Sifuentes v. X Corp.

Opinion

DAVID ANGEL SIFUENTES, Case No. 24-cv-00590-SK Plaintiff, v. ORDER GRANTING DEFENDANT’S X CORP., INC., DISMISSING WITH PREJUDICE Defendant. Regarding Docket No. 37

Plaintiff David Angel Sifuentes, III (“Plaintiff”), proceeding pro se, brings claims under state law arising from three alleged data breaches that compromised Plaintiff’s account information stored with Defendant X Corp., Inc., formerly Twitter, Inc (“Defendant”). (Dkt. No. 32.) This matter comes before the Court upon consideration of Defendant’s motion to dismiss. (Dkt. No. 37.) This Court has jurisdiction pursuant to 28 U.S.C. § 1332. Both parties consented to magistrate judge jurisdiction. (Dkt. Nos. 9, 28.) Having carefully considered the parties’ papers, relevant legal authority, and the record in the case, the Court hereby GRANTS Defendant’s motion for the reasons set forth below. A. Factual Allegations. The operative complaint is Plaintiff’s Second Amended Complaint. (Dkt. No. 32.) The Court accepts the Second Amended Complaint’s allegations as true for the purposes of this motion. Plaintiff is a Michigan resident. (Id. at ¶ 2.) Defendant, a California corporation, operates the social media platform, X, formerly Twitter.1 (Id. at ¶ 3.) Plaintiff created an X account in 2011. (Id. at ¶ 2.) Plaintiff’s email address, name, IP address, location, and Facebook account were linked to his X account. (Id.) In addition, Plaintiff used the same password that he used for his other online accounts, including bank accounts. (Id.) Defendant suffered data breaches in 2016, 2021, and 2023 that exposed Plaintiff’s email address and password. (Id. at ¶ 4.) Defendant never informed Plaintiff about the breaches. (Id. at 6.) Plaintiff first learned of the 2016 data breach in November 2020 through a report from Credit Karma, a personal finance company. (Id. at ¶ 6.) Plaintiff investigated the breach and learned that Defendant had concealed the breach and did not take any remedial actions. (Id.) In January 2021, Plaintiff learned from Credit Karma that X had allegedly been breached again—the alleged breach occurred that same month. (Id. at ¶ 6, Ex. A.) On December 13, 2023, Plaintiff received a notification from MasterCard ID Theft Protection, an identity theft monitoring service, that X had been breached a third time on January 5, 2023. (Id. at ¶ 6, Ex. B.) As a result of the data breaches, information linked to Plaintiff’s X account was offered for sale on the “dark web.” (Id. at ¶ 5.) “[H]ackers and cybercriminals” used Plaintiff’s exposed email and password information to access his other online accounts, such as Spotify, Netflix, PayPal, Bank of America, and Facebook. (Id. at ¶ 5.) Plaintiff has suffered damages in connection with “the persistent risk of identity theft and fraud,” including emotional distress and anxiety, time and expense spent monitoring credit reports and financial accounts, and “costs associated with mitigating the risk of identity theft and fraud.” (Id. at ¶ 120-21.) B. Causes of Action. Plaintiff brings fourteen claims for relief, consisting of claims for: (1) Negligence, (id. at ¶¶ 15-19), (2) Breach of Contract, (id. at ¶¶ 20-27), (3) Breach of Implied Contract, (id. at ¶¶ 28-34), (4) Breach of Bailment, (id. at ¶¶ 35-40), (5) Public Disclosure of Private Facts, (id. at ¶¶ 41-46), (6) Negligent Infliction of Emotional Distress, (id. at ¶¶ 47-52), (7) Intentional Infliction of Emotional Distress (“IIED”), (id. at ¶¶ 53-57),2 (8) Violation of the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code § 1798.100 et seq., (id. at ¶¶ 82-89),3 (9) Violations of California Civil Code sections 1798.29 and 1798.82, (id. at ¶¶ 90-97), (10) Violation of the Michigan Identity Theft Prevention Act (“MITPA”), Mich. Comp. Laws § 445.61 et seq., (id. at ¶¶ 98-105), (11) Violation of the Michigan Consumer Protection Act, (“MCPA”), Mich. Comp. Laws § 445.901 et seq., (id. at ¶¶ 106-112), (12) Conversion, Cal. Civ. Code § 3336, (id. at ¶¶ 113-114), (13) Unjust