K. v. Google LLC ( 2023 )

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 8 M. K., Case No. 21-cv-08465-VKD 9 Plaintiff, ORDER GRANTING IN PART AND 10 v. DENYING IN PART GOOGLE’S MOTION TO DISMISS 11 GOOGLE LLC, et al., Re: Dkt. No. 78 Defendants. 12 13 14 Plaintiff M.K., through his mother as guardian ad litem, brings this action against Google, 15 LLC (“Google”) and the Fremont Unified School District (“District”) asserting claims for relief 16 for harm M.K. alleges he suffered when the District used a Google platform to facilitate remote 17 learning during the COVID-19 pandemic.1 Both defendants moved to dismiss M.K.’s original 18 complaint pursuant to Rule 12(b)(6). Dkt. Nos. 21, 33. The Court granted these motions, but gave 19 M.K. leave to amend his complaint. Dkt. Nos. 64, 65. 20 M.K.’s first amended complaint (“FAC”) asserts four claims against Google for: (1) 21 violation of the federal Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710; (2) violation of 22 California’s unfair competition law (“UCL”), Cal. Bus. & Prof. Code § 17200, et seq.; (3) 23 violation of the California Student Online Personal Information Protection Act (“SOPIPA”), Cal. 24 Bus. & Prof. Code § 22584; and (4) “failure to protect.” Dkt. No. 66 ¶¶ 39-104.2 Google again 25 26 1 All parties have expressly consented that all proceedings in this matter may be heard and finally adjudicated by a magistrate judge. 28 U.S.C. § 636(c); Fed. R. Civ. P. 73; Dkt. Nos. 6, 19, 32. 27 1 moves to dismiss all claims pursuant to Rule 12(b)(6). See Dkt. No. 78. M.K. opposes the 2 motion, except that he has withdrawn his SOPIPA claim against Google. See Dkt. No. 83. 3 The Court held a hearing on Google’s motion to dismiss on July 18, 2023. Dkt. No. 86. 4 Upon consideration of the moving and responding papers, as well as the oral arguments presented, 5 the Court grants the motion in part and denies it in part. 6 I. BACKGROUND 7 The following facts are based on the allegations of the FAC. 8 In 2020, M.K. was a student at a public elementary school in the District. Dkt. No. 66 ¶ 1. 9 In March 2020, due to the COVID-19 pandemic, the District closed its school buildings, and M.K. 10 began attending school remotely using a Google platform.3 Id. ¶¶ 1-2. According to the FAC, 11 “M.K’s parents were not given an option to opt out or an alternative to receive education if they 12 did not wish to submit M.K. to the risks of attending school on the Google platform.” Id. ¶ 2. 13 The District assigned M.K. a Google account. Id. ¶ 3. Using this account, M.K. “[was] 14 allowed to access online videos provided by Google’s YouTube, a video sharing platform[,] as 15 well as Google [Slide Show], a platform that allows individuals to watch videos as well as insert 16 videos and messages into slideshows to watch.” Id. ¶ 7. The District logged M.K. out of his 17 Google account at the end of each school day. Id. ¶ 3. 18 According to the FAC, M.K. used multiple devices to access his Google account, including 19 his personal iPad and, later, a Google Chromebook computer supplied by the District. Id. ¶¶ 4, 6. 20 M.K. watched videos on Google’s YouTube and Slide Show platforms while logged into the 21 Google platform for school. Id. ¶ 9. M.K.’s teachers informed his parents that M.K. was 22 watching videos during class when he should have been focused on his lessons. Id. ¶ 10. M.K.’s 23 teachers further advised M.K.’s parents that the teachers could see M.K.’s online activity during 24 class time. Id. Based on this information, M.K. alleges that Google gave the District and other 25 3 In some places, the FAC refers to this platform as “Google Classroom” or “Google Classrooms.” 26 See Dkt. No. 66 ¶¶ 4, 14. In its motion, Google refers to this as its “education platform, Google Workspace for Education.” See Dkt. No. 78 at 1. However, it is not clear from the allegations in 27 the FAC exactly what the platform is or whether there are any terms of service that govern the 1 unidentified third parties access to M.K.’s online activity. Id. ¶ 13. 2 On or about January 14, 2021, one of M.K’s teachers reported receiving a sexually explicit 3 communication from M.K. via a Google chat message. Id. ¶ 16. M.K. alleges that his Google 4 account had been hacked and that he did not send the message. Id. ¶¶ 17, 20, 24. The District 5 investigated the message incident. As part of that investigation, the District obtained and 6 reviewed information about the dates and times M.K.’s Google account was accessed, the 7 activities the account user engaged in while logged in to the account, and the IP addresses used to 8 access the account. Id. ¶¶ 18, 20-21, 49. 