K. v. Google LLC

1

2

3

4 UNITED STATES DISTRICT COURT

5 NORTHERN DISTRICT OF CALIFORNIA

6 SAN JOSE DIVISION

7

8 M. K., Case No. 21-cv-08465-VKD

9 Plaintiff,

ORDER GRANTING IN PART AND

10 v. DENYING IN PART GOOGLE’S

MOTION TO DISMISS

11 GOOGLE LLC, et al.,

Re: Dkt. No. 78

Defendants.

12

13

14 Plaintiff M.K., through his mother as guardian ad litem, brings this action against Google,

15 LLC (“Google”) and the Fremont Unified School District (“District”) asserting claims for relief

16 for harm M.K. alleges he suffered when the District used a Google platform to facilitate remote

17 learning during the COVID-19 pandemic.1 Both defendants moved to dismiss M.K.’s original

18 complaint pursuant to Rule 12(b)(6). Dkt. Nos. 21, 33. The Court granted these motions, but gave

19 M.K. leave to amend his complaint. Dkt. Nos. 64, 65.

20 M.K.’s first amended complaint (“FAC”) asserts four claims against Google for: (1)

21 violation of the federal Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710; (2) violation of

22 California’s unfair competition law (“UCL”), Cal. Bus. & Prof. Code § 17200, et seq.; (3)

23 violation of the California Student Online Personal Information Protection Act (“SOPIPA”), Cal.

24 Bus. & Prof. Code § 22584; and (4) “failure to protect.” Dkt. No. 66 ¶¶ 39-104.2 Google again

25

26

1 All parties have expressly consented that all proceedings in this matter may be heard and finally

adjudicated by a magistrate judge. 28 U.S.C. § 636(c); Fed. R. Civ. P. 73; Dkt. Nos. 6, 19, 32.

27

1 moves to dismiss all claims pursuant to Rule 12(b)(6). See Dkt. No. 78. M.K. opposes the

2 motion, except that he has withdrawn his SOPIPA claim against Google. See Dkt. No. 83.

3 The Court held a hearing on Google’s motion to dismiss on July 18, 2023. Dkt. No. 86.

4 Upon consideration of the moving and responding papers, as well as the oral arguments presented,

5 the Court grants the motion in part and denies it in part.

6 I. BACKGROUND

7 The following facts are based on the allegations of the FAC.

8 In 2020, M.K. was a student at a public elementary school in the District. Dkt. No. 66 ¶ 1.

9 In March 2020, due to the COVID-19 pandemic, the District closed its school buildings, and M.K.

10 began attending school remotely using a Google platform.3 Id. ¶¶ 1-2. According to the FAC,

11 “M.K’s parents were not given an option to opt out or an alternative to receive education if they

12 did not wish to submit M.K. to the risks of attending school on the Google platform.” Id. ¶ 2.

13 The District assigned M.K. a Google account. Id. ¶ 3. Using this account, M.K. “[was]

14 allowed to access online videos provided by Google’s YouTube, a video sharing platform[,] as

15 well as Google [Slide Show], a platform that allows individuals to watch videos as well as insert

16 videos and messages into slideshows to watch.” Id. ¶ 7. The District logged M.K. out of his

17 Google account at the end of each school day. Id. ¶ 3.

18 According to the FAC, M.K. used multiple devices to access his Google account, including

19 his personal iPad and, later, a Google Chromebook computer supplied by the District. Id. ¶¶ 4, 6.

20 M.K. watched videos on Google’s YouTube and Slide Show platforms while logged into the

21 Google platform for school. Id. ¶ 9. M.K.’s teachers informed his parents that M.K. was

22 watching videos during class when he should have been focused on his lessons. Id. ¶ 10. M.K.’s

23 teachers further advised M.K.’s parents that the teachers could see M.K.’s online activity during

24 class time. Id. Based on this information, M.K. alleges that Google gave the District and other

25

3 In some places, the FAC refers to this platform as “Google Classroom” or “Google Classrooms.”

26

See Dkt. No. 66 ¶¶ 4, 14. In its motion, Google refers to this as its “education platform, Google

Workspace for Education.” See Dkt. No. 78 at 1. However, it is not clear from the allegations in

27

the FAC exactly what the platform is or whether there are any terms of service that govern the

1 unidentified third parties access to M.K.’s online activity. Id. ¶ 13.

