Karen Young v. Meta Platforms, Inc., et al.

• Court: District Court, N.D. California
• Decided: October 15, 2025
• Docket: 4:24-cv-03583
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 KAREN YOUNG, Case No. 24-cv-03583-HSG

8 Plaintiff, ORDER GRANTING MOTION TO DISMISS 9 v. Re: Dkt. No. 35 10 META PLATFORMS, INC., et al., 11 Defendants.

12 On March 10, 2025, the Court dismissed Pro Se Plaintiff Karen Young’s original 13 complaint with leave to amend. Dkt. No. 31. Plaintiff timely filed an amended complaint 14 (“FAC”), Dkt. No. 32, and Defendants again move to dismiss. Dkt. No. 35 (“Mot.”). The motion 15 is fully briefed. See Dkt. Nos. 37 (“Opp.”) and 38 (“Reply”). The Court again finds this matter 16 appropriate for disposition without oral argument and the matter is deemed submitted. See Civil 17 L.R. 7-1(b). For the reasons explained below, the Court GRANTS the motion, this time without 18 leave to amend. 19 I. BACKGROUND 20 All of Plaintiff’s claims in the FAC, as in the original complaint, arise from an incident in 21 which her Facebook page was hacked. Plaintiff states that she created and operates a Facebook 22 page titled “Math4cure, LCC,” which has “a following of over 65k [people] with [an] ongoing and 23 specific concern for cancer patients in addition to mathematical algorithms [and] STEM 24 principles.” FAC ¶¶ 6–7. Plaintiff alleges that the Math4cure page was targeted in multiple 25 hacking attempts, including a data breach in June 2023 that compromised Plaintiff’s personal 26 Facebook page and the Math4cure page. Id. ¶¶ 12–39. According to Plaintiff, the data breach 27 caused “fraudulent messaging,” “advertising [for] fraudulent products,” and messages containing 1 that the Math4cure page processed an unauthorized one cent charge and declined a subsequent 2 $10,025 advertising charge. Id. Plaintiff alleges that she made “numerous attempts” to address 3 the data breach with Meta but that Meta “did not properly address or resolve” the breach, leaving 4 Plaintiff’s data compromised, alongside the data of Math4cure’s 65,000 followers. Id. 5 Plaintiff now asserts six causes of action: (1) negligence, (2) breach of contract, (3) 6 negligent misrepresentation, (4) breach of fiduciary duty, (5) violation of the Computer Fraud and 7 Abuse Act (“CFAA”), and (6) violation of the Stored Communications Act (“SCA”). See 8 generally FAC. Plaintiff seeks general and specific damages totaling $5 million, punitive 9 damages, and a series of declarations or orders. Id. 10 II. LEGAL STANDARD 11 A defendant may move to dismiss a complaint for failing to state a claim upon which relief 12 can be granted under Rule 12(b)(6). “Dismissal under Rule 12(b)(6) is appropriate only where the 13 complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” 14 Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To survive a Rule 15 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief that is plausible 16 on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible 17 when a plaintiff pleads “factual content that allows the court to draw the reasonable inference that 18 the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). 19 In reviewing the plausibility of a complaint, courts “accept factual allegations in the complaint as 20 true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek v. 21 St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Nevertheless, courts do not 22 “accept as true allegations that are merely conclusory, unwarranted deductions of fact, or 23 unreasonable inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) 24 (quoting Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)). 25 Additionally, “[p]leadings must be construed so as to do justice.” Fed. R. Civ. P. 8(e). “[A] pro 26 se complaint, however inartfully pleaded, must be held to less stringent standards than formal 27 pleadings drafted by lawyers.” Erickson v. Pardus, 551 U.S. 89, 94 (2007) (quotation omitted). 1 54 (9th Cir. 1995). Even a “liberal interpretation of a . . . complaint may not supply essential 2 elements of the claim that were not initially pled.” Ivey v. Bd. of Regents of Univ. of Alaska, 673 3 F.2d 266, 268 (9th Cir. 1982). 4 III. DISCUSSION 5 Defendant raises a number of grounds for dismissing the FAC, but the Court need not 6 reach all of them because two are dispositive. First, Defendants’ Terms of Service (“TOS” or the 7 “Terms”) directly bar the majority of Plaintiff’s claims. And second, Plaintiff does not (and 8 cannot) plausibly plead any violation of the Computer Fraud and Abuse Act (“CFAA”) or the 9 Stored Communications Act (“SCA”). 10 A. The Terms of Service to Which Plaintiff Admits She Agreed are Incorporated by Reference and Bar Her Claims for Negligence, Negligent Misrepresentation, 11 Breach of Fiduciary Duty and Breach of Contract 12 Defendants’ first argument is that four of Plaintiff’s claims and the associated damages 13 sought are barred by Facebook’s TOS. See Dkt. No. 35 at 12–15.1 Plaintiff does not deny that she 14 agreed to the Terms of Service: to the contrary, Plaintiff relies on them for some of her causes of 15 action. See, e.g. FAC at ¶ 43 (“The Defendants had a legal duty to provide a safe and functional 16 environment for its users, as explicitly stated in its Terms of Service.”), ¶ 61 (“Plaintiff entered 17 into an agreement with the Defendants under the Terms of Service, which required the Defendants 18 to provide a secure platform and protect user accounts from unauthorized access.”). Defendants 19 proffer Facebook’s applicable Terms of Service and Commercial Terms as of June 13, 2024, the 20 filing date of the original complaint. Dkt. No. 36-1, Exs. A and B. Plaintiff does not dispute the 21 authenticity of these documents. The Court thus finds that it may consider these documents as 22 incorporated by reference in the complaint. See United States v. Ritchie, 342 F.3d 903, 908 (9th 23 Cir. 2003) (“Even if a document is not attached to a complaint, it may be incorporated by 24 reference into a complaint if the plaintiff refers extensively to the document or the document 25 forms the basis of the plaintiff's claim.”).

