K. v. Google LLC

1

2

3

4 UNITED STATES DISTRICT COURT

5 NORTHERN DISTRICT OF CALIFORNIA

6 SAN JOSE DIVISION

7

8 M.K., a minor by and through his guardian Case No. 21-cv-08465-VKD

ad litem Melanie Kirksey,

9

Plaintiff, ORDER GRANTING GOOGLE LLC’S

10 MOTION TO DISMISS THE

v. COMPLAINT

11

GOOGLE LLC and FREMONT UNIFIED Re: Dkt. No. 33

12 SCHOOL DISTRICT,

Defendants.

13

14 Plaintiff M.K., through his mother as guardian ad litem, sues Google, LLC (“Google”) and

15 the Fremont Unified School District (“District”), alleging that defendants violated his right to

16 privacy through a Google platform used for remote learning during the COVID-19 pandemic.

17 Google moves pursuant to Rule 12(b)(6) to dismiss the complaint. M.K. opposes the motion.

18 Upon consideration of the moving and responding papers, as well as the oral arguments presented,

19 the Court grants Google’s motion to dismiss the complaint, with leave to amend.1

20 I. BACKGROUND

21 The following background facts are based on the allegations of the complaint.

22 M.K. is a minor who attends a public elementary school in the District. Dkt. No. 1 ¶ 1. In

23 March 2020, due to the COVID-19 pandemic, M.K. began attending school remotely through a

24 Google platform that allowed schools and students to transition to “online and internet based

25 systems to access their education.” Id. ¶¶ 1-3. According to the complaint, “[p]arents were not

26

27

1 All parties have expressly consented that all proceedings in this matter may be heard and finally

1 given an option to opt out or an alternative to receive education if they did not wish to risk their

2 child’s privacy.” Id. ¶ 3. The complaint further alleges that “[w]ithout notice to parents Google

3 has collected troves of personal information, including: M.K.’s physical locations, websites

4 visited, every search term used in Google’s search engine and links clicked on, the videos

5 watched, voice recordings, saved passwords, biometrics and other behavioral information.” Id.

6 ¶ 6.

7 M.K. alleges, on information and belief, that his “device was hacked in January 2021 and

8 the hacker sent sexually explicit content to [his] classroom teacher.” Id. ¶ 7. The content

9 reportedly sent by the hacker “was linked to M.K.,” and M.K. was both exposed to, and

10 disciplined for, that content. Id. The complaint further alleges, on information and belief, that

11 “Google will log the hacker’s explicit conduct as conduct of M.K.” and that M.K. “has no means

12 of clearing his reputation and ensuring that data associated with him and [sic] is his data.” Id. ¶ 8.

13 According to M.K., “Google and [the District] failed to inform teachers, school staff and

14 parents of the risk of stalking or hacking into the classroom.” Id. ¶ 7. Google allegedly failed to

15 “provide the school with full notice of its collection, use, and disclosure practices” and did not

16 “enable [learning education agencies] to review and have deleted the personal information

17 collected from its students.” Id. ¶¶ 11, 14. As such, the District reportedly “could not consent to

18 Google’s collection of data[.]” Id. ¶ 14. M.K. states that the District failed “to inform parent[s] of

19 what Google would collect and use” and of “the security risks” presented by “predators and

20 hackers while in online classrooms,” and “failed to obtain parental consent.” Id. ¶¶ 11, 14, 15.

21 Reportedly, neither defendant informed parents that M.K.’s “biometric data would be collected

22 and stored[.]” Id. ¶ 14.

23 The complaint asserts five claims for relief for alleged violation of the federal Video

24 Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710 (claim 1); violation of the California Student

25 Online Personal Information Protection Act (“SOPIPA”), Cal. Bus. & Prof. Code § 22584 (claim

26 2); violation of California’s unfair competition law (“UCL”), Cal. Bus. & Prof. Code § 17200, et

27 seq. (claim 3); “Failure to Protect” (claim 4); and violation of the California constitutional right to

1 privacy (claim 5).2 The complaint seeks damages, as well as injunctive relief, including “an order

2 requiring Google to permanently destroy the biometric identifiers and biometric information it has

3 collected from [M.K.].” Id. at 14.

4 Google moves pursuant to Rule 12(b)(6) to dismiss each of M.K.’s claims for relief. With

5 respect to the VPPA claim, Google argues that the complaint fails to state sufficient facts

6 establishing a plausible claim for relief. As for the remaining claims, Google contends that they

7 are preempted by the federal Children’s Online Privacy Protection Act of 1998 (“COPPA”), and

8 that the complaint fails, in any event, to state sufficient facts supporting plausible claims for relief.