Enrichment (id. at ¶¶ 115-16), and (14) Negligence Per Se (id. at ¶¶ 117-19). Plaintiff seeks $375,000 in emotional distress damages or “in the alternative an award of $150,000,” $5 million in punitive damages, and injunctive relief. (Id. at ¶¶ 21-22.) C. Procedural History. Plaintiff is a frequent litigant, both in this Court and in Plaintiff’s home state of Michigan.4 The Court is aware of four actions that Plaintiff has filed against Defendant arising out of alleged data breaches: two in the Western District of Michigan and two in this Court, before the undersigned. Plaintiff filed his first action against Defendant in the Western District of Michigan on November 30, 2022. Sifuentes v. Twitter Inc., No. 22-cv-01128-RJJ-PJG (W.D. Mich. filed Nov. 30, 2022). Plaintiff’s complaint was similar to the Second Amended Complaint, except that he only alleged injuries arising from the alleged 2016 data breach, not the alleged data breaches in 2021 or 2023, and that Plaintiff also brought claims under federal law. (22-cv-01128-RJJ-PJG, 2 The Second Amended Complaint states a claim for “intentional and or neglect [sic] infliction of emotional distress.” (Dkt. No. 32, ¶ 53.) As Plaintiff already brought a claim for negligent infliction of emotional distress, the Court construes Plaintiff’s seventh claim as one for IIED. 3 The Second Amended Complaint numbers this as claim 11. (Dkt. No. 32, ¶ 82.) The Court uses consecutive numbering and labels the CCPA claim as claim 8. Dkt. No. 1.) The Court in the Western District of Michigan dismissed Plaintiff’s complaint with prejudice because plaintiff failed to state a federal claim and the court declined to exercise supplemental jurisdiction over the remaining state claims. (22-cv-01128-RJJ-PJG, Dkt. Nos. 19, 21, 22.) The court also denied Plaintiff’s motions for reconsideration, for relief from judgment, to vacate the judgment, and to disqualify the involved judicial officers. (22-cv-01128-RJJ-PJG, Dkt. Nos. 35, 40, 47.) Plaintiff filed an additional complaint in the Western District of Michigan on September 15, 2023. Sifuentes v. Twitter Inc., No. 23-cv-00981-RJJ-PJG (W.D. Mich. filed Sep. 15, 2023). This complaint was identical to the complaint filed on November 30, 2022. (23-cv-00981-RJJ- PJG, Dkt. No. 2.) As relevant here, Plaintiff also filed a declaration with his complaint, which included an exhibit, entitled “Exhibit A,” which is a printout from a communication between Plaintiff and Credit Karma, LLC. (23-cv-00981-RJJ-PJG, Dkt. No. 4.) Credit Karma informed Plaintiff that after investigating the alleged June 2016 breach, “it looks like [X]’s database wasn’t actually breached, rather, the breached info was gathered from individual infected machines. To put it simply: it’s likely that [X] wasn’t hacked, [sic] you were.” (Id.) The Court in the Western District of Michigan dismissed Plaintiff’s complaint with prejudice because the notice that X’s database “wasn’t actually breached” made it impossible for Plaintiff to establish a plausible claim for data breach or to demonstrate the injury in fact and traceability necessary for Article III standing. Sifuentes v. Twitter Inc., No. 23-cv-981, 2023 WL 7295186, at *2 (W.D. Mich. Nov. 6, 2023). The Court also denied Plaintiff’s motion to vacate and for relief from judgment. (23-cv-00981-RJJ-PJG, Dkt. Nos. 17, 24.) Plaintiff filed two notices of appeal, but he filed motions to dismiss his appeals voluntarily after the United States Court of Appeals for the Sixth Circuit denied his motions for leave to proceed in forma pauperis. (23-cv-00981-RJJ-PJG, Dkt. Nos. 14, 18, 20, 21.) The Court of Appeals for the Sixth Circuit granted Plaintiff’s motions to dismiss his appeals voluntarily. (23-cv-00981-RJJ-PJG, Dkt. Nos. 22, 23.) Plaintiff filed an additional motion for relief from judgment on August 27, 2024, which remains pending. (23-cv-00981-RJJ-PJG, Dkt. No. 25.) No. 23-cv-1758-SK (N.D. Cal. filed Apr. 12, 2023). That complaint similarly alleged that Plaintiff