Rodriguez v. ByteDance, Inc.

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

EVELIA RODRIGUEZ, ERIKKA WILSON, A.N., a minor, AIDEN GUNDLACH, J.V., a minor, ZACHARY BUCKUS, RAYMON MARINES, DOMINICK POLIZZI, and ROBERT KOPLOS, individually and on behalf of all others similarly situated,

Plaintiffs, Case No. 23 CV 4953

v. Hon. Georgia N. Alexakis

BYTEDANCE, INC., BEIJING DOUYIN INFORMATION SERVICE CO. LTD., BYTEDANCE LTD., BYTEDANCE PTE. LTD., BEIJING BYTEDANCE TECHNOLOGY CO. LTD., and TIKTOK, INC.,

Defendants.

MEMORANDUM OPINION AND ORDER Plaintiffs Evelia Rodriguez, Erikka Wilson, A.N., Aiden Gundlach, Zachary Buckus, Raymon Marines, J.V., Dominick Polizzi, and Robert Koplos bring this suit individually and on behalf of a putative class against defendant ByteDance, Ltd. (“ByteDance”) and related companies. They allege that defendants violated privacy statutes by collecting their data from a video-editing application called CapCut. Defendants have moved to dismiss the second amended complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). [69]. The Court grants in part and denies in part defendants’ motion to dismiss. Plaintiffs have also moved for alternative service of process on two China- based defendants. [61]. The Court denies that motion. In doing so, the Court has considered the surreply defendants filed opposing plaintiffs’ motion for alternative

service and therefore grants defendants’ motion for leave to file that surreply. [77]. LEGAL STANDARD A complaint must contain a “short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A complaint need only contain factual allegations that, accepted as true, are sufficient to “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is plausible “when the

plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556). The allegations “must be enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. At the pleading stage, a court must “accept all well-pleaded factual allegations as true and view them in the light most favorable to the plaintiff.” Lavalais v. Vill. of

Melrose Park, 734 F.3d 629, 632 (7th Cir. 2013). But “allegations in the form of legal conclusions are insufficient.” McReynolds v. Merrill Lynch & Co., 694 F.3d 873, 885 (7th Cir. 2012). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678. ANALYSIS The Court assumes familiarity with the facts of this case as outlined in its March 3, 2025 order. See [56]. There, the Court granted in part and denied in part

defendants’ motion to dismiss plaintiffs’ first amended complaint. See generally id. Specifically, the Court determined that plaintiffs sufficiently stated violations of their privacy rights under the California Constitution; intrusion upon seclusion, larceny, and conversion under California law; and Section 15(b) of Illinois’ Biometric Information Privacy Act (“BIPA”), subject to various limitations. Id. at 48. The Court dismissed the remainder of plaintiffs’ claims without prejudice except for plaintiffs’ claim under the Video Privacy Protection Act, which the Court dismissed with

prejudice. Id. The Court granted plaintiffs leave to amend their complaint, and plaintiffs filed their second amended complaint on April 4, 2025. [58]. Defendants have since moved to dismiss this latest version of the complaint. [69]. Rather than summarize all its allegations, in the sections that follow, the Court describes those allegations that bear on its analysis.

But before addressing defendants’ motion to dismiss, the Court first addresses plaintiffs’ opposition motion for alternative service of process on China-based defendants Beijing Douyin Information Service Co. Ltd. and Beijing ByteDance Technology Co. Ltd. [61]. A. Motion for Alternative Service of Process Rule 4(f)(3) allows a court to authorize service on foreign defendants by any “means not prohibited by international agreement as may be directed by the court.”

Fed. R. Civ. P. 4(f)(3). “[T]he decision whether to allow alternative methods of serving process under Rule 4(f)(3) is committed to the sound discretion of the district court.” Porter v. Scott Sports SA, No. 23 C 1328, 2023 WL 8190381, at *2 (N.D. Ill. Nov. 27, 2023) (quoting Strabala v. Zhang, 318 F.R.D. 81, 114 (N.D. Ill. 2016)). Although Rule 4(m)’s 90-day deadline for service does not apply to foreign defendants, “the amount of time allowed for foreign service is not unlimited” because “district courts need to be able to control their dockets.” Nylok Corp. v. Fastener World

Inc., 396 F.3d 805, 807 (7th Cir. 2005) (citing O’Rourke Bros. Inc. v. Nesbitt Burns, Inc., 201 F.3d 948, 952 (7th Cir. 2000)). “If, for example, a plaintiff made no attempt to begin the process of foreign service within [the deadline under Rule 4(m)], it might be proper for a court to dismiss the claim.” Id. In light of Nylok, some district courts dismiss foreign defendants for failure to serve when “the plaintiff has not demonstrated reasonable diligence in attempting service.” Empire Indus., Inc. v.