9 According to the FAC, on or about January 27, 2021, M.K.’s teacher “scheduled a parent- 10 teacher zoom call and made a teacher suspension on the basis of ‘Sexual Harassment via Google 11 Classroom.’” Id. ¶ 22. The FAC describes the suspension variously as a “teacher removal from 12 class,” a two-day suspension from school, an exclusion from “his regular school day” that lasted 13 “weeks,” and a “permanent[]” removal from class. Id. ¶¶ 23, 25-26, 28, 82, 107. M.K. eventually 14 stopped attending school in the District. Id. ¶¶ 31, 82. 15 M.K. alleges that “Google made M.K.’s personal information available to hackers, and to 16 staff of [the District], who then penalized [him] for a hacker[’]s activity on Google Slideshow and 17 Google Chat.” Id. ¶ 52. He also alleges that Google failed to implement adequate cybersecurity 18 measures to prevent his Google account from being hacked, or his personal information from 19 being used or disclosed for unauthorized purposes, and that Google failed to warn M.K.’s parents 20 and the District of the “vulnerability of Google Classrooms.” Id. ¶¶ 77-81, 87. M.K. seeks “an 21 order requiring Google to permanently destroy all data of M.K.” and other injunctive relief, 22 damages for “emotional distress and damage to reputation caused by negligence,” and punitive 23 damages. Id. at 16-17. 24 II. LEGAL STANDARD 25 A motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) tests the legal 26 sufficiency of the claims in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). 27 Dismissal is appropriate where there is no cognizable legal theory or an absence of sufficient facts 1 F.2d 696, 699 (9th Cir. 1990)). At the motion to dismiss stage, all material allegations in the 2 complaint must be taken as true and construed in the light most favorable to the claimant. Id. 3 The factual allegations in the complaint “must be enough to raise a right to relief above the 4 speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). Implausible claims 5 for relief will not survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009). A 6 claim is plausible if its factual content permits the court to draw a reasonable inference that the 7 defendant is liable for the alleged misconduct. Id. at 678. 8 Rule 8(a)(2) requires only “a short and plain statement of the claim showing that the 9 pleader is entitled to relief.” However, “[t]hreadbare recitals of the elements of a cause of action, 10 supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678. “The court is 11 not required to accept legal conclusions cast in the form of factual allegations if those conclusions 12 cannot reasonably be drawn from the facts alleged.” Clegg v. Cult Awareness Network, 18 F.3d 13 752, 754-55 (9th Cir. 1994). 14 III. DISCUSSION 15 As M.K. has withdrawn his SOPIPA claim against Google (claim 3), the Court considers 16 only Google’s motion to dismiss claims 1, 2 and 4. The Court also considers Google’s request for 17 judicial notice. 18 A. Google’s Request for Judicial Notice 19 Google requests that the Court take judicial notice of guidance regarding the Children’s 20 Online Privacy Protection Act (“COPPA”), 15 U.S.C. § 6501 et seq., published by the Federal 21 Trade Commission (“FTC”): “Complying with COPPA: Frequently Asked Questions, Federal 22 Trade Commission,” https://www.ftc.gov/business-guidance/resources/complying-coppa- 23 frequently-asked-questions (“COPPA Guidance”). See Dkt. No. 78 at 3-4. Among other things, 24 the COPPA guidance states that “[m]any school districts contract with third-party website 25 operators to offer online programs . . . [i]n these cases, the schools may act as the parent’s agent 26 and can consent under COPPA to the collection of kids’ information on the parent’s behalf.” Id. at 27 3. M.K. does not oppose Google’s request for judicial notice, but argues that the FTC’s COPPA 1 “Generally, district courts may not consider material outside the pleadings when assessing 2 the sufficiency of a complaint.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 3 2018). However, a court may take judicial notice of facts that are “not subject to reasonable 4 dispute” because they are “generally known” or “can be accurately and readily determined from 5 sources whose accuracy cannot reasonably be questioned.” Id. at 999; Fed. R. Evid. 201(b). 6 Courts may take judicial notice of matters of public record, including statutes, regulations 7 and agency interpretations thereof. See Jonna Corp. v. City of Sunnyvale, CA, No. 17-CV-00956- 8 LHK, 2017 WL 5194513, at *4 (N.D. Cal. Nov. 9, 2017). But while a court may take notice of 9 public records, it may not take notice of disputed facts stated in those records. Khoja, 899 F.3d at 10 999 (citing Lee v. City of Los Angeles, 250 F.3d 668, 689 (9th Cir. 2001)). 