2 On or about January 14, 2021, one of M.K’s teachers reported receiving a sexually explicit

3 communication from M.K. via a Google chat message. Id. ¶ 16. M.K. alleges that his Google

4 account had been hacked and that he did not send the message. Id. ¶¶ 17, 20, 24. The District

5 investigated the message incident. As part of that investigation, the District obtained and

6 reviewed information about the dates and times M.K.’s Google account was accessed, the

7 activities the account user engaged in while logged in to the account, and the IP addresses used to

8 access the account. Id. ¶¶ 18, 20-21, 49.

9 According to the FAC, on or about January 27, 2021, M.K.’s teacher “scheduled a parent-

10 teacher zoom call and made a teacher suspension on the basis of ‘Sexual Harassment via Google

11 Classroom.’” Id. ¶ 22. The FAC describes the suspension variously as a “teacher removal from

12 class,” a two-day suspension from school, an exclusion from “his regular school day” that lasted

13 “weeks,” and a “permanent[]” removal from class. Id. ¶¶ 23, 25-26, 28, 82, 107. M.K. eventually

14 stopped attending school in the District. Id. ¶¶ 31, 82.

15 M.K. alleges that “Google made M.K.’s personal information available to hackers, and to

16 staff of [the District], who then penalized [him] for a hacker[’]s activity on Google Slideshow and

17 Google Chat.” Id. ¶ 52. He also alleges that Google failed to implement adequate cybersecurity

18 measures to prevent his Google account from being hacked, or his personal information from

19 being used or disclosed for unauthorized purposes, and that Google failed to warn M.K.’s parents

20 and the District of the “vulnerability of Google Classrooms.” Id. ¶¶ 77-81, 87. M.K. seeks “an

21 order requiring Google to permanently destroy all data of M.K.” and other injunctive relief,

22 damages for “emotional distress and damage to reputation caused by negligence,” and punitive

23 damages. Id. at 16-17.

24 II. LEGAL STANDARD

25 A motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) tests the legal

26 sufficiency of the claims in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001).

27 Dismissal is appropriate where there is no cognizable legal theory or an absence of sufficient facts

1 F.2d 696, 699 (9th Cir. 1990)). At the motion to dismiss stage, all material allegations in the

2 complaint must be taken as true and construed in the light most favorable to the claimant. Id.

3 The factual allegations in the complaint “must be enough to raise a right to relief above the

4 speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). Implausible claims

5 for relief will not survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009). A

6 claim is plausible if its factual content permits the court to draw a reasonable inference that the

7 defendant is liable for the alleged misconduct. Id. at 678.

8 Rule 8(a)(2) requires only “a short and plain statement of the claim showing that the

9 pleader is entitled to relief.” However, “[t]hreadbare recitals of the elements of a cause of action,

10 supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678. “The court is

11 not required to accept legal conclusions cast in the form of factual allegations if those conclusions

12 cannot reasonably be drawn from the facts alleged.” Clegg v. Cult Awareness Network, 18 F.3d

13 752, 754-55 (9th Cir. 1994).

14 III. DISCUSSION

15 As M.K. has withdrawn his SOPIPA claim against Google (claim 3), the Court considers

16 only Google’s motion to dismiss claims 1, 2 and 4. The Court also considers Google’s request for

17 judicial notice.

18 A. Google’s Request for Judicial Notice

19 Google requests that the Court take judicial notice of guidance regarding the Children’s

20 Online Privacy Protection Act (“COPPA”), 15 U.S.C. § 6501 et seq., published by the Federal

21 Trade Commission (“FTC”): “Complying with COPPA: Frequently Asked Questions, Federal

22 Trade Commission,” https://www.ftc.gov/business-guidance/resources/complying-coppa-

23 frequently-asked-questions (“COPPA Guidance”). See Dkt. No. 78 at 3-4. Among other things,

24 the COPPA guidance states that “[m]any school districts contract with third-party website

25 operators to offer online programs . . . [i]n these cases, the schools may act as the parent’s agent

26 and can consent under COPPA to the collection of kids’ information on the parent’s behalf.” Id. at

27 3. M.K. does not oppose Google’s request for judicial notice, but argues that the FTC’s COPPA

1 “Generally, district courts may not consider material outside the pleadings when assessing

2 the sufficiency of a complaint.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir.

3 2018). However, a court may take judicial notice of facts that are “not subject to reasonable

4 dispute” because they are “generally known” or “can be accurately and readily determined from

5 sources whose accuracy cannot reasonably be questioned.” Id. at 999; Fed. R. Evid. 201(b).

