UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF FLORIDA TAMPA DIVISION
PROJECT TRAVEL, LLC, a Delaware Limited Liability Company,
Plaintiff/Counter Defendant,
Lead Case No.: 8:24-cv-02817-WFJ-LSG v. Member Case No.: 8:25-cv-02967-WFJ-AAS
TERRA DOTTA, LLC, A North Carolina Limited Liability Company
Defendant/Counter Claimant. _____________________________________/
ORDER Before the Court is Plaintiff/Counter Defendant Project Travel, LLC’s (“Project Travel”) Motion to Dismiss. Dkt. 34.1 Defendant/Counter Claimant Terra Dotta, LLC (“Terra Dotta”) has responded in opposition, Dkt. 39, and Plaintiff/Counter Defendant replied. Dkt. 47. After careful consideration, the Court grants in part and denies in part Project Travel’s motion to dismiss. BACKGROUND This dispute stems from an alleged pattern of misconduct by Defendant Terra Dotta to undermine Plaintiff Project Travel’s business and steal its confidential and
1 All docket cites in this Order are to the Member Case—8:25-cv-02967-WFJ-AAS. proprietary information. Dkt. 1 ¶ 1. Terra Dotta and Project Travel are direct competitors that provide software platforms to universities to help students find
study abroad programs, arrange for travel and lodging, navigate visa requirements, and enroll in international programs. Dkt. 29 ¶ 1.2 Terra Dotta is a North Carolina limited liability company with its principal place of business in Chapel Hill, North
Carolina. Id. ¶ 16. Project Travel (d/b/a Via TRM) is a Delaware limited liability company with its principal place of business in Denver, Colorado. Id. ¶ 17; but see Dkt. 1 ¶ 11 (“Project Travel is incorporated in Delaware and has its headquarters and principal place of business in Venice, Florida.”).
Notably, the instant action has been consolidated with Project Travel, LLC v. Rowe, Case No. 8:24-cv02817-WFJ-LSG (the “Lead Case”), in which Project Travel is suing a former employee, Jason Rowe, for allegedly misappropriating trade secrets
and sharing them with Terra Dotta. Dkt. 1 ¶¶ 2–4. Following Mr. Rowe’s departure from Project Travel and subsequent hiring at Terra Dotta, Project Travel learned that Terra Dotta had undergone a massive overhaul to its competing software. Id. ¶¶ 5, 6. Project Travel alleges these software changes are “plainly intended to mirror the
functions and features of [its own] software.” Id. ¶ 6. After Mr. Rowe joined Terra Dotta, Project Travel claims that Terra Dotta accelerated the launch of this new software by several months, and that it is “simply not feasible that Terra Dotta could
2 These paragraph citations refer to Terra Dotta’s counterclaims section of its answer. See Dkt. 29 at 16–42. have radically changed its software in such a short period of time without the use of Project Travel’s confidential information[.]” Id. Project Travel believes that Mr.
Rowe communicated confidential information to Terra Dotta while Project Travel still employed him. Id. After consolidation with the Lead Case, Dkt. 26, Terra Dotta filed an answer
and brought eight counterclaims against Project Travel, asserting: (1) unfair competition under the Lanham Act, 15 U.S.C. § 1125; (2) common law unfair competition; (3) breach of contract; (4) computer trespass under N.C. Gen. Stat. § 14-458; (5) violation of the Digital Millennium Copyright Act, 17 U.S.C. § 1201(a)
(“DMCA”); (6) unfair or deceptive trade practices under N.C. Gen. Stat. § 75-1.1 (“NCUDTPA”); (7) violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(2)(C) (“CFAA”); and (8) abuse of process. Dkt. 29 ¶¶ 118–68.
In its counterclaims, Terra Dotta alleges that Project Travel surreptitiously posed as a Terra Dotta customer to gain unauthorized access to Terra Dotta’s system portal. Id. ¶¶ 63–86. Specifically, in early 2024, the University of San Diego (“USD”) was a Terra Dotta customer, but subsequently switched to Project Travel.