11 The Court grants Google’s request for judicial notice of the FTC’s published guidance 12 because the request is unopposed. However, the guidance has no bearing on the Court’s resolution 13 of the motion to dismiss. 14 B. Claim 1: Video Privacy Protection Act 15 Congress enacted the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, “to 16 preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar 17 audio visual materials.” Mollett v. Netflix, Inc., 795 F.3d 1062, 1065 (9th Cir. 2015) (quoting S. 18 Rep. 100-599, at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342–1.). The statute forbids “video 19 tape service provider[s]” from knowingly disclosing “personally identifiable information 20 concerning any consumer.” 18 U.S.C. § 2710(b)(1). A person aggrieved by a violation of the 21 statute may bring an action for actual damages of not less than $2,500, punitive damages, 22 attorneys’ fees, and injunctive relief. See 18 U.S.C. § 2710(c). To state a claim for violation of 23 the VPPA, M.K. must plausibly allege that (1) Google is a “video tape service provider,” (2) M.K. 24 is a “consumer,” (3) Google knowingly disclosed M.K.’s “personally identifiable information” to 25 “any person,” and (4) the disclosure was not a permitted disclosure authorized under § 2710(b)(2). 26 See Dkt. No. 65 at 4-5 (citing Mollet, 795 F.3d at 1066). 27 M.K. alleges that Google is a video tape service provider because it delivers audio visual 1 that he is a “non-paying subscriber of Google Classrooms, Youtube and Google Slideshow and 2 was given an account to access the listed Google Platforms by [the District].” Id. ¶ 40. He alleges 3 “upon information and belief” that the District “pays a subscription fee which pays for the 4 subscription costs of each student within the [D]istrict.” Id. Finally, M.K. alleges that Google 5 shared his personal information with third parties, including the District and its employees, 6 without his consent. See id. ¶¶ 46-51. 7 Google does not dispute that it is a video tape service provider within the meaning of the 8 VPPA, but it argues that M.K. fails to plausibly allege that the company disclosed his personal 9 information to anyone other than the District. Dkt. No. 78 at 5-6. Google also argues that 10 disclosure of M.K.’s personal information to the District does not violate the VPPA because (1) 11 M.K. is not a “consumer” within the meaning of the statute, as his account was created as part of 12 his relationship with the District, not a relationship with Google, and (2) any disclosure to the 13 District was permitted under the statute’s exception for disclosures made in the ordinary course of 14 business. Id. at 7-9. The Court considers each of these arguments. 15 1. Whether M.K. is a “consumer” 16 For purposes of the VPPA, a consumer is “any renter, purchaser, or subscriber of goods or 17 services” from a video tape service provider. 18 U.S.C. § 2710(a)(1). The VPPA does not define 18 the term “subscriber.” While the parties appear to agree that a person may be a subscriber even if 19 he does not pay for a subscription, they disagree about whether M.K. is a subscriber of goods and 20 services from Google. See Dkt. No. 78 at 7-8; Dkt. No. 83 at 4-5. M.K. contends that he is a 21 subscriber because he has a Google account, including a unique login, and he argues that it does 22 not matter that the District required him to have such an account or arranged for him to get it. Dkt. 23 No. 83 at 4-5. Google argues that M.K. is not a subscriber because his relationship is with the 24 District only, and not with Google. Dkt. No. 78 at 7. 25 The Ninth Circuit has not addressed the meaning of the term “subscriber” as used in the 26 VPPA. The two circuits that have considered this question have adopted similar interpretations of 27 the statutory text. In Ellis v. Cartoon Network, the Eleventh Circuit held that “’subscription’ 1 person and an entity.” 803 F.3d 1251, 1256 (11th Cir. 2015). Relevant considerations include 2 whether the relationship between the plaintiff and the video tape service provider involves 3 payment, registration, establishment of an account, provision of personal information, receipt or 4 delivery of goods or services, expressed association, and/or access to restricted content. See id.; 5 see also Perry v. Cable News Network, 854 F.3d 1336, 1342 (11th Cir. 2017) (applying the Ellis 6 framework). In Ellis, the plaintiff downloaded the defendant’s free application on his smartphone 7 and used it to watch video clips. The Eleventh Circuit concluded the plaintiff was not a subscriber 8 within the meaning of the VPPA, explaining: 9 In our view, downloading an app for free and using it to view content at no cost is not enough to make a user of the app a 10 “subscriber” under the VPPA, as there is no ongoing commitment or 11 relationship between the user and the entity which owns and operates the app. Importantly, such a user is free to delete the app 12 without consequences whenever he likes, and never access its content again. The downloading of an app, we think, is the 13 equivalent of adding a particular website to one’s Internet browser as a favorite, allowing quicker access to the website's content. 