6 Courts may take judicial notice of matters of public record, including statutes, regulations

7 and agency interpretations thereof. See Jonna Corp. v. City of Sunnyvale, CA, No. 17-CV-00956-

8 LHK, 2017 WL 5194513, at *4 (N.D. Cal. Nov. 9, 2017). But while a court may take notice of

9 public records, it may not take notice of disputed facts stated in those records. Khoja, 899 F.3d at

10 999 (citing Lee v. City of Los Angeles, 250 F.3d 668, 689 (9th Cir. 2001)).

11 The Court grants Google’s request for judicial notice of the FTC’s published guidance

12 because the request is unopposed. However, the guidance has no bearing on the Court’s resolution

13 of the motion to dismiss.

14 B. Claim 1: Video Privacy Protection Act

15 Congress enacted the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, “to

16 preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar

17 audio visual materials.” Mollett v. Netflix, Inc., 795 F.3d 1062, 1065 (9th Cir. 2015) (quoting S.

18 Rep. 100-599, at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342–1.). The statute forbids “video

19 tape service provider[s]” from knowingly disclosing “personally identifiable information

20 concerning any consumer.” 18 U.S.C. § 2710(b)(1). A person aggrieved by a violation of the

21 statute may bring an action for actual damages of not less than $2,500, punitive damages,

22 attorneys’ fees, and injunctive relief. See 18 U.S.C. § 2710(c). To state a claim for violation of

23 the VPPA, M.K. must plausibly allege that (1) Google is a “video tape service provider,” (2) M.K.

24 is a “consumer,” (3) Google knowingly disclosed M.K.’s “personally identifiable information” to

25 “any person,” and (4) the disclosure was not a permitted disclosure authorized under § 2710(b)(2).

26 See Dkt. No. 65 at 4-5 (citing Mollet, 795 F.3d at 1066).

27 M.K. alleges that Google is a video tape service provider because it delivers audio visual

1 that he is a “non-paying subscriber of Google Classrooms, Youtube and Google Slideshow and

2 was given an account to access the listed Google Platforms by [the District].” Id. ¶ 40. He alleges

3 “upon information and belief” that the District “pays a subscription fee which pays for the

4 subscription costs of each student within the [D]istrict.” Id. Finally, M.K. alleges that Google

5 shared his personal information with third parties, including the District and its employees,

6 without his consent. See id. ¶¶ 46-51.

7 Google does not dispute that it is a video tape service provider within the meaning of the

8 VPPA, but it argues that M.K. fails to plausibly allege that the company disclosed his personal

9 information to anyone other than the District. Dkt. No. 78 at 5-6. Google also argues that

10 disclosure of M.K.’s personal information to the District does not violate the VPPA because (1)

11 M.K. is not a “consumer” within the meaning of the statute, as his account was created as part of

12 his relationship with the District, not a relationship with Google, and (2) any disclosure to the

13 District was permitted under the statute’s exception for disclosures made in the ordinary course of

14 business. Id. at 7-9. The Court considers each of these arguments.

15 1. Whether M.K. is a “consumer”

16 For purposes of the VPPA, a consumer is “any renter, purchaser, or subscriber of goods or

17 services” from a video tape service provider. 18 U.S.C. § 2710(a)(1). The VPPA does not define

18 the term “subscriber.” While the parties appear to agree that a person may be a subscriber even if

19 he does not pay for a subscription, they disagree about whether M.K. is a subscriber of goods and

20 services from Google. See Dkt. No. 78 at 7-8; Dkt. No. 83 at 4-5. M.K. contends that he is a

21 subscriber because he has a Google account, including a unique login, and he argues that it does

22 not matter that the District required him to have such an account or arranged for him to get it. Dkt.

23 No. 83 at 4-5. Google argues that M.K. is not a subscriber because his relationship is with the

24 District only, and not with Google. Dkt. No. 78 at 7.

25 The Ninth Circuit has not addressed the meaning of the term “subscriber” as used in the

26 VPPA. The two circuits that have considered this question have adopted similar interpretations of

27 the statutory text. In Ellis v. Cartoon Network, the Eleventh Circuit held that “’subscription’

1 person and an entity.” 803 F.3d 1251, 1256 (11th Cir. 2015). Relevant considerations include

2 whether the relationship between the plaintiff and the video tape service provider involves

3 payment, registration, establishment of an account, provision of personal information, receipt or

4 delivery of goods or services, expressed association, and/or access to restricted content. See id.;

5 see also Perry v. Cable News Network, 854 F.3d 1336, 1342 (11th Cir. 2017) (applying the Ellis

