K. v. Google LLC

Opinion

M. K., Case No. 21-cv-08465-VKD

Plaintiff, ORDER GRANTING IN PART AND v. DENYING IN PART GOOGLE’S MOTION TO DISMISS GOOGLE LLC, et al., Re: Dkt. No. 78 Defendants.

Plaintiff M.K., through his mother as guardian ad litem, brings this action against Google, LLC (“Google”) and the Fremont Unified School District (“District”) asserting claims for relief for harm M.K. alleges he suffered when the District used a Google platform to facilitate remote learning during the COVID-19 pandemic.1 Both defendants moved to dismiss M.K.’s original complaint pursuant to Rule 12(b)(6). Dkt. Nos. 21, 33. The Court granted these motions, but gave M.K. leave to amend his complaint. Dkt. Nos. 64, 65. M.K.’s first amended complaint (“FAC”) asserts four claims against Google for: (1) violation of the federal Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710; (2) violation of California’s unfair competition law (“UCL”), Cal. Bus. & Prof. Code § 17200, et seq.; (3) violation of the California Student Online Personal Information Protection Act (“SOPIPA”), Cal. Bus. & Prof. Code § 22584; and (4) “failure to protect.” Dkt. No. 66 ¶¶ 39-104.2 Google again

1 All parties have expressly consented that all proceedings in this matter may be heard and finally adjudicated by a magistrate judge. 28 U.S.C. § 636(c); Fed. R. Civ. P. 73; Dkt. Nos. 6, 19, 32. moves to dismiss all claims pursuant to Rule 12(b)(6). See Dkt. No. 78. M.K. opposes the motion, except that he has withdrawn his SOPIPA claim against Google. See Dkt. No. 83. The Court held a hearing on Google’s motion to dismiss on July 18, 2023. Dkt. No. 86. Upon consideration of the moving and responding papers, as well as the oral arguments presented, the Court grants the motion in part and denies it in part. The following facts are based on the allegations of the FAC. In 2020, M.K. was a student at a public elementary school in the District. Dkt. No. 66 ¶ 1. In March 2020, due to the COVID-19 pandemic, the District closed its school buildings, and M.K. began attending school remotely using a Google platform.3 Id. ¶¶ 1-2. According to the FAC, “M.K’s parents were not given an option to opt out or an alternative to receive education if they did not wish to submit M.K. to the risks of attending school on the Google platform.” Id. ¶ 2. The District assigned M.K. a Google account. Id. ¶ 3. Using this account, M.K. “[was] allowed to access online videos provided by Google’s YouTube, a video sharing platform[,] as well as Google [Slide Show], a platform that allows individuals to watch videos as well as insert videos and messages into slideshows to watch.” Id. ¶ 7. The District logged M.K. out of his Google account at the end of each school day. Id. ¶ 3. According to the FAC, M.K. used multiple devices to access his Google account, including his personal iPad and, later, a Google Chromebook computer supplied by the District. Id. ¶¶ 4, 6. M.K. watched videos on Google’s YouTube and Slide Show platforms while logged into the Google platform for school. Id. ¶ 9. M.K.’s teachers informed his parents that M.K. was watching videos during class when he should have been focused on his lessons. Id. ¶ 10. M.K.’s teachers further advised M.K.’s parents that the teachers could see M.K.’s online activity during class time. Id. Based on this information, M.K. alleges that Google gave the District and other 3 In some places, the FAC refers to this platform as “Google Classroom” or “Google Classrooms.” See Dkt. No. 66 ¶¶ 4, 14. In its motion, Google refers to this as its “education platform, Google Workspace for Education.” See Dkt. No. 78 at 1. However, it is not clear from the allegations in the FAC exactly what the platform is or whether there are any terms of service that govern the unidentified third parties access to M.K.’s online activity. Id. ¶ 13. On or about January 14, 2021, one of M.K’s teachers reported receiving a sexually explicit communication from M.K. via a Google chat message. Id. ¶ 16. M.K. alleges that his Google account had been hacked and that he did not send the message. Id. ¶¶ 17, 20, 24. The District investigated the message incident. As part of that investigation, the District obtained and reviewed information about the dates and times M.K.’s Google account was accessed, the activities the account user engaged in while logged in to