14 Under the circumstances, Mr. Ellis was not a “subscriber” of 15 Cartoon Network or its CN app. 16 Ellis, 803 F.3d at 1257; see also Perry, 854 F.3d at 1342-43 (concluding that plaintiff was not a 17 subscriber of CNN, even if he was able to access certain features a typical user of CNN’s free 18 mobile application could not, because plaintiff’s ability to access those features was due to his 19 status as a subscriber of his cable television provider, not CNN). 20 In Yershov v. Gannett Satellite Information Network, the First Circuit considered many of 21 the same factors described in Ellis, but reached a different conclusion on similar facts. 820 F.3d 22 482, 488 (1st Cir. 2016). Although the First Circuit agreed that “subscription” requires more than 23 merely accessing content through a web browser, it disagreed with the Eleventh Circuit’s 24 conclusion that downloading a mobile application is insufficient to establish a “subscriber” 25 relationship with the application’s provider. The First Circuit explained: 26 To use the App, Yershov did indeed have to provide Gannett with 27 personal information, such as his Android ID and his mobile device's GPS location at the time he viewed a video, each linked to free of a commitment to provide consideration in the form of that 1 information, which was of value to Gannett. And by installing the 2 App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship 3 with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites on 4 the web that Yershov might have accessed through a web browser. 5 Yershov, 820 F.3d at 489; see also id. (“Ellis . . . presumed that downloading a mobile device 6 application is the equivalent of adding a particular web site to one’s Internet browser as a favorite. 7 . . . We do not think that such a presumption is so apparently true as to dictate our reading of the 8 complaint, which concedes no such equivalence.”). 9 Here, Google argues that M.K. only has a relationship with the District. Dkt. No. 78 at 8. 10 It contends that the District provided M.K. with a Google account so that he could attend school 11 remotely using a service Google provided to the District, and that his access to Google’s video 12 content was made possible solely by virtue of his status as a student in the District. Id. M.K. 13 responds that he had a Google account, with a unique login, through which he obtained access to 14 YouTube videos and videos on Google Slide Show. Dkt. No. 83 at 5; see also Dkt. No. 66 ¶¶ 3, 7, 15 9. He also alleges that, by virtue of that account, Google had his personal information and tracked 16 the videos he watched. Dkt. No. 66 ¶¶ 7-10, 13-14. He argues that these facts support the 17 existence of a subscriber relationship between M.K. and Google. Dkt. No. 83 at 5. 18 The Court agrees that M.K. plausibly alleges the existence of a subscriber relationship with 19 Google. The fact that M.K. obtained his Google account through the District for the purpose of 20 attending school remotely does not undermine his allegation that he is, in fact, a Google account- 21 holder. While the FAC pleads few details about that account-holder relationship, the Court may 22 reasonably infer from M.K.’s allegations that he did not merely view videos while surfing the 23 web. Rather, the allegations in the FAC support an inference that he watched videos while logged 24 into his Google account using an application or service provided by Google that collected 25 information about the content he viewed and associated that activity with him. See id. ¶¶ 8-10 26 (“The District’s school principal and tech department . . . told parent [that] District staff had 27 accessed student’s activity on Google Slide Show. . . . M.K. watched videos offered by Google, 1 LLC’s Youtube and Slide Show platform.”); see also id. ¶¶ 49-50. 