Winslyn Indus., LLC, No. 18 C 698, 2020 WL 3100581, at *3 (N.D. Ill. June 11, 2020); see also Quantum Color Graphics, LLC v. Fan Ass’n Event Photo GmbH, 185 F. Supp. 2d 897, 906 (N.D. Ill. 2002) (“Service on a foreign defendant is subject to ‘flexible due diligence’ standard as measured by the reasonableness of Plaintiff’s effort as well as the prejudice to the defendant from any delay.”) (cleaned up). Defendants say plaintiffs should not be permitted to serve the China-based defendants now—nearly two years after this litigation commenced and while the parties are on their second round of Rule 12 briefing and already in the initial stages

of discovery. The Court agrees. Plaintiffs offer no compelling reason why it took them two years to seek the Court’s permission to serve the China-based defendants by email. They say that they were “attempting to negotiate a settlement or waiver of service right up until April 4, 2025.” [76] at 3. But even assuming that were true, it was not reasonable for plaintiffs to rely on the hope of successful negotiations for two years in lieu of asking the Court for relief at the beginning of this case (or at least after a reasonable amount of time when it would have been clear to plaintiffs that

waiver of service was not forthcoming and settlement discussions would not bear fruit).1 For example, in a joint status report on October 25, 2023, the parties represented that the China-based defendants would not agree to waive service. [14] at 5. That would have been an appropriate time to move under Rule 4(f)(3) for alternative service. Plaintiffs also point to more recent developments in the litigation—e.g., the filing of a second amended complaint, the transfer of the case to

this Court’s docket, the start of discovery, and the forthcoming divestiture, see [76] at 1—but those later developments did not prohibit plaintiffs from moving under Rule 4(f)(3) much earlier.

1 Defendants submit that the “parties’ discussion of service on BDIS ended 20 months ago on October 20, 2023, after Defendants’ counsel informed Plaintiffs’ counsel that BDIS would not authorize them to accept service or waiver service.” [77-1] at 2 (emphasis in original). The Court need not resolve this factual dispute. Even if the parties were negotiating a possible waiver until recently, that is not an excuse for waiting almost two years to ask for alternative service. Moreover, although plaintiffs are technically correct that Rule 4(m)’s 90-day deadline does not apply when serving a defendant in a foreign country, that exception exists because “[s]ervice in a foreign country often is accomplished by means that

require more than the time set by Rule 4(m).” See Fed. R. Civ. P. 4(m) advisory committee’s note to 2016 amendment; see also Nylok, 396 F.3d at 807 (Rule 4(m)’s exception for foreign defendants “seems to recognize that the timeliness of foreign service is often out of the plaintiff’s control”). But here, plaintiffs do not blame their delay on the extra time it takes to serve defendants in China—in fact, as far as the Court can tell, plaintiffs have not attempted to serve these defendants via the Chinese central authority. [61] at 8. The justification for exempting plaintiffs from Rule 4(m)’s

time limit does not excuse plaintiffs’ delay here; there is nothing complex or time- consuming about asking the Court’s permission to serve via email. Practical considerations also counsel against granting plaintiffs’ motion. Defendants have represented that if the China-based defendants are brought into the suit, they will challenge whether this Court may properly exercise personal jurisdiction over them. [72] at 2. And, in addition to challenging personal jurisdiction,

the China-based defendants should have their own opportunity to oppose plaintiffs’ second amended complaint on the merits. But with the Court now ruling on the viability of a second amended complaint, the time for challenging the pleadings has passed. The Court will not delay the litigation any further—and, in so doing, prejudice those defendants who already have been actively defending this action— because of plaintiffs’ lack of diligence. For these reasons, plaintiffs’ motion for alternative service of process on the China-based defendants is denied. [61]. Because the Court denies the motion on timeliness grounds, it takes no position on whether plaintiffs could serve defendants

in China via email pursuant to Rule 4(f)(3). Defendants Beijing Douyin Information Service Co. Ltd. and Beijing ByteDance Technology Co. Ltd are therefore dismissed from this suit without prejudice. B. Motion to Dismiss Defendants have moved to dismiss each of the amended claims in plaintiffs’ second amended complaint. See generally [69]. The Court considers each in turn. 1. Computer Fraud and Abuse Act (Count I)

Under the Computer Fraud and Abuse Act (“CFAA”), a plaintiff must plead that a defendant’s “actions caused loss of more than $5,000 during any one-year period.” Brodsky v. Apple Inc., No. 19-CV-00712-LHK, 2019 WL 4141936, at *7 (N.D. Cal. Aug. 30, 2019); see also 18 U.S.C. § 1030(c)(4)(A)(i)(I). The statute defines “loss” as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or

information to its condition prior to the offense.” 18 U.S.C. § 1030(e)(11). The statutory definition of “loss” “focus[es] on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data.” Van Buren v. United States, 593 U.S. 374, 392 (2021). In its previous order, the Court dismissed plaintiffs’ CFAA claim, in part, because it did not sufficiently allege “loss” under the CFAA. See [56] at 12–14. Now, plaintiffs focus on two theories of loss: (1) subscription fees for users who paid for CapCut’s additional services, and (2) device battery drain resulting in unnecessary electricity costs.2 [58] ¶¶ 197–203. Defendants contend that these allegations still fall

short, [70] at 4–8, and the Court agrees. Subscription fees do not represent “harm to computer data, programs, systems, or information services,” which is what qualifies as loss under the CFAA. Van Buren, 593 U.S. at 391; see also id. at 391–92 (“The statutory definitions of ‘damage’ and ‘loss’ … focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data.”). Plaintiffs’ subscription fees also were not “caused by harm to computer data, programs, systems, or

information services,” as the statute requires. Id. (emphasis added) (citing 18 U.S.C. § 1030(e)(11)). Plaintiffs’ battery drainage theory fares no better. The complaint alleges that “the CapCut app significantly drains the batteries of user devices even when it is not in use overnight.” [58] ¶ 267; see also id. ¶ 200. Plaintiffs further allege that “[t]he 328.4 milliampere-hour battery drain measured overnight for the CapCut app

translates to millions of dollars in electricity costs each year from overnight battery drain alone.” Id. ¶ 268 (emphasis added). The source for this figure is a screenshot that plaintiffs place in their complaint. Id. ¶ 200. Yet this screenshot reflects that the

