K. v. Google LLC

Opinion

M.K., a minor by and through his guardian Case No. 21-cv-08465-VKD ad litem Melanie Kirksey, Plaintiff, ORDER GRANTING GOOGLE LLC’S v. COMPLAINT GOOGLE LLC and FREMONT UNIFIED Re: Dkt. No. 33 Defendants. Plaintiff M.K., through his mother as guardian ad litem, sues Google, LLC (“Google”) and the Fremont Unified School District (“District”), alleging that defendants violated his right to privacy through a Google platform used for remote learning during the COVID-19 pandemic. Google moves pursuant to Rule 12(b)(6) to dismiss the complaint. M.K. opposes the motion. Upon consideration of the moving and responding papers, as well as the oral arguments presented, the Court grants Google’s motion to dismiss the complaint, with leave to amend.1 The following background facts are based on the allegations of the complaint. M.K. is a minor who attends a public elementary school in the District. Dkt. No. 1 ¶ 1. In March 2020, due to the COVID-19 pandemic, M.K. began attending school remotely through a Google platform that allowed schools and students to transition to “online and internet based systems to access their education.” Id. ¶¶ 1-3. According to the complaint, “[p]arents were not

1 All parties have expressly consented that all proceedings in this matter may be heard and finally given an option to opt out or an alternative to receive education if they did not wish to risk their child’s privacy.” Id. ¶ 3. The complaint further alleges that “[w]ithout notice to parents Google has collected troves of personal information, including: M.K.’s physical locations, websites visited, every search term used in Google’s search engine and links clicked on, the videos watched, voice recordings, saved passwords, biometrics and other behavioral information.” Id. ¶ 6. M.K. alleges, on information and belief, that his “device was hacked in January 2021 and the hacker sent sexually explicit content to [his] classroom teacher.” Id. ¶ 7. The content reportedly sent by the hacker “was linked to M.K.,” and M.K. was both exposed to, and disciplined for, that content. Id. The complaint further alleges, on information and belief, that “Google will log the hacker’s explicit conduct as conduct of M.K.” and that M.K. “has no means of clearing his reputation and ensuring that data associated with him and [sic] is his data.” Id. ¶ 8. According to M.K., “Google and [the District] failed to inform teachers, school staff and parents of the risk of stalking or hacking into the classroom.” Id. ¶ 7. Google allegedly failed to “provide the school with full notice of its collection, use, and disclosure practices” and did not “enable [learning education agencies] to review and have deleted the personal information collected from its students.” Id. ¶¶ 11, 14. As such, the District reportedly “could not consent to Google’s collection of data[.]” Id. ¶ 14. M.K. states that the District failed “to inform parent[s] of what Google would collect and use” and of “the security risks” presented by “predators and hackers while in online classrooms,” and “failed to obtain parental consent.” Id. ¶¶ 11, 14, 15. Reportedly, neither defendant informed parents that M.K.’s “biometric data would be collected and stored[.]” Id. ¶ 14. The complaint asserts five claims for relief for alleged violation of the federal Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710 (claim 1); violation of the California Student Online Personal Information Protection Act (“SOPIPA”), Cal. Bus. & Prof. Code § 22584 (claim 2); violation of California’s unfair competition law (“UCL”), Cal. Bus. & Prof. Code § 17200, et seq. (claim 3); “Failure to Protect” (claim 4); and violation of the California constitutional right to privacy (claim 5).2 The complaint seeks damages, as well as injunctive relief, including “an order requiring Google to permanently destroy the biometric identifiers and biometric information it has collected from [M.K.].” Id. at 14. Google moves pursuant to Rule 12(b)(6) to dismiss each of M.K.’s claims for relief. With respect to the VPPA claim, Google argues that the complaint fails to state sufficient facts establishing a plausible claim for relief. As for the remaining claims, Google contends that they are preempted by the federal Children’s Online Privacy Protection Act of 1998 (“COPPA”), and that the complaint fails, in any event, to state sufficient facts supporting plausible claims for relief. For the reasons discussed below, the Court dismisses M.K.’s claims for failure to state a claim for relief. A motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) tests the legal sufficiency of the claims in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). Dismissal is appropriate where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory. Id. (citing Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990)). In such a motion, all material allegations in the complaint must be taken as true and construed in the light most favorable to the claimant. Id. However, “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Moreover, “the court is not required to accept legal conclusions cast in the form of factual allegations if those conclusions cannot reasonably be drawn from the facts alleged.” Clegg v. Cult Awareness Network, 18 F.3d 752, 754-55 (9th Cir. 1994). Rule 8(a)(2) requires only “a short and plain statement of the claim showing that the pleader is entitled to relief.” This means that the “[f]actual allegations must be enough to raise a right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 2 Although the complaint did not clearly indicate which claims are asserted against each defendant, M.K. subsequently confirmed that the VPPA and UCL claims are asserted only against (2007) (citations omitted). However, only plausible claims for relief will survive a motion to dismiss. Iqbal, 556 U.S. at 679. A claim is plausible if its factual content permits the court to draw a reasonable inference that the defendant is liable for the alleged misconduct. Id. A plaintiff does not have to provide detailed facts, but the pleading must include “more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Id. at 678. Documents appended to or incorporated into the complaint or which properly are the subject of judicial notice may be considered along with the complaint when deciding a Rule 12(b)(6) motion. Khoja v. Orexigen Therapeutics, 899 F.3d 988, 998 (9th Cir. 2018); Coto Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010).3 A. Claim 1: VPPA, 18 U.S.C. § 2710 The VPPA prohibits “[a] video tape service provider” from “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider[.]” 