was harmed by a data breach of X, but it only referenced the alleged 2021 breach. (23- cv-1758-SK, Dkt. No. 7.) That case proceeded before the undersigned through a hearing on Defendant’s motion to dismiss (23-cv-1758-SK, Dkt. No. 52); however, following the hearing, Plaintiff voluntarily dismissed the matter in November 2023. (23-cv-1758-SK, Dkt. No. 55.) Plaintiff filed this action on January 29, 2024, along with a motion to proceed in forma pauperis. (Dkt. Nos. 1, 2.) The Court granted the application to proceed in forma pauperis and dismissed the complaint with leave to amend pursuant to 28 U.S.C. § 1915. (Dkt. No. 4.) After Plaintiff filed his First Amended Complaint, the Court allowed his action to proceed. (Dkt. Nos. 7, 13.) Defendant filed a motion to dismiss, but the Court allowed Plaintiff to file a Second Amended Complaint and dismissed the motion as moot. (Dkt. Nos. 18, 25, 27.) Defendant filed a second motion to dismiss and accompanying request for judicial notice, which are currently before the Court. (Dkt. Nos. 37, 38.) Plaintiff opposed the motion. (Dkt. No. 41.) Because the parties did not discuss the issue of res judicata in the motion and opposition, the Court directed Defendant to include a discussion of res judicata in its reply and allowed Plaintiff to file a sur- reply. (Dkt. Nos. 46, 54, 56.) Defendant’s reply included a supplemental request for judicial notice. (Dkt. No. 54-1.) Plaintiff filed several supplemental pleadings in addition to his opposition and sur-reply, which violates the Court’s local rules and which the Court will not consider. (Dkt. Nos. 43, 57, 58, 60, 61.) In its discretion, the Court determined to rule on this motion without a hearing. (Dkt. No. 42.) A. Applicable Legal Standard on Motion to Dismiss. A motion to dismiss is proper under Federal Rule of Civil Procedure 12(b)(6) where the pleadings fail to state a claim upon which relief can be granted. On a motion to dismiss under Rule 12(b)(6), the Court construes the allegations in the complaint in the light most favorable to the non-moving party and takes as true all material allegations in the complaint. Sanders v. Kennedy, 794 F.2d 478, 481 (9th Cir. 1986) (per curiam). A plaintiff’s obligation to provide the recitation of the elements of a cause of action will not do.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). Rather, a plaintiff must instead allege “enough facts to state a claim to relief that is plausible on its face.” Id. at 570. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 556). “[A]s a general rule, a district court may not consider materials beyond the pleadings in ruling on a Rule 12(b)(6) motion.” Skilstaf, Inc. v. CVS Caremark Corp., 669 F.3d 1005, 1016 n.9 (9th Cir. 2012). However, documents subject to judicial notice, such as matters of public record, may be considered on a motion to dismiss. See id. In considering such documents, the Court does not convert a motion to dismiss into one for summary judgment. See id. “The court need not . . . accept as true allegations that contradict matters properly subject to judicial notice . . . .” Sprewell v. Golden State Warriors, 266 F. 3d 979, 988 (9th Cir. 2001). If the allegations in a complaint are insufficient to state a claim, a court should grant leave to amend, unless amendment would be futile (i.e., “the pleading could not possibly be cured by the allegation of other facts”). Cook, Perkiss & Lieche, Inc. v. N. Cal. Collection Serv., Inc., 911 F.2d 242, 246-47 (9th Cir. 1990) (per curiam). B. Defendant’s Motion to Dismiss. 