2 The second amended complaint also alleges harm from (1) lost value of user data and (2) increased risk of identity theft and fraud, see [58] ¶¶ 183, 266, but plaintiffs do not discuss these theories in their response to defendants’ motion to dismiss the CFAA claim, see [81] at 5–8. Any reliance on these theories of loss to support the CFAA claim is therefore waived. See G & S Holdings LLC v. Cont’l Cas. Co., 697 F.3d 534, 538 (7th Cir. 2012) (“[A] party waives an argument by failing to make it before the district court.”). 328.4 milliampere-hour figure is CapCut’s total battery usage while in the foreground—not while in the background (i.e., not in active use)—and that the battery usage accumulated over a 13-hour time span. Id. ¶ 200 (battery usage

captured between 10:38 p.m. and 11:39 a.m.). Plaintiffs argue that the Court must take their allegations at face value, [81] at 6, but for their claim to be plausible, plaintiffs still must plead factual content from which the Court can draw a reasonable inference, see Iqbal, 556 U.S. at 678. Here, the complaint itself undermines the plausibility of plaintiffs’ alleged harm by relying on a screenshot that does not show, or even permit the inference, that the purported battery drainage occurred only overnight, when CapCut was not actively in use. See

Zablocki v. Merchants Credit Guide Co., 968 F.3d 620, 623 (7th Cir. 2020) (“[W]hen the plaintiff relies on a document attached to the complaint and does not deny its accuracy, the facts communicated by that document control over allegations to the contrary.”); Zak v. Bose Corp., No. 17-CV-02928, 2019 WL 1437909, at *3 (N.D. Ill. Mar. 31, 2019) (“[T]he Court need not give legal effect to conclusory allegations that are contradicted by the pleader’s actual description of what happened.”) (citing

McCauley v. City of Chicago, 671 F.3d 611, 617-18 (7th Cir. 2011)). Moreover, although plaintiffs try to attribute concrete costs to battery drainage, those costs are actually quite notional, at least as alleged. Plaintiffs contend that battery drainage costs a total of “approximately $8 million per year for 100 million users,” which amounts to eight cents per year per user. [58] ¶ 268. That already small figure is even smaller after considering the aforementioned screenshot. As just discussed, plaintiffs’ calculation is based on CapCut’s total battery usage while in the foreground and during hours when a user would be awake. Id. ¶¶ 200, 268. In addition, plaintiffs’ calculation is premised on the unsupported position that

the battery drainage could have resulted only from defendants’ unlawful practices. It’s not uncommon for apps to run in the background for legitimate purposes—e.g., to sync data, deliver notifications, or provide system maintenance—but plaintiffs’ complaint sets forth no allegations to exclude that common-sense possibility. At bottom, plaintiffs’ allegations regarding battery-drain costs prove too speculative to state a claim to relief. Plaintiffs may assert in blanket fashion costs of eight cents per user per year, but the actual content of their complaint does not support that figure.3

Plaintiffs also bring a claim under 18 U.S.C. § 1030(c)(4)(A)(i)(IV), which establishes a CFAA violation when the offense causes a “threat to public health or safety.” Id. ¶ 274. Specifically, plaintiffs contend that defendants’ alleged intrusions threaten national security, and thus fall within the confines of the “public health or safety” provision, “by misappropriating sensitive user data (including biometric data) and by allowing the [Chinese Communist Party (“CCP”)], Chinese government, and

other third parties to access user data without authorization.” [81] at 8. Traditionally, however, the CFAA’s “public health or safety” provision has been used to address specific concerns that result from the targeting or disabling of health-

3 Defendants also argue that the battery drainage theory fails because plaintiffs cannot aggregate the putative class’s damages to meet the $5,000 per year minimum unless the damage arose from a single act. See [70] at 6 (quoting Halperin v. Int’l Web Servs., LLC, 70 F. Supp. 3d 893, 899 (N.D. Ill. 2014)). Because the Court dismisses the battery drain theory on other grounds, it assumes without deciding that plaintiffs can aggregate the putative class’s damages for the purposes of meeting the CFAA’s minimum damages requirement. or safety-related infrastructure. In United States v. Mitra, for example, the defendant was convicted under the “threat to public health or safety” provision when he took control of the communications system for “police, fire, and emergency

