Karen Young v. Meta Platforms, Inc., et al.

Opinion

KAREN YOUNG, Case No. 24-cv-03583-HSG

Plaintiff, ORDER GRANTING MOTION TO DISMISS v. Re: Dkt. No. 35 META PLATFORMS, INC., et al., Defendants.

On March 10, 2025, the Court dismissed Pro Se Plaintiff Karen Young’s original complaint with leave to amend. Dkt. No. 31. Plaintiff timely filed an amended complaint (“FAC”), Dkt. No. 32, and Defendants again move to dismiss. Dkt. No. 35 (“Mot.”). The motion is fully briefed. See Dkt. Nos. 37 (“Opp.”) and 38 (“Reply”). The Court again finds this matter appropriate for disposition without oral argument and the matter is deemed submitted. See Civil L.R. 7-1(b). For the reasons explained below, the Court GRANTS the motion, this time without leave to amend. All of Plaintiff’s claims in the FAC, as in the original complaint, arise from an incident in which her Facebook page was hacked. Plaintiff states that she created and operates a Facebook page titled “Math4cure, LCC,” which has “a following of over 65k [people] with [an] ongoing and specific concern for cancer patients in addition to mathematical algorithms [and] STEM principles.” FAC ¶¶ 6–7. Plaintiff alleges that the Math4cure page was targeted in multiple hacking attempts, including a data breach in June 2023 that compromised Plaintiff’s personal Facebook page and the Math4cure page. Id. ¶¶ 12–39. According to Plaintiff, the data breach caused “fraudulent messaging,” “advertising [for] fraudulent products,” and messages containing that the Math4cure page processed an unauthorized one cent charge and declined a subsequent $10,025 advertising charge. Id. Plaintiff alleges that she made “numerous attempts” to address the data breach with Meta but that Meta “did not properly address or resolve” the breach, leaving Plaintiff’s data compromised, alongside the data of Math4cure’s 65,000 followers. Id. Plaintiff now asserts six causes of action: (1) negligence, (2) breach of contract, (3) negligent misrepresentation, (4) breach of fiduciary duty, (5) violation of the Computer Fraud and Abuse Act (“CFAA”), and (6) violation of the Stored Communications Act (“SCA”). See generally FAC. Plaintiff seeks general and specific damages totaling $5 million, punitive damages, and a series of declarations or orders. Id. A defendant may move to dismiss a complaint for failing to state a claim upon which relief can be granted under Rule 12(b)(6). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when a plaintiff pleads “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). In reviewing the plausibility of a complaint, courts “accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Nevertheless, courts do not “accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quoting Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)). Additionally, “[p]leadings must be construed so as to do justice.” Fed. R. Civ. P. 8(e). “[A] pro se complaint, however inartfully pleaded, must be held to less stringent standards than formal pleadings drafted by lawyers.” Erickson v. Pardus, 551 U.S. 89, 94 (2007) (quotation omitted). 54 (9th Cir. 1995). Even a “liberal interpretation of a . . . complaint may not supply essential elements of the claim that were not initially pled.” Ivey v. Bd. of Regents of Univ. of Alaska, 673 F.2d 266, 268 (9th Cir. 1982). Defendant raises a number of grounds for dismissing the FAC, but the Court need not reach all of them because two are dispositive. First, Defendants’ Terms of Service (“TOS” or the “Terms”) directly bar the majority of Plaintiff’s claims. And second, Plaintiff does not (and cannot) plausibly plead any violation of the Computer Fraud and Abuse Act (“CFAA”) or the Stored Communications Act (“SCA”). A. The Terms of Service to Which Plaintiff Admits She Agreed are Incorporated by Reference and Bar Her Claims for Negligence, Negligent Misrepresentation, Breach of Fiduciary Duty and Breach of Contract Defendants’ first argument is that four of Plaintiff’s claims and the associated damages sought are barred by Facebook’s TOS. See Dkt. No. 35 at 12–15.1 Plaintiff does not deny that she agreed to the Terms of Service: to the contrary, Plaintiff relies on them for some of her causes of action. See, e.g. FAC at ¶ 43 (“The Defendants had a legal duty to provide a safe and functional environment for its users, as explicitly stated in its Terms of Service.”), ¶ 61 (“Plaintiff entered into an agreement with the Defendants under the Terms of Service, which required the Defendants to provide a secure platform and protect user accounts from unauthorized access.”). Defendants proffer Facebook’s applicable Terms of Service and Commercial Terms as of June 13, 2024, the filing date of the original complaint. Dkt. No. 36-1, Exs. A and B. Plaintiff does not dispute the authenticity of these documents. The Court thus finds that it may consider these documents as incorporated by reference in the complaint. See United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003) (“Even if a document is not attached to a complaint, it may be incorporated by reference into a complaint if the plaintiff refers extensively to the document or the document forms the basis of the plaintiff's claim.”).