the account, and the IP addresses used to access the account. Id. ¶¶ 18, 20-21, 49. According to the FAC, on or about January 27, 2021, M.K.’s teacher “scheduled a parent- teacher zoom call and made a teacher suspension on the basis of ‘Sexual Harassment via Google Classroom.’” Id. ¶ 22. The FAC describes the suspension variously as a “teacher removal from class,” a two-day suspension from school, an exclusion from “his regular school day” that lasted “weeks,” and a “permanent[]” removal from class. Id. ¶¶ 23, 25-26, 28, 82, 107. M.K. eventually stopped attending school in the District. Id. ¶¶ 31, 82. M.K. alleges that “Google made M.K.’s personal information available to hackers, and to staff of [the District], who then penalized [him] for a hacker[’]s activity on Google Slideshow and Google Chat.” Id. ¶ 52. He also alleges that Google failed to implement adequate cybersecurity measures to prevent his Google account from being hacked, or his personal information from being used or disclosed for unauthorized purposes, and that Google failed to warn M.K.’s parents and the District of the “vulnerability of Google Classrooms.” Id. ¶¶ 77-81, 87. M.K. seeks “an order requiring Google to permanently destroy all data of M.K.” and other injunctive relief, damages for “emotional distress and damage to reputation caused by negligence,” and punitive damages. Id. at 16-17. A motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) tests the legal sufficiency of the claims in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). Dismissal is appropriate where there is no cognizable legal theory or an absence of sufficient facts F.2d 696, 699 (9th Cir. 1990)). At the motion to dismiss stage, all material allegations in the complaint must be taken as true and construed in the light most favorable to the claimant. Id. The factual allegations in the complaint “must be enough to raise a right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). Implausible claims for relief will not survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009). A claim is plausible if its factual content permits the court to draw a reasonable inference that the defendant is liable for the alleged misconduct. Id. at 678. Rule 8(a)(2) requires only “a short and plain statement of the claim showing that the pleader is entitled to relief.” However, “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678. “The court is not required to accept legal conclusions cast in the form of factual allegations if those conclusions cannot reasonably be drawn from the facts alleged.” Clegg v. Cult Awareness Network, 18 F.3d 752, 754-55 (9th Cir. 1994). As M.K. has withdrawn his SOPIPA claim against Google (claim 3), the Court considers only Google’s motion to dismiss claims 1, 2 and 4. The Court also considers Google’s request for judicial notice. A. Google’s Request for Judicial Notice Google requests that the Court take judicial notice of guidance regarding the Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. § 6501 et seq., published by the Federal Trade Commission (“FTC”): “Complying with COPPA: Frequently Asked Questions, Federal Trade Commission,” https://www.ftc.gov/business-guidance/resources/complying-coppa- frequently-asked-questions (“COPPA Guidance”). See Dkt. No. 78 at 3-4. Among other things, the COPPA guidance states that “[m]any school districts contract with third-party website operators to offer online programs . . . [i]n these cases, the schools may act as the parent’s agent and can consent under COPPA to the collection of kids’ information on the parent’s behalf.” Id. at 3. M.K. does not oppose Google’s request for judicial notice, but argues that the FTC’s COPPA “Generally, district courts may not consider material outside the pleadings when assessing the sufficiency of a complaint.