1. Defendants’ Request for Judicial Notice is Granted. Defendant filed two requests for judicial notice. (Dkt. Nos. 38, 54-1.) Plaintiff summarily opposes the requests. (Dkt. No. 41, p. 4.) Together, the requests ask the Court take judicial notice of the following documents for the purposes of ruling on this motion: (1) Plaintiff’s Initial Complaint in this action, including attached exhibits, (2) Defendant’s signup page as it existed on January 1, 2011, (3) Defendant’s signup page as it existed on December 31, 2011, (4) Defendant’s Terms of Service in effect on January 1, 2011, (5) Defendant’s Terms of Service in effect on December 31, 2011, (6) Defendant’s Privacy Policy in effect on January 3, 2011, (8) The PACER docket sheet for Sifuentes v. Twitter Inc., No. 23-cv-1758-SK (N.D. Cal. filed Apr. 12, 2023), (9) Plaintiff’s First Amended Complaint filed in Sifuentes v. Twitter Inc., No. 23-cv- 1758-SK (N.D. Cal. filed Apr. 12, 2023), (10) Plaintiff’s Complaint filed in Sifuentes v. Twitter Inc., No. 23-cv-981, 2023 WL 7295186, at *2 (W.D. Mich. Nov. 6, 2023), (11) Plaintiff’s Declaration filed at Dkt. No. 4 in Sifuentes v. Twitter Inc., No. 23-cv- 981, 2023 WL 7295186, at *2 (W.D. Mich. Nov. 6, 2023), and (12) The Judgment entered in Sifuentes v. Twitter Inc., No. 23-cv-981, 2023 WL 7295186, at *2 (W.D. Mich. Nov. 6, 2023). (Dkt. Nos. 38, 54-1.) The Court may take judicial notice of facts “not subject to reasonable dispute” because they are (1) “generally known within the trial court’s territorial jurisdiction,” or (2) “capable of accurate and ready determination from sources whose accuracy cannot reasonably be questioned.” See Fed. R. Evid. 201(b). Defendants’ noticed documents all fall under the second category. Documents 1 and 8-12 are court filings. Courts “may take judicial notice of undisputed matters of public record, including documents on file in federal or state courts.” Harris v. Cnty. of Orange, 682 F.3d 1126, 1132 (9th Cir. 2012) (citation omitted). Documents 2 and 3 are publicly available webpages. Courts regularly take judicial notice of the contents of webpages because they “can be accurately and readily determined.” E.g., Makaeff v. Trump Univ., LLC, 715 F.3d 254, 259 (9th Cir. 2013); Garcia v. E.L. Heritage Inn of Sacramento, LLC, No. 21-15674, 2022 WL 3359175, at *1 (9th Cir. Aug. 15, 2022). Documents 4-7 are Defendants’ Terms of Service and Privacy Policy. These documents are not the subject of reasonable dispute, and their authenticity is not in question. See, e.g., Trudeau v. Google LLC, 349 F. Supp. 3d 869, 876 (N.D. Cal. 2018) (taking judicial notice of Google’s Terms of Service); Matera v. Google Inc., 2016 WL 5339806, at *7 (N.D. Cal. Sept. 23, 2016) (same). Moreover, Plaintiff refers to these documents in his Second Amended Complaint, v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003) (explaining that a document “may be incorporated by reference into a complaint if . . . the document forms the basis of the plaintiff’s claim.”). Accordingly, the Court GRANTS Defendant’s two requests for judicial notice. 2. California Law Applies to Plaintiff’s Claims. Defendant argues that California law governs Plaintiff’s claims because Plaintiff agreed to Defendant’s Terms of Service (“Terms”), which provides that California law governs disputes between Defendant and its users. (Dkt. No. 37, p. 15.) Plaintiff does not dispute that California law governs, (Dkt. No. 41), and Plaintiff’s Second Amended Complaint alleges that Plaintiff “agreed to the terms of service and privacy policy of Defendant,” which constituted “a valid and enforceable contract between Plaintiff and Defendant,” (Dkt. No. 32. ¶¶ 21-22). Further, this Court has already determined that Defendant’s terms set forth a valid choice-of-law clause. Trump v. Twitter Inc., 602 F. Supp. 3d 1213, 1226 (N.D. Cal. 2022). Accordingly, California substantive law applies to Plaintiff’s claims. 