18 U.S.C. § 2710(b)(1). That provision “protects generally a consumer’s substantive privacy interest in his or her video-viewing history.” Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017). In relevant part, the statute defines the term “video tape service provider” to mean “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials[.]” 18 U.S.C. § 2710(a)(4). The VPPA defines the term “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. § 2710(a)(1). The VPPA defines “personally identifiable information” to “include[] information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” Id. § 2710(a)(3). To plead a plausible claim under section 2710(b)(1), M.K. must allege that (1) Google is a “video service provider,” (2) M.K. is a “consumer,” (3) Google knowingly disclosed his “personally identifiable information” to “any person,” and (4) the disclosure was not

3 The Court does not find it necessary or appropriate to consider materials submitted by Google authorized by section 2710(b)(2). See Mollett v. Netflix, Inc., 795 F.3d 1062, 1066 (9th Cir. 2015); Stark v. Patreon, Inc., — F. Supp. 3d —, No. 22-cv-03131-JCS, 2022 WL 7652166, at *5 (N.D. Cal. Oct. 13, 2022). Even under liberal pleading standards, M.K.’s complaint fails to state facts plausibly establishing the elements of a VPPA claim. The complaint does not allege any facts that M.K. watched videos, or the circumstances under which that occurred, except for highly generalized allegations that Google collected various pieces of information about him, including “videos watched.” See Dkt. No. 1 ¶ 6; see also id. ¶¶ 25, 52, 58. There are no facts alleged about the platform, application, or website M.K. reportedly used to watch videos, or any facts from which the Court plausibly could infer that M.K. is a “consumer” and Google is a “video tape service provider” within the meaning of the VPPA. Instead, M.K. alleges, in formulaic language that largely parrots the language of the VPPA, that that “[a]s users [sic] of the App, [M.K.] is a consumers [sic] within the definition of 18 U.S.C. § 2710(a)(1) of the VPPA,” and that Google “delivers pre-recorded audio visual materials as described in 18 U.S.C. § 2710(a)(4) and is engaged in the business, or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio-visual materials delivering videos to consumers through its applications and platforms.” Id. ¶¶ 35, 36. The complaint does not identify what “App” is being referred to, and other allegations that M.K. highlights in his opposition brief simply state that he used a Google platform for remote learning during the COVID-19 pandemic; his account was hacked; and “his teacher received sexually inappropriate messages which were attributed to [him][.]” See id. ¶¶ 1-3, 48-50. The complaint alleges, in equally conclusory fashion, that Google “collected consumers[’] personally identifiable information (‘PII’) within 18 U.S.C. § 2710(a)(3),” and “upon information and belief,” Google disclosed such information to unidentified “third-parties, including data brokers and advertisers[.]” Id. ¶¶ 37, 38. There are no facts linking these allegations to M.K., much less identifying what “personally identifiable information” Google allegedly disclosed, or to whom such information was disclosed. In sum, M.K.’s complaint fails to plead facts establishing the foundational requirements for a VPPA claim. For the first time in his opposition, M.K. asserts that he “was given a Google based account through [the District] and he accessed videos through Google on that account.” Dkt. No. 45 at 9. He further states that “Google delivered videos to [him], student’s [G]oogle chrome book and account connect him to videos watched[,] and his teacher and district staff were given access to what [he] watched and when it was being watched.” Id. No such facts are alleged in the complaint. M.K. also requests leave to amend “to clarify that [his] school reviewed his online activity and informed parents of that review.” Id. at 10. Google maintains that such allegations, even if credited, would not state a plausible VPPA claim, or would be subject to a statutory exception to liability. See Dkt. No. 47 at 8. While it remains unclear precisely what facts M.K. believes he can assert on amendment to correct the identified pleading deficiencies, on this record the Court cannot conclude that amendment will be futile. Accordingly, M.K. is given leave to amend his VPPA claim. B. COPPA Preemption Google moves to dismiss M.K.’s state and common law claims for relief on the ground that they are all expressly preempted by COPPA. See Dkt. No. 33 at 12-14; Dkt. No. 47 at 3-16. Google’s preemption argument is based on the premise that M.K. cannot sue under state or common law claims to privately enforce violations of COPPA. The current rule in the Ninth Circuit is that “COPPA’s preemption clause does not bar state-law causes of action that are parallel to, or proscribe the same conduct forbidden by, COPPA.” Jones v. Google LLC, 56 F.4th 735, 741 (9th Cir. 2022).4 Accordingly, Google’s motion to dismiss M.K.’s state and common law claims for relief based on express preemption under COPPA is denied. C. Failure to State a Claim for Relief Google maintains that even if they are not preempted by COPPA, each of M.K.’s state law and common law claims must be dismissed because the complaint fails to adequately allege facts supporting a plausible claim for relief. For the reasons discussed below, the Court agrees.