9 For the reasons discussed below, the Court dismisses M.K.’s claims for failure to state a claim for

10 relief.

11 II. LEGAL STANDARD

12 A motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) tests the legal

13 sufficiency of the claims in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001).

14 Dismissal is appropriate where there is no cognizable legal theory or an absence of sufficient facts

15 alleged to support a cognizable legal theory. Id. (citing Balistreri v. Pacifica Police Dep’t, 901

16 F.2d 696, 699 (9th Cir. 1990)). In such a motion, all material allegations in the complaint must be

17 taken as true and construed in the light most favorable to the claimant. Id.

18 However, “[t]hreadbare recitals of the elements of a cause of action, supported by mere

19 conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Moreover,

20 “the court is not required to accept legal conclusions cast in the form of factual allegations if those

21 conclusions cannot reasonably be drawn from the facts alleged.” Clegg v. Cult Awareness

22 Network, 18 F.3d 752, 754-55 (9th Cir. 1994).

23 Rule 8(a)(2) requires only “a short and plain statement of the claim showing that the

24 pleader is entitled to relief.” This means that the “[f]actual allegations must be enough to raise a

25 right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555

26

2 Although the complaint did not clearly indicate which claims are asserted against each

27

defendant, M.K. subsequently confirmed that the VPPA and UCL claims are asserted only against

1 (2007) (citations omitted). However, only plausible claims for relief will survive a motion to

2 dismiss. Iqbal, 556 U.S. at 679. A claim is plausible if its factual content permits the court to

3 draw a reasonable inference that the defendant is liable for the alleged misconduct. Id. A plaintiff

4 does not have to provide detailed facts, but the pleading must include “more than an unadorned,

5 the-defendant-unlawfully-harmed-me accusation.” Id. at 678.

6 Documents appended to or incorporated into the complaint or which properly are the

7 subject of judicial notice may be considered along with the complaint when deciding a Rule

8 12(b)(6) motion. Khoja v. Orexigen Therapeutics, 899 F.3d 988, 998 (9th Cir. 2018); Coto

9 Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010).3

10 III. DISCUSSION

11 A. Claim 1: VPPA, 18 U.S.C. § 2710

12 The VPPA prohibits “[a] video tape service provider” from “knowingly disclos[ing], to

13 any person, personally identifiable information concerning any consumer of such provider[.]”

14 18 U.S.C. § 2710(b)(1). That provision “protects generally a consumer’s substantive privacy

15 interest in his or her video-viewing history.” Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th

16 Cir. 2017). In relevant part, the statute defines the term “video tape service provider” to mean

17 “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental,

18 sale, or delivery of prerecorded video cassette tapes or similar audio visual materials[.]” 18 U.S.C.

19 § 2710(a)(4). The VPPA defines the term “consumer” as “any renter, purchaser, or subscriber of

20 goods or services from a video tape service provider.” Id. § 2710(a)(1). The VPPA defines

21 “personally identifiable information” to “include[] information which identifies a person as having

22 requested or obtained specific video materials or services from a video tape service provider.” Id.

23 § 2710(a)(3). To plead a plausible claim under section 2710(b)(1), M.K. must allege that

24 (1) Google is a “video service provider,” (2) M.K. is a “consumer,” (3) Google knowingly

25 disclosed his “personally identifiable information” to “any person,” and (4) the disclosure was not

26

27

3 The Court does not find it necessary or appropriate to consider materials submitted by Google

1 authorized by section 2710(b)(2). See Mollett v. Netflix, Inc., 795 F.3d 1062, 1066 (9th Cir.

2 2015); Stark v. Patreon, Inc., — F. Supp. 3d —, No. 22-cv-03131-JCS, 2022 WL 7652166, at *5

3 (N.D. Cal. Oct. 13, 2022).

4 Even under liberal pleading standards, M.K.’s complaint fails to state facts plausibly

5 establishing the elements of a VPPA claim. The complaint does not allege any facts that M.K.