2 In these circumstances, the Court concludes that M.K. adequately alleges that he is a 3 subscriber of Google’s services for purposes of the VPPA. See, e.g., Jackson v. Fandom, Inc., No. 4 22-CV-04423-JST, 2023 WL 4670285, at *4 (N.D. Cal. July 20, 2023) (“Jackson does not allege 5 merely that she viewed videos hosted on a website, but rather that she created a Fandom account; 6 became a registered user; ‘provided Fandom with her PII, including her name and email address’; 7 and then used Fandom to watch videos. . . . This is sufficient to plead that Jackson is a subscriber, 8 and therefore a consumer, within the meaning of the statute.”); In re Hulu Priv. Litig., 2012 WL 9 3282960, at *8 (“Plaintiffs pleaded more than just visiting Hulu’s website. They were subscribers 10 of goods and services. . . . They visited hulu.com and viewed video content. . . . The resurrected 11 previously-deleted cookies allowed their data to be tracked ‘regardless of whether they were 12 registered and logged in.’ . . . Hulu gave Scorecard research Plaintiffs’ ‘Hulu profile identifiers’ 13 linked to their ‘individual Hulu profile pages that included name, location preference information 14 designated by the user as private, and Hulu username.’”). 15 2. Whether any disclosure was incident to Google’s ordinary course of business 16 The VPPA provides that a video tape service provider is exempt from liability for 17 disclosure of a consumer’s personally identifiable information “if the disclosure is incident to the 18 ordinary course of business of the video tape service provider.” 18 U.S.C. § 2710(b)(2)(E). The 19 statute defines “ordinary course of business” as “only debt collection activities, order fulfillment, 20 request processing, and the transfer of ownership.” 18 U.S.C. § 2710(a)(2). The Court agrees 21 with Google that the FAC does not plausibly allege that Google disclosed M.K.’s personal 22 information to third parties other than the District. With respect to the District, Google argues that 23 “[a]ny disclosure of M.K.’s information to the District so that it could manage the [Google 24 Workspace for Education] account that it provided to M.K.—e.g., to determine whether he was 25 participating in class or watching YouTube videos, or whether his account had been used to 26 disseminate inappropriate content—would be incidental to Google carrying out its agreements 27 with its subscriber, the District, in its business operations,” thereby falling within the statutory 1 exemption. Dkt. No. 78 at 9. M.K. disputes that the disclosures he alleges qualify for the 2 exemption. Dkt. No. 83 at 5-6. 3 “[T]he permissibility of disclosure under the VPPA turns on the underlying purpose for 4 which [the provider] provides the information to a third party.” Sterk v. Redbox Automated Retail, 5 LLC, 770 F.3d 618, 626 (7th Cir. 2014); see also Rodriguez v. Sony Computer Ent. Am., LLC, 801 6 F.3d 1045, 1054 (9th Cir. 2015) (intra-corporate disclosures and disclosures to third parties 7 providing services in support of business operations fell within the “order fulfillment” or “request 8 processing” exemptions of §§ 2710(a)(2) and (b)(2)(E)). While Google may have meritorious 9 arguments that its disclosure of M.K.’s personal information to the District was not an 10 unauthorized disclosure within the meaning of the VPPA, the Court cannot conclude, at the 11 pleading stage, that the alleged disclosures were merely incidental to Google’s fulfillment of its 12 contractual obligations to the District.4 The FAC contains no information about any such 13 contractual obligations, and they are not otherwise part of the record before the Court. 14 Accordingly, the Court concludes that M.K.’s VPPA claim survives Google’s challenge on 15 this basis as well, to the extent the claim challenges Google’s alleged disclosure of M.K.’s 16 personal information to the District. 17 C. Claim 2: Unfair Competition Law 18 California’s UCL “prohibits, and provides civil remedies for, unfair competition,” which it 19 defines as “any unlawful, unfair or fraudulent business act or practice.” Kwikset Corp. v. Superior 20 Ct., 51 Cal. 4th 310, 320 (2011); see Cal. Bus. & Prof. Code § 17200. The UCL “establishes three 21 varieties of unfair competition—acts or practices which are unlawful, or unfair, or fraudulent.” 