6 framework). In Ellis, the plaintiff downloaded the defendant’s free application on his smartphone

7 and used it to watch video clips. The Eleventh Circuit concluded the plaintiff was not a subscriber

8 within the meaning of the VPPA, explaining:

9 In our view, downloading an app for free and using it to view

content at no cost is not enough to make a user of the app a

10

“subscriber” under the VPPA, as there is no ongoing commitment or

11 relationship between the user and the entity which owns and

operates the app. Importantly, such a user is free to delete the app

12 without consequences whenever he likes, and never access its

content again. The downloading of an app, we think, is the

13 equivalent of adding a particular website to one’s Internet browser

as a favorite, allowing quicker access to the website's content.

14

Under the circumstances, Mr. Ellis was not a “subscriber” of

15 Cartoon Network or its CN app.

16 Ellis, 803 F.3d at 1257; see also Perry, 854 F.3d at 1342-43 (concluding that plaintiff was not a

17 subscriber of CNN, even if he was able to access certain features a typical user of CNN’s free

18 mobile application could not, because plaintiff’s ability to access those features was due to his

19 status as a subscriber of his cable television provider, not CNN).

20 In Yershov v. Gannett Satellite Information Network, the First Circuit considered many of

21 the same factors described in Ellis, but reached a different conclusion on similar facts. 820 F.3d

22 482, 488 (1st Cir. 2016). Although the First Circuit agreed that “subscription” requires more than

23 merely accessing content through a web browser, it disagreed with the Eleventh Circuit’s

24 conclusion that downloading a mobile application is insufficient to establish a “subscriber”

25 relationship with the application’s provider. The First Circuit explained:

26

To use the App, Yershov did indeed have to provide Gannett with

27 personal information, such as his Android ID and his mobile

device's GPS location at the time he viewed a video, each linked to

free of a commitment to provide consideration in the form of that

1

information, which was of value to Gannett. And by installing the

2 App on his phone, thereby establishing seamless access to an

electronic version of USA Today, Yershov established a relationship

3 with Gannett that is materially different from what would have been

the case had USA Today simply remained one of millions of sites on

4 the web that Yershov might have accessed through a web browser.

5

Yershov, 820 F.3d at 489; see also id. (“Ellis . . . presumed that downloading a mobile device

6

application is the equivalent of adding a particular web site to one’s Internet browser as a favorite.

7

. . . We do not think that such a presumption is so apparently true as to dictate our reading of the

8

complaint, which concedes no such equivalence.”).

9

Here, Google argues that M.K. only has a relationship with the District. Dkt. No. 78 at 8.

10

It contends that the District provided M.K. with a Google account so that he could attend school

11

remotely using a service Google provided to the District, and that his access to Google’s video

12

content was made possible solely by virtue of his status as a student in the District. Id. M.K.

13

responds that he had a Google account, with a unique login, through which he obtained access to

14

YouTube videos and videos on Google Slide Show. Dkt. No. 83 at 5; see also Dkt. No. 66 ¶¶ 3, 7,

15

9. He also alleges that, by virtue of that account, Google had his personal information and tracked

16

the videos he watched. Dkt. No. 66 ¶¶ 7-10, 13-14. He argues that these facts support the

17

existence of a subscriber relationship between M.K. and Google. Dkt. No. 83 at 5.

18

The Court agrees that M.K. plausibly alleges the existence of a subscriber relationship with

19

Google. The fact that M.K. obtained his Google account through the District for the purpose of

20

attending school remotely does not undermine his allegation that he is, in fact, a Google account-

21

holder. While the FAC pleads few details about that account-holder relationship, the Court may

22

reasonably infer from M.K.’s allegations that he did not merely view videos while surfing the

23

web. Rather, the allegations in the FAC support an inference that he watched videos while logged

24

into his Google account using an application or service provided by Google that collected

25

information about the content he viewed and associated that activity with him. See id. ¶¶ 8-10

26

(“The District’s school principal and tech department . . . told parent [that] District staff had

27

accessed student’s activity on Google Slide Show. . . . M.K. watched videos offered by Google,

1 LLC’s Youtube and Slide Show platform.”); see also id. ¶¶ 49-50.

2 In these circumstances, the Court concludes that M.K. adequately alleges that he is a

3 subscriber of Google’s services for purposes of the VPPA. See, e.g., Jackson v. Fandom, Inc., No.