Id. ¶ 63. While its contract with Terra Dotta was still active, USD allegedly added Project Travel’s Vice-President of Operations, Trevor Stiegelmar, to the permissions group for USD’s Terra Dotta portal. Id. ¶ 66. Mr. Stiegelmar then registered his own
credentials to access the portal. Id. ¶ 73. Terra Dotta avers it did not authorize Project Travel’s access to its USD portal, id. ¶ 69, and that all users of Terra Dotta’s portal agree to be bound by Terra Dotta’s Terms of Use. Id. ¶ 54. Those Terms forbid
unauthorized access to the portal. Id. ¶ 56. The Terms of Use also prohibit obtaining confidential information from the portal. Id. ¶¶ 57–60. Notwithstanding those Terms, Mr. Stiegelmar, under the auspices of USD’s account, allegedly accessed the
Terra Dotta portal a dozen times over ten days. Id. ¶ 76. While on the portal, Project Travel’s executive allegedly obtained Terra Dotta’s confidential information, including “the platform’s analytics capabilities, flexible brochure-building capabilities, permissions system, and deployment rules.” Id. ¶¶ 79–81. Project
Travel supposedly used Terra Dotta’s information in furtherance of its own interests when dealing with USD and other customers. Id. ¶¶ 82, 85. Next, Terra Dotta claims Project Travel misrepresented its capabilities and
took credit for Terra Dotta’s accolades in the marketplace. Id. ¶ 104. In early 2025, Project Travel submitted a bid to the University of South Carolina (“USC”). Id. ¶ 105. In that bid, Project Travel stated that its International Student & Scholar Services (“ISSS”) platform had been live for over five years. Id. ¶ 106. That
statement was allegedly false, as Project Travel launched its ISSS platform in late 2024. Id. Project Travel also reportedly provided a customer quote suggesting that its ISSS platform had received positive feedback, but the customer was using Terra
Dotta’s ISSS platform, not Project Travel’s. Id. ¶ 109. Project Travel further represented that it had never had a failed project, but it had reportedly previously failed to complete a project it had with Dartmouth College. Id. ¶ 108. Based on a bid
replete with allegedly false representations, Terra Dotta claims USC decided to purchase Project Travel’s platform instead of Terra Dotta’s. Id. ¶¶ 110–112. On January 26, 2026, Plaintiff/Counter Defendant Project Travel filed the
instant motion to dismiss all of Defendant/Counter Claimant Terra Dotta’s counterclaims under Federal Rule of Civil Procedure 12(b)(6). See Dkt. 34. LEGAL STANDARD Federal Rule of Civil Procedure 8(a)(2) requires a short and plain statement
of the claim showing that the plaintiff is entitled to relief to give the defendant fair notice of the claims and grounds. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citation omitted). The plaintiff is required to allege “more than labels and
conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Id. (citation omitted). In considering a Rule 12(b)(6) motion to dismiss, the court must construe the facts in the light most favorable to the plaintiff. Wiersum v. U.S. Bank, N.A., 785 F.3d 483, 485 (11th Cir. 2015). A complaint “must contain
sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face” to survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 677–78 (2009) (citation modified). However, “[c]onclusory allegations, unwarranted
deductions of facts or legal conclusions masquerading as facts will not prevent dismissal.” Jackson v. BellSouth Telecomms., 372 F.3d 1250, 1262 (11th Cir. 2004) (citation omitted).
DISCUSSION Plaintiff/Counter Defendant Project Travel raises a wide range of arguments when seeking dismissal of each counterclaim. The Court, however, begins with some
preliminary matters before considering Project Travel’s substantive arguments as to each counterclaim. I. Preliminary Matters a. Choice of law concerning common law claims
Project Travel begins its motion to dismiss by arguing that each of Terra Dotta’s common law counterclaims—specifically, the unfair competition (Count II), breach of contract (Count III), and abuse of process (Count VIII)—are governed by
Florida law. Dkt. 34 at 3. Terra Dotta disagrees, arguing that North Carolina law should govern the disposition of these claims and that any choice-of-law analysis is premature at the motion-to-dismiss stage. Dkt. 39 at 14, 16, 18. At this stage of the proceeding, the Court agrees that it would be inappropriate to undergo a choice-of-
law analysis because there are outcome-determinative facts that are not yet before the Court. The Supreme Court has long held that a federal court sitting in diversity, as is
the case here for Terra Dotta’s state law claims, will apply the conflict-of-laws rules of the forum state. Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941); see also Dkt. 29 ¶ 18 (“This Court has subject matter jurisdiction . . . under 28 U.S.C.
§ 1332 because Terra Dotta and [Project Travel] are citizens of different states and the amount in controversy exceeds $75,000.”). Applying Florida’s conflict of laws rules, the State allows the application of another jurisdiction’s laws under the “most
significant relationship” test outlined in the Restatement (Second) of Conflict of Laws. See Grupo Televisa, S.A. v. Telemundo Comm. Grp., Inc., 485 F.3d 1233, 1240 (11th Cir. 2007) (citing Bishop v. Fla. Specialty Paint Co., 389 So. 2d 999, 1001 (Fla. 1980)). That analysis, in turn, requires a review of a variety of factors
under section 145 of the Restatement, which often entails factual findings. Id. at 1240–41. The factors Florida courts consider are: “(a) the place where the injury occurred, (b) the place where the conduct causing the injury occurred, (c) the domicil
[sic], residence, nationality, place of incorporation and place of business of the parties, and (d) the place where the relationship, if any, between the parties is centered.” Bishop, 389 So. 2d at 1001 (quoting Restatement (Second) of Conflict of Laws § 145).
However, due to the fact-intensive nature of the most significant relationship test, some district courts within the Eleventh Circuit have found that “a choice of law analysis [is] inappropriate at the motion to dismiss stage.” Tufts v.