communications” in Madison, Wisconsin. 405 F.3d 492, 494 (7th Cir. 2005); see also Vaquero Energy, Inc. v. Herda, No. 1:15-CV-0967-JLT, 2015 WL 5173535, at *8 (E.D. Cal. Sept. 3, 2015) (finding § 1030(c)(4)(A)(i)(IV) claim likely to succeed where defendants accessed systems that controlled “extensive and critical oil and gas production facilities in close connection to residential and commercial areas”). Plaintiffs cite no authority holding that national security concerns stemming from the Chinese government’s access to personal data—even assuming those

concerns are as well-founded as plaintiffs contend—are actionable under the CFAA. As at least one other district court has pointed out, under plaintiffs’ interpretation of the statute’s public health or safety provision, “every American [could] assert that the collection of his or her data (no matter the nature of the data) threatens public health or safety under the CFAA.” See, e.g., Griffith v. TikTok, Inc., No. 5:23-CV-00964-SB- E, 2023 WL 9019035, at *5 (C.D. Cal. Dec. 13, 2023). Unless and until clearer legal authority materializes to support plaintiffs’ expansive view of the CFAA, the Court will not adopt it.4 The Court grants defendants’ motion to dismiss Count I.

2. Computer Data Access and Fraud Act (Count IV) In its earlier order, the Court dismissed plaintiffs’ claim under the Computer Data Access and Fraud Act (“CDAFA”) for failure to plead a cognizable loss. See [56] at 14–15. Now, in their second amended complaint, plaintiffs rely on the same two theories of loss just discussed: battery drain and subscription fees. For the same reasons, neither of those theories—speculative and unsupported, as alleged—are cognizable under the CDAFA’s definition of loss. See id. at 15 (explaining that the

statute’s “narrow definition of ‘loss’ is understood to encompass specific harms related to computer intrusions,” such as “costs related to fixing a computer, lost revenue, or other consequential damages incurred due to an interruption of computer services”). Plaintiffs also point to a cursory allegation in their complaint that, as a result of CapCut’s unauthorized access, the “battery, memory, CPU, and bandwidth of [their] devices have been compromised.” [58] ¶ 213; see also [81] at 13 (arguing that

“CapCut’s unauthorized access caused Plaintiffs’ devices to work slower, utilized

4 As in Griffith, the Court is also not persuaded by the fact that a military member and government contractor are among the named plaintiffs. 2023 WL 9019035, at *4 (rejecting similar argument that named plaintiff had access to transportation management infrastructure). Plaintiffs cite to an earlier opinion in the Griffith matter to support an argument that even Griffith recognizes that public safety considerations are presented when the compromised data belongs to “class members who are federal employees or hold other sensitive positions.” [81] at 11 (citing Griffith v. TikTok, Inc., 697 F. Supp. 3d 963, 975 (C.D. Cal. 2003)). Read in the proper context, however, the district court in that Griffith decision was simply restating the plaintiff’s position, not adopting it. computer resources, and created unjust profits” for defendants) (citing [58] ¶¶ 213, 417, 488). As for unjust profits, plaintiffs do not allege that any of defendants’ profits resulted from their access to plaintiffs’ data in violation of the CDAFA. See [58] ¶ 213.

And besides vague assertions about loss of memory and bandwidth, plaintiffs do not actually identify any cognizable impact on their specific devices apart from the battery-drain allegations already discussed. See Lineberry v. AddShopper, Inc., No. 23-CV-01996-VC, 2025 WL 551864, at *2 (N.D. Cal. Feb. 19, 2025) (dismissing CDAFA claim because plaintiffs failed to “articulate that theory of loss a concrete way”; “the complaint neither alleges that there is a market for individual people’s browsing activity, nor anything about what the actual value of the plaintiffs’ data

could be”). Plaintiffs also say that they are entitled to expenditures they incurred to verify that their systems were not altered, damaged, or deleted by the access, [81] at 13, but they do not allege that they in fact incurred such costs, [58] ¶ 350 (alleging only that the code “specifically entitles” plaintiffs to damages from these types of losses). Because plaintiffs have not alleged a cognizable loss under the CDAFA, the

Court grants defendants’ motion to dismiss Count IV. 3. Electronic Communications Privacy Act & California Invasion of Privacy Act (Counts II & IX)

The Court previously dismissed plaintiffs’ Electronic Communications Privacy Act (“ECPA”) and California Invasion of Privacy Act (“CIPA”) § 631 claims because they failed to allege any interception of communications as the statutes require. [56] at 18–20. It separately dismissed plaintiffs’ CIPA § 632 claim because plaintiffs had not alleged the use of an electronic amplifying device or a recording device to eavesdrop on plaintiffs’ communications. Cal. Pen. Code § 632(a). Id. at 20–21. Plaintiffs try to cure these deficiencies via their second amended complaint, but fail

to do so. Relevant to this portion of the analysis, plaintiffs supplement their claims by alleging that “[u]sing the CapCut app, users can send and receive email invitations to join a space to jointly collaborate on editing videos.” [58] ¶ 299. They continue: “Users then may exchange other communications in the space to edit the video,” and “[o]nce a draft video is completed, users can ‘directly share the video with team members or share it with external members via link or email to invite them for

comments.’” Id. They further allege that the “CapCut app contains various functions to send and receive information in real time such as the Service component, Broadcast Receivers, and data collection triggers” and (as best as this layperson Court can understand the technical jargon that occasionally pops up in the pleadings) that some aspects of the app’s source code “allow the CapCut app to collect and transmit data even when the app is not in use.” Id. ¶ 296. From these predicate allegations,