3. The Doctrine of Res Judicata Bars Plaintiff’s Claims Arising from the Alleged 2016 Breach. Defendant argues that Plaintiff’s claims are precluded by the judgment in Sifuentes v. Twitter Inc., No. 23-cv-00981-RJJ-PJG (W.D. Mich. filed Sep. 15, 2023) (hereinafter, “Sifuentes I”). (Dkt. No. 54, pp. 7-10.) Plaintiff argues that this action is not precluded because he did not have a “full and fair opportunity to litigate” in Sifuentes I. (Dkt. No. 61, pp. 1-2.) Although California law applies to Plaintiff’s claims, the question of whether res judicata applies is determined by Michigan law. “Where the allegedly preclusive decision was a diversity action, federal common law requires us to apply ‘the law that would be applied by state courts in the State in which the federal diversity court sits.’” Vazquez v. Jan-Pro Franchising Int’l, Inc., 986 F.3d 1106, 1114 (9th Cir. 2021) (quoting Semtek Int’l Inc. v. Lockheed Martin Corp., 531 U.S. 497, 508 (2001). “Because the allegedly preclusive decisions were rendered by federal courts located in [Michigan], we look to [Michigan] preclusion law.” Id. The purpose of res judicata is to prevent multiple lawsuits litigating the same cause of action. Washington v. Sinai Hosp. of Greater Detroit, 733 N.W.2d 755, 759 (Mich. Ct. App. 2007). “The doctrine bars a second, subsequent action when (1) the prior action was decided on the merits, (2) both actions involve the same parties or their privies, and (3) the matter in the second case was, or could have been, resolved in the first.” Adair v. Michigan, 680 N.W.2d 386, 396 (Mich. Ct. App. 2004). With respect to the third prong, Michigan courts apply a broad “transactional” test. Garrett v. Washington, 886 N.W.2d 762, 766 (Mich. Ct. App. 2016). Under the transactional test, the determinative question is whether the claims in the instant case arose as part of the same transaction as did the plaintiff’s claims in the original action. Id. “Whether a factual grouping constitutes a transaction for purposes of res judicata is to be determined pragmatically, by considering whether the facts are related in time, space, origin or motivation, and whether they form a convenient trial unit.” Adair v. State, 680 N.W.2d 386, 398 (Mich. 2004) (citation omitted, cleaned up). “Res judicata bars every claim arising from the same transaction that the parties, exercising reasonable diligence, could have raised but did not.” Id. at 397. The first and second prongs of Michigan’s res judicata test are easily satisfied. First, Sifuentes I was dismissed with prejudice. Sifuentes, 2023 WL at *3. Contrary to Plaintiff’s claims that he did not have a full and fair opportunity to litigate, Plaintiff was able to file an objection to the dismissal of his case before judgment was entered. (23-cv-00981-RJJ-PJG, Dkt. No. 10.) Moreover, it is clearly established that “[a] dismissal with prejudice amounts to an adjudication on the merits and bars a further action based on the same facts.” Grimmer v. Lee, 872 N.W.2d 725, 729 (Mich. Ct. App. 2015). Second, the parties in Sifuentes I are the same parties in this action: Sifuentes and X Corp., Inc. (formerly Twitter). However, the third prong is only satisfied as to Plaintiff’s claims arising out of the alleged breach in 2016. Both Sifuentes I and this action allege that Plaintiff had an account with Defendant, that Defendant suffered data breaches that compromised Plaintiff’s information, that Defendant did not provide adequate notice of those breaches to Plaintiff, that Plaintiff learned of the data breach in November 2020 through a report from an external credit and breach monitoring service, and that Plaintiff suffered resulting emotional distress. (23-cv-00981-RJJ-PJG, DKT. No. breach in 2016, whereas this action alleges harm arising out of alleged breaches in 2016, 2021, and 2023. Each alleged data breach constitutes a separate transaction, for the facts pertaining to each breach are unrelated in time and could each potentially give rise to separate statutory penalties. In Sifuentes I, the court determined that Plaintiff’s own pleadings suggested no breach occurred, but that reasoning does not necessarily apply to the 2021 and 2023 breaches. Further, Plaintiff alleges that he did not even have notice of the 2023 breach until after he filed Sifuentes I. (Compare 23-cv-00981-RJJ-PJG, Dkt. No. 2 (filing Sifuentes I on September 15, 2023) with Dkt. No. 32, Ex. B (receiving notice of 2023 breach on December 13, 2023).) In sum, res judicata bars Plaintiff’s claims premised on the alleged breach in 2016, and the Court GRANTS Defendant’s motion to dismiss with respect to those claims. Because no amendment to the pleadings could possibly get around the res judicata bar, amendment would be futile. The Court therefore DISMISSES the claims based on the 2016 breach WITH PREJUDICE. Res judicata does not preclude Plaintiff’s claims premised on the 2021 and 2023 breaches, but those claims are also not viable for the reasons set forth below. 