4 The Court understands that there is a pending request before the Ninth Circuit for a rehearing in 1. SOPIPA, Cal. Bus. & Prof. Code § 22584 SOPIPA prohibits an “operator”5 from engaging in certain activities, and also imposes certain duties, with respect to students in kindergarten through the twelfth grade. For example, the statute prohibits an operator from “[u]s[ing] information, including persistent unique identifiers, created or gathered by the operator’s site, service, or application, to amass a profile about a K-12 student except in furtherance of K-12 school purposes”; “[s]ell[ing] a student’s information”; or disclosing certain information about the student. See Cal. Bus. & Prof. Code § 22584(b)(1)(A)(2), (3), (4). SOPIPA also requires an operator to, among other things, “[i]mplement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure,” and to “[d]elete a student’s covered information if the school or district requests deletion of data under the control of the school or district.” Id. § 22584(d)(1), (2). Google argues that the complaint’s allegations are vague and unsupported by sufficiently specific facts. M.K. offers no argument to the contrary. See Dkt. No. 45 at 10-12. Indeed, the complaint alleges “upon information and belief” that “Google has collected personal information including behavioral information and biometric data for purposes that do not further school purposes.” Dkt. No. 1 ¶ 46. While the complaint elsewhere asserts (on information and belief) various ways in which Google might collect a student’s biometric data (Dkt. No. 1 ¶ 58), M.K. alleges no facts explaining how or why he believes that Google collected his biometric information. To the extent M.K.’s claim is based on the alleged hacking incident (see id. ¶ 48), the complaint contains no facts explaining what role, if any, Google played in that event. The complaint contains no allegations that would permit a plausible inference that Google failed to implement and maintain reasonable security procedures and practices. Accordingly, M.K.’s SOPIPA claim is dismissed. Arguing that there is no private right of action under SOPIPA, Google contends that this 5 SOPIPA defines the term “operator” to mean “the operator of an Internet Web site, online service, online application, or mobile application with actual knowledge that the site, service, or claim must be dismissed without leave to amend. The parties have not cited, and the Court has not found, any authority discussing SOPIPA § 22584. And neither M.K. nor Google has engaged in the kind of analysis that would allow the Court to make an informed decision about whether there is a private right of action under the statute, or whether any such right properly could be implied. Accordingly, and assuming (without deciding) that M.K. can privately enforce alleged violations of SOPIPA, the Court will give him leave to amend. To the extent M.K. contends that he can, in any event, enforce SOPIPA violations through California’s UCL, his UCL claim is discussed below. 2. UCL, Cal. Bus. & Prof. Code § 17200, et seq. California’s UCL broadly defines “unfair competition” to “include any unlawful, unfair or fraudulent business act or practice . . ..” Cal. Bus. & Prof. Code § 17200. “Its purpose is to protect both consumers and competitors by promoting fair competition in commercial markets for goods and services.” Kwikset v. Super. Ct., 51 Cal. 4th 310, 320 (2011) (internal quotations and citation omitted). “Because Business and Professions Code section 17200 is written in the disjunctive, it establishes three varieties of unfair competition—acts or practices which are unlawful, or unfair, or fraudulent. In other words, a practice is prohibited as unfair or deceptive even if not unlawful and vice versa.” Cel-Tech Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 20 Cal. 4th 163, 180 (1999) (internal quotations and citations omitted). Although M.K.’s complaint makes passing reference to “deceptive” conduct (see Dkt. No. 1 ¶¶ 66, 70), M.K.’s allegations and arguments focus on the “unlawful” and “unfair” prongs of the UCL. His overall thesis appears to be that Google unlawfully collected and stored his personal information. See, e.g., Dkt. No. 1 ¶¶ 52, 58, 62, 67, 72. The Court agrees with Google that, as a threshold matter, M.K.’s UCL claim fails because he has not alleged facts establishing his standing to bring such a claim. “While the substantive reach of [the UCL] remains expansive,” to establish standing to enforce the UCL’s provisions, a plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury, and (2) show that that economic injury was the result of, i.e., Kwikset Corp., 51 Cal. 4th at 322; see also Cal. Bus. & Prof. Code § 17204 (“Actions for relief