plaintiffs conclude, CapCut “obtains the contents of users’ electronic communications as they are sent in real time in transit.” Id. ¶ 300; see also [58] ¶ 298 (alleging, in a conclusory manner, that “electronic communications were intercepted during transmission”); [81] at 14. Plaintiffs are asking the Court to make an unreasonable inferential leap. Although the predicate facts alleged describe how an interception could occur, plaintiffs do not credibly allege that defendants in fact intercepted their communications. The complaint does not allege, for example, how the interception occurred, whose communications were intercepted, or what was contained in those

communications. Compare Campbell v. Facebook Inc., 77 F. Supp. 3d 836, 840 (N.D. Cal. 2014) (plaintiffs stated a claim where they specifically alleged that “Facebook uses a software application called a ‘web crawler’ to scan any URLs that are contained in messages” to use for “like counters” and targeted advertising) and In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (plaintiffs alleged that Facebook unlawfully “receive[d] and compile[d] their personally identifiable browsing history”), with [58] ¶ 307 (more vaguely alleging that defendants “intercept videos,

emails, messages, and other electronic communications”). Plaintiffs also rely on the theory that CapCut is run by ByteDance executives in China and that defendants “gave third parties [like the CCP] real-time access.” [81] at 19; see also [58] ¶¶ 302–03; see also [58] ¶ 301 (alleging that CapCut is ‘spying [on users] by design’”). Even putting aside the Court’s reservations about the speculative nature of these allegations, see infra at 18–19, plaintiffs still do not say

how ByteDance’s conduct amounts to contemporaneous interception of user communications as opposed to mere access to data. See [58] ¶ 303 (alleging that ByteDance executives in China “have direct access to user data”) (emphasis added). To the extent plaintiffs bring a § 632 claim under CIPA, that claim likewise continues to fail. Section 632(a) imposes liability on any party who “uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication.” Cal. Pen. Code § 632(a). This claim suffers the same flaw as the ECPA claim. Although plaintiffs plead user communications that could be the subject of eavesdropping, they do not plead facts to plausibly suggest that any eavesdropping

in fact occurred. See supra at 14–15; see also [58] ¶ 462 (alleging only in a conclusory fashion that defendants “intercepted and recorded … electronic communications”); id. ¶ 463 (alleging defendants used CapCut to “eavesdrop, record, and/or use electronic communications containing private data”).5 At bottom, plaintiffs have not pled enough facts to “nudge[] their claim[] across the line from conceivable to plausible.” Twombly, 550 U.S. at 570. In their response, plaintiffs seek a more lenient application of the pleading standards because, they

maintain, the pertinent facts “are in exclusive possession of defendants.” [81] at 2. But “the Supreme Court has roundly rejected [the] contention that the pleading requirements are relaxed when a plaintiff has not yet had an opportunity to conduct discovery.” See Goldberg v. 401 N. Wabash Venture LLC, No. 09 C 6455, 2010 WL 1655089, at *5 (N.D. Ill. Apr. 22, 2010) (discussing Iqbal and Twombly); see also Iqbal, 556 U.S. at 686 (“Because respondent’s complaint is deficient under Rule 8, he is not

5 Because plaintiffs’ allegations of eavesdropping are overly speculative, the Court need not decide whether CapCut—as the platform that houses the communications between users— is a party to the communications and therefore exempt from liability. See Garcia v. Build.com, Inc., No. 22-CV-01985-DMS-KSC, 2023 WL 4535531, at *5 (S.D. Cal. July 13, 2023) (“[P]arties to a conversation cannot eavesdrop on their own conversations.”); Thomasson v. GC Servs. Ltd. P’ship, 321 F. App’x 557, 559 (9th Cir. 2008) (no liability under § 632 where defendant was a participant in telephone calls and “[n]o third party listened in on the conversations”); c.f. Thomas v. Papa John’s Int’l, Inc., No. 24-3557, 2025 WL 1704437, at *1 (9th Cir. June 18, 2025) (Papa John’s collection of data from plaintiff’s interactions with its website was not eavesdropping under § 631 because Papa John’s was a party to the communication). entitled to discovery, cabined or otherwise.”). The Court acknowledges the “informational asymmetry” problem that can occur in data-privacy cases. [81] at 16 (citing In re TikTok, Inc. In-App Browser Privacy Litigation, No. 24 C 2110, 2024 WL