26 27 1 The Terms of Service provide in relevant part: 2 Limits on Liability 3 We work hard to provide the best Products we can and to specify clear 4 guidelines for everyone who uses them. Our Products, however, are provided “as is,” and we make no guarantees that they always will be 5 safe, secure, or error-free, or that they will function without disruptions, delays, or imperfections. To the extent permitted by law, 6 we also DISCLAIM ALL WARRANTIES WHETHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF 7 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. We do not 8 control or direct what people and others do or say, and we are not responsible for their actions or conduct (whether online or offline) or 9 any content they share (including offensive, inappropriate, obscene, unlawful, and other objectionable content). 10

11 We cannot predict when issues might arise with our Products. Accordingly, our liability shall be limited to the fullest extent 12 permitted by applicable law, and under no circumstance will we be liable to you for any lost profits, revenues, information, or data, or 13 consequential, special, indirect, exemplary, punitive, or incidental damages arising out of or related to these Terms or the Meta Products 14 (however caused and on any theory of liability, including negligence), even if we have been advised of the possibility of such damages. Our 15 aggregate liability arising out of or relating to these Terms or the Meta Products will not exceed the greater of $100 or the amount you have 16 paid us in the past twelve months. 17 Dkt. No. 36-1, Ex. A at § 4(3). 18 The Terms, therefore, explicitly (1) disclaim any guarantee that Facebook will be safe, 19 secure, or error-free, or operate without disruptions; and (2) disclaim liability for third-party acts 20 or conduct. Id. The Terms also cap any liability exceeding $100 arising out of or related to 21 Facebook or the Terms of Use. Id. The Court therefore GRANTS the motion to dismiss 22 Plaintiff’s negligence, breach of contract, negligent misrepresentation and breach of fiduciary duty 23 causes of action, because on its face the Terms bar all of those claims, which are predicated on 24 Defendants’ alleged failure to keep Plaintiff’s account secure and free from disruptions in 25 response to the third-party conduct of hackers.2 Accord Damner v. Facebook Inc., No. 20-CV- 26 2 In her opposition, Plaintiff contends that the limitations in the TOS cannot bar claims for gross 27 negligence, intentional misconduct, or fraud, and suggests that her breach of contract claim also 1 05177-JCS, 2020 WL 7862706, at *1–9 (N.D. Cal. Dec. 31, 2020) (dismissing claims based on 2 allegations that the plaintiff’s Facebook account was hacked such that he lost access and control 3 over the account and that Facebook refused to assist him in restoring access); Baldwin-Kennedy v. 4 Meta Platforms, Inc., No. 23-cv-06615-HSG, 2024 WL 4565091, at *2–4 (N.D. Cal. Oct. 23, 5 2024) (dismissing claims, including negligence, breach of contract and misrepresentation claims, 6 to the extent they were based on alleged failure to keep plaintiff’s account secure and free from 7 disruptions due to third-party conduct). 8 B. Plaintiff Does Not, and Cannot, State a Viable Claim Under the CFAA or the SCA 9 i. CFAA 10 Plaintiff alleges that Defendants violated the Computer Fraud and Abuse Act because they 11 “knowingly continued allowed unauthorized access to the Plaintiff’s accounts and failed to act 12 upon multiple reports of security breaches.” FAC ¶ 83. Plaintiff alleges that “[t]hough the 13 hackers committed the unauthorized access, Meta’s failure to implement adequate safeguards and 14 prevent continued access constitutes contributory negligence and willful blindness: Facebook’s 15 Terms of Service promise account and payment security, and enforcement against ‘unauthorized 16 access.’” Id. ¶ 89. 17 Defendants point out that the CFAA makes it unlawful to “intentionally access[] a 18 computer without authorization or exceed[] authorized access.” 18 U.S.C. § 1030(a)(2). But here, 19 Plaintiff does not allege that Defendants unlawfully accessed her Facebook account without 20 authorization. Instead, she alleges that the hackers did so. Plaintiff contends that “[t]he CFAA 21 provides a cause of action when a defendant’s failure to safeguard a user’s data leads to 22 unauthorized access by third parties,” Opp. at 11, citing Andrews v. Sirius XM Radio, 932 F.3d 23 1253 (9th Cir. 2019). Andrews did not so hold, or address this point in any way: there, the Ninth 24