pursuant to this chapter shall be prosecuted exclusively in a court of competent jurisdiction . . . by a person who has suffered an injury in fact and has lost money or property as a result of the unfair competition.”). Standing to bring a UCL claim therefore is “substantially narrower than federal standing under article III, section 2 of the United States Constitution, which may be predicated on a broader range of injuries.” Kwikset Corp., 51 Cal. 4th at 324. To the extent M.K.’s complaint appears to base his standing on the alleged collection and storage of his personal information (see Dkt. No. 1 ¶¶ 52, 58, 62, 67, 72), courts have held that “[a] plaintiff’s ‘personal information’ does not constitute property under the UCL.” In re Facebook Priv. Litig., 791 F. Supp. 2d 705, 714 (N.D. Cal. 2011), aff’d, 572 F. App’x 494 (9th Cir. 2014); see also Archer v. United Rentals, Inc., 195 Cal. App. 4th 807, 816 (2011) (dismissing UCL invasion of privacy claim based on “the unlawful collection and recordation of [plaintiffs’] personal identification information” because plaintiffs “failed to demonstrate how such privacy violation translates into a loss of money or property.”). M.K. offers no argument or authority to the contrary. Instead, M.K. argues that he “has a property interest in education,” and that the alleged “damage to his reputation resulted in loss of actual education and class time.” See Dkt. No. 45 at 12 (citing Goss v. Lopez, 419 U.S. 565, 574 (1975)). Goss held that students have a property interest in public education protected by the Due Process Clause of the Fourteenth Amendment. Goss, 419 U.S. at 574. M.K. has not presented any argument or authority recognizing that the alleged harms to that interest or to his reputation constitute “a loss of money or property” required to establish standing to enforce the UCL. For the first time in his opposition brief, M.K. argues that his parents were “required to fund tutors for [him] after he was removed by his teacher for online conduct associated to his account” and “to escape the tracking and collection of data[.]” Dkt. No. 45 at 12. M.K. acknowledges, however, that these allegations are not in his complaint. Moreover, it remains unclear whether he might be able to plead sufficient facts demonstrating that such economic injury properly may be attributed to him, or that it necessarily was caused by amendment will be futile. According, M.K. is given leave to amend this claim to assert facts establishing his standing. Pending an amended complaint that establishes M.K.’s standing, the Court does not address Google’s remaining arguments that M.K. fails to plead facts establishing a plausible UCL violation. 3. Failure to Protect M.K. claims that Google was “negligent when it failed to train . . . teachers on the risk of hackers and predators infiltrating the online platform and how to respond and identify individuals who hacked into the online class programs and protect student safety.” Dkt. No. 1 ¶ 77. He further alleges that he was “forced to use Google’s service in order to participate in school,” and that Google “secretly and unlawfully monitor[ed] and profile[d] children . . . without the knowledge or consent of those children’s parents,” and to M.K.’s detriment, “causing him to have his account infiltrated with inappropriate language of a hacker.” Id. ¶ 78. M.K.’s claim sounds in negligence, which requires him to allege facts establishing “(1) a legal duty of due care; (2) a breach of that duty; (3) causation; and (4) damages.” In re Google Android Consumer Privacy Litig., No. 11-MD-02264 JSW, 2013 WL 1283236, at *12 (N.D. Cal. Mar. 26, 2013). Google argues, persuasively, that the complaint fails to plausibly allege facts supporting the breach of any duty Google owed to M.K. The complaint alleges that Google “had a duty to protect [him] from predators while he was participating in his online school” and that Google “assumed this responsibility when it made entered [sic] schools for the purpose of data collection.” Dkt. No. 1 ¶ 82. In essence, M.K.’s complaint concerns a situation where Google offers an educational platform that the District chose to use. While M.K. contends that in doing so, Google “created a special relationship” with him and essentially owed a duty of care under the “Good Samaritan Rule” (see Dkt. No. 45 at 13), he cites no authority to that effect.6 As discussed above, M.K.’s allegations concerning Google’s alleged monitoring and collection of data about him, and its role (if any) in the alleged hacking incident, are conclusory and inadequately pled. 6 Additionally, M.K.’s arguments that “Google has not been neutral” (Dkt. No. 45 at 14) appear to be based on a misapprehension of the court’s discussion of “content-neutral liability” for purposes Accordingly, M.K.’s claim based on a negligent failure to protect is dismissed. Because the Court cannot conclude that amendment would be futile, M.K. is given leave to amend. 