Hay, No. 6:18-CV-572ORL37DCI, 2018 WL 11249187, at *2 (M.D. Fla. Aug. 10, 2018) (collecting cases); see Onemata Corp. v. Rahman, No. 20-CV-62002, 2025 WL 2696584, at *5 (S.D. Fla. Aug. 13, 2025), report and recommendation
approved, No. 0:20-CV-62002-WPD, 2025 WL 2694794 (S.D. Fla. Sept. 22, 2025) (collecting cases and finding “[a]t this dismissal stage, the Court need not conduct a choice of law analysis and the Moving Parties’ request on this issue should be denied
as premature”). In this case, reserving the choice-of-law analysis for summary judgment seems the more prudent option, as the Court would have the benefit of a more thorough record on each common law count. For example, the Court cannot conduct
a full choice-of-law analysis on the common law unfair competition claim in Count II because there are insufficient facts to decide a basic factor like where the conduct causing the injury occurred. Terra Dotta specifically alleges that Mr. Stiegelmar
orchestrated the unauthorized incursion into Terra Dotta’s USD platform on Project Travel’s behalf, Dkt. 29 ¶¶ 66–68, 73–76, but there are no allegations about where Mr. Stiegelmar was at the time of the alleged intrusions. Project Travel’s motion to dismiss claims that the alleged conduct happened in Florida since Plaintiff is
headquartered there, Dkt. 34 at 4; see also Dkt. 1 ¶ 11, but Terra Dotta points to Project Travel’s website, which states that Mr. Stiegelmar is based in Aurora, Colorado, Dkt. 39 at 16 (citing We Are Via, Via, https://www.viatrm.com/about (last
visited Apr. 1, 2026)). Terra Dotta further argues that Project Travel’s principal place of business is either in Michigan or Colorado. Dkt. 39 at 16; Dkt. 29 ¶ 17.3 This fundamental disagreement over where Project Travel’s principal place of
business is and where Mr. Stiegelmar is located prevents this Court from resolving the choice-of-law issue at this time. Similar issues arise in the breach of contract claim in Count III, as the Court
needs further factual development about Mr. Stiegelmar’s whereabouts when he allegedly created an account and agreed to Terra Dotta’s Terms of Use. Dkt. 29 ¶¶ 72–74. As to the abuse of process claim in Count VIII, Terra Dotta asserts that North Carolina law applies because the injury occurred there, Dkt. 39 at 19, but the
allegations concern Mr. Rowe being subjected to a deposition by Project Travel, Dkt. 29 ¶ 164, and there are no allegations about where Mr. Rowe’s deposition was taken or why North Carolina law should apply in an action filed in Florida and being
litigated in Florida. In short, the parties need discovery to explore these discrepancies and other relevant facts in the choice-of-law determination. Therefore, the Court defers the choice-of-law analysis on Counts II, III, and VIII to a later stage of the proceeding. Project Travel’s motion to dismiss is denied as to these counts, but
Plaintiff is free to re-raise any of the substantive arguments made in its motion (as it relates to these counts) at a later time.
3 Potentially complicating matters further is a previous order from this Court in the Lead Case, which noted that Mr. Stiegelmar (on behalf of Project Travel) had countersigned a contract in Michigan. See Project Travel, LLC v. Rowe, No. 8:24-CV-2817-WFJ-LSG, 2025 WL 807460, at *1 (M.D. Fla. Mar. 13, 2025). b. Count IV—Computer Trespass claim The other preliminary matter concerns Terra Dotta’s computer trespass claim
under N.C. Gen. Stat. § 14-458. As Project Travel correctly notes, Terra Dotta’s computer trespass claim under North Carolina law is subject to a one-year statute of limitations. Dkt. 34 at 19; see N.C. Gen. Stat. § 14-458(c); N.C. Gen. Stat. § 1-
539.2A(b); N.C. Gen. Stat. § 1-54; Glover Constr. Co., Inc. v. Sequoia Servs., LLC, No. 18 CVS 1900, 2020 WL 3393065, at *8 (N.C. Super. June 18, 2020) (“Plaintiff’s claim for computer trespass . . . has a limitations period of one year.”). In the Eleventh Circuit, a “Rule 12(b)(6) dismissal based on a statute of limitations is
appropriate only where it is ‘apparent from the face of the complaint’ that the claim is time-barred.” United States v. Henco Holding Corp., 985 F.3d 1290, 1296 (11th Cir. 2021).
Here, Terra Dotta admits it learned of Project Travel’s alleged computer trespass on March 13, 2024, and that Project Travel’s unauthorized access ended on March 22, 2024. Dkt. 29 ¶¶ 76, 84 (“[Project Travel] continued to access the platform until March 22, 2024, when Terra Dotta discovered the unauthorized access
and put a stop to it.”). Terra Dotta’s computer trespass counterclaim, filed on December 22, 2025, is well past the one-year statute of limitations—a fact that Terra Dotta concedes in its response. Dkt. 39 at 10 (“Terra Dotta concedes that its standalone computer trespass claim is time-barred.”). Therefore, the Court grants Project Travel’s motion to dismiss Count IV with prejudice as time-barred.
II. Count I—Lanham Act claim Turning now to Project Travel’s substantive arguments for dismissal, Project Travel contends that the Lanham Act claim in Court I should be dismissed for two
reasons: first, Rule 9(b)’s heightened pleading requirements applies to the Lanham Act claim, and second, Terra Dotta failed to state a claim because “mere isolated responses to state-issued requests for proposal (‘RFPs’) are not actionable ‘commercial advertisements’ under the Lanham Act.” Dkt. 34 at 5. The Court will
address both arguments in turn. a. Application of Rule 9(b) standard The elements of a false-advertising claim under the Lanham Act are: “(1) the
defendant's statements were false or misleading; (2) the statements deceived, or had the capacity to deceive, consumers; (3) the deception had a material effect on the consumers’ purchasing decision; (4) the misrepresented service affects interstate commerce; and (5) the plaintiff has been, or likely will be, injured as a result of the
false or misleading statement.” Hi-Tech Pharms., Inc. v. HBS Int’l Corp., 910 F.3d 1186, 1196 (11th Cir. 2018) (citation modified). Rule 9(b) adds an additional requirement to “state with particularity the circumstances constituting fraud or
mistake.” Fed. R. Civ. P. 9(b). If Rule 9(b) does apply, Terra Dotta must also allege: “(1) the precise statements, documents, or misrepresentations made; (2) the time, place, and person responsible for the statement; (3) the content and manner in which
these statements misled the Plaintiffs; and (4) what the defendants gained by the alleged fraud.” Am. Dental Ass’n v. Cigna Corp., 605 F.3d 1283, 1291 (11th Cir. 2010) (citation modified).