4 22-CV-04423-JST, 2023 WL 4670285, at *4 (N.D. Cal. July 20, 2023) (“Jackson does not allege

5 merely that she viewed videos hosted on a website, but rather that she created a Fandom account;

6 became a registered user; ‘provided Fandom with her PII, including her name and email address’;

7 and then used Fandom to watch videos. . . . This is sufficient to plead that Jackson is a subscriber,

8 and therefore a consumer, within the meaning of the statute.”); In re Hulu Priv. Litig., 2012 WL

9 3282960, at *8 (“Plaintiffs pleaded more than just visiting Hulu’s website. They were subscribers

10 of goods and services. . . . They visited hulu.com and viewed video content. . . . The resurrected

11 previously-deleted cookies allowed their data to be tracked ‘regardless of whether they were

12 registered and logged in.’ . . . Hulu gave Scorecard research Plaintiffs’ ‘Hulu profile identifiers’

13 linked to their ‘individual Hulu profile pages that included name, location preference information

14 designated by the user as private, and Hulu username.’”).

15 2. Whether any disclosure was incident to Google’s ordinary course of

business

16

The VPPA provides that a video tape service provider is exempt from liability for

17

disclosure of a consumer’s personally identifiable information “if the disclosure is incident to the

18

ordinary course of business of the video tape service provider.” 18 U.S.C. § 2710(b)(2)(E). The

19

statute defines “ordinary course of business” as “only debt collection activities, order fulfillment,

20

request processing, and the transfer of ownership.” 18 U.S.C. § 2710(a)(2). The Court agrees

21

with Google that the FAC does not plausibly allege that Google disclosed M.K.’s personal

22

information to third parties other than the District. With respect to the District, Google argues that

23

“[a]ny disclosure of M.K.’s information to the District so that it could manage the [Google

24

Workspace for Education] account that it provided to M.K.—e.g., to determine whether he was

25

participating in class or watching YouTube videos, or whether his account had been used to

26

disseminate inappropriate content—would be incidental to Google carrying out its agreements

27

with its subscriber, the District, in its business operations,” thereby falling within the statutory

1 exemption. Dkt. No. 78 at 9. M.K. disputes that the disclosures he alleges qualify for the

2 exemption. Dkt. No. 83 at 5-6.

3 “[T]he permissibility of disclosure under the VPPA turns on the underlying purpose for

4 which [the provider] provides the information to a third party.” Sterk v. Redbox Automated Retail,

5 LLC, 770 F.3d 618, 626 (7th Cir. 2014); see also Rodriguez v. Sony Computer Ent. Am., LLC, 801

6 F.3d 1045, 1054 (9th Cir. 2015) (intra-corporate disclosures and disclosures to third parties

7 providing services in support of business operations fell within the “order fulfillment” or “request

8 processing” exemptions of §§ 2710(a)(2) and (b)(2)(E)). While Google may have meritorious

9 arguments that its disclosure of M.K.’s personal information to the District was not an

10 unauthorized disclosure within the meaning of the VPPA, the Court cannot conclude, at the

11 pleading stage, that the alleged disclosures were merely incidental to Google’s fulfillment of its

12 contractual obligations to the District.4 The FAC contains no information about any such

13 contractual obligations, and they are not otherwise part of the record before the Court.

14 Accordingly, the Court concludes that M.K.’s VPPA claim survives Google’s challenge on

15 this basis as well, to the extent the claim challenges Google’s alleged disclosure of M.K.’s

16 personal information to the District.

17 C. Claim 2: Unfair Competition Law

18 California’s UCL “prohibits, and provides civil remedies for, unfair competition,” which it

19 defines as “any unlawful, unfair or fraudulent business act or practice.” Kwikset Corp. v. Superior

20 Ct., 51 Cal. 4th 310, 320 (2011); see Cal. Bus. & Prof. Code § 17200. The UCL “establishes three

21 varieties of unfair competition—acts or practices which are unlawful, or unfair, or fraudulent.”

22

23

4 M.K. has no duty to foreclose an ordinary course of business defense in his complaint. See

Nayab v. Cap. One Bank (USA), N.A., 942 F.3d 480, 494-95 (9th Cir. 2019) (“The burden of

24

proving justification or exemption under a special exception to the prohibitions of a statute

generally rests on one who claims its benefits. . . . The plaintiff need not negative the exception to

25

the statute. If the defendant wishes to rely upon the proviso, the burden is upon it to bring itself

within the exception.”) (quoting Schlemmer v. Buffalo, Rochester, & Pittsburg Ry. Co., 205 U.S.