4. California Constitutional Right to Privacy “The California Constitution creates a privacy right that protects individuals from the invasion of their privacy by private parties.” In re Yahoo! Mail Litig., 7 F. Supp. 3d 1016, 1037 (N.D. Cal. 2014); Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 20 (1994) (The right to privacy embodied in article I, section 1 of the California Constitution “creates a right of action against private as sell as government entities.”). To state a claim for invasion of privacy under the California Constitution, M.K. must plead facts establishing “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.” Hill, 7 Cal. 4th at 39-40. “Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right. Thus, the extent and gravity of the invasion is an indispensable consideration in assessing an alleged invasion of privacy.” Id. at 37. As discussed above, M.K.’s complaint is highly conclusory and does not plausibly allege facts to support Google’s alleged monitoring and collection of data about him. Here, M.K. alleges that Google monitored his “privately owned personal computer and his Chrome Book during non[- ]school hours,” and “design[ed] the App to secretly obtain, and improperly gain knowledge of, review, and[/]or retain [M.K.]’s activities through the technologies and activities described herein.” Dkt. No. 1 ¶¶ 88, 89. M.K. further alleges that “the nature of privacy invasion involves sharing [M.K]’s personally identifiable information and/or viewing data with potentially countless third-parties, known and unknown, for undisclosed and potentially unknowable purposes, in perpetuity.” Id. ¶ 90. There are no facts identifying what “App” is referred to or the “technologies and activities” purportedly set out in the complaint. Nor does the complaint allege any facts describing the purported sharing of M.K.’s data, what data was shared, and with whom it was shared. In sum, M.K. fails to allege sufficient facts to plausibly establish that Google violated his Accordingly, M.K.’s claim for invasion of privacy under the California Constitution is dismissed. Because the Court cannot conclude that amendment would be futile, M.K. is given leave to amend this claim. Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely given when justice so requires,” because “the court must remain guided by the underlying purpose of Rule 15 . . . to facilitate decisions on the merits, rather than on the pleadings or technicalities.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (internal quotation marks and citation omitted). “The decision of whether to grant leave to amend nevertheless remains within the discretion of the district court,” which may deny leave to amend if allowing amendment would unduly prejudice the opposing party, cause undue delay, or be futile, or if the party seeking amendment has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512 F.3d 522, 532 (9th Cir. 2008) (citing Foman v. Davis, 371 U.S. 178, 182 (1962)). Although M.K. has articulated some additional facts that he believes could be alleged on an amendment, the Court harbors some uncertainty whether those additional facts will correct all of the pleading deficiencies identified in Google’s present motion. Nevertheless, as the law generally favors resolving matters on the merits, the Court will permit M.K. to amend his claims. Amendment is limited to the claims asserted in his complaint.7 Based on the foregoing, Google’s motion to dismiss is granted with leave to amend, consistent with the rulings in this order. M.K.’s amended complaint shall be filed by April 10, 2023. Google’s response to the amended complaint shall be filed April 24, 2023. The initial case management conference is re-set for May 30, 2023, 1:30 p.m. The parties’ joint case management statement is due by May 23, 2023. All other related deadlines in 7 In his opposition, M.K. argues, in passing, that claims for security breaches are allowed under the California Consumer Privacy Act (“CCPA”). Dkt. No. 45 at 7. No such claim is alleged in his complaint. Indeed, in the proceedings concerning Google’s present motion to dismiss, as well as the separate motion to dismiss filed by the District, M.K. has alluded to potential other claims he 1 the Court’s Order Setting Initial Case Management Conference and ADR Deadlines (Dkt. No. 4) 2 are adjusted accordingly. 4 Dated: March 27, 2023 5 6 Varga win K, Marcle: VIRGINIA K. DEMARCHI 7 United States Magistrate Judge 8 9 10 11 a 12

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28