6 watched videos, or the circumstances under which that occurred, except for highly generalized

7 allegations that Google collected various pieces of information about him, including “videos

8 watched.” See Dkt. No. 1 ¶ 6; see also id. ¶¶ 25, 52, 58. There are no facts alleged about the

9 platform, application, or website M.K. reportedly used to watch videos, or any facts from which

10 the Court plausibly could infer that M.K. is a “consumer” and Google is a “video tape service

11 provider” within the meaning of the VPPA. Instead, M.K. alleges, in formulaic language that

12 largely parrots the language of the VPPA, that that “[a]s users [sic] of the App, [M.K.] is a

13 consumers [sic] within the definition of 18 U.S.C. § 2710(a)(1) of the VPPA,” and that Google

14 “delivers pre-recorded audio visual materials as described in 18 U.S.C. § 2710(a)(4) and is

15 engaged in the business, or affecting interstate or foreign commerce, of rental, sale, or delivery of

16 prerecorded video cassette tapes or similar audio-visual materials delivering videos to consumers

17 through its applications and platforms.” Id. ¶¶ 35, 36. The complaint does not identify what

18 “App” is being referred to, and other allegations that M.K. highlights in his opposition brief

19 simply state that he used a Google platform for remote learning during the COVID-19 pandemic;

20 his account was hacked; and “his teacher received sexually inappropriate messages which were

21 attributed to [him][.]” See id. ¶¶ 1-3, 48-50. The complaint alleges, in equally conclusory fashion,

22 that Google “collected consumers[’] personally identifiable information (‘PII’) within 18 U.S.C.

23 § 2710(a)(3),” and “upon information and belief,” Google disclosed such information to

24 unidentified “third-parties, including data brokers and advertisers[.]” Id. ¶¶ 37, 38. There are no

25 facts linking these allegations to M.K., much less identifying what “personally identifiable

26 information” Google allegedly disclosed, or to whom such information was disclosed. In sum,

27 M.K.’s complaint fails to plead facts establishing the foundational requirements for a VPPA claim.

1 For the first time in his opposition, M.K. asserts that he “was given a Google based

2 account through [the District] and he accessed videos through Google on that account.” Dkt. No.

3 45 at 9. He further states that “Google delivered videos to [him], student’s [G]oogle chrome book

4 and account connect him to videos watched[,] and his teacher and district staff were given access

5 to what [he] watched and when it was being watched.” Id. No such facts are alleged in the

6 complaint. M.K. also requests leave to amend “to clarify that [his] school reviewed his online

7 activity and informed parents of that review.” Id. at 10. Google maintains that such allegations,

8 even if credited, would not state a plausible VPPA claim, or would be subject to a statutory

9 exception to liability. See Dkt. No. 47 at 8. While it remains unclear precisely what facts M.K.

10 believes he can assert on amendment to correct the identified pleading deficiencies, on this record

11 the Court cannot conclude that amendment will be futile. Accordingly, M.K. is given leave to

12 amend his VPPA claim.

13 B. COPPA Preemption

14 Google moves to dismiss M.K.’s state and common law claims for relief on the ground that

15 they are all expressly preempted by COPPA. See Dkt. No. 33 at 12-14; Dkt. No. 47 at 3-16.

16 Google’s preemption argument is based on the premise that M.K. cannot sue under state or

17 common law claims to privately enforce violations of COPPA. The current rule in the Ninth

18 Circuit is that “COPPA’s preemption clause does not bar state-law causes of action that are

19 parallel to, or proscribe the same conduct forbidden by, COPPA.” Jones v. Google LLC, 56 F.4th

20 735, 741 (9th Cir. 2022).4 Accordingly, Google’s motion to dismiss M.K.’s state and common

21 law claims for relief based on express preemption under COPPA is denied.

22 C. Failure to State a Claim for Relief

23 Google maintains that even if they are not preempted by COPPA, each of M.K.’s state law

24 and common law claims must be dismissed because the complaint fails to adequately allege facts

25 supporting a plausible claim for relief. For the reasons discussed below, the Court agrees.

26

27

4 The Court understands that there is a pending request before the Ninth Circuit for a rehearing in

1 1. SOPIPA, Cal. Bus. & Prof. Code § 22584

2 SOPIPA prohibits an “operator”5 from engaging in certain activities, and also imposes

3 certain duties, with respect to students in kindergarten through the twelfth grade. For example, the

4 statute prohibits an operator from “[u]s[ing] information, including persistent unique identifiers,

5 created or gathered by the operator’s site, service, or application, to amass a profile about a K-12

6 student except in furtherance of K-12 school purposes”; “[s]ell[ing] a student’s information”; or

7 disclosing certain information about the student. See Cal. Bus. & Prof. Code § 22584(b)(1)(A)(2),

8 (3), (4). SOPIPA also requires an operator to, among other things, “[i]mplement and maintain

9 reasonable security procedures and practices appropriate to the nature of the covered information,

10 and protect that information from unauthorized access, destruction, use, modification, or

11 disclosure,” and to “[d]elete a student’s covered information if the school or district requests

12 deletion of data under the control of the school or district.” Id. § 22584(d)(1), (2).