As several district courts have noted, the Eleventh Circuit has not yet weighed in on whether Rule 9(b)’s heightened pleading standard applies to Lanham Act claims. See Epson Am., Inc. v. Safe Space Scan Tech. LLC, 2024 WL 4555880, at *3 (S.D. Fla. Sept. 13, 2024) (“I recognize that the Eleventh Circuit has not determined
whether Rule 9(b) applies to Lanham Act claims based on fraud.”), report and recommendation adopted, 2024 WL 4554104 (S.D. Fla. Oct. 23, 2024); Warriors & Fam. Assistance Ctr. LLC v. Trajector Inc., 2024 WL 4627134, at *2 (N.D. Fla.
Sept. 24, 2024) (“There seems to be no binding precedent on whether Rule 9(b) necessarily applies to all Lanham Act false advertising claims or all FDUTPA claims.”).4 In the Middle District of Florida, there is at least one district court that has found “the weight of authority holds that a Lanham Act claim for false
advertising and a state-law claim for unfair competition need not be pleaded with
4 See also USA Nutraceuticals Grp., Inc. v. BPI Sports, LLC, No. 15-CIV-80352, 2016 WL 4254257, at *2 (S.D. Fla. Feb. 16, 2016) (“However, BPI provides no cases from within this Circuit indicating that Rule 9(b) should be similarly applied to claims pursued under the Lanham Act.”); ZAGG Inc. v. Ichilevici, No. 23-CV-20304, 2024 WL 5186468, at *4 (S.D. Fla. Dec. 20, 2024) (collecting cases on the split in authority between district courts within the Eleventh Circuit). specificity.” Incarcerated Ent., LLC v. Warner Bros. Pictures, 261 F. Supp. 3d 1220, 1226–27 (M.D. Fla. May 10, 2017) (collecting cases).
Fortunately, this Court need not wade into the split over which pleading standard applies, as Terra Dotta satisfies the heightened pleading requirements of Rule 9(b). First, Terra Dotta has identified the precise misrepresentation it is
complaining about by alleging that Project Travel “submitted a response to a request for proposal . . . from the University of South Carolina” and that Project Travel falsely stated that its “ISSS platform had been live for over five years” when the “ISSS platform had only been active since late 2024, and even then only in pilot
form.” Dkt. 29 ¶¶ 105–06; see also id. ¶ 108 (“[Project Travel] also inaccurately told the University of South Carolina in its RFP response that Via had no failed projects. [Project Travel] entered into a contract with Dartmouth College in 2022,
and yet by early 2025, [Project Travel’s] solution with Dartmouth still was not live and had no go-live plan, despite Dartmouth having hired outside implementation resources.”). Second, Terra Dotta alleges that Project Travel made these misrepresentations to USC in early 2025 through an RFP. Id. ¶¶ 105–06. Third, Terra
Dotta explains that Project Travel’s actions confused and misled USC into buying its platform instead of Terra Dotta’s. Id. ¶ 110; see also id. ¶¶ 111, 113 (“The University of South Carolina would not have elected to do so if it had known that
the ISSS platform was untested and that [Project Travel] lacked experience in supporting an ISSS platform. . . . The University of South Carolina also would not have chosen [Project Travel] if it knew of the failure of [Project Travel’s]
implementation at Dartmouth.”). Fourth, Terra Dotta has alleged that, through its alleged misrepresentations, Project Travel has suffered financial loss by losing business from customers in this market. Id. ¶¶ 117, 124. Since Terra Dotta’s
allegations sufficiently alert Project Travel “to the precise misconduct with which they are charged,” Ziemba v. Cascade Int’l, Inc., 256 F.3d 1194, 1202 (11th Cir. 2001) (citation modified), Count I satisfies Rule 9(b)’s heightened pleading standard.
b. Failure to state a claim Because Terra Dotta’s allegations are sufficient even under Rule 9(b), the Court turns to whether Count I states a viable false-advertising claim under the
Lanham Act. A Lanham Act false advertising claim under 15 U.S.C. § 1125(a) arises when “any person who, on or in connection with any goods . . . uses in commerce any . . . false or misleading description of fact, or false or misleading representation of fact, which . . . in commercial advertising or promotion, misrepresents the nature,
characteristics, qualities, or geographic origin of his or her or another person's goods.” Suntree Techs., Inc. v. Ecosense Int’l, Inc., 693 F.3d 1338, 1348 (11th Cir. 2012) (citation modified); see 15 U.S.C. § 1125(a)(1)(B). To establish a prima facie
case of false advertising pursuant to 1125(a), the plaintiff must establish that the alleged infringing conduct constitutes “commercial advertising or promotion.” Suntree Techs., 693 F.3d at 1349. To make this determination, the representations
must be: (1) commercial speech; (2) by a defendant who is in commercial competition with plaintiff; (3) for the purpose of influencing consumers to buy defendant’s goods or services. While the representations need not be made in a classic advertising campaign, but may consist instead of more informal types of promotion, the representations (4) must be disseminated sufficiently to the relevant purchasing public to constitute advertising or promotion within that industry.