26

1, 10 (1907)); see also Adams v. America’s Test Kitchen, LP, No. 22-CV-11309-AK, 2023 WL

4304675, at *8 (D. Mass. June 30, 2023) (plaintiff need not negate “consent” exception to VPPA

27

liability at the pleading stage, as it is akin to an affirmative defense); Feldman v. Star Trib. Media

1 Cel-Tech Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 20 Cal. 4th 163, 180 (1999) (cleaned

2 up). “Restitution and injunctive relief” are the only remedies available under the UCL, but they

3 may be “cumulative” of other remedies. De La Torre v. CashCall, Inc., 5 Cal. 5th 966, 980

4 (2018).

5 M.K. alleges that Google engaged in unlawful conduct by collecting and using M.K.’s

6 personal information without his permission in violation of COPPA and related FTC regulations.5

7 Dkt. No. 66 ¶¶ 55-74; Dkt. No. 83 at 9. M.K. also alleges that Google engaged in unfair conduct

8 by signing a “Student Privacy Pledge” promising to use student data only for authorized school-

9 related purposes and to inform students’ parents of the types of personal information Google

10 collects and the purposes, if any, for which the information is shared with others, and then

11 violating those promises. Dkt. No. 66 ¶ 72; Dkt. No. 83 at 9. In addition, M.K. alleges that

12 Google represented that its platform was secure and failed to warn the District, students, and

13 parents of the platform’s “cybersecurity weaknesses.” Dkt. No. 66 ¶¶ 75-81, 87; Dkt. No. 83 at 9.

14 Google argues that M.K. fails to plead economic injury sufficient to establish standing

15 under the UCL. Dkt. No. 78 at 9-10. Google also contends that the FAC does not plausibly allege

16 a violation of COPPA or any unfair conduct. Id. at 10-11.

17 “While the substantive reach of [the UCL] remains expansive,” to establish standing to

18 enforce the UCL’s provisions, a plaintiff must “(1) establish a loss or deprivation of money or

19 property sufficient to qualify as injury in fact, i.e., economic injury, and (2) show that that

20 economic injury was the result of, i.e., caused by, the unfair business practice . . . that is the

21 gravamen of the claim.” Kwikset Corp., 51 Cal. 4th at 321, 322; see also Cal. Bus. & Prof. Code

22 § 17204 (“Actions for relief pursuant to this chapter shall be prosecuted exclusively . . . by a

23 person who has suffered an injury in fact and has lost money or property as a result of the unfair

24 competition.”). Standing to bring a UCL claim therefore is “substantially narrower than federal

25 standing under article III, section 2 of the United States Constitution, which may be predicated on

26 a broader range of injuries.” Kwikset Corp., 51 Cal. 4th at 324.

27

1 M.K. claims that he “suffered an actual concrete economic harm” because “his family

2 expended their personal funds to hire tutors and an attorney to handle his suspension and correct

3 his school records.” 6 Dkt. No. 83 at 7; see also Dkt. No. 66 ¶¶ 15, 33, 73-74. M.K. argues that he

4 “has a future interest in his parent[’]s estate and that interest was reduced by the costs of his

5 attorney fees and tutors, and he is now deprived of money to which he had a cognizable claim

6 through California [p]robate law.” Dkt. No. 83 at 7-8. Google moves to dismiss on the ground

7 that M.K. alleges only economic injury to his parents, who are not parties, and that M.K. fails to

8 plausibly allege that such injury was caused by Google. Dkt. No. 78 at 10.

9 The Court agrees with Google that M.K. lacks standing under the UCL.

10 First, as Google observes, M.K. does not allege that he suffered any loss of money or

11 property. The fact that M.K.’s parents paid for tutors for M.K. and for the services of an attorney

12 following M.K.’s suspension does not support M.K.’s assertion that he suffered economic injury.

13 The UCL requires “that a private action under that law be brought exclusively by a “person who

14 has suffered injury in fact and has lost money or property as a result of the unfair competition.”