The Terms of Service provide in relevant part: Limits on Liability We work hard to provide the best Products we can and to specify clear guidelines for everyone who uses them. Our Products, however, are provided “as is,” and we make no guarantees that they always will be safe, secure, or error-free, or that they will function without disruptions, delays, or imperfections. To the extent permitted by law, we also DISCLAIM ALL WARRANTIES WHETHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF PURPOSE, TITLE, AND NON-INFRINGEMENT. We do not control or direct what people and others do or say, and we are not responsible for their actions or conduct (whether online or offline) or any content they share (including offensive, inappropriate, obscene, unlawful, and other objectionable content).

We cannot predict when issues might arise with our Products. Accordingly, our liability shall be limited to the fullest extent permitted by applicable law, and under no circumstance will we be liable to you for any lost profits, revenues, information, or data, or consequential, special, indirect, exemplary, punitive, or incidental damages arising out of or related to these Terms or the Meta Products (however caused and on any theory of liability, including negligence), even if we have been advised of the possibility of such damages. Our aggregate liability arising out of or relating to these Terms or the Meta Products will not exceed the greater of $100 or the amount you have paid us in the past twelve months. Dkt. No. 36-1, Ex. A at § 4(3). The Terms, therefore, explicitly (1) disclaim any guarantee that Facebook will be safe, secure, or error-free, or operate without disruptions; and (2) disclaim liability for third-party acts or conduct. Id. The Terms also cap any liability exceeding $100 arising out of or related to Facebook or the Terms of Use. Id. The Court therefore GRANTS the motion to dismiss Plaintiff’s negligence, breach of contract, negligent misrepresentation and breach of fiduciary duty causes of action, because on its face the Terms bar all of those claims, which are predicated on Defendants’ alleged failure to keep Plaintiff’s account secure and free from disruptions in response to the third-party conduct of hackers.2 Accord Damner v. Facebook Inc., No. 20-CV- 2 In her opposition, Plaintiff contends that the limitations in the TOS cannot bar claims for gross negligence, intentional misconduct, or fraud, and suggests that her breach of contract claim also 05177-JCS, 2020 WL 7862706, at *1–9 (N.D. Cal. Dec. 31, 2020) (dismissing claims based on allegations that the plaintiff’s Facebook account was hacked such that he lost access and control over the account and that Facebook refused to assist him in restoring access); Baldwin-Kennedy v. Meta Platforms, Inc., No. 23-cv-06615-HSG, 2024 WL 4565091, at *2–4 (N.D. Cal. Oct. 23, 2024) (dismissing claims, including negligence, breach of contract and misrepresentation claims, to the extent they were based on alleged failure to keep plaintiff’s account secure and free from disruptions due to third-party conduct). B. Plaintiff Does Not, and Cannot, State a Viable Claim Under the CFAA or the SCA i. CFAA Plaintiff alleges that Defendants violated the Computer Fraud and Abuse Act because they “knowingly continued allowed unauthorized access to the Plaintiff’s accounts and failed to act upon multiple reports of security breaches.” FAC ¶ 83. Plaintiff alleges that “[t]hough the hackers committed the unauthorized access, Meta’s failure to implement adequate safeguards and prevent continued access constitutes contributory negligence and willful blindness: Facebook’s Terms of Service promise account and payment security, and enforcement against ‘unauthorized access.’” Id. ¶ 89. Defendants point out that the CFAA makes it unlawful to “intentionally access[] a computer without authorization or exceed[] authorized access.” 18 U.S.C. § 1030(a)(2). But here, Plaintiff does not allege that Defendants unlawfully accessed her Facebook account without authorization. Instead, she alleges that the hackers did so. Plaintiff contends that “[t]he CFAA provides a cause of action when a defendant’s failure to safeguard a user’s data leads to unauthorized access by third parties,” Opp. at 11, citing Andrews v. Sirius XM Radio, 932 F.3d 1253 (9th Cir. 2019). Andrews did not so hold, or address this point in any way: there, the Ninth