Id. (citation modified). Project Travel argues that the fourth element has not been sufficiently alleged. Dkt. 34 at 10. Specifically, Project Travel claims there are no allegations that any misrepresentations have been disseminated to the relevant purchasing public; instead, Terra Dotta only describes one RFP to a single customer. Id. Here, the Court agrees that a single RFP to a customer does not constitute sufficient dissemination. To be considered “commercial advertisement or promotion,” the information must have been disseminated to potential customers. See Suntree Techs., 693 F.3d at 1349 (affirming summary judgment because “Suntree also failed to present any evidence that the brochure was actually disseminated to any potential customers”); Advisors Excel, LLC v. Scranton, 2014 WL 12543802, *6–7 (S.D. Fla. Sep. 15, 2014) (granting the motion to dismiss
because “while Plaintiff does allege dissemination through the internet, Plaintiff fails to allege how long the video was posted, whether the video was posted on a public or private website, any estimate of how many people saw the video, or any other
facts that could assist in measuring the breadth of the alleged dissemination”). Although the Eleventh Circuit has stated that “where the customer market is particularly small, courts may find a statement to be sufficiently disseminated . . .
even though only distributed to a few customers (or even one),” Suntree Techs, 693 F.3d at 1349 (citation modified), Terra Dotta has not alleged anything about the size of its particular market of selling software services to higher education institutions with study abroad programs. See EarthCam, Inc. v. OxBlue Corp., 49 F. Supp. 3d
1210, 1243 (N.D. Ga. 2014), aff’d, 703 F. App’x 803 (11th Cir. 2017) (citation omitted) (granting summary judgment since “OxBlue has not presented any evidence regarding the size of the market for high-end, megapixel construction
cameras and webcams,” and a single advertisement to “one customer does not constitute ‘commercial advertising or promotion’ under the Lanham Act”).5 Therefore, the Court dismisses the Lanham Act counterclaim in Count I.
5 The Court also finds Terra Dotta’s citation to governmental bid cases to be unavailing and easily distinguishable. See Dkt. 39 at 8–9 (citing Lockheed Martin Corp. v. Boeing Co., No. 6:03-CV-796, 2005 WL 729685, at *3 (M.D. Fla. Mar. 21, 2005); Analytical Servs. & Materials, 299 F. Supp. 2d 565, 574 (E.D. Va. 2004)). Terra Dotta’s allegations make it clear that its market is higher education institutions, not the federal government. See Dkt. 29 ¶¶ 1– 2. III. Count V—DMCA Violation Next, Project Travel claims that “Terra Dotta cannot state a claim under the
DMCA because the unauthorized use of passwords and user registrations to access computer software [is] not [an] act[] of ‘circumvention’ of a technological measure prohibited under the DMCA.” Dkt. 34 at 21. Terra Dotta pushes back, arguing that
Project Travel is attempting to “impose[] an additional and extratextual element onto a DMCA claim.” Dkt. 39 at 20. To state a claim under section 1201(a), plaintiff must allege that defendant (1) circumvented (2) a technological measure that effectively controls access to a
protected work. See Burroughs Payment Sys., Inc. v. Symco Grp., Inc., No. 1:10- CV-03029-JEC, 2011 WL 13217738, at *4 (N.D. Ga. Dec. 13, 2011) (citing 17 U.S.C. § 1201(a)(1)(A)). To “circumvent a technological measure” means “to
descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner.” 17 U.S.C. § 1201(a)(3)(A). Importantly, the DMCA is “not concerned with people exceeding the alleged limits of their authority once given
valid access.” Aeropost Int’l Servs., Inc. v. Aerocasillas, S.A., No. 09-23437-CIV, 2011 WL 13174672, at *6 (S.D. Fla. Mar. 31, 2011) (citing I.M.S. Inquiry Mgmt. Sys., Ltd. v. Berkshire Info. Sys., Inc., 307 F. Supp. 2d 521, 531 (S.D.N.Y. 2004);
Egilman v. Keller & Heckman, LLP, 401 F. Supp. 2d 105, 112 (D.D.C. 2005)). In this case, element two is not at issue, as Terra Dotta has sufficiently alleged it had a technological measure—i.e., password protection—that controlled access to
its portal. Dkt. 29 ¶ 146; see Burroughs Payment Sys., 2011 WL 13217738, at *4 (quoting Universal City Studios, Inc. v. Corley, 273 F.3d 429, 440 (2d Cir. 2001)) (“[P]assword protection is a recognized ‘technological measure that effectively
controls access’ under the DMCA.”). Instead, the parties’ dispute is the first element—whether Mr. Stiegelmar’s alleged behavior “circumvented” this technological measure. Here, the Court finds that Terra Dotta has failed to allege any “circumvention”
under the DMCA. While Mr. Stiegelmar did not have authorization to access Terra Dotta’s platform provided to USD, he used his login credentials in the technological manner authorized by Terra Dotta. See Dkt. 29 ¶¶ 66, 73, 76. On this point, the Court