4367849, at *5 (N.D. Ill. Oct. 1, 2024)). But plaintiffs still must plausibly allege that they have been injured under the ECPA and CIPA, even if they cannot provide all the attendant details. See In re TikTok, Inc., 2024 WL 4367849, at *5 (not requiring “detailed facts about the time and circumstances of the[] injury at the pleading stage” where plaintiff already had plausibly alleged the unlawful interception of their name, billing address, credit card numbers, and banking details while using an in-app browser). Because plaintiffs have not met this threshold, the Court grants

defendants’ motion to dismiss Counts II and IX. 4. Stored Communications Act (Count III) In its previous order, the Court dismissed plaintiffs’ claims under the Stored Communications Act (“SCA”) because plaintiffs’ allegations that defendants divulged the contents of their information to the CCP were overly speculative. [56] at 21–23. Specifically, it noted that the allegations in plaintiffs’ first amended complaint related

to the disclosure of data from TikTok, not CapCut. Id. at 21–22. It further noted that the statements plaintiffs cited about the CCP’s access to user data came from a former ByteDance employee who was terminated from the company long before CapCut was ever launched in the United States. Id. at 22. Plaintiffs now supplement their first amended complaint with details of the April 2024 Protecting Americans from Foreign Adversary Controlled Applications Act, which requires ByteDance to divest its platforms from all United States operations. See generally [58] ¶¶ 160–77. Plaintiffs say this legislation supports their SCA claim because it is “expressly premised on the ongoing access to user

communications and control that the CCP and Chinese government exercise over Defendant ByteDance.” [81] at 21. For instance, plaintiffs allege that during the legislative process, Congress “made extensive findings regarding the … close relationship between Defendant ByteDance and the CCP” and observed that China is “constructing ‘massive databases of Americans’ personal information.’” [58] ¶ 162. Plaintiffs further allege that “ByteDance has a Communist Party committee on site that, as of 2022, … included at least 138 individuals in the company’s Beijing office.”

Id. ¶ 317. Plaintiffs say that because CapCut is ‘“directly run by ByteDance executives in China’ who have direct access to user data … ByteDance must provide access to users’ electronic communications to the Chinese government.” Id. ¶ 320. This theory requires too many inferential leaps. First, plaintiffs presume without support that because some ByteDance employees are located in China and have ties to the CCP, those same employees also have access to CapCut’s user data.

Second, even if those employees do have access to CapCut’s data, plaintiffs do not plausibly allege that those employees are required to disclose that information to the Chinese government or the CCP. See id. ¶ 320 (stating, in conclusory fashion, that “ByteDance must provide access to users’ electronic communications to the Chinese government”) (emphasis added); see also In re Google, Inc. Privacy Policy Litig., 2013 WL 6248499, at *12 (N.D. Cal. Dec. 3, 2013) (allegations about Google’s disclosure of contents to third parties were too “theoretical … [to] support a claim” under the SCA). And third, even if plaintiffs had sufficiently alleged that CCP-affiliated ByteDance employees disclose data to the Chinese government and CCP, plaintiffs do not

sufficiently allege that these employees disclose user communications as opposed to the other types of data CapCut collects about its users. See 18 U.S.C. § 2702(a)(1) (imposing liability only when an entity knowingly divulges the “contents of a communication”) (emphasis added). The SCA claim therefore suffers a similar flaw as the ECPA and CIPA claims: although plaintiffs allege communications that in theory could be disclosed to third parties, see [58] ¶ 314, they do not plausibly allege that defendants in fact engaged in any unlawful disclosures. Plaintiffs’ allegations

are too speculative to state a claim for relief. The Court grants defendants’ motion to dismiss Count III. 5. Unfair Competition Law (Count VII) The Court previously dismissed a claim under the California Unfair Competition Law (“UCL”) because plaintiffs had not stated with particularity that they “lost money or property as a result of” defendants’ data privacy practices. Cal.

Bus. & Prof. Code § 17200; see also [56] at 28–31. In their second amended complaint, plaintiffs no longer seek to establish UCL loss under the diminution of value or invasion of privacy theories. Instead, they focus on four other theories: subscription fees, battery drain and device costs, benefit-of-the-bargain damages, and identity theft. As for the subscription fees, while plaintiffs assert generally that “[n]amed Plaintiffs [ ] utilized both yearly and monthly subscription services,” [58] ¶ 202, allegations earlier in the complaint indicate that only two of the nine named plaintiffs

pay subscription fees, id. ¶¶ 18–19.6 Plaintiffs say these individuals experienced an injury because they “would not have downloaded the CapCut app and incurred [ ] costs if they had known about CapCut’s improper data practices.” Id. ¶ 202. But the plausibility of this claim is belied by plaintiffs’ own allegations, which specify that these two plaintiffs are still using and paying for the CapCut app. Id. ¶ 18 (alleging that named plaintiff Zachary Buckus “continues to subscribe to the paid, CapCut Pro version of the app”); id. ¶ 19 (alleging that named plaintiff Raymon Marines videos

“switched to a paid subscription to CapCut Pro, which he has used for around two years” and “uses CapCut in his work as a film editor”). If plaintiffs’ theory of loss were true, these named plaintiffs would have ceased using and paying for the CapCut app. See Scott v. O’Grady, 975 F.2d 366, 368 (7th Cir. 1992) (courts are “not obliged to ignore any facts set forth in the complaint that undermine the plaintiff’s claim or to assign any weight to unsupported conclusions of law”) (quoting R.J.R. Services, Inc.

v. Aetna Casualty and Surety Co., 895 F.2d 279, 281 (7th Cir. 1989)). Plaintiffs therefore cannot rely on the subscription fees to establish loss under the UCL. Plaintiffs similarly allege they suffered “benefit of the bargain damages, insofar as Defendants took more data than they were authorized to take and used that data for undisclosed and unauthorized purposes.” Id. ¶ 196. True, some courts