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 2018). However, a court may take judicial notice of facts that are “not subject to reasonable dispute” because they are “generally known” or “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Id. at 999; Fed. R. Evid. 201(b). Courts may take judicial notice of matters of public record, including statutes, regulations and agency interpretations thereof. See Jonna Corp. v. City of Sunnyvale, CA, No. 17-CV-00956- LHK, 2017 WL 5194513, at *4 (N.D. Cal. Nov. 9, 2017). But while a court may take notice of public records, it may not take notice of disputed facts stated in those records. Khoja, 899 F.3d at 999 (citing Lee v. City of Los Angeles, 250 F.3d 668, 689 (9th Cir. 2001)). The Court grants Google’s request for judicial notice of the FTC’s published guidance because the request is unopposed. However, the guidance has no bearing on the Court’s resolution of the motion to dismiss. B. Claim 1: Video Privacy Protection Act Congress enacted the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, “to preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” Mollett v. Netflix, Inc., 795 F.3d 1062, 1065 (9th Cir. 2015) (quoting S. Rep. 100-599, at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342–1.). The statute forbids “video tape service provider[s]” from knowingly disclosing “personally identifiable information concerning any consumer.” 18 U.S.C. § 2710(b)(1). A person aggrieved by a violation of the statute may bring an action for actual damages of not less than $2,500, punitive damages, attorneys’ fees, and injunctive relief. See 18 U.S.C. § 2710(c). To state a claim for violation of the VPPA, M.K. must plausibly allege that (1) Google is a “video tape service provider,” (2) M.K. is a “consumer,” (3) Google knowingly disclosed M.K.’s “personally identifiable information” to “any person,” and (4) the disclosure was not a permitted disclosure authorized under § 2710(b)(2). See Dkt. No. 65 at 4-5 (citing Mollet, 795 F.3d at 1066). M.K. alleges that Google is a video tape service provider because it delivers audio visual that he is a “non-paying subscriber of Google Classrooms, Youtube and Google Slideshow and was given an account to access the listed Google Platforms by [the District].” Id. ¶ 40. He alleges “upon information and belief” that the District “pays a subscription fee which pays for the subscription costs of each student within the [D]istrict.” Id. Finally, M.K. alleges that Google shared his personal information with third parties, including the District and its employees, without his consent. See id. ¶¶ 46-51. Google does not dispute that it is a video tape service provider within the meaning of the VPPA, but it argues that M.K. fails to plausibly allege that the company disclosed his personal information to anyone other than the District. Dkt. No. 78 at 5-6. Google also argues that disclosure of M.K.’s personal information to the District does not violate the VPPA because (1) M.K. is not a “consumer” within the meaning of the statute, as his account was created as part of his relationship with the District, not a relationship with Google, and (2) any disclosure to the District was permitted under the statute’s exception for disclosures made in the ordinary course of business. Id. at 7-9. The Court considers each of these arguments. 1. Whether M.K. is a “consumer” For purposes of the VPPA, a consumer is “any renter, purchaser, or subscriber of goods or services” from a video tape service provider. 18 U.S.C. § 2710(a)(1). The VPPA does not define the term “subscriber.” While the parties appear to agree that a person may be a subscriber even if he does not pay for a subscription, they disagree about whether M.K. is a subscriber of goods and services from Google. See Dkt. No. 78 at 7-8; Dkt. No. 83 at 4-5. M.K. contends that he is a subscriber because he has a Google account, including a unique login, and he argues that it does not matter that the District required him to have such an account or arranged for him to get it. Dkt. No. 83 at 4-5. Google argues that M.K. is not a subscriber because his relationship is with the District only, and not with Google. Dkt. No. 78 at 7. The Ninth Circuit has not addressed the meaning of the term “subscriber” as used in the VPPA. The two circuits that have considered this question have adopted similar interpretations of the statutory text. In Ellis v. Cartoon Network, the Eleventh Circuit held that “’subscription’ person and an entity.” 