13 Google argues that the complaint’s allegations are vague and unsupported by sufficiently

14 specific facts. M.K. offers no argument to the contrary. See Dkt. No. 45 at 10-12. Indeed, the

15 complaint alleges “upon information and belief” that “Google has collected personal information

16 including behavioral information and biometric data for purposes that do not further school

17 purposes.” Dkt. No. 1 ¶ 46. While the complaint elsewhere asserts (on information and belief)

18 various ways in which Google might collect a student’s biometric data (Dkt. No. 1 ¶ 58), M.K.

19 alleges no facts explaining how or why he believes that Google collected his biometric

20 information. To the extent M.K.’s claim is based on the alleged hacking incident (see id. ¶ 48),

21 the complaint contains no facts explaining what role, if any, Google played in that event. The

22 complaint contains no allegations that would permit a plausible inference that Google failed to

23 implement and maintain reasonable security procedures and practices. Accordingly, M.K.’s

24 SOPIPA claim is dismissed.

25 Arguing that there is no private right of action under SOPIPA, Google contends that this

26

5 SOPIPA defines the term “operator” to mean “the operator of an Internet Web site, online

27

service, online application, or mobile application with actual knowledge that the site, service, or

1 claim must be dismissed without leave to amend. The parties have not cited, and the Court has not

2 found, any authority discussing SOPIPA § 22584. And neither M.K. nor Google has engaged in

3 the kind of analysis that would allow the Court to make an informed decision about whether there

4 is a private right of action under the statute, or whether any such right properly could be implied.

5 Accordingly, and assuming (without deciding) that M.K. can privately enforce alleged violations

6 of SOPIPA, the Court will give him leave to amend. To the extent M.K. contends that he can, in

7 any event, enforce SOPIPA violations through California’s UCL, his UCL claim is discussed

8 below.

9 2. UCL, Cal. Bus. & Prof. Code § 17200, et seq.

10 California’s UCL broadly defines “unfair competition” to “include any unlawful, unfair or

11 fraudulent business act or practice . . ..” Cal. Bus. & Prof. Code § 17200. “Its purpose is to protect

12 both consumers and competitors by promoting fair competition in commercial markets for goods

13 and services.” Kwikset v. Super. Ct., 51 Cal. 4th 310, 320 (2011) (internal quotations and citation

14 omitted). “Because Business and Professions Code section 17200 is written in the disjunctive, it

15 establishes three varieties of unfair competition—acts or practices which are unlawful, or unfair,

16 or fraudulent. In other words, a practice is prohibited as unfair or deceptive even if not unlawful

17 and vice versa.” Cel-Tech Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 20 Cal. 4th 163, 180

18 (1999) (internal quotations and citations omitted).

19 Although M.K.’s complaint makes passing reference to “deceptive” conduct (see Dkt. No.

20 1 ¶¶ 66, 70), M.K.’s allegations and arguments focus on the “unlawful” and “unfair” prongs of the

21 UCL. His overall thesis appears to be that Google unlawfully collected and stored his personal

22 information. See, e.g., Dkt. No. 1 ¶¶ 52, 58, 62, 67, 72.

23 The Court agrees with Google that, as a threshold matter, M.K.’s UCL claim fails because

24 he has not alleged facts establishing his standing to bring such a claim. “While the substantive

25 reach of [the UCL] remains expansive,” to establish standing to enforce the UCL’s provisions, a

26 plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as

27 injury in fact, i.e., economic injury, and (2) show that that economic injury was the result of, i.e.,

1 Kwikset Corp., 51 Cal. 4th at 322; see also Cal. Bus. & Prof. Code § 17204 (“Actions for relief

2 pursuant to this chapter shall be prosecuted exclusively in a court of competent jurisdiction . . . by

3 a person who has suffered an injury in fact and has lost money or property as a result of the unfair

4 competition.”). Standing to bring a UCL claim therefore is “substantially narrower than federal

5 standing under article III, section 2 of the United States Constitution, which may be predicated on

6 a broader range of injuries.” Kwikset Corp., 51 Cal. 4th at 324.