15 Amalgamated Transit Union, Loc. 1756, AFL-CIO v. Superior Ct., 46 Cal. 4th 993, 1002 (2009)

16 (quoting Cal. Bus. & Prof. Code § 17204) (emphasis in original); see also id. (standing exists

17 “only if that individual was actually injured by . . . an unfair business practice”) (emphasis in

18 original). Recent decisions in this District have distinguished between economic harms to parents

19 and children when analyzing standing under the UCL. For example, in M.S. v. Nintendo of

20 America, Inc., the court found that the child plaintiffs did not have standing to bring a false

21 advertising claim against the defendant because their parents were the ones who purchased the

22 products at issue and suffered the economic injury. No. C 20-06929 WHA, 2022 WL 17169835,

23 at *3 (N.D. Cal. Nov. 22, 2022); see also Sanchez v. Nintendo of Am. Inc., No. C 20-06929 WHA,

24 2022 WL 4099154, at *3 (N.D. Cal. Sept. 7, 2022) (children lacked Article III standing to bring

25

26

6 M.K. relies principally on Allergan v. Athena Cosmetics, a Federal Circuit case applying

California law. 640 F.3d 1377 (Fed. Cir. 2011). That case is inapposite. In Allergan, the Federal

27

Circuit reversed a district court decision that applied an outdated version of the UCL standing

1 claim regarding reduced resale value because products in question belonged to parents). And in

2 I.B. v. Facebook, Inc., the court determined that children who alleged that their purchases of

3 online credits violated other California statutes lacked standing under the UCL because the

4 plaintiffs had used their parents’ credit cards. No. C 12-1894 CW, 2013 WL 6734239, at *6 (N.D.

5 Cal. Dec. 20, 2013).

6 Second, M.K does not plausibly allege that Google’s misconduct caused the economic

7 injury in question—i.e., his parents’ expenditure of money to pay for tutors and for the services of

8 an attorney. “To challenge a business practice, a private plaintiff must allege injury in fact caused

9 by the practice in question.” Prager Univ. v. Google LLC, 85 Cal. App. 5th 1022, 1041-42

10 (2022); see also Two Jinn, Inc. v. Gov’t Payment Serv., Inc., 233 Cal. App. 4th 1321, 1332 (2015)

11 (“[T]here must be a causal connection between the harm suffered and the unlawful business

12 activity. That causal connection is broken when a complaining party would suffer the same harm

13 whether or not a defendant complied with the law.”) (quoting Daro v. Superior Ct., 151 Cal. App.

14 4th 1079, 1099 (2007)). Here, the economic harm M.K. claims his parents suffered does not stem

15 from Google’s alleged failure to comply with COPPA or its implementing regulations, or from

16 Google’s alleged violation of a “privacy pledge.” Rather, the harm results directly from the

17 District’s decision to suspend M.K. from school for sending a sexually explicit message to his

18 teacher—a suspension M.K. contends reflects improper conduct by the District. M.K. does not

19 plausibly allege a causal connection between Google’s alleged unlawful or unfair conduct and the

20 economic harm his parents suffered.

21 Accordingly, the Court concludes that M.K. fails to state a claim against Google under the

22 UCL.

23 D. Claim 4: Failure to Protect

24 M.K. alleges that Google “failed to protect M.K. under SOPIPA’s affirmative duty to

25 protect when it failed to warn parents of cybersecurity issues, failed to warn the district, failed to

26 develop reasonable security procedures and practices, failed to design a system that would alert

27 teachers, staff, parents or student users to individuals logging on Google Classrooms from a new

1 claim sounds in negligence, which requires him to allege facts establishing “(1) a legal duty of due

2 care; (2) a breach of that duty; (3) causation; and (4) damages.” In re Google Android Consumer

3 Privacy Litig., No. 11-MD-02264 JSW, 2013 WL 1283236, at *12 (N.D. Cal. Mar. 26, 2013).

4 Google argues that M.K.’s failure to protect claim is nothing more than a “retread” of the

5 SOPIPA claim that M.K. has since withdrawn.7 Dkt. No. 78 at 17. M.K. responds that he relies

6 on SOPIPA and COPPA as the sources of Google’s duty of care owed to him, but he otherwise

7 fails to address Google’s arguments. Dkt. No. 83 at 10.

8 The Court agrees with Google that the FAC does not refer to COPPA as the alleged source

9 of any duty of care owed by Google to M.K. With respect to SOPIPA, Google persuasively

10 argues (and M.K. appears to concede) that SOPIPA does not afford a private right of action for

11 violation of its terms, and M.K. does not explain why he should nevertheless be permitted to rely

12 on an alleged violation of that statute by recasting his claim as negligent failure to protect. See

13 Dkt. No. 78 at 12-14; Dkt. No. 83 at 10.

14 In any event, M.K. fails to plausibly allege any violations of the duties he claims Google

15 owes him. First, he alleges that Google failed to incorporate reasonable cybersecurity protections

16 into its platform and failed to warn consumers, including the District, students, and their parents,