Moreover, the Court finds that Plaintiff could not truthfully and plausibly plead any of these claims in an amended complaint without contradicting the basic, and non-actionable, facts she has already pled over the course of two complaints. See Weisbuch v. Cnty. of Los Angeles, 119 F.3d 778, 783 and n.1 (9th Cir. 1997) (explaining that “[a] plaintiff may plead herself out of court” where she “plead[s] facts which establish that [she] cannot prevail on [her] claim”); Sprewell, 266 Circuit’s holding was based solely on plaintiff’s failure to plausibly allege “loss” within the meaning of the statute. 932 F.3d at 1262–63. Because Plaintiff cannot allege that Defendants intentionally accessed a computer without authorization, she cannot state a claim under the CFAA, and the Court GRANTS the motion to dismiss this claim. ii. SCA Finally, Plaintiff alleges that “Defendants failed to safeguard [her] stored electronic communications and account data from unauthorized access” in violation of the Stored Communications Act. FAC ¶¶ 93-99. That claim also fails. The Stored Communications Act “has a ‘narrow scope’” and “‘is not a catch-all statute designed to protect the privacy of stored Internet communications.’” Damner, 2020 WL 7862706, at *5 (quoting In re Google, Inc. Priv. Pol’y Litig., No. C-12-01382-PSG, 2013 WL 6248499, at *12 (N.D. Cal. Dec. 3, 2013)). Much like the CFAA, it only imposes liability on those who “intentionally access[]” or “intentionally exceed[] an authorization to access” stored internet communications. See 18 U.S.C. § 2701(a); see also Baldwin-Kennedy, 2024 WL 4565091, at *6.3 Because Plaintiff cannot allege that Defendants unlawfully accessed her Facebook account without authorization, the Court GRANTS the motion to dismiss this claim. The Court GRANTS the motion to dismiss in its entirety. Dkt. No. 35. The Court understands and respects that Plaintiff sincerely appears to have found the hacking incident, and Defendants’ response to it, frustrating. But Plaintiff previously had an opportunity to amend, and has failed to cure the legal deficiencies the Court previously identified (and to the extent the FAC advances new theories, they are not viable for the reasons explained in this order). The Court therefore DISMISSES the case against Defendants without leave to amend. See Ramirez v. Galaza, 334 F.3d 850, 860 (9th Cir. 2003) (“Leave to amend should be granted unless the pleading

3 Plaintiff’s opposition cites “Orin v. Barclay, 2021 WL 4759881 (E.D. Mich. 2021)” for the premise that the court there “allowed a claim under the SCA where a third party accessed a user’s communications without authorization.” Opp. at 12. But the Westlaw citation Plaintiff references 1 could not possibly be cured by the allegation of other facts, and should be granted more liberally 2 to pro se plaintiffs.”) (quotations omitted); Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 3 1007 (9th Cir. 2009) (“[W]here the Plaintiff has previously been granted leave to amend and has 4 subsequently failed to add the requisite particularity to its claims, [t]he district court’s discretion to 5 deny leave to amend 1s particularly broad.” (quotation omitted)). The Clerk is directed to enter 6 judgment in favor of Defendant Meta Platforms Inc. and against Plaintiff and to close the case.*

9 . □ avwobs S. GILLIAM, JR. / 10 United States District Judge 11 a 12

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 07 * This is not the first dismissal of a claim brought by Plaintiff in this district based on her use of Facebook. See Young v. Facebook, Inc., 10-cv-03579, Dkt. No. 61 (dismissing without leave to 2g || amend claims for breach of contract, breach of the implied covenant of good faith and fair dealing, and negligence, among others).