7 To the extent M.K.’s complaint appears to base his standing on the alleged collection and

8 storage of his personal information (see Dkt. No. 1 ¶¶ 52, 58, 62, 67, 72), courts have held that

9 “[a] plaintiff’s ‘personal information’ does not constitute property under the UCL.” In re

10 Facebook Priv. Litig., 791 F. Supp. 2d 705, 714 (N.D. Cal. 2011), aff’d, 572 F. App’x 494 (9th

11 Cir. 2014); see also Archer v. United Rentals, Inc., 195 Cal. App. 4th 807, 816 (2011) (dismissing

12 UCL invasion of privacy claim based on “the unlawful collection and recordation of [plaintiffs’]

13 personal identification information” because plaintiffs “failed to demonstrate how such privacy

14 violation translates into a loss of money or property.”). M.K. offers no argument or authority to

15 the contrary.

16 Instead, M.K. argues that he “has a property interest in education,” and that the alleged

17 “damage to his reputation resulted in loss of actual education and class time.” See Dkt. No. 45 at

18 12 (citing Goss v. Lopez, 419 U.S. 565, 574 (1975)). Goss held that students have a property

19 interest in public education protected by the Due Process Clause of the Fourteenth Amendment.

20 Goss, 419 U.S. at 574. M.K. has not presented any argument or authority recognizing that the

21 alleged harms to that interest or to his reputation constitute “a loss of money or property” required

22 to establish standing to enforce the UCL. For the first time in his opposition brief, M.K. argues

23 that his parents were “required to fund tutors for [him] after he was removed by his teacher for

24 online conduct associated to his account” and “to escape the tracking and collection of data[.]”

25 Dkt. No. 45 at 12. M.K. acknowledges, however, that these allegations are not in his complaint.

26 Moreover, it remains unclear whether he might be able to plead sufficient facts demonstrating that

27 such economic injury properly may be attributed to him, or that it necessarily was caused by

1 amendment will be futile. According, M.K. is given leave to amend this claim to assert facts

2 establishing his standing. Pending an amended complaint that establishes M.K.’s standing, the

3 Court does not address Google’s remaining arguments that M.K. fails to plead facts establishing a

4 plausible UCL violation.

5 3. Failure to Protect

6 M.K. claims that Google was “negligent when it failed to train . . . teachers on the risk of

7 hackers and predators infiltrating the online platform and how to respond and identify individuals

8 who hacked into the online class programs and protect student safety.” Dkt. No. 1 ¶ 77. He

9 further alleges that he was “forced to use Google’s service in order to participate in school,” and

10 that Google “secretly and unlawfully monitor[ed] and profile[d] children . . . without the

11 knowledge or consent of those children’s parents,” and to M.K.’s detriment, “causing him to have

12 his account infiltrated with inappropriate language of a hacker.” Id. ¶ 78. M.K.’s claim sounds in

13 negligence, which requires him to allege facts establishing “(1) a legal duty of due care; (2) a

14 breach of that duty; (3) causation; and (4) damages.” In re Google Android Consumer Privacy

15 Litig., No. 11-MD-02264 JSW, 2013 WL 1283236, at *12 (N.D. Cal. Mar. 26, 2013).

16 Google argues, persuasively, that the complaint fails to plausibly allege facts supporting

17 the breach of any duty Google owed to M.K. The complaint alleges that Google “had a duty to

18 protect [him] from predators while he was participating in his online school” and that Google

19 “assumed this responsibility when it made entered [sic] schools for the purpose of data collection.”

20 Dkt. No. 1 ¶ 82. In essence, M.K.’s complaint concerns a situation where Google offers an

21 educational platform that the District chose to use. While M.K. contends that in doing so, Google

22 “created a special relationship” with him and essentially owed a duty of care under the “Good

23 Samaritan Rule” (see Dkt. No. 45 at 13), he cites no authority to that effect.6 As discussed above,

24 M.K.’s allegations concerning Google’s alleged monitoring and collection of data about him, and

25 its role (if any) in the alleged hacking incident, are conclusory and inadequately pled.

26

6 Additionally, M.K.’s arguments that “Google has not been neutral” (Dkt. No. 45 at 14) appear to

27

be based on a misapprehension of the court’s discussion of “content-neutral liability” for purposes

1 Accordingly, M.K.’s claim based on a negligent failure to protect is dismissed. Because

2 the Court cannot conclude that amendment would be futile, M.K. is given leave to amend.