25 Moreover, the Court finds that Plaintiff could not truthfully and plausibly plead any of these claims in an amended complaint without contradicting the basic, and non-actionable, facts she has 26 already pled over the course of two complaints. See Weisbuch v. Cnty. of Los Angeles, 119 F.3d 778, 783 and n.1 (9th Cir. 1997) (explaining that “[a] plaintiff may plead herself out of court” 27 where she “plead[s] facts which establish that [she] cannot prevail on [her] claim”); Sprewell, 266 1 Circuit’s holding was based solely on plaintiff’s failure to plausibly allege “loss” within the 2 meaning of the statute. 932 F.3d at 1262–63. Because Plaintiff cannot allege that Defendants 3 intentionally accessed a computer without authorization, she cannot state a claim under the CFAA, 4 and the Court GRANTS the motion to dismiss this claim. 5 ii. SCA 6 Finally, Plaintiff alleges that “Defendants failed to safeguard [her] stored electronic 7 communications and account data from unauthorized access” in violation of the Stored 8 Communications Act. FAC ¶¶ 93-99. That claim also fails. The Stored Communications Act 9 “has a ‘narrow scope’” and “‘is not a catch-all statute designed to protect the privacy of stored 10 Internet communications.’” Damner, 2020 WL 7862706, at *5 (quoting In re Google, Inc. Priv. 11 Pol’y Litig., No. C-12-01382-PSG, 2013 WL 6248499, at *12 (N.D. Cal. Dec. 3, 2013)). Much 12 like the CFAA, it only imposes liability on those who “intentionally access[]” or “intentionally 13 exceed[] an authorization to access” stored internet communications. See 18 U.S.C. § 2701(a); see 14 also Baldwin-Kennedy, 2024 WL 4565091, at *6.3 Because Plaintiff cannot allege that 15 Defendants unlawfully accessed her Facebook account without authorization, the Court GRANTS 16 the motion to dismiss this claim. 17 IV. CONCLUSION 18 The Court GRANTS the motion to dismiss in its entirety. Dkt. No. 35. The Court 19 understands and respects that Plaintiff sincerely appears to have found the hacking incident, and 20 Defendants’ response to it, frustrating. But Plaintiff previously had an opportunity to amend, and 21 has failed to cure the legal deficiencies the Court previously identified (and to the extent the FAC 22 advances new theories, they are not viable for the reasons explained in this order). The Court 23 therefore DISMISSES the case against Defendants without leave to amend. See Ramirez v. 24 Galaza, 334 F.3d 850, 860 (9th Cir. 2003) (“Leave to amend should be granted unless the pleading 25

26 3 Plaintiff’s opposition cites “Orin v. Barclay, 2021 WL 4759881 (E.D. Mich. 2021)” for the premise that the court there “allowed a claim under the SCA where a third party accessed a user’s 27 communications without authorization.” Opp. at 12. But the Westlaw citation Plaintiff references 1 could not possibly be cured by the allegation of other facts, and should be granted more liberally 2 || to pro se plaintiffs.”) (quotations omitted); Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 3 1007 (9th Cir. 2009) (“[W]here the Plaintiff has previously been granted leave to amend and has 4 subsequently failed to add the requisite particularity to its claims, [t]he district court’s discretion to 5 deny leave to amend 1s particularly broad.” (quotation omitted)). The Clerk is directed to enter 6 || judgment in favor of Defendant Meta Platforms Inc. and against Plaintiff and to close the case.* 7 IT IS SO ORDERED.

9 . □ avwobs S. GILLIAM, JR. / 10 United States District Judge 11 a 12

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 07 * This is not the first dismissal of a claim brought by Plaintiff in this district based on her use of Facebook. See Young v. Facebook, Inc., 10-cv-03579, Dkt. No. 61 (dismissing without leave to 2g || amend claims for breach of contract, breach of the implied covenant of good faith and fair dealing, and negligence, among others).