22 23 4 M.K. has no duty to foreclose an ordinary course of business defense in his complaint. See Nayab v. Cap. One Bank (USA), N.A., 942 F.3d 480, 494-95 (9th Cir. 2019) (“The burden of 24 proving justification or exemption under a special exception to the prohibitions of a statute generally rests on one who claims its benefits. . . . The plaintiff need not negative the exception to 25 the statute. If the defendant wishes to rely upon the proviso, the burden is upon it to bring itself within the exception.”) (quoting Schlemmer v. Buffalo, Rochester, & Pittsburg Ry. Co., 205 U.S. 26 1, 10 (1907)); see also Adams v. America’s Test Kitchen, LP, No. 22-CV-11309-AK, 2023 WL 4304675, at *8 (D. Mass. June 30, 2023) (plaintiff need not negate “consent” exception to VPPA 27 liability at the pleading stage, as it is akin to an affirmative defense); Feldman v. Star Trib. Media 1 Cel-Tech Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 20 Cal. 4th 163, 180 (1999) (cleaned 2 up). “Restitution and injunctive relief” are the only remedies available under the UCL, but they 3 may be “cumulative” of other remedies. De La Torre v. CashCall, Inc., 5 Cal. 5th 966, 980 4 (2018). 5 M.K. alleges that Google engaged in unlawful conduct by collecting and using M.K.’s 6 personal information without his permission in violation of COPPA and related FTC regulations.5 7 Dkt. No. 66 ¶¶ 55-74; Dkt. No. 83 at 9. M.K. also alleges that Google engaged in unfair conduct 8 by signing a “Student Privacy Pledge” promising to use student data only for authorized school- 9 related purposes and to inform students’ parents of the types of personal information Google 10 collects and the purposes, if any, for which the information is shared with others, and then 11 violating those promises. Dkt. No. 66 ¶ 72; Dkt. No. 83 at 9. In addition, M.K. alleges that 12 Google represented that its platform was secure and failed to warn the District, students, and 13 parents of the platform’s “cybersecurity weaknesses.” Dkt. No. 66 ¶¶ 75-81, 87; Dkt. No. 83 at 9. 14 Google argues that M.K. fails to plead economic injury sufficient to establish standing 15 under the UCL. Dkt. No. 78 at 9-10. Google also contends that the FAC does not plausibly allege 16 a violation of COPPA or any unfair conduct. Id. at 10-11. 17 “While the substantive reach of [the UCL] remains expansive,” to establish standing to 18 enforce the UCL’s provisions, a plaintiff must “(1) establish a loss or deprivation of money or 19 property sufficient to qualify as injury in fact, i.e., economic injury, and (2) show that that 20 economic injury was the result of, i.e., caused by, the unfair business practice . . . that is the 21 gravamen of the claim.” Kwikset Corp., 51 Cal. 4th at 321, 322; see also Cal. Bus. & Prof. Code 22 § 17204 (“Actions for relief pursuant to this chapter shall be prosecuted exclusively . . . by a 23 person who has suffered an injury in fact and has lost money or property as a result of the unfair 24 competition.”). Standing to bring a UCL claim therefore is “substantially narrower than federal 25 standing under article III, section 2 of the United States Constitution, which may be predicated on 26 a broader range of injuries.” Kwikset Corp., 51 Cal. 4th at 324. 27 1 M.K. claims that he “suffered an actual concrete economic harm” because “his family 2 expended their personal funds to hire tutors and an attorney to handle his suspension and correct 3 his school records.” 6 Dkt. No. 83 at 7; see also Dkt. No. 66 ¶¶ 15, 33, 73-74. M.K. argues that he 4 “has a future interest in his parent[’]s estate and that interest was reduced by the costs of his 5 attorney fees and tutors, and he is now deprived of money to which he had a cognizable claim 6 through California [p]robate law.” Dkt. No. 83 at 7-8. Google moves to dismiss on the ground 7 that M.K. alleges only economic injury to his parents, who are not parties, and that M.K. fails to 8 plausibly allege that such injury was caused by Google. Dkt. No. 78 at 10. 9 The Court agrees with Google that M.K. lacks standing under the UCL. 10 First, as Google observes, M.K. does not allege that he suffered any loss of money or 11 property. The fact that M.K.’s parents paid for tutors for M.K. and for the services of an attorney 12 following M.K.’s suspension does not support M.K.’s assertion that he suffered economic injury. 13 The UCL requires “that a private action under that law be brought exclusively by a “person who 14 has suffered injury in fact and has lost money or property as a result of the unfair competition.” 