4. The Terms Bar Plaintiff’s Claims under Common Law (other than IIED) (Claims 1-6, 13-14). Defendants argue that the Terms bar Plaintiff’s common law claims (other than IIED). (Dkt. No. 37, pp. 15-16.) Plaintiff argues that the Terms do not shield against liability for tort and statutory claims. (Dkt. No. 41, p. 3.) Both parties agree the Terms are a valid and enforceable agreement between them. See supra p. 6. The Terms include the following language: Your access to and use of the Services or any Content is at your own risk . . . . Twitter will not be responsible or liable for any harm to your computer system, loss of data, or other harm that results from your access to or use of the Services, or any Content . . . . We make no warranty that the Services will meet your requirements or be available on an uninterrupted, secure, or error-free basis . . . . Limitation of Liability TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, TWITTER . . . WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR LOSS OF PROFITS, DATA, USE, GOOD-WILL, OR OTHER INTANGIBLE LOSSES, RESULTING FROM (i) YOUR ACCESS TO OR USE OF . . . THE SERVICES; . . . (iv) UNAUTHORIZED ACCESS, USE OR ALTERATION OF YOUR TRANSMISSIONS CONTRACT, TORT (INCLUDING NEGLIGENCE) OR ANY BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGE, AND EVEN IF A REMEDY SET FORTH HEREIN IS FOUND TO (Dkt. Nos. 38-5, pp. 3-4; 38-6, pp. 3-4.) California courts enforce “clear, unambiguous, and explicit” liability limiting provisions unless they are unconscionable. Murphy v. Twitter, Inc., 274 Cal. Rptr. 3d 360, 377-78 (Ct. App. 2021) (citation omitted). Plaintiff does not argue that the Terms are unconscionable. “Courts have also recognized service providers that offer free services to Internet users may have a legitimate commercial need to limit their liability and have rejected claims that such limitations are so one-sided as to be substantively unconscionable.” Id. at 378. Moreover, this Court has already concluded that Defendants’ Terms bar liability for a data breach absent specific allegations of unconscionability. Gerber v. Twitter, Inc., No. 4:23-CV-00186-KAW, 2024 WL 1354449, at *4-5 (N.D. Cal. Mar. 29, 2024). Under California law, companies may limit liability for claims under contract and claims for torts involving ordinary negligence, see Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 147 Cal. Rptr. 3d 634, 642 (Ct. App. 2012), but not for intentional torts, fraud, and statutory claims. See Cal. Civ. Code § 1668. Accordingly, the Terms bar all of Plaintiff’s claims except for IIED (claim 7) and statutory violations (claims 8-12). The Court GRANTS Defendants’ motion to dismiss as to claims 1-6 and 13-14. Because no amendment to the pleadings could possibly get around these liability limiting provisions, amendment would be futile. The Court therefore DISMISSES claims 1-6 and 13-14 WITH PREJUDICE. 5. Plaintiff’s Second Amended Complaint Does Not State a Claim for IIED (Claim 7). Plaintiff fails to state a claim for intentional infliction of emotional distress. “To state a cause of action for intentional infliction of emotional distress, the plaintiff must allege (1) extreme and outrageous conduct with the intention of causing, or reckless disregard of the probability of causing, emotional distress; (2) the plaintiff’s suffering severe or extreme emotional distress; and (3) actual and proximate causation of the emotional distress by the defendant's outrageous conduct.” Mintz v. Blue Cross of California, 92 Cal. Rptr. 3d 422, 