The opinion
1
2
3
4 UNITED STATES DISTRICT COURT
5 NORTHERN DISTRICT OF CALIFORNIA
6 SAN JOSE DIVISION
7
8 M.K., a minor by and through his guardian Case No. 21-cv-08465-VKD
ad litem Melanie Kirksey,
9
Plaintiff, ORDER GRANTING FREMONT
10 UNIFIED SCHOOL DISTRICT’S
v. MOTION TO DISMISS
11
GOOGLE LLC and FREMONT UNIFIED Re: Dkt. No. 21
12 SCHOOL DISTRICT,
Defendants.
13
14 Plaintiff M.K., through his mother as guardian ad litem, sues Google, LLC (“Google”) and
15 the Fremont Unified School District (“District”), alleging that defendants violated his right to
16 privacy through a Google platform used for remote learning during the COVID-19 pandemic. The
17 District moves pursuant to Rule 12(b)(6) to dismiss the complaint. M.K. opposes the motion.
18 Upon consideration of the moving and responding papers, as well as the oral arguments presented,
19 the Court grants the District’s motion to dismiss the complaint, with leave to amend.1
20 I. BACKGROUND
21 The following background facts are based on the allegations of the complaint.
22 M.K. is a minor who attends a public elementary school in the District. Dkt. No. 1 ¶ 1. In
23 March 2020, due to the COVID-19 pandemic, M.K. began attending school remotely through a
24 Google platform that allowed schools and students to transition to “online and internet based
25 systems to access their education.” Id. ¶¶ 1-3. According to the complaint, “[p]arents were not
26
27
1 All parties have expressly consented that all proceedings in this matter may be heard and finally
1 given an option to opt out or an alternative to receive education if they did not wish to risk their
2 child’s privacy.” Id. ¶ 3. The complaint further alleges that “[w]ithout notice to parents Google
3 has collected troves of personal information, including: M.K.’s physical locations, websites
4 visited, every search term used in Google’s search engine and links clicked on, the videos
5 watched, voice recordings, saved passwords, biometrics and other behavioral information.” Id.
6 ¶ 6.
7 M.K. alleges, on information and belief, that his “device was hacked in January 2021 and
8 the hacker sent sexually explicit content to [his] classroom teacher.” Id. ¶ 7. The content
9 reportedly sent by the hacker “was linked to M.K.,” and M.K. was both exposed to, and
10 disciplined for, that content. Id. The complaint further alleges, on information and belief, that
11 “Google will log the hacker’s explicit conduct as conduct of M.K.” and that M.K. “has no means
12 of clearing his reputation and ensuring that data associated with him and [sic] is his data.” Id. ¶ 8.
13 According to M.K., “Google and [the District] failed to inform teachers, school staff and
14 parents of the risk of stalking or hacking into the classroom.” Id. ¶ 7. Google allegedly failed to
15 “provide the school with full notice of its collection, use, and disclosure practices” and did not
16 “enable [learning education agencies] to review and have deleted the personal information
17 collected from its students.” Id. ¶¶ 11, 14. As such, the District reportedly “could not consent to
18 Google’s collection of data[.]” Id. ¶ 14. M.K. states that the District failed “to inform parent[s] of
19 what Google would collect and use” and of “the security risks” presented by “predators and
20 hackers while in online classrooms,” and “failed to obtain parental consent.” Id. ¶¶ 11, 14, 15.
21 Reportedly, neither defendant informed parents that M.K.’s “biometric data would be collected
22 and stored[.]” Id. ¶ 14.
23 The complaint asserts five claims for relief for alleged violation of the federal Video
24 Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710 (claim 1); violation of the California Student
25 Online Personal Information Protection Act (“SOPIPA”), Cal. Bus. & Prof. Code § 22584 (claim
26 2); violation of California’s unfair competition law (“UCL”), Cal. Bus. & Prof. Code § 17200, et
27 seq. (claim 3); “Failure to Protect” (claim 4); and violation of the California constitutional right to
1 requiring the District to “offer an alternative to students who wish to maintain their privacy and do
2 not wish to submit to Google’s platforms.” Id. at 14.
3 Although the complaint did not clearly indicate which claims are asserted against each
4 defendant, M.K. subsequently confirmed that the VPPA and UCL claims are asserted only against
5 Google. See Dkt. No. 25 at 3, 5; Dkt. No. 59 at 3. M.K. has also withdrawn the SOPIPA claim
6 against the District. See Dkt. No. 43 at 5. Accordingly, the only remaining claims against the
7 District are for alleged “Failure to Protect” and violation of M.K.’s privacy right under the
8 California constitution.
9 The District moves pursuant to Rule 12(b)(6) to dismiss each of M.K.’s claims. For the
10 reasons discussed below, the Court dismisses each of M.K.’s claims with leave to amend.