17 of the dangers it created. Id. ¶ 104. M.K. has not plausibly alleged any security (or cybersecurity)

18 defects. It is not sufficient for M.K. to allege merely that his Google account was hacked, or that

19 Google should have warned him that his account could be hacked. See Bem v. Stryker Corp., No.

20 C 15-2485 MMC, 2015 WL 4573204, at *1 (N.D. Cal. July 29, 2015) (complaint failed to state a

21 claim for negligence when it “relie[d] on conclusory allegations and fail[ed] to plead any facts

22 describing the particular defect, the injury sustained, the manner in which [defendant] was

23 negligent, or how any such negligence caused or contributed in any manner to any specified

24 injury.”). M.K. alleges that Google “failed to design a system that would alert teachers, staff,

25

7 Google also argues that to the extent M.K. seeks to hold Google responsible for the sexually

26

explicit communication M.K. says a hacker sent to his teacher, M.K.’s claim is barred by the

Communications Decency Act, 47 U.S.C. § 230(c), which immunizes interactive service providers

27

from liability for claims that treat them as publishers of third-party content. Dkt. No. 78 at 17-18.

1 parents or student users to individuals logging on Google Classrooms from a new IP address.”

2 Dkt. No. 66 ¶ 104. M.K. seems to suggest that Google had a duty to includes such an alert in its

3 platform design, but the FAC does not identify the source of any such duty. To the extent M.K.

4 suggest that Google and/or the District should have monitored the IP addresses from which each

5 student accessed the Google platform, this suggestion is at odds with M.K.’s objections that

6 Google and the District improperly monitored his online activities. In short, the FAC is devoid of

7 any non-conclusory factual allegations about what was negligent about Google’s platform design

8 or its data handling practices, or about what the company was required to warn the District,

9 students, and their parents about. M.K. does not allege any facts that support an inference that

10 Google failed to use reasonable security procedures or practices with respect to the Google

11 platform at issue, or that any such failure caused M.K.’s alleged injury. See Iqbal, 556 U.S. at

12 678.

13 Second, M.K. alleges that Google failed to ensure that his data was not “used to advertise

14 services.” Id. M.K. says that he believes Google shared his personal information with advertisers

15 because his parents saw “third party ads via pop ups and recommendations for related videos and

16 products from advertisers on his iPad connected to topics typed into his Google classroom, videos

17 watched or conversations had while using Google Classroom.” Id. ¶ 5. M.K. asks the Court to

18 infer from this single, conclusory allegation that Google shared information with advertisers about

19 M.K.’s activities while he was logged into his Google account and using Google’s platform for

20 school. The FAC does not identify the advertisements or recommendations shown to M.K., or the

21 school-related topics, videos, or conversations to which these advertisements or recommendations

22 were “connected.” Moreover, given that the iPad M.K. used for school was his own personal

23 device, see id. ¶ 4, it is not reasonable to infer from these allegations alone that Google shared

24 M.K.’s school-related information with advertisers. While it certainly is possible that Google

25 shared M.K.’s information in the manner that he claims, the allegations in the FAC “fail to raise a

26 right to relief above the speculative level.” Twombly, 550 U.S. at 555.

27 At the hearing, M.K.’s counsel claimed that Google knew or should have known that its

1 not appear in the FAC, and M.K. cites no authority for the proposition that the existence of prior

2 || hacking incidents supports an affirmative duty to warn or suggests that the platform suffered from

3 a design defect.

4 Accordingly, the Court concludes that M.K. fails to state a claim against Google for negligent

5 failure to protect.

6 E. Leave to Amend

7 M.K. has already had one opportunity to amend his claims against Google. He does not

8 ask for another opportunity to amend, nor does he suggest that there are any additional facts that

9 || he could plead in support of his claims. See Dkt. No. 88 at 56:5-57:1. For this reason, the Court

10 || concludes that it would be futile to grant M.K. leave to amend yet again.

11 || Iv. CONCLUSION

12 For the reasons explained above, the Court grants Google’s motion to dismiss with respect

13 to claims 2, 3, and 4 of the FAC. The Court denies Google’s motion to dismiss claim 1 as to the

14 || alleged disclosure of M.K.’s personally identifiable information to the District and its employees.

3 15 Google’s responsive pleading is due 14 days from the date of this order. See Fed. R. Civ. P.

16 |} 12a).

= 17 IT IS SO ORDERED.

18 Dated: August 1, 2023

19 «8

VIRGINIA K. DEMARCHI

21 United States Magistrate Judge

22

23

24

25

26

27

28