, titled “Data Breaches Are Frequent, But Evidence of Resulting Identity Theft is Limited; However, the Full Extent is Unknown” (GAO–07-737), available at https://www.gao.gov/assets/gao-07-737.pdf; 12) Twitter Help Center page titled “About your email and phone number discoverability privacy settings,” available at https://help.twitter.com/en/safety-and-security/email-and-phone- discoverability-settings; 13) Twitter Help Center page titled “How to Upload and Manage Your Contacts,” available at https://help.twitter.com/en/using-twitter/upload-your-contacts-to-search- for-friends; 14) Twitter Help Center page titled “About Twitter’s Account Suggestions,” available at https://help.twitter.com/en/using-twitter/account-suggestions. (RJN at 1-3; Decl. of Stephen A. Broome, Dkt. No. 40-1, Exs. 1-14.)1 Plaintiffs oppose Defendant’s request to judicial notice as to Exhibit Nos. 9, 11, 12, 13, and 14 on the grounds that Defendant is seeking to establish the truth of the documents’ contents to dispute the well-pleaded facts in the complaint. (Pl.’s RJN Opp’n, Dkt. No. 44 at 1.) Defendant argues that these exhibits are all incorporated into the complaint by reference. (Def.’s RJN at 7-8.) The “incorporation by reference” doctrine “permits [a court] to take into account documents whose contents are alleged in a complaint and whose authenticity no party questions, but which are not physically attached to the plaintiff’s pleading.” Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005). Thus, “[e]ven if a document is not attached to a complaint, it may be incorporated by reference into a complaint if the plaintiff refers extensively to the document or the document forms the basis of the plaintiff’s claim.” United States v. Richie, 342 F.3d 903, 908 (9th Cir. 2003). The court, however, “is not required to incorporate documents by reference.” Davis v. HSBC Bank Nev., N.A., 691 F.3d 1152, 1159 (9th Cir. 2012). The disputed exhibits are not needed to resolve the pending motion, so the Court declines to incorporate them by reference. The Court also declines to incorporate Exhibit 10 by reference, because it is also unnecessary. As to the remaining Exhibit Nos. 1-8, the Court will take judicial notice of those exhibits pursuant to the incorporation by reference doctrine. Accordingly, Defendant’s request for judicial notice is GRANTED IN PART AND B. Motion to Dismiss i. Terms of Service As an initial matter, Defendant argues that the first five causes of action for breach of contract, negligence, negligence per se, gross negligence, and unjust enrichment are barred by the Terms of Service (“TOS”) disclaimer and the limitation of liability clauses. (Def.’s Mot. at 6.) Section 6 of the TOS provides that California law governs both the terms and any claim that may arise between the consumer and Twitter. (RJN, Ex. 6 at 9-10.) “With respect to claims for breach of contract, limitation of liability clauses are enforceable unless they are unconscionable, that is, the improper result of unequal bargaining power or contrary to public policy.” Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 209 Cal. App. 4th 1118, 1126 (2012). Specifically, Section 5 of the TOS contained disclaimers and limitations of liability. First, users were advised that the services were being made available “AS-IS”:

Your access to and use of the Services or any Content are at your own risk. . . . [T]he Services are provided to you on an “AS IS” . . . basis. The Twitter Entities make no warranty or representation and disclaim all responsibility and liability for: (i) the . . security or reliability of the Services or any Content; (ii) any harm to your computer system, loss of data, or other harm that results from your access to or use of the Services or any content; . . . and (iv) whether the Services will meet your requirements or be available on an uninterrupted, secure, or error-free basis. (RJN, Ex. 6 at 8) (emphasis added). Next, the limitation of liability clause was as follows:

LAW, THE TWITTER ENTITIES SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR TO OR USE OF OR INABILITY TO ACCESS OR USE THE SERVICES; (ii) ANY CONDUCT OR CONTENT OF ANY THIRD PARTY ON THE SERVICES, INCLUDING WITHOUT LIMITATION, ANY DEFAMATORY, OFFENSIVE OR ILLEGAL CONDUCT OF OTHER USERS OR THIRD PARTIES; (iii) ANY CONTENT OBTAINED FROM THE SERVICES; OR (iv) UNAUTHORIZED ACCESS, USE OR ALTERATION OF YOUR TRANSMISSIONS OR CONTENT… THE LIMITATIONS OF THIS SUBSECTION SHALL APPLY TO ANY THEORY OF CONTRACT, STATUTE, TORT (INCLUDING NEGLIGENCE) OR OTHERWISE…. (RJN, Ex. 6 at 9) (emphasis added). Courts in this district have found liability limitation provisions to be generally enforceable for similar services. See, e.g., Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1038 (N.D. Cal. 2019) (contract claims barred by TOS). Broad provisions such as these, however, have also been found to be unconscionable because they “are overly one-sided and bar any effective relief.” In re Yahoo! Inc. Customer Data Sec. Breach Litig., 313 F. Supp. 3d 1113, 1137 (N.D. Cal. 2018). Moreover, as Plaintiffs do allege, Defendant is obligated by law to maintain reasonable data security systems. (CCAC ¶¶ 180-183.) Despite this obligation, Twitter allegedly “took minimal action despite knowing about their inadequate security measures,” which would be adequate to plead that the limitations of liability are substantively unconscionable. See In re Yahoo! Inc., 313 F. Supp. 3d at 1138. Regardless, as Defendant argues, the operative complaint contains no specific allegations regarding the unconscionability of the TOS. (See Def.’s Reply at 2.) At the hearing, Plaintiffs conceded that the complaint was devoid of any such allegations and requested leave to amend to allege unconscionability. Even in the absence of such allegations, as Defendant conceded at the hearing, the gross negligence claim would not be barred by the TOS, because “California law forbids limiting liability for gross negligence.” In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 800 (N.D. Cal. 2019). Accordingly, the first, second, third, and fifth causes of action for breach of contract, negligence, negligence per se, and unjust enrichment are dismissed with leave to amend, so that these causes of action. ii. First and Fifth Causes of Action: Contract Claims Plaintiffs first and fifth causes of action are for breach of contract and unjust enrichment. (CCAC ¶¶ 118-134, 157-167.) Unjust enrichment is considered to be quasi-contract claim. See Doe v. Meta Platforms, Inc., No. 22-CV-03580-WHO, 2023 WL 5837443, at *13 (N.D. Cal. Sept. 7, 2023). These claims have already been dismissed, see discussion, supra, Part III.B.i, so the Court will briefly address them together. At the hearing, Plaintiffs indicated a willingness to allege the specific promises made within the TOS and related privacy policies. While Defendant’s argument that Plaintiffs should have already done so is well taken, the Court will permit Plaintiffs to amend these causes of action to allege the specific promises, but Plaintiffs are advised that the Court is not inclined to give them another opportunity to amend should their next attempt prove to be insufficient. iii. Second through Fourth Causes of Action: Negligence claims Plaintiffs second through fourth causes of action are for negligence, negligence per se, and gross negligence. (CCAC ¶¶ 135-156.) As discussed above, Plaintiffs have failed to allege that the TOS is unconscionable, so the negligence and negligence per se causes of action are dismissed with leave to amend. Since negligence per se is not an independent cause of action, Plaintiffs’ amended complaint should plead both theories as the single tort of negligence. See Moore v. Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 521 n.2 (2022), review denied (Dec. 14, 2022). To plead negligence, including gross negligence, Plaintiffs must show that Defendant “owed [Plaintiffs] a legal duty, that it breached the duty, and that the breach was a proximate or legal cause of [Plaintiffs’] injuries.” Merrill v. Navegar, Inc., 26 Cal. 4th 465, 477 (2001). Defendant argues that the economic loss rule bars Plaintiffs’ claims. (Def.’s Mot. at 15- 16.) The economic loss rule provides that “there is no recovery in tort for negligently inflicted ‘purely economic losses,’ meaning financial harm unaccompanied by physical or property damage.” Sheen v. Wells Fargo Bank, N.A., 12 Cal. 5th 905, 922, 505 P.3d 625, 632 (2022), reh'g claim arises from the contract (in other words, the claim is not independent of the contract).” Moore v. Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 535, 299 Cal. Rptr. 3d 544, 561 (2022), review denied (Dec. 14, 2022) (citing Sheen, 12 Cal. 5th at 923). As an initial matter, it is unclear to the Court what economic losses Plaintiffs have suffered, if any. Defendant cites to Moore in support of their argument that the economic loss rule bars Plaintiffs’ negligence claims. (Def.’s Mot. at 16.) There, the California Court of Appeal found that the economic loss rule barred the appellants’ negligence claim because their complaint’s allegations “implicitly referr[ed] to their time’s financial value” rather than being “accompanied by any personal injury or property damage.” Moore v. Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 535-36, 299 Cal. Rptr. 3d 544, 561 (2022), review denied (Dec. 14, 2022). In sum, the Moore plaintiffs failed to allege their loss of time as a personal injury, which would have presumably allowed their negligence claim to survive the pleadings stage. Id. at 536. Here, unlike Moore, Plaintiffs do allege non-economic injuries in spending “time monitoring [their] various accounts in an effort to detect and prevent any misuses of [their] PII….” (CCAC ¶ 26.) “Various California courts have referred to privacy-based causes of action as actions for ‘personal injury.’” Greenley v. Avis Budget Grp. Inc., No. 19-cv-00421-GPC-AHG, 2020 WL 1493618, at *13 (S.D. Cal. Mar. 27, 2020) (collecting cases); Medoff v. Minka Lighting, LLC, No. 22-cv-08885-SVW-PVC, 2023 WL 4291973, at *8 (C.D. Cal. May 8, 2023) (quoting same language from Greenley). Courts in this district have found that loss of time allegations are sufficient to state a harm that is not a “pure economic loss.” Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1039 (N.D. Cal. 2019). The Court agrees and finds that the economic loss rule would not bar the remaining negligence claim should Plaintiffs sufficiently allege that the TOS is unconscionable. See discussion, supra, Part III.B.i. Accordingly, Plaintiffs adequately state a claim for gross negligence, and the motion to dismiss is denied as to the fourth cause of action.2 2 The Court notes that the harm allegation is not explicitly cited in the claim itself, which merely incorporates preceding paragraphs by reference. In an effort to clarify their allegations and comply iv. Sixth Cause of Action: Unfair Competition Law, Bus. & Prof. Code § 17200 In order to establish standing for the UCL Claim, plaintiffs must show that they personally lost money or property “as a result of the unfair competition.” CAL. BUS. & PROF. CODE § 17204; Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 330 (2011). Under California law: [t]here are innumerable ways in which economic injury from unfair competition may be shown. A plaintiff may (1) surrender in a transaction more, or acquire in a transaction less, than he or she otherwise would have; (2) have a present or future property interest diminished; (3) be deprived of money or property to which he or she has a cognizable claim; (4) be required to enter into a transaction, costing money or property, that would otherwise have been unnecessary. Kwikset, 51 Cal. 4th at 323. Here, Plaintiffs allege two harms: (1) loss of the monetary value of the personal information, and (2) failure to receive the benefit of their bargain with Twitter. (CCAC ¶¶ 185, 192.) If either harm is plausibly alleged, Plaintiffs would satisfy the standing requirement for these two causes of action. Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1040 (N.D. Cal. 2019). Plaintiffs contend that the complaint adequately alleges how and when Plaintiffs’ PII was offered for sale and the monetary value and market for PII. (CCAC ¶¶ 46, 48, 50-52, 56-57, 59- 60, 102, 185.) Plaintiffs position that the sale of their PII on the dark web satisfies the “lost-value- of-PII” theory has been rejected by courts in this district, because the existence of a nefarious market does not equate to an allegation that Plaintiffs “attempted or intended to participate in this market, or otherwise to derive economic value from their PII.” Doe v. Meta Platforms, Inc., No. 22-CV-03580-WHO, 2023 WL 5837443, at *16 (N.D. Cal. Sept. 7, 2023) (quoting Moore v. Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 538 (2022), review denied (Dec. 14, 2022)). To the extent that Plaintiffs rely on Brown v. Google LLC, No. 20-CV-03664-LHK, 2021 WL 6064009 (N.D. Cal. Dec. 22, 2021), for the proposition that the future value of their data was diminished by the unauthorized sale of that data, that reliance is misplaced. (Pls.’ Opp’n at 15.) Brown is factually inapposite because that case involved allegations that Plaintiffs had been induced to give Google their data without payment, and that they would have demanded payment had they known that Google had previously paid individuals for their browsing histories. Brown, is dismissed with prejudice, because any amendment would be futile. Plaintiffs, however, do have the potential to sufficiently allege economic injury based on “benefit of the bargain.” (See Pls.’ Opp’n at 15.) Business and Professions Code § 22576 prohibits “an operator of a commercial website” that collects PII from consumers from violating “its posted privacy policy.” Plaintiffs argue that they have UCL standing based on a breach of the contractual privacy protections governing the sales in violation of Section 22576. (Id.; see also CCAC ¶ 183.) Thus, Plaintiffs have standing so long as they have adequately alleged that Defendant breached the terms of its privacy agreement. See In re Anthem, Inc. Data Breach Litig., No. 15-md-2617-LHK, 2016 WL 3029783, at *13, *30 (N.D. Cal. 2016) (finding defendant’s breach of privacy policies incorporated into customers’ insurance contracts deprived plaintiffs of the benefit of their bargain and caused economic injury sufficient to establish UCL standing). Plaintiffs are, therefore, granted leave to amend to clearly allege violations of the privacy policy, which, if adequately pled, will satisfy the harm requirement for the UCL claim. Thus, the sixth cause of action is dismissed with leave to amend. v. Seventh Cause of Action: California Consumers Legal Remedies Act The seventh cause of action is for violation of the California Consumers Legal Remedies Act (“CLRA”). (CCAC ¶¶ 186-193.) Defendant argues that the CLRA claim fails because Plaintiffs fail to allege that the parties engaged in a transaction for the “sale or lease of goods or services to any consumer.” (Def.’s Mot. at 22 (quoting Cal. Civ. Code § 1770(a)).) At the hearing, Plaintiffs conceded this cause of action. Accordingly, the seventh cause of action is dismissed with prejudice. vi. Eighth Cause of Action: Declaratory Judgment The eighth cause of action is for declaratory judgment. (CCAC ¶¶ 194-201.) Specifically, Plaintiffs allege that Twitter’s data security measures remain inadequate, and they seek a declaratory judgment that Twitter owes a legal duty to secure consumers’ PII and to timely notify them of a data breach, and that it continues to breach that duty by failing to employ reasonable measures to secure consumers’ PII. (CCAC ¶¶ 196-197.) 1 (Def.’s Mot. at 23.) Plaintiffs’ claim for gross negligence is sufficiently pled. Furthermore, a 2 dispute exists as to the continued risk Plaintiffs and similarly situated users face, rendering the 3 dismissal of the declaratory judgment claim premature. See Bass v. Facebook, Inc., 394 F. Supp. 4 } 3d 1024, 1040 (N.D. Cal. 2019). 5 Accordingly, the motion to dismiss is denied as to the eighth cause of action. 7 For the reasons set forth above, Defendant’s motion to dismiss is GRANTED IN PART 8 AND DENIED IN PART. Consistent with this order, the motion is granted with leave to amend 9 as to first, second, third, fifth, and sixth causes of action. The motion is granted with prejudice 10 regarding the seventh cause of action for violation of the California Consumers Legal Remedies 11 Act. The motion is denied as to the fourth and eighth causes of action. 12 Plaintiffs shall file a second amended complaint within 21 days of this order. 14 Dated: March 29, 2024

A 16 United States Magistrate Judge

18 19 20 21 22 23 24 25 26 27 28