11 II. LEGAL STANDARD
12 A motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) tests the legal
13 sufficiency of the claims in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001).
14 Dismissal is appropriate where there is no cognizable legal theory or an absence of sufficient facts
15 alleged to support a cognizable legal theory. Id. (citing Balistreri v. Pacifica Police Dep’t, 901
16 F.2d 696, 699 (9th Cir. 1990)). In such a motion, all material allegations in the complaint must be
17 taken as true and construed in the light most favorable to the claimant. Id.
18 However, “[t]hreadbare recitals of the elements of a cause of action, supported by mere
19 conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Moreover,
20 “the court is not required to accept legal conclusions cast in the form of factual allegations if those
21 conclusions cannot reasonably be drawn from the facts alleged.” Clegg v. Cult Awareness
22 Network, 18 F.3d 752, 754-55 (9th Cir. 1994).
23 Rule 8(a)(2) requires only “a short and plain statement of the claim showing that the
24 pleader is entitled to relief.” This means that the “[f]actual allegations must be enough to raise a
25 right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555
26 (2007) (citations omitted). However, only plausible claims for relief will survive a motion to
27 dismiss. Iqbal, 556 U.S. at 679. A claim is plausible if its factual content permits the court to
1 does not have to provide detailed facts, but the pleading must include “more than an unadorned,
2 the-defendant-unlawfully-harmed-me accusation.” Id. at 678.
3 Documents appended to or incorporated into the complaint or which properly are the
4 subject of judicial notice may be considered along with the complaint when deciding a Rule
5 12(b)(6) motion. Khoja v. Orexigen Therapeutics, 899 F.3d 988, 998 (9th Cir. 2018); Coto
6 Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010).
7 III. DISCUSSION
8 A. COPPA Preemption
9 In its motion papers, the District’s primary contention is that M.K.’s claims cannot be
10 maintained against public entities, such as the District. See Dkt. Nos. 21, 26. At the motion
11 hearing, the District also argued that M.K.’s claims are preempted by the federal Children’s
12 Online Privacy Protection Act of 1998 (“COPPA”). See Dkt. No. 59 at 4, 10. Although the
13 preemption argument was not presented in the District’s motion papers, M.K. was given leave to
14 file a supplemental brief addressing those arguments. See Dkt. No. 59 at 14-16; see also Dkt. Nos.
15 40, 43.
16 The Court understands the District to assert express preemption based on the same
17 arguments presented by Google in its separately filed motion to dismiss the complaint. See Dkt.
18 No. 59 at 4, 10. Google’s preemption argument is based on the premise that M.K. cannot sue
19 under state or common law claims to privately enforce violations of COPPA. See Dkt. No. 33 at
20 12-14; Dkt. No. 47 at 3-16. The current rule in the Ninth Circuit is that “COPPA’s preemption
21 clause does not bar state-law causes of action that are parallel to, or proscribe the same conduct
22 forbidden by, COPPA.” Jones v. Google LLC, 56 F.4th 735, 741 (9th Cir. 2022).2 Accordingly,
23 the District’s motion to dismiss M.K.’s state and common law claims for relief based on express
24 preemption under COPPA is denied.
25
26
27
2 The Court understands that there is a pending request before the Ninth Circuit for a rehearing in
1 B. Failure to Protect
2 M.K. alleges that the District was negligent when it “allowed Google LLC to obtain
3 biometric and personal information,” “required students to submit to Google’s platforms to obtain
4 educational services during Covid-Related shutdowns,” and “failed to train its teachers on the risk
5 of hackers and predators infiltrating the online platform and how to respond and identify
6 individuals who hacked into the online class programs and protect student safety.” Dkt. No. 1
7 ¶¶ 75-77. He further states that the District “failed to offer reasonable care to ensure [he] would
8 not be subjected to the invasion of his privacy and data collection of Google to access his
9 education.” Id. ¶ 79. Additionally, M.K. alleges that as “the provider of education services,” the
10 District “had a duty to protect [him] from predators while he was participating in his online
11 school.” Id. ¶ 82. According to the complaint, M.K. “was harmed when he was punished and
12 excluded from school and when the District failed to identify the source and IP address of the
13 inappropriate comments” reportedly made by the hacker. Id. ¶ 84. M.K. also alleges that he
14 suffered harm to his reputation, as well as harm “from the exclusions from his online class during
15 a pandemic that had excluded him from in person learning.” Id.