6 In their response brief, plaintiffs do not dispute that only two named plaintiffs paid for CapCut’s services. [81] at 22–24. have held that the benefit of the bargain theory is cognizable under the UCL where a “user has surrendered in [a] transaction more than she otherwise would have.” In re Meta Pixel Tax Filing Cases, 724 F. Supp. 3d 987, 1024 (N.D. Cal. 2024); see also

Ji v. Naver Corp., No. 21-CV-05143-HSG, 2023 WL 6466211, at *9 (N.D. Cal. Oct. 3, 2023). But the benefit of the bargain theory is rooted in a plaintiffs’ ex ante expectations of what they were surrendering in the transaction. And here, plaintiffs do not say what their data-related expectations were going into the transaction and how defendants’ practices differed from these expectations. To the contrary, each of the named plaintiffs pleads that they never read CapCut’s privacy policy or terms of service before using the app. [58] ¶¶ 10, 13, 16, 17, 18, 19, 22, 23, 25; see also Scott,

975 F.2d at 368. Plaintiffs again argue that their damages include “loss of control over property (their data) that has a marketable value,” but the Court stands by its rejection of that argument for the reasons discussed in its previous order. See [56] at 29–30. The Court is also not persuaded by plaintiffs’ remaining two theories of harm. As already described, see supra at 8–10, plaintiffs’ battery loss theory is too

speculative to show harm, especially where plaintiffs do not plausibly state that the battery drain was due to defendants’ alleged unauthorized access and not the normal functioning of the CapCut app. C.f. Hernandez v. Path, Inc., No. 12-CV-01515 YGR, 2012 WL 5194120, at *2 (N.D. Cal. Oct. 19, 2012) (finding that alleged “depletion of two to three seconds of battery capacity” was “de minimis”). As for plaintiffs’ theory that their data is “now at risk of identity theft and fraud,” [58] ¶ 204, plaintiffs do not say how they have “lost money or property” because of this heightened risk, In re Sony Gaming Networks & Customer Data Sec.

Breach Litig., 903 F. Supp. 2d 942, 966 (S.D. Cal. 2012) (“Plaintiffs’ allegations that the heightened risk of identity theft, time and money spent on mitigation of that risk, and property value in one’s information, do not suffice as injury under the UCL.”). Plaintiffs do not allege, for example, that they have spent money on credit monitoring or some other means of mitigating the risk of identity theft.7 Plaintiffs’ reliance on TransUnion LLC v. Ramirez for their data-exposure theory is also unavailing. 594 U.S. 413, 425 (2021). See [81] at 26 n.29. TransUnion dealt with Article III standing,

but the UCL’s “lost money or property” standard is “substantially narrower than [Article III] standing … which may be predicated on a broader range of injuries.” See Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 324 (2011). Even if such harm were to suffice under Article III, plaintiffs still do not explain how exposure alone amounts to “lost money or property” under the UCL’s narrower standard. Because plaintiffs do not allege “lost money or property” from defendants’

alleged privacy violations, the Court grants defendants’ motion to dismiss Count VII.

7 Plaintiffs cite to Owens v. Smith, Gambrell and Russell Int’l, LLP, 2024 WL 391663, at *14 (C.D. Cal. May 30, 2024), for this proposition, but the Court is unable to locate the case using the Westlaw citation provided. (The Court was able to locate the opinion on the district court’s docket, so the opinion does exist.) It makes no difference to the Court’s analysis, however, because plaintiffs do not allege that they actually incurred credit-monitoring costs. 6. False Advertising Law (Count VIII) The Court previously dismissed plaintiffs’ claim under California’s False Advertising Law (“FAL”), in part because plaintiffs had not met the FAL’s economic

loss requirement. [56] at 31–33. For the same reasons just discussed in the context of plaintiffs’ UCL claim, plaintiffs have not satisfied the FAL’s economic loss requirement. See In re Ferrero Litig., 794 F. Supp. 2d 1107, 1111 (S.D. Cal. 2011) (“In order to assert a claim under the UCL or FAL, a person must have ‘suffered injury in fact and ha[ve] lost money or property.’”) (quoting Cal. Bus. & Prof. Code § 17535). The Court grants defendants’ motion to dismiss Count VIII. 7. Restitution and Unjust Enrichment (Count XII)

In its earlier order, the Court dismissed the restitution and unjust enrichment claim because plaintiffs failed to plead an actionable wrong—in other words, plaintiffs had not pled that they relied on a misrepresentation or omission when deciding to use the CapCut app. See [56] at 38–39. Plaintiffs fill this gap in their second amended complaint. They allege that “[h]ad Defendants fully and accurately disclosed their data practices, Plaintiffs would not have downloaded the CapCut app,

Plaintiffs would not have incurred economic injuries, and Defendants would not have obtained unjust benefits.” [58] ¶ 521; see also id. (“Plaintiffs relied on Defendants’ omissions, and this reliance was justifiable and reasonable.”). Defendants counter that plaintiffs’ unjust enrichment claim falls along with plaintiffs’ UCL and FAL claims because they are “predicated on the same allegations.” [70] at 26 (quoting Cleary v. Philip Morris, Inc., 656 F.3d 511, 517 (7th Cir. 2011)). But even if that were the case, plaintiffs now root their unjust enrichment claim in other actionable wrongs, including a few that survived defendants’ earlier motion to dismiss. See [58] ¶ 493 (alleging that defendants engaged in unlawful acts

by (1) invading their privacy under the California Constitution and (2) committing statutory larceny). Plaintiffs allege that defendants were unjustly enriched by these actions in several ways—for example, by using plaintiffs’ data to profit from targeted advertising, improving their artificial intelligence technologies, and incurring substantial subscription fees. Id. ¶¶ 488–89. Defendants do not say why plaintiffs’ unjust enrichment claim cannot survive based on these other theories of unlawful conduct. See [70] at 26; [95] at 14–15.