finds Project Travel’s citation to I.M.S. Inquiry Mgmt. Sys., 307 F. Supp. 2d at 531 to be persuasive. In I.M.S., the plaintiff was a company that collected advertising tracking information, primarily for publishers and advertisers. 307 F. Supp. 2d at 523. One
of the services provided by the plaintiff was a web-based service that allowed its customers to track magazine subscriptions online. Id. This service was available only to the plaintiff’s clients, who were required to enter an authorized username and
password before accessing the website. Id. The defendant, a competitor that provided similar advertising-tracking services, allegedly accessed I.M.S.’s website and copied information for use in its own services. Id. The plaintiff alleged that the defendant
had obtained the username and password from a third party whom the plaintiff had authorized to access the website. Id. The I.M.S. court found that, while the defendant’s actions bypassed permission to access I.M.S.’s copyrighted works, the
allegations were insufficient because they were not a circumvention of the technological means to protect the copyrighted material. Id. at 532. Several district courts within the Eleventh Circuit have followed I.M.S.’s reasoning that using the proper channel to access copyrighted work—even if one lacks the authorization to
do so—does not constitute “circumvention” under the DMCA. See Aeropost Int’l Servs., 2011 WL 13174672, at *6; Flagstone Island Gardens, L.L.C. v. Ser, No. 11- 21865-CIV, 2011 WL 13223685, at *3 (S.D. Fla. Sept. 13, 2011); Burroughs
Payment Sys., 2011 WL 13217738, at *4. Here, the material facts in I.M.S. are almost on all fours with the allegations in this case. Terra Dotta alleges that Mr. Stiegelmar obtained administrative access to its platform from a third party (i.e., USD), who Terra Dotta had previously
authorized to use its platform as a customer. See Dkt. 29 ¶ 66. Mr. Stiegelmar then proceeded to “register and obtain access credentials” (i.e., create a username and password), which allowed him to access Terra Dotta’s platform at least twelve times.
Id. ¶¶ 73–76. While Terra Dotta never authorized Project Travel to access its platform, id. ¶ 69, there are no allegations that Project Travel “avoid[ed], bypass[ed], remove[d], deactivate[d], or impair[ed]” the password-protection
measure placed on Terra Dotta’s platform. See 17 U.S.C. § 1201(a)(3)(A); see also Flagstone Island Gardens, 2011 WL 13223685, at *3 (citation modified) (“[W]hile Plaintiff alleges that Defendant was no longer authorized to use the
username/password combination, other courts have concluded that using a username/password combination as intended—by entering a valid username and password, albeit without authorization—does not constitute circumvention under the DMCA.”); Burroughs Payment Sys., 2011 WL 13217738, at *6 (“[P]laintiff’s
allegations that defendant used a lawful password without authorization are insufficient to state a claim upon which relief may be granted.”); Aeropost Int’l Servs., 2011 WL 13174672, at *6 (“Here, the allegations are that Defendants used a
valid login and password to enter the website and to create another login, which they were freely able to do without any technological impediment. . . . [T]he plaintiffs allowed the defendants access to their website and left ‘freely’ available the ability to create additional logins and passwords. The Court cannot say these allegations
sufficiently state a DMCA violation.”); iSpot.tv, Inc. v. Teyfukova, No. 2:21-CV- 06815-MEMF(MARX), 2023 WL 3602806, at *5 (C.D. Cal. May 22, 2023) (“The [complaint] still only alleges that Teyfukova individually used the credentials in the
technological manner by which she was authorized to do so—albeit without authorization. Indeed, the SAC still does not allege that Teyfukova took any steps to avoid, bypass, remove, deactivate, or impair the . . . credentials.”).
Terra Dotta, however, resists this conclusion, arguing that Project Travel “avoided or bypassed Terra Dotta’s password-protection by using credentials for which it had no authorization.” Dkt. 39 at 22. True enough, but Mr. Stiegelmar using
credentials that he had no authorization to obtain is not the issue. The central issue is whether the unauthorized use of an otherwise valid password constitutes “circumvention” under the DMCA. On this issue, the district court in Burroughs Payment Sys. explained it best with its “key” analogy:
[A] password issued by the copyright holder is like a key a homeowner has made for its own lock. If the homeowner loses this key, or even if it is stolen, one can hardly say that the person using it, while certainly not authorized to enter, somehow “avoided or bypassed” the doorlock. They actually used the doorlock in a manner intended by the lock's technology. Applying this concept to the digital world, “[d]efendant did not surmount or puncture or evade any technological measure to [access plaintiff's protected website without plaintiff's authorization] . . . ; instead, it used a password intentionally issued by plaintiff to another entity.” [I.M.S., 307 F. Supp. 2d at 532–33].