803 F.3d 1251, 1256 (11th Cir. 2015). Relevant considerations include whether the relationship between the plaintiff and the video tape service provider involves payment, registration, establishment of an account, provision of personal information, receipt or delivery of goods or services, expressed association, and/or access to restricted content. See id.; see also Perry v. Cable News Network, 854 F.3d 1336, 1342 (11th Cir. 2017) (applying the Ellis framework). In Ellis, the plaintiff downloaded the defendant’s free application on his smartphone and used it to watch video clips. The Eleventh Circuit concluded the plaintiff was not a subscriber within the meaning of the VPPA, explaining: In our view, downloading an app for free and using it to view content at no cost is not enough to make a user of the app a “subscriber” under the VPPA, as there is no ongoing commitment or relationship between the user and the entity which owns and operates the app. Importantly, such a user is free to delete the app without consequences whenever he likes, and never access its content again. The downloading of an app, we think, is the equivalent of adding a particular website to one’s Internet browser as a favorite, allowing quicker access to the website's content. Under the circumstances, Mr. Ellis was not a “subscriber” of Cartoon Network or its CN app. Ellis, 803 F.3d at 1257; see also Perry, 854 F.3d at 1342-43 (concluding that plaintiff was not a subscriber of CNN, even if he was able to access certain features a typical user of CNN’s free mobile application could not, because plaintiff’s ability to access those features was due to his status as a subscriber of his cable television provider, not CNN). In Yershov v. Gannett Satellite Information Network, the First Circuit considered many of the same factors described in Ellis, but reached a different conclusion on similar facts. 820 F.3d 482, 488 (1st Cir. 2016). Although the First Circuit agreed that “subscription” requires more than merely accessing content through a web browser, it disagreed with the Eleventh Circuit’s conclusion that downloading a mobile application is insufficient to establish a “subscriber” relationship with the application’s provider. The First Circuit explained: To use the App, Yershov did indeed have to provide Gannett with personal information, such as his Android ID and his mobile device's GPS location at the time he viewed a video, each linked to free of a commitment to provide consideration in the form of that information, which was of value to Gannett. And by installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites on the web that Yershov might have accessed through a web browser. Yershov, 820 F.3d at 489; see also id. (“Ellis . . . presumed that downloading a mobile device application is the equivalent of adding a particular web site to one’s Internet browser as a favorite. . . . We do not think that such a presumption is so apparently true as to dictate our reading of the complaint, which concedes no such equivalence.”). Here, Google argues that M.K. only has a relationship with the District. Dkt. No. 78 at 8. It contends that the District provided M.K. with a Google account so that he could attend school remotely using a service Google provided to the District, and that his access to Google’s video content was made possible solely by virtue of his status as a student in the District. Id. M.K. responds that he had a Google account, with a unique login, through which he obtained access to YouTube videos and videos on Google Slide Show. Dkt. No. 83 at 5; see also Dkt. No. 66 ¶¶ 3, 7, 9. He also alleges that, by virtue of that account, Google had his personal information and tracked the videos he watched. Dkt. No. 66 ¶¶ 7-10, 13-14. He argues that these facts support the existence of a subscriber relationship between M.K. and Google. Dkt. No. 83 at 5. The Court agrees that M.K. plausibly alleges the existence of a subscriber relationship with Google. The fact that M.K. obtained his Google account through the District for the purpose of attending school remotely does not undermine his allegation that he is, in fact, a Google account- holder. While the FAC pleads few details about that account-holder relationship, the Court may reasonably infer from M.K.’s allegations that he did not merely view videos while surfing the web. Rather, the allegations in the FAC support an inference that he watched videos while logged into his Google account using an application or service provided by Google that collected information about the content he viewed and associated that activity with him. See id. ¶¶ 8-10 (“The District’s school principal and tech department . . . told parent [that] District staff had