432-33 (Cal. App. 2009). “Further, the conduct alleged must be so extreme and outrageous as to go beyond all possible bounds of decency, and to be regarded as atrocious, and utterly intolerable in a civilized community.” Id. (citations and quotation marks omitted, cleaned up). Defendant argues that Plaintiff has not alleged that Defendant behaved in an “extreme and outrageous” manner or intended to cause Plaintiff emotional distress (or recklessly disregarded the probability thereof). (Dkt. No. 37, pp. 26-27.) Plaintiff does not respond specifically to this argument, but generally argues that he has satisfied the Twombly plausible pleading standard. On the contrary, Twombly instructs that Plaintiff must provide “factual allegation . . . enough to raise a right to relief above the speculative level” and that “a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 (citation and quotation marks omitted). Plaintiff’s allegations are a literal “formulaic recitation of the elements of IIED.” (See Dkt. No. 32 ¶¶ 54-56 (“Defendant acted intentionally or recklessly . . . . Defendant’s conduct was extreme and outrageous, and exceeded all bounds of decency . . . . Defendant’s conduct caused Plaintiff to suffer emotional distress.”).) “As such, the allegations are conclusory and not entitled to be assumed true.” Ashcroft, 556 U.S. at 681 (citing Twombly, 550 U.S. at 554-55). As Plaintiff has not stated a plausible claim for IIED, the Court GRANTS Defendant’s motion to dismiss with respect to Plaintiff’s seventh cause of action but dismisses WITH LEAVE 6. Plaintiff Cannot Bring Claims Under the CCPA and California Civil Code Sections 1798.29 and 1798.82 Because He is Not a California Resident (Claims 8-9). Defendants argue that the CCPA and California Civil Code sections 1798.29 and 1798.82 only provide a private right of action to California residents. (Dkt. No. 37, pp. 27-28.) Plaintiff he should be able to seek relief under these statutes because holding otherwise would violate the equal protection clause, because the language and policy of the statutes supports extraterritorial reach, because Plaintiff is connected to California through his use of California-based online platforms, and because the harm occurred in California. (Dkt. No. 32, pp. 11-16.) Plaintiff’s arguments are not sufficient to allow him to assert these claims, though. The CCPA creates a private right of action for “[a]ny consumer whose nonencrypted and nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.” Cal. Civ. Code § 1798.150(a). A “consumer” is defined as “a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.” Cal. Civ. Code § 1798.140(g). Section 17014 of Title 18 of the California Code of Regulations defines “resident” as “(1) every individual who is in the State for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose. All other individuals are nonresidents.” Cal. Code Regs. tit. 18, § 17014. Therefore, the CCPA is clear that it does not apply to non-resident plaintiffs. Delgado v. Meta Platforms, Inc., 718 F. Supp. 3d 1146, 1154 (N.D. Cal. 2024) (“[T]he CCPA does not apply to Illinois citizens.”). Similarly, California Civil Code sections 1798.29 and 1798.82 impose requirements for disclosure of “breach[es] in the security of the data to a resident of California.” Cal. Civ. Code. §§ 1798.29, 1798.82. Based on that plain language, non-California residents lack standing to bring claims under these provisions. See e.g., In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-MD-02752-LHK, 2017 WL 3727318, at *34 (N.D. Cal. Aug. 30, 2017). On this basis, his eighth and ninth claims necessary fail. Accordingly, the Court GRANTS Defendant’s motion to dismiss as to Plaintiff’s eighth and ninth causes of action. Because no amendment to the pleadings could possibly get around these statutory bars, amendment would be 7. Plaintiff’s Claims Under Michigan Law are Barred by the Terms’ Choice of Law Clause (Claims 10 and 11). Disputes between Plaintiff and Defendant are governed