16 The District contends that to the extent M.K. seeks to hold the District liable in tort, his
17 claim fails to identify the statutory basis for his claim. Indeed, in California, “public entity tort
18 liability is exclusively statutory.” C.A. v. William S. Hart Union High Sch. Dist., 53 Cal. 4th 861,
19 868 (2012). The California Tort Claims Act thus provides that, “[e]xcept as otherwise provided
20 by statute,” public entities are “not liable for an injury, whether such injury arises out of an act or
21 omission of the public entity or a public employee or any other person.” Cal. Govt. Code
22 § 815(a). M.K. contends that elsewhere in his complaint, he has alleged violations of COPPA and
23 the California Consumer Privacy Act, Cal. Civ. Code § 1798.100. See Dkt. No. 25 at 5 (citing
24 Dkt. No. 1 ¶¶ 20-24). However, no such claims have been asserted against the District. Nor has
25 M.K. cited any authority that any such claims could be asserted against the District, or that those
26 statutes properly could serve as the basis for a tort claim against the District. Accordingly, M.K.’s
27 “Failure to Protect” claim is dismissed, with leave to amend.
1 C. California Constitutional Right to Privacy
2 The right to privacy embodied in article I, section 1 of the California Constitution “creates
3 a right of action against private as well as government entities.” Hill v. Nat’l Collegiate Athletic
4 Ass’n, 7 Cal. 4th 1, 20 (1994). To state a claim for invasion of privacy under the California
5 Constitution, M.K. must plead facts establishing “(1) a legally protected privacy interest; (2) a
6 reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting
7 a serious invasion of privacy.” Id. at 39-40. “Actionable invasions of privacy must be sufficiently
8 serious in their nature, scope, and actual or potential impact to constitute an egregious breach of
9 the social norms underlying the privacy right. Thus, the extent and gravity of the invasion is an
10 indispensable consideration in assessing an alleged invasion of privacy.” Id. at 37.
11 In his complaint, M.K. alleges that he “has a reasonable expectations [sic] of privacy in his
12 mobile devices and his online behavior, generally.” Dkt. No. 1 ¶ 87. He further alleges that both
13 Google and the District were in a “unique position to monitor [his] behavior through their access
14 to [his] privately owned personal computer and his Chrome Book during non[-]school hours.” Id.
15 ¶ 88. However, the complaint contains no allegations that would permit a plausible inference that
16 the District took any such actions. While the complaint also asserts that both defendants
17 “intentionally design[ed] the App to secretly obtain, and improperly gain knowledge of, review,
18 and or retain [M.K.]’s activities” (id. ¶ 89), M.K. fails to plead facts identifying the “App” being
19 referred to, much less any facts plausibly establishing that the District had any role in designing it.
20 Accordingly, M.K.’s claim for violation of his California constitutional right to privacy is
21 dismissed with leave to amend.
22 IV. LEAVE TO AMEND
23 Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely
24 given when justice so requires,” because “the court must remain guided by the underlying purpose
25 of Rule 15 . . . to facilitate decisions on the merits, rather than on the pleadings or technicalities.”
26 Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (internal quotation marks and
27 citation omitted). “The decision of whether to grant leave to amend nevertheless remains within
1 unduly prejudice the opposing party, cause undue delay, or be futile, or if the party seeking
2 || amendment has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512 F.3d 522, 532 (9th
3 || Cir. 2008) (citing Foman v. Davis, 371 U.S. 178, 182 (1962)).
4 Although M.K. has articulated some additional facts that he believes could be alleged on
5 an amendment, the Court harbors some uncertainty whether those additional facts will correct all
6 || of the pleading deficiencies identified in the District’s present motion. Nevertheless, as the law
7 generally favors resolving matters on the merits, the Court will permit M.K. to amend his claims.
8 Amendment is limited to the claims asserted in his complaint.?
9 || Vv. CONCLUSION
10 Based on the foregoing, Google’s motion to dismiss is granted with leave to amend,
11 consistent with the rulings in this order. M.K.’s amended complaint shall be filed by April 10,
12 || 2023. The District’s response to the amended complaint shall be filed by April 24, 2023.
5 13 The initial case management conference is re-set for May 30, 2023, 1:30 p.m. The
14 || parties’ joint case management statement is due by May 23, 2023. All other related deadlines in
3 15 || the Court’s Order Setting Initial Case Management Conference and ADR Deadlines (Dkt. No. 4)
a 16 are adjusted accordingly.
IT IS SO ORDERED.
|| Dated: March 27, 2023
19
VIRGINIA K. DEMARCH
United States Magistrate Judge
22
23
24
25
26
07 3 In the proceedings concerning the District’s present motion to dismiss, as well as the separate
motion to dismiss filed by Google, M.K. has alluded to potential other claims he believes he may
2g || have, but has not pled. Needless to say, M.K. has not taken steps to properly seek leave to amend
his complaint to add any other claims for relief.