accessed student’s activity on Google Slide Show. . . . M.K. watched videos offered by Google, LLC’s Youtube and Slide Show platform.”); see also id. ¶¶ 49-50. In these circumstances, the Court concludes that M.K. adequately alleges that he is a subscriber of Google’s services for purposes of the VPPA. See, e.g., Jackson v. Fandom, Inc., No. 22-CV-04423-JST, 2023 WL 4670285, at *4 (N.D. Cal. July 20, 2023) (“Jackson does not allege merely that she viewed videos hosted on a website, but rather that she created a Fandom account; became a registered user; ‘provided Fandom with her PII, including her name and email address’; and then used Fandom to watch videos. . . . This is sufficient to plead that Jackson is a subscriber, and therefore a consumer, within the meaning of the statute.”); In re Hulu Priv. Litig., 2012 WL 3282960, at *8 (“Plaintiffs pleaded more than just visiting Hulu’s website. They were subscribers of goods and services. . . . They visited hulu.com and viewed video content. . . . The resurrected previously-deleted cookies allowed their data to be tracked ‘regardless of whether they were registered and logged in.’ . . . Hulu gave Scorecard research Plaintiffs’ ‘Hulu profile identifiers’ linked to their ‘individual Hulu profile pages that included name, location preference information designated by the user as private, and Hulu username.’”). 2. Whether any disclosure was incident to Google’s ordinary course of business The VPPA provides that a video tape service provider is exempt from liability for disclosure of a consumer’s personally identifiable information “if the disclosure is incident to the ordinary course of business of the video tape service provider.” 18 U.S.C. § 2710(b)(2)(E). The statute defines “ordinary course of business” as “only debt collection activities, order fulfillment, request processing, and the transfer of ownership.” 18 U.S.C. § 2710(a)(2). The Court agrees with Google that the FAC does not plausibly allege that Google disclosed M.K.’s personal information to third parties other than the District. With respect to the District, Google argues that “[a]ny disclosure of M.K.’s information to the District so that it could manage the [Google Workspace for Education] account that it provided to M.K.—e.g., to determine whether he was participating in class or watching YouTube videos, or whether his account had been used to disseminate inappropriate content—would be incidental to Google carrying out its agreements with its subscriber, the District, in its business operations,” thereby falling within the statutory exemption. Dkt. No. 78 at 9. M.K. disputes that the disclosures he alleges qualify for the exemption. Dkt. No. 83 at 5-6. “[T]he permissibility of disclosure under the VPPA turns on the underlying purpose for which [the provider] provides the information to a third party.” Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 626 (7th Cir. 2014); see also Rodriguez v. Sony Computer Ent. Am., LLC, 801 F.3d 1045, 1054 (9th Cir. 2015) (intra-corporate disclosures and disclosures to third parties providing services in support of business operations fell within the “order fulfillment” or “request processing” exemptions of §§ 2710(a)(2) and (b)(2)(E)). While Google may have meritorious arguments that its disclosure of M.K.’s personal information to the District was not an unauthorized disclosure within the meaning of the VPPA, the Court cannot conclude, at the pleading stage, that the alleged disclosures were merely incidental to Google’s fulfillment of its contractual obligations to the District.4 The FAC contains no information about any such contractual obligations, and they are not otherwise part of the record before the Court. Accordingly, the Court concludes that M.K.’s VPPA claim survives Google’s challenge on this basis as well, to the extent the claim challenges Google’s alleged disclosure of M.K.’s personal information to the District. C. Claim 2: Unfair Competition Law California’s UCL “prohibits, and provides civil remedies for, unfair competition,” which it defines as “any unlawful, unfair or fraudulent business act or practice.” Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 320 (2011); see Cal. Bus. & Prof. Code § 17200. The UCL “establishes three varieties of unfair competition—acts or practices which are unlawful, or unfair, or fraudulent.”