by California law. See supra, pp. 7-8. To disregard this choice, Plaintiff must show that California’s data protection law is contrary to a fundamental policy of Michigan’s data protection law and that Michigan has a materially greater interest in the determination of the matter. See Ruiz v. Affinity Logistics Corp., 667 F.3d 1318, 1323 (9th Cir. 2012). Plaintiff presents no argument why the Court should disregard the choice of California law in favor of the Michigan statutes. Consequently, Plaintiff cannot bring claims against Defendant under Michigan law. See Trump, 602 F. Supp. 3d at 1226-27 (holding that Twitter’s California choice-of-law provision barred claim under another state’s statute where the plaintiff did not carry burden of demonstrating conflict of laws). The Court GRANTS Defendant’s motion to dismiss as to claims 10 and 11. Because no amendment to the pleadings could possibly get around the choice of law provision, amendment would be futile. The Court therefore DISMISSES claims 10 and 11 WITH PREJUDICE. 8. Plaintiff’s Claim for Conversion Fails as a Matter of Law (Claim 12). Defendant argues that Plaintiff’s claim for conversion fails as a matter of law because Plaintiff voluntarily provided his allegedly stolen information to Defendant and because his account information does not constitute property capable of exclusive possession of control. (Dkt. No. 37, pp. 30-31.) Plaintiff does not respond to these arguments. Defendants are correct. Under California law, “[c]onversion is the wrongful exercise of dominion over the property of another. The elements of a conversion are the plaintiff’s ownership or right to possession of the property at the time of the conversion; the defendant’s conversion by a wrongful act or disposition of property rights; and damages.” Greka Integrated, Inc. v. Lowrey, 35 Cal. Rptr. 3d 684, 692 (Ct. App. 2005). Because conversion requires a wrongful act, there can be no conversion claim if a plaintiff willingly provided his property to a defendant. See Farrington v. A. Teichert & Son, 139 P.2d 80, 82 (Cal. 1943). Plaintiff says himself that he used his email address, password, full name, IP address, and location to create his X account. (Dkt. No. 31, p. 1.) Thus, Defendant did not wrongfully convert this information; Plaintiff gave it to Defendant. 1 See Holistic Supplements, L.L.C. v. Stark, 275 Cal. Rptr. 3d 791, 806-07 (Ct. App. 2021). 2 However, the Ninth Circuit consistently applies a three-part test to determining the property 3 element in California cases: “First, there must be an interest capable of precise definition; second, 4 it must be capable of exclusive possession or control; and third, the putative owner must have 5 established a legitimate claim to exclusivity.” Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 6 2003). This Court has held that “personal information” such as “a user’s location, zip code, device 7 identifier, and other data” is incapable of precise definition and is not capable of exclusive 8 possession or control, such that there can be no conversion of such personal information. In re 9 iPhone Application Litig., 844 F. Supp. 2d 1040, 1075 (N.D. Cal. 2012). 10 The Court GRANTS Defendant’s motion to dismiss as to Plaintiff's 12" cause of action. 11 Because Plaintiff's own admissions destroy his conversion claim, amendment would be futile. 12 The Court therefore DISMISSES this claim WITH PREJUDICE.° 14 For the foregoing reasons, the Court GRANTS Defendant’s motion to dismiss, GRANTS 15 || Defendant’s requests for judicial notice, and dismisses all claims other than the claim for ITED in a 16 || Plaintiff's Second Amended Complaint WITH PREJUDICE. Plaintiff may amend his claim 17 (Claim 7) for IED by December 16, 2024. No other amendment is allowed. 19 Dated: December 2, 2024 4 ( . a, . 20 SALLIE KIM 21 United States Magistrate Judge 22 23 24 25 26 27 28 > The Court declines to reach Defendant’s alternative arguments for dismissal of □□□□□□□□□□ Second Amended Complaint.