On the other hand, if the trespasser uses a “skeleton key” which is ground to fit any lockset, the trespasser has “circumvented” the door lock by opening the door through a means which the lockset, and its creator, did not intend. In the digital world, when a defendant uses the exact password created by a plaintiff for its digital lock, it does not “avoid” or “bypass” the digital lock. However, when a defendant uses some technology to open the digital lock, other than the password specifically made for the digital lock, it is “avoiding” or “bypassing” the digital lock [in violation of the DMCA]. Burroughs Payment Sys., 2011 WL 13217738, at *5. Therefore, Terra Dotta’s counterclaim under section 1201(a) of the DMCA is due to be dismissed. Project
Travel’s motion to dismiss Count V is granted. IV. Count VI—Unfair or Deceptive Trade Practices under N.C. Gen. Stat. § 75-1.1
Turning to the NCUDTPA claim in Count VI, Project Travel argues the claim should be dismissed because Terra Dotta is merely restating its breach of contract claim and fails to plead an “aggravating circumstance” that would support a claim under NCUDTPA. Dkt. 34 at 12–15. In response, Terra Dotta asserts that its computer trespass claim in Count IV is an alternative predicate for its NCUDTPA claim, not solely its breach of contract claim in Count III, so the aggravating
circumstances requirement is not applicable. Dkt. 39 at 11–12. To the extent Terra Dotta’s NCUDTPA claim is predicated on its computer trespass claim, the Court finds Count VI survives dismissal.
As an initial matter, the Court dismissed Terra Dotta’s computer trespass counterclaim as time-barred. However, “UDTPA is clearly governed by a four-year statute of limitations,” and “North Carolina case law indicates that the UDTPA statute of limitations applies to a UDTPA claim regardless of whether that claim is
predicated on a different substantive claim governed by a different statute of limitations.” Bland v. Carolina Lease Mgmt. Grp., LLC, No. 23-1367, 2024 WL 2012487, at *2 (4th Cir. May 7, 2024) (citing N.C. Gen. Stat. § 75-16.2; Shepard v. Ocwen Fed. Bank, FSB, 638 S.E.2d 197, 200 (N.C. 2006)). As such, while Terra Dotta’s individual computer trespass claim under N.C. Gen. Stat. § 14-458 cannot
move forward; it can still be asserted as the predicate to Terra Ditta’s NCUDTPA claim. “In order to state a claim under the UDTPA, a plaintiff must show (1)
defendant committed an unfair or deceptive act or practice; (2) the action in question was in or affecting commerce; and (3) the act proximately caused injury to the plaintiff.” Ellis v. La.-Pac. Corp., 699 F.3d 778, 787 (4th Cir. 2012) (citation modified). The only element at issue is whether Terra Dotta sufficiently alleged an
unfair or deceptive act—that is, whether Terra Dotta stated a claim for computer trespass. Because Terra Dotta asserts that computer trespass is the predicate unfair or deceptive act under the NCUDTPA, Terra Dotta must have alleged the following
two elements under N.C. Gen. Stat. § 14-458: “(1) a person must ‘use a computer or computer network without authority,’ with (2) the intent to engage in one of the enumerated prohibited actions.” Rel. Ins., Inc. v. Pilot Risk Mgmt. Consulting, LLC, No. 22 CVS 4285, 2024 WL 3549145, at *44 (N.C. Super. July 12, 2024) (citation
omitted). For purposes of this statute, “a person is ‘without authority’ when . . . the person has no right or permission of the owner to use a computer, or the person uses a computer in a manner exceeding the right or permission[.]” N.C. Gen. Stat. § 14-
458(a). Additionally, North Carolina state courts have ruled that a violation of N.C. Gen. Stat. § 14-458 “can occur even where the defendant’s initial access to the
computer at issue was authorized.” Miller v. RedGoose, L.L.C., No. 23 CVS 25675, 2024 WL 4892114, at *5 (N.C. Super. Nov. 26, 2024); see also Pilot Risk Mgmt. Consulting, 2024 WL 3549145, at *45 (finding that “Former Employees ‘used’ [the
plaintiff’s] computers in a manner exceeding their rights or permission” after leaving the company). Federal district courts in North Carolina interpreting the computer trespass statute have reached a similar conclusion, finding that “[a]ny greater utilization of that access would exceed his ‘right or permission,’ thus qualifying as
‘without authority’ for purposes of the North Carolina computer trespass statute.” CHGYM LLC v. Unify Athletics, LLC, No. 1:21CV911, 2022 WL 112208, at *5 (M.D.N.C. Jan. 12, 2022) (citing N.C. Gen. Stat. § 14-458(a)); see McKeown v.
Tectran Mfg., Inc., No. 5:17-CV-00109, 2018 WL 2207139, at *3 (W.D.N.C. May 14, 2018). Here, Project Travel contends that there are “no facts showing that Project Travel accessed Terra Dotta’s platform ‘without authority,’ which is a fundamental
requirement under the statute.” Dkt. 34 at 19. The Court disagrees, as ample allegations make it clear that USD—not Terra Dotta itself—provided Mr. Stiegelmar with administrative access to Terra Dotta’s portal. See Dkt. 29 ¶¶ 68, 69, 76, 84. To
the extent Project Travel claims that Mr. Stiegelmar had permission to register and create an account on Terra Dotta’s portal based on USD’s permission, “unlimited access did not mean [Mr. Stiegelmar] had unlimited authorization.” CHGYM LLC,
2022 WL 112208, at *5. Mr. Stiegelmar’s twelve unauthorized logins to Terra Dotta’s portal, which allegedly allowed Project Travel to view and copy Terra Dotta’s proprietary systems, Dkt. 29 ¶¶ 41, 76–85, undoubtedly “exceed [Mr.