4 M.K. has no duty to foreclose an ordinary course of business defense in his complaint. See Nayab v. Cap. One Bank (USA), N.A., 942 F.3d 480, 494-95 (9th Cir. 2019) (“The burden of proving justification or exemption under a special exception to the prohibitions of a statute generally rests on one who claims its benefits. . . . The plaintiff need not negative the exception to the statute. If the defendant wishes to rely upon the proviso, the burden is upon it to bring itself within the exception.”) (quoting Schlemmer v. Buffalo, Rochester, & Pittsburg Ry. Co., 205 U.S. 1, 10 (1907)); see also Adams v. America’s Test Kitchen, LP, No. 22-CV-11309-AK, 2023 WL 4304675, at *8 (D. Mass. June 30, 2023) (plaintiff need not negate “consent” exception to VPPA liability at the pleading stage, as it is akin to an affirmative defense); Feldman v. Star Trib. Media Cel-Tech Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 20 Cal. 4th 163, 180 (1999) (cleaned up). “Restitution and injunctive relief” are the only remedies available under the UCL, but they may be “cumulative” of other remedies. De La Torre v. CashCall, Inc., 5 Cal. 5th 966, 980 (2018). M.K. alleges that Google engaged in unlawful conduct by collecting and using M.K.’s personal information without his permission in violation of COPPA and related FTC regulations.5 Dkt. No. 66 ¶¶ 55-74; Dkt. No. 83 at 9. M.K. also alleges that Google engaged in unfair conduct by signing a “Student Privacy Pledge” promising to use student data only for authorized school- related purposes and to inform students’ parents of the types of personal information Google collects and the purposes, if any, for which the information is shared with others, and then violating those promises. Dkt. No. 66 ¶ 72; Dkt. No. 83 at 9. In addition, M.K. alleges that Google represented that its platform was secure and failed to warn the District, students, and parents of the platform’s “cybersecurity weaknesses.” Dkt. No. 66 ¶¶ 75-81, 87; Dkt. No. 83 at 9. Google argues that M.K. fails to plead economic injury sufficient to establish standing under the UCL. Dkt. No. 78 at 9-10. Google also contends that the FAC does not plausibly allege a violation of COPPA or any unfair conduct. Id. at 10-11. “While the substantive reach of [the UCL] remains expansive,” to establish standing to enforce the UCL’s provisions, a plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury, and (2) show that that economic injury was the result of, i.e., caused by, the unfair business practice . . . that is the gravamen of the claim.” Kwikset Corp., 51 Cal. 4th at 321, 322; see also Cal. Bus. & Prof. Code § 17204 (“Actions for relief pursuant to this chapter shall be prosecuted exclusively . . . by a person who has suffered an injury in fact and has lost money or property as a result of the unfair competition.”). Standing to bring a UCL claim therefore is “substantially narrower than federal standing under article III, section 2 of the United States Constitution, which may be predicated on a broader range of injuries.” Kwikset Corp., 51 Cal. 4th at 324. M.K. claims that he “suffered an actual concrete economic harm” because “his family expended their personal funds to hire tutors and an attorney to handle his suspension and correct his school records.” 6 Dkt. No. 83 at 7; see also Dkt. No. 66 ¶¶ 15, 33, 73-74. M.K. argues that he “has a future interest in his parent[’]s estate and that interest was reduced by the costs of his attorney fees and tutors, and he is now deprived of money to which he had a cognizable claim through California [p]robate law.” Dkt. No. 83 at 7-8. Google moves to dismiss on the ground that M.K. alleges only economic injury to his parents, who are not parties, and that M.K. fails to plausibly allege that such injury was caused by Google. Dkt. No. 78 at 10. The Court agrees with Google that M.K. lacks standing under the UCL. First, as Google observes, M.K. does not allege that he suffered any loss of money or property. The fact that M.K.’s parents paid for tutors for M.K. and for the services of an attorney following M.K.’s suspension does not support M.K.’s assertion that he suffered economic injury. The UCL requires “that a private action under that law be brought exclusively by a “person who has suffered injury in fact and has lost money or property as a result of the unfair competition.” Amalgamated Transit Union, Loc. 1756, AFL-CIO v. Superior Ct., 46 Cal. 4th 993, 1002 (2009) (quoting Cal. Bus. & Prof. Code § 17204) (emphasis in original); see also id. (standing exists “only if that individual was actually injured by . . . an unfair business practice”) (emphasis in original). Recent decisions in this District have distinguished between economic harms to parents and children when analyzing standing under the UCL. For example, in M.S. v. Nintendo of America, Inc., the court found that the child plaintiffs did not have standing to bring a false advertising claim against the defendant because their parents were the ones who purchased the products at issue and suffered the economic injury. No. C 20-06929 WHA, 2022 WL 17169835, at *3 (N.D. Cal. Nov. 22, 2022); see also Sanchez v. Nintendo of Am. Inc., No. C 20-06929 WHA, 2022 WL 4099154, at *3 (N.D. Cal. Sept. 7, 2022) (children lacked Article III standing to bring