15 Amalgamated Transit Union, Loc. 1756, AFL-CIO v. Superior Ct., 46 Cal. 4th 993, 1002 (2009) 16 (quoting Cal. Bus. & Prof. Code § 17204) (emphasis in original); see also id. (standing exists 17 “only if that individual was actually injured by . . . an unfair business practice”) (emphasis in 18 original). Recent decisions in this District have distinguished between economic harms to parents 19 and children when analyzing standing under the UCL. For example, in M.S. v. Nintendo of 20 America, Inc., the court found that the child plaintiffs did not have standing to bring a false 21 advertising claim against the defendant because their parents were the ones who purchased the 22 products at issue and suffered the economic injury. No. C 20-06929 WHA, 2022 WL 17169835, 23 at *3 (N.D. Cal. Nov. 22, 2022); see also Sanchez v. Nintendo of Am. Inc., No. C 20-06929 WHA, 24 2022 WL 4099154, at *3 (N.D. Cal. Sept. 7, 2022) (children lacked Article III standing to bring 25 26 6 M.K. relies principally on Allergan v. Athena Cosmetics, a Federal Circuit case applying California law. 640 F.3d 1377 (Fed. Cir. 2011). That case is inapposite. In Allergan, the Federal 27 Circuit reversed a district court decision that applied an outdated version of the UCL standing 1 claim regarding reduced resale value because products in question belonged to parents). And in 2 I.B. v. Facebook, Inc., the court determined that children who alleged that their purchases of 3 online credits violated other California statutes lacked standing under the UCL because the 4 plaintiffs had used their parents’ credit cards. No. C 12-1894 CW, 2013 WL 6734239, at *6 (N.D. 5 Cal. Dec. 20, 2013). 6 Second, M.K does not plausibly allege that Google’s misconduct caused the economic 7 injury in question—i.e., his parents’ expenditure of money to pay for tutors and for the services of 8 an attorney. “To challenge a business practice, a private plaintiff must allege injury in fact caused 9 by the practice in question.” Prager Univ. v. Google LLC, 85 Cal. App. 5th 1022, 1041-42 10 (2022); see also Two Jinn, Inc. v. Gov’t Payment Serv., Inc., 233 Cal. App. 4th 1321, 1332 (2015) 11 (“[T]here must be a causal connection between the harm suffered and the unlawful business 12 activity. That causal connection is broken when a complaining party would suffer the same harm 13 whether or not a defendant complied with the law.”) (quoting Daro v. Superior Ct., 151 Cal. App. 14 4th 1079, 1099 (2007)). Here, the economic harm M.K. claims his parents suffered does not stem 15 from Google’s alleged failure to comply with COPPA or its implementing regulations, or from 16 Google’s alleged violation of a “privacy pledge.” Rather, the harm results directly from the 17 District’s decision to suspend M.K. from school for sending a sexually explicit message to his 18 teacher—a suspension M.K. contends reflects improper conduct by the District. M.K. does not 19 plausibly allege a causal connection between Google’s alleged unlawful or unfair conduct and the 20 economic harm his parents suffered. 21 Accordingly, the Court concludes that M.K. fails to state a claim against Google under the 22 UCL. 23 D. Claim 4: Failure to Protect 24 M.K. alleges that Google “failed to protect M.K. under SOPIPA’s affirmative duty to 25 protect when it failed to warn parents of cybersecurity issues, failed to warn the district, failed to 26 develop reasonable security procedures and practices, failed to design a system that would alert 27 teachers, staff, parents or student users to individuals logging on Google Classrooms from a new 1 claim sounds in negligence, which requires him to allege facts establishing “(1) a legal duty of due 2 care; (2) a breach of that duty; (3) causation; and (4) damages.” In re Google Android Consumer 3 Privacy Litig., No. 11-MD-02264 JSW, 2013 WL 1283236, at *12 (N.D. Cal. Mar. 26, 2013). 4 Google argues that M.K.’s failure to protect claim is nothing more than a “retread” of the 5 SOPIPA claim that M.K. has since withdrawn.7 Dkt. No. 78 at 17. M.K. responds that he relies 6 on SOPIPA and COPPA as the sources of Google’s duty of care owed to him, but he otherwise 7 fails to address Google’s arguments. Dkt. No. 83 at 10. 8 The Court agrees with Google that the FAC does not refer to COPPA as the alleged source 9 of any duty of care owed by Google to M.K. With respect to SOPIPA, Google persuasively 10 argues (and M.K. appears to concede) that SOPIPA does not afford a private right of action for 11 violation of its terms, and M.K. does not explain why he should nevertheless be permitted to rely 12 on an alleged violation of that statute by recasting his claim as negligent failure to protect. See 13 Dkt. No. 78 at 12-14; Dkt. No. 83 at 10. 