3 4. California Constitutional Right to Privacy

4 “The California Constitution creates a privacy right that protects individuals from the

5 invasion of their privacy by private parties.” In re Yahoo! Mail Litig., 7 F. Supp. 3d 1016, 1037

6 (N.D. Cal. 2014); Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 20 (1994) (The right to

7 privacy embodied in article I, section 1 of the California Constitution “creates a right of action

8 against private as sell as government entities.”). To state a claim for invasion of privacy under the

9 California Constitution, M.K. must plead facts establishing “(1) a legally protected privacy

10 interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by

11 defendant constituting a serious invasion of privacy.” Hill, 7 Cal. 4th at 39-40. “Actionable

12 invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential

13 impact to constitute an egregious breach of the social norms underlying the privacy right. Thus,

14 the extent and gravity of the invasion is an indispensable consideration in assessing an alleged

15 invasion of privacy.” Id. at 37.

16 As discussed above, M.K.’s complaint is highly conclusory and does not plausibly allege

17 facts to support Google’s alleged monitoring and collection of data about him. Here, M.K. alleges

18 that Google monitored his “privately owned personal computer and his Chrome Book during

19 non[- ]school hours,” and “design[ed] the App to secretly obtain, and improperly gain knowledge

20 of, review, and[/]or retain [M.K.]’s activities through the technologies and activities described

21 herein.” Dkt. No. 1 ¶¶ 88, 89. M.K. further alleges that “the nature of privacy invasion involves

22 sharing [M.K]’s personally identifiable information and/or viewing data with potentially countless

23 third-parties, known and unknown, for undisclosed and potentially unknowable purposes, in

24 perpetuity.” Id. ¶ 90. There are no facts identifying what “App” is referred to or the “technologies

25 and activities” purportedly set out in the complaint. Nor does the complaint allege any facts

26 describing the purported sharing of M.K.’s data, what data was shared, and with whom it was

27 shared. In sum, M.K. fails to allege sufficient facts to plausibly establish that Google violated his

1 Accordingly, M.K.’s claim for invasion of privacy under the California Constitution is

2 dismissed. Because the Court cannot conclude that amendment would be futile, M.K. is given

3 leave to amend this claim.

4 IV. LEAVE TO AMEND

5 Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely

6 given when justice so requires,” because “the court must remain guided by the underlying purpose

7 of Rule 15 . . . to facilitate decisions on the merits, rather than on the pleadings or technicalities.”

8 Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (internal quotation marks and

9 citation omitted). “The decision of whether to grant leave to amend nevertheless remains within

10 the discretion of the district court,” which may deny leave to amend if allowing amendment would

11 unduly prejudice the opposing party, cause undue delay, or be futile, or if the party seeking

12 amendment has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512 F.3d 522, 532 (9th

13 Cir. 2008) (citing Foman v. Davis, 371 U.S. 178, 182 (1962)).

14 Although M.K. has articulated some additional facts that he believes could be alleged on

15 an amendment, the Court harbors some uncertainty whether those additional facts will correct all

16 of the pleading deficiencies identified in Google’s present motion. Nevertheless, as the law

17 generally favors resolving matters on the merits, the Court will permit M.K. to amend his claims.

18 Amendment is limited to the claims asserted in his complaint.7

19 V. CONCLUSION

20 Based on the foregoing, Google’s motion to dismiss is granted with leave to amend,

21 consistent with the rulings in this order. M.K.’s amended complaint shall be filed by April 10,

22 2023. Google’s response to the amended complaint shall be filed April 24, 2023.

23 The initial case management conference is re-set for May 30, 2023, 1:30 p.m. The

24 parties’ joint case management statement is due by May 23, 2023. All other related deadlines in

25

7 In his opposition, M.K. argues, in passing, that claims for security breaches are allowed under

26

the California Consumer Privacy Act (“CCPA”). Dkt. No. 45 at 7. No such claim is alleged in his

complaint. Indeed, in the proceedings concerning Google’s present motion to dismiss, as well as

27

the separate motion to dismiss filed by the District, M.K. has alluded to potential other claims he

1 the Court’s Order Setting Initial Case Management Conference and ADR Deadlines (Dkt. No. 4)

2 are adjusted accordingly.

3 IT IS SO ORDERED.

4 Dated: March 27, 2023

5

6 Varga win K, Marcle:

VIRGINIA K. DEMARCHI

7 United States Magistrate Judge

8

9

10

11

a 12

15

16

= 17

Z 18

19

20

21

22

23

24

25

26

27

28