6 M.K. relies principally on Allergan v. Athena Cosmetics, a Federal Circuit case applying California law. 640 F.3d 1377 (Fed. Cir. 2011). That case is inapposite. In Allergan, the Federal Circuit reversed a district court decision that applied an outdated version of the UCL standing claim regarding reduced resale value because products in question belonged to parents). And in I.B. v. Facebook, Inc., the court determined that children who alleged that their purchases of online credits violated other California statutes lacked standing under the UCL because the plaintiffs had used their parents’ credit cards. No. C 12-1894 CW, 2013 WL 6734239, at *6 (N.D. Cal. Dec. 20, 2013). Second, M.K does not plausibly allege that Google’s misconduct caused the economic injury in question—i.e., his parents’ expenditure of money to pay for tutors and for the services of an attorney. “To challenge a business practice, a private plaintiff must allege injury in fact caused by the practice in question.” Prager Univ. v. Google LLC, 85 Cal. App. 5th 1022, 1041-42 (2022); see also Two Jinn, Inc. v. Gov’t Payment Serv., Inc., 233 Cal. App. 4th 1321, 1332 (2015) (“[T]here must be a causal connection between the harm suffered and the unlawful business activity. That causal connection is broken when a complaining party would suffer the same harm whether or not a defendant complied with the law.”) (quoting Daro v. Superior Ct., 151 Cal. App. 4th 1079, 1099 (2007)). Here, the economic harm M.K. claims his parents suffered does not stem from Google’s alleged failure to comply with COPPA or its implementing regulations, or from Google’s alleged violation of a “privacy pledge.” Rather, the harm results directly from the District’s decision to suspend M.K. from school for sending a sexually explicit message to his teacher—a suspension M.K. contends reflects improper conduct by the District. M.K. does not plausibly allege a causal connection between Google’s alleged unlawful or unfair conduct and the economic harm his parents suffered. Accordingly, the Court concludes that M.K. fails to state a claim against Google under the D. Claim 4: Failure to Protect M.K. alleges that Google “failed to protect M.K. under SOPIPA’s affirmative duty to protect when it failed to warn parents of cybersecurity issues, failed to warn the district, failed to develop reasonable security procedures and practices, failed to design a system that would alert teachers, staff, parents or student users to individuals logging on Google Classrooms from a new claim sounds in negligence, which requires him to allege facts establishing “(1) a legal duty of due care; (2) a breach of that duty; (3) causation; and (4) damages.” In re Google Android Consumer Privacy Litig., No. 11-MD-02264 JSW, 2013 WL 1283236, at *12 (N.D. Cal. Mar. 26, 2013). Google argues that M.K.’s failure to protect claim is nothing more than a “retread” of the SOPIPA claim that M.K. has since withdrawn.7 Dkt. No. 78 at 17. M.K. responds that he relies on SOPIPA and COPPA as the sources of Google’s duty of care owed to him, but he otherwise fails to address Google’s arguments. Dkt. No. 83 at 10. The Court agrees with Google that the FAC does not refer to COPPA as the alleged source of any duty of care owed by Google to M.K. With respect to SOPIPA, Google persuasively argues (and M.K. appears to concede) that SOPIPA does not afford a private right of action for violation of its terms, and M.K. does not explain why he should nevertheless be permitted to rely on an alleged violation of that statute by recasting his claim as negligent failure to protect. See Dkt. No. 78 at 12-14; Dkt. No. 83 at 10. In any event, M.K. fails to plausibly allege any violations of the duties he claims Google owes him. First, he alleges that Google failed to incorporate reasonable cybersecurity protections into its platform and failed to warn consumers, including the District, students, and their parents, of the dangers it created. Id. ¶ 104. M.K. has not plausibly alleged any security (or cybersecurity) defects. It is not sufficient for M.K. to