Stiegelmar’s] ‘right or permission,’ thus qualifying as ‘without authority’ for purposes of the North Carolina computer trespass statute.” CHGYM LLC, 2022 WL 112208, at *5. Thus, the Court finds that Terra Dotta has sufficiently alleged computer trespass as a predicate act for its NCUDTPA claim. Project Travel’s
motion to dismiss Count VI is denied. V. Count VII—CFAA Violation Finally, turning to the CFAA claim in Count VII, Project Travel challenges
the adequacy of Terra Dotta’s allegations. Specifically, Project Travel continues to assert that “Terra Dotta does not allege facts showing Project Travel lacked authorization or exceeded its authorization in using Terra Dotta’s platform.” Dkt. 34 at 23. Again, the Court disagrees and finds that Count VII survives dismissal.
Although primarily a criminal statute, the CFAA provides a civil remedy to any person who suffers damage or loss as a result of a violation of the statute. See 18 U.S.C. § 1030(g). To recover, Terra Dotta must allege that Project Travel “(1)
intentionally ‘accessed’ a computer, (2) lacked authorization or exceeded his authorized access to the computer, (3) obtained information from the computer, and (4) caused a loss of at least $ 5,000.00[.]” Clarity Servs., Inc. v. Barney, 698 F. Supp.
2d 1309, 1313 (M.D. Fla. 2010) (citing 18 U.S.C. 1030(a)(2)(C)). The only element at issue is whether Terra Dotta sufficiently alleged that Project Travel lacked authorization or exceeded its authorized access. See Dkt. 34 at 23. While the CFAA
does not define “without authorization,” it does state that “exceeds authorized access” means “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter[.]” 18 U.S.C. § 1030(e)(6); see EarthCam, 703 F. App’x at 808
(citation omitted) (“[O]ne of the lessons from [prior precedent] may be that a person exceeds authorized access if he or she uses the access in a way that contravenes any policy or term of use governing the computer in question.”); Van Buren v. United
States, 593 U.S. 374, 396 (2021) (“[A]n individual ‘exceeds authorized access’ when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him.”).
Here, there are numerous allegations that Project Travel lacked authorization to access Terra Dotta’s platform, and even if Project Travel did have authorization via USD, Mr. Stiegelmar allegedly exceeded that authorization by logging in at least
twelve times to view proprietary information about Terra Dotta’s platform and systems in violation of Terra Dotta’s Terms of Use. Dkt. 29 ¶¶ 54–60, 68–76, 83. Indeed, to register and obtain access credentials, Mr. Stiegelmar agreed to be bound
by the Terms of Use, id. ¶¶ 54, 74, and while accessing the platform, Project Travel allegedly “conducted other activities that the Terms of Use explicitly prohibited, including: a. Harvesting Contact and Personal Information; and b. Accessing Other
Portal Information.” Id. ¶ 83. Accepting the factual allegation as true, as the Court must at this stage, Terra Dotta has adequately alleged that Project Travel, at a minimum, exceeded its authorization when it viewed and “obtained confidential and proprietary information about Terra Dotta and its platform” in violation of its Terms
of Use. Id. ¶¶ 81–85; see Power Equip. Maint., Inc. v. AIRCO Power Servs., Inc., 953 F. Supp. 2d 1290, 1296 (S.D. Ga. 2013) (“Similarly, exceeds authorized access simply means that, while an employee’s initial access was permitted, the employee
accessed information for which the employer had not provided permission.”); Aquent LLC v. Stapleton, 65 F. Supp. 3d 1339, 1346 (M.D. Fla. 2014) (“In the Amended Complaint, [the plaintiff] alleges that [the defendant] signed an offer letter from [the plaintiff] that stated she was ‘required to keep such information
confidential during [her] employment and at all times thereafter and may use such information only within the scope of [her] duties to the company,’ . . . The Amended Complaint adequately alleges that [the defendant] exceeded her authorization.”). Therefore, the motion to dismiss is denied as to Count VII since Terra Dotta has sufficiently stated a claim under the CFAA.
CONCLUSION Terra Dotta’s response requests that leave to amend be granted. Dkt. 39 at 24. Because Terra Dotta’s Lanham Act and DMCA counterclaims are premised solely
on grounds unsustainable as a matter of law, any amendment would be futile. As such, the Court declines to grant leave to amend those counterclaims and dismisses them with prejudice. See Coventry First, LLC v. McCarty, 605 F.3d 865, 870 (11th Cir. 2010) (finding leave to amend not required where amendment would be futile).
Accordingly, it is hereby ORDERED and ADJUDGED that: 1. Plaintiff/Counter Defendant Project Travel’s Motion to Dismiss, Dkt. 34, is GRANTED in part and DENIED in part.
a. The Court DISMISSES with prejudice Counts I, V, and IV. b. The Motion to Dismiss is DENIED as to all other counts. 2. Defendant/Counter Claimant Terra Dotta’s request for oral argument, Dkt. 40, is DENIED as moot.
3. Plaintiff/Counter Defendant Project Travel must file a responsive pleading to the remaining counterclaims within FOURTEEN (14) days of the date of this Order.
DONE AND ORDERED at Tampa, Florida, on April 1, 2026. /s/ William F. Jung WILLIAM F. JUNG UNITED STATES DISTRICT JUDGE
COPIES FURNISHED TO: Counsel of Record