14 In any event, M.K. fails to plausibly allege any violations of the duties he claims Google 15 owes him. First, he alleges that Google failed to incorporate reasonable cybersecurity protections 16 into its platform and failed to warn consumers, including the District, students, and their parents, 17 of the dangers it created. Id. ¶ 104. M.K. has not plausibly alleged any security (or cybersecurity) 18 defects. It is not sufficient for M.K. to allege merely that his Google account was hacked, or that 19 Google should have warned him that his account could be hacked. See Bem v. Stryker Corp., No. 20 C 15-2485 MMC, 2015 WL 4573204, at *1 (N.D. Cal. July 29, 2015) (complaint failed to state a 21 claim for negligence when it “relie[d] on conclusory allegations and fail[ed] to plead any facts 22 describing the particular defect, the injury sustained, the manner in which [defendant] was 23 negligent, or how any such negligence caused or contributed in any manner to any specified 24 injury.”). M.K. alleges that Google “failed to design a system that would alert teachers, staff, 25 7 Google also argues that to the extent M.K. seeks to hold Google responsible for the sexually 26 explicit communication M.K. says a hacker sent to his teacher, M.K.’s claim is barred by the Communications Decency Act, 47 U.S.C. § 230(c), which immunizes interactive service providers 27 from liability for claims that treat them as publishers of third-party content. Dkt. No. 78 at 17-18. 1 parents or student users to individuals logging on Google Classrooms from a new IP address.” 2 Dkt. No. 66 ¶ 104. M.K. seems to suggest that Google had a duty to includes such an alert in its 3 platform design, but the FAC does not identify the source of any such duty. To the extent M.K. 4 suggest that Google and/or the District should have monitored the IP addresses from which each 5 student accessed the Google platform, this suggestion is at odds with M.K.’s objections that 6 Google and the District improperly monitored his online activities. In short, the FAC is devoid of 7 any non-conclusory factual allegations about what was negligent about Google’s platform design 8 or its data handling practices, or about what the company was required to warn the District, 9 students, and their parents about. M.K. does not allege any facts that support an inference that 10 Google failed to use reasonable security procedures or practices with respect to the Google 11 platform at issue, or that any such failure caused M.K.’s alleged injury. See Iqbal, 556 U.S. at 12 678. 13 Second, M.K. alleges that Google failed to ensure that his data was not “used to advertise 14 services.” Id. M.K. says that he believes Google shared his personal information with advertisers 15 because his parents saw “third party ads via pop ups and recommendations for related videos and 16 products from advertisers on his iPad connected to topics typed into his Google classroom, videos 17 watched or conversations had while using Google Classroom.” Id. ¶ 5. M.K. asks the Court to 18 infer from this single, conclusory allegation that Google shared information with advertisers about 19 M.K.’s activities while he was logged into his Google account and using Google’s platform for 20 school. The FAC does not identify the advertisements or recommendations shown to M.K., or the 21 school-related topics, videos, or conversations to which these advertisements or recommendations 22 were “connected.” Moreover, given that the iPad M.K. used for school was his own personal 23 device, see id. ¶ 4, it is not reasonable to infer from these allegations alone that Google shared 24 M.K.’s school-related information with advertisers. While it certainly is possible that Google 25 shared M.K.’s information in the manner that he claims, the allegations in the FAC “fail to raise a 26 right to relief above the speculative level.” Twombly, 550 U.S. at 555. 27 At the hearing, M.K.’s counsel claimed that Google knew or should have known that its 1 not appear in the FAC, and M.K. cites no authority for the proposition that the existence of prior 2 || hacking incidents supports an affirmative duty to warn or suggests that the platform suffered from 3 a design defect. 4 Accordingly, the Court concludes that M.K. fails to state a claim against Google for negligent 5 failure to protect. 6 E. Leave to Amend 7 M.K. has already had one opportunity to amend his claims against Google. He does not 8 ask for another opportunity to amend, nor does he suggest that there are any additional facts that 9 || he could plead in support of his claims. See Dkt. No. 88 at 56:5-57:1. For this reason, the Court 10 || concludes that it would be futile to grant M.K. leave to amend yet again. 11 || Iv. CONCLUSION 12 For the reasons explained above, the Court grants Google’s motion to dismiss with respect 13 to claims 2, 3, and 4 of the FAC. The Court denies Google’s motion to dismiss claim 1 as to the 14 || alleged disclosure of M.K.’s personally identifiable information to the District and its employees. 3 15 Google’s responsive pleading is due 14 days from the date of this order. See Fed. R. Civ. P. 16 |} 12a). = 17 IT IS SO ORDERED. 18 Dated: August 1, 2023 19 «8 VIRGINIA K. DEMARCHI 21 United States Magistrate Judge 22 23 24 25 26 27 28