allege merely that his Google account was hacked, or that Google should have warned him that his account could be hacked. See Bem v. Stryker Corp., No. C 15-2485 MMC, 2015 WL 4573204, at *1 (N.D. Cal. July 29, 2015) (complaint failed to state a claim for negligence when it “relie[d] on conclusory allegations and fail[ed] to plead any facts describing the particular defect, the injury sustained, the manner in which [defendant] was negligent, or how any such negligence caused or contributed in any manner to any specified injury.”). M.K. alleges that Google “failed to design a system that would alert teachers, staff, 7 Google also argues that to the extent M.K. seeks to hold Google responsible for the sexually explicit communication M.K. says a hacker sent to his teacher, M.K.’s claim is barred by the Communications Decency Act, 47 U.S.C. § 230(c), which immunizes interactive service providers from liability for claims that treat them as publishers of third-party content. Dkt. No. 78 at 17-18. parents or student users to individuals logging on Google Classrooms from a new IP address.” Dkt. No. 66 ¶ 104. M.K. seems to suggest that Google had a duty to includes such an alert in its platform design, but the FAC does not identify the source of any such duty. To the extent M.K. suggest that Google and/or the District should have monitored the IP addresses from which each student accessed the Google platform, this suggestion is at odds with M.K.’s objections that Google and the District improperly monitored his online activities. In short, the FAC is devoid of any non-conclusory factual allegations about what was negligent about Google’s platform design or its data handling practices, or about what the company was required to warn the District, students, and their parents about. M.K. does not allege any facts that support an inference that Google failed to use reasonable security procedures or practices with respect to the Google platform at issue, or that any such failure caused M.K.’s alleged injury. See Iqbal, 556 U.S. at 678. Second, M.K. alleges that Google failed to ensure that his data was not “used to advertise services.” Id. M.K. says that he believes Google shared his personal information with advertisers because his parents saw “third party ads via pop ups and recommendations for related videos and products from advertisers on his iPad connected to topics typed into his Google classroom, videos watched or conversations had while using Google Classroom.” Id. ¶ 5. M.K. asks the Court to infer from this single, conclusory allegation that Google shared information with advertisers about M.K.’s activities while he was logged into his Google account and using Google’s platform for school. The FAC does not identify the advertisements or recommendations shown to M.K., or the school-related topics, videos, or conversations to which these advertisements or recommendations were “connected.” Moreover, given that the iPad M.K. used for school was his own personal device, see id. ¶ 4, it is not reasonable to infer from these allegations alone that Google shared M.K.’s school-related information with advertisers. While it certainly is possible that Google shared M.K.’s information in the manner that he claims, the allegations in the FAC “fail to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. At the hearing, M.K.’s counsel claimed that Google knew or should have known that its 1 not appear in the FAC, and M.K. cites no authority for the proposition that the existence of prior 2 hacking incidents supports an affirmative duty to warn or suggests that the platform suffered from 3 a design defect. 4 Accordingly, the Court concludes that M.K. fails to state a claim against Google for negligent 5 failure to protect. 6 E. Leave to Amend 7 M.K. has already had one opportunity to amend his claims against Google. He does not 8 ask for another opportunity to amend, nor does he suggest that there are any additional facts that 9 he could plead in support of his claims. See Dkt. No. 88 at 56:5-57:1. For this reason, the Court 10 concludes that it would be futile to grant M.K. leave to amend yet again. 11 Iv. CONCLUSION 12 For the reasons explained above, the Court grants Google’s motion to dismiss with respect 13 to claims 2, 3, and 4 of the FAC. The Court denies Google’s motion to dismiss claim 1 as to the 14 alleged disclosure of M.K.’s personally identifiable information to the District and its employees. 15 Google’s responsive pleading is due 14 days from the date of this order. See Fed. R. Civ. P. 16 } 12a).

= 17 IT IS SO ORDERED. 18 Dated: August 1, 2023 19 «8 VIRGINIA K. DEMARCHI 21 United States Magistrate Judge 22 23 24 25 26 27 28