Defendants only suggest that a claim like larceny “does not match up with how Plaintiffs actually pleaded their restitution/unjust enrichment claim.” [95] at 14–15. But while some of plaintiffs’ allegations focus on fraudulent omissions that would be actionable under the UCL and FAL, see [58] ¶¶ 494, 499, 503–10, plaintiffs also allege that defendants acted unlawfully by, among other things, “violating statutory larceny,” id. ¶ 493(n). This is sufficient to plead an actionable wrong.

The Court therefore denies defendants’ motion to dismiss Count XII. 8. Biometric Information Privacy Act (Count XIII) The Court previously dismissed plaintiffs’ claims under Section 15(c), (d), and (e) of BIPA, 740 ILCS 14/15(c)–(e). See [56] at 43–47. Plaintiffs only attempt to replead their claim under Section 15(e), which requires entities to “store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity’s industry” or “in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.” 740

ILCS 14/15(e). The Court granted defendants’ motion to dismiss plaintiffs’ earlier Section 15(e) claim because plaintiffs had not described the requisite standard of care or explained how defendants’ practices fell short. See [56] at 47. Plaintiffs now allege eight different industry standards of care they say defendants violated with respect to their biometric data. These standards require entities to (1) obtain informed consent before collecting biometric data, [58] ¶ 553, (2) only collect biometric data that is necessary and only use it for the specified purpose,

id. ¶ 555, (3) implement measures for secure storage and transmission, id. ¶ 556, (4) limit access to biometric data and implement access controls and authentication for biometric data, id. ¶ 558, (5) conduct regular security audits, id. ¶ 563, (6) establish clear policies for retention of biometric data and information, id. ¶ 564, (7) maintain transparency and accountability with respect to the collection of biometric data, id. ¶ 565, and (8) adhere to relevant regulations and laws for the protection of users’

biometric data, id. ¶ 566. Plaintiffs adequately allege that defendants did not comply with at least some of these standards. For example, as to the first standard, plaintiffs allege that defendants provided no “notice and description of how they store and use biometric data and information,” which plausibly bears on how defendants “transmit” that data. Id. ¶ 553, see also id. ¶ 562. As to the second requirement that an entity only use biometric data for a specified purpose, id. ¶ 555, plaintiffs allege defendants go beyond using biometric data for video-making purposes and use it for other purposes, including (as alleged elsewhere in their complaint) “targeted advertising,

improvements to their artificial intelligence technologies, [and] their patent applications.” Id. ¶¶ 454, 555. Without ticking through each of the eight standards of care, the Court is satisfied that plaintiffs have done enough to state a claim under Section 15(e). Defendants suggest that the conduct alleged in plaintiffs’ Section 15(e) claim cannot overlap with requirements BIPA imposes elsewhere. See, e.g., [70] at 26–27 (arguing that the requirements that defendants have a biometric data retention

schedule and provide consent and/or notification of biometric data collection mirror BIPA’s requirements in Section 15(a)). But defendants provide no authority for the proposition that conduct that violates other BIPA provisions cannot also satisfy a claim under Section 15(e) if it violates a standard of care in the defendant’s industry. The Court denies defendants’ motion to dismiss Count XIII. CONCLUSION

For the reasons set forth above, the Court denies plaintiffs’ motion for alternative service of process [61]; grants defendants’ motion for leave to file a surreply [77]; and grants in part and denies in part defendants’ motion to dismiss [69]. To summarize: plaintiffs’ claims under the CFAA (Count I), CDAFA (Count IV), ECPA and CIPA (Counts II and IX), SCA (Count III), UCL (Count VII), and FAL (Count VIII) are dismissed with prejudice. See Agnew v. Nat? Collegiate Athletic Assn, 683 F.3d 328, 347 (7th Cir. 2012) (“[A] district court is not required to grant [leave to amend] when a plaintiff has had multiple opportunities to state a claim upon which relief may be granted.”). Plaintiffs may proceed with their claims under the California Constitution (Count V); intrusion upon seclusion (Count VI), larceny (Count X), and conversion (Count XJ); restitution and unjust enrichment (Count □□□□ and Sections 15(b) and (e) of BIPA (Count XIII). Defendants have until 9/26/25 to answer plaintiffs’ second amended complaint. The parties are directed to submit a joint status report reflecting their progress on fact discovery, which is scheduled to close by 1/15/26, by 10/10/25. If at any point the parties are interested in participating in a settlement conference with a Magistrate Judge, they should email the Courtroom Deputy and a referral will be entered. Wry J ray i Ul ul, Georgia N. Alexakis United States District Judge Date: 8/29/25