Gerber v. Twitter, Inc.

1

2

3

4 UNITED STATES DISTRICT COURT

5 NORTHERN DISTRICT OF CALIFORNIA

6

7 STEPHEN GERBER, et al., Case No. 4:23-cv-00186-KAW

8 Plaintiffs, ORDER GRANTING IN PART AND

DENYING IN PART DEFENDANT'S

9 v. MOTION TO DISMISS PLAINTIFFS'

SECOND AMENDED CLASS ACTION

10 TWITTER, INC., et al., COMPLAINT

11 Defendants. Re: Dkt. No. 89

12

13 On June 12, 2024, Defendant X Corp., as successor in interest to Twitter, Inc. (collectively

14 “Twitter”), filed a motion to dismiss Plaintiffs’ second amended consolidated class action

15 complaint.

16 Upon review of the moving papers, the Court finds this matter suitable for resolution

17 without oral argument pursuant to Civil Local Rule 7-1(b), and, for the reasons set forth below,

18 GRANTS IN PART AND DENIES IN PART Defendant’s motion to dismiss.

19 I. BACKGROUND

20 Twitter is a social media platform where users can post and engage with short-form

21 commentary, called “Tweets,” which may include text, images, or video. (Consolidated Second

22 Am. Class Action Compl., “CCAC,” Dkt. No. 72 ¶¶ 4, 33-35.) Each user must create a username

23 and display name, which are displayed publicly and associate the user with their activity on the

24 Twitter platform. (CCAC ¶ 37.) Twitter invites users to operate on its platform by using

25 pseudonymous user and display names, thereby allowing users to share and access information

26 and engage freely and anonymously. (CCAC ¶¶ 77-79.) While Twitter does not charge its users, it

27 realizes billions of dollars in annual revenues from the highly valuable data generated by its users.

1 In order to sign up for an account on the Twitter platform, a prospective user is required to:

2 (1) enter into a User Agreement, and (2) provide certain personal information, including name,

3 email address, phone number, and date of birth (collectively, “PII”). (CCAC ¶¶ 37-38.) The User

4 Agreement, includes the Terms of Service (“TOS”), the Privacy Policy, the Twitter Rules and

5 Policies, and all incorporated policies. (See CCAC ¶¶ 38.) As a result, prior to accessing the

6 Twitter platform and using Twitter’s services, Plaintiffs entered into the User Agreement with

7 Twitter, including the Privacy Policy, and provided Twitter with their PII, as requested by Twitter

8 and subject to Twitter’s representations set forth in the Privacy Policy. (CCAC ¶¶ 38-41, 139.)

9 The Privacy Policy states in detail how user data, including PII, will be used and who will have

10 access to that data. (CCAC ¶¶ 38-40.)

11 From around June 2021 through January 2022, a defect in Twitter’s application

12 programming interface (“API”) allowed threat actors to access and obtain PII associated with an

13 estimated 200 million Twitter users. (CCAC ¶¶ 82.) It is unclear from publicly available

14 information whether the person(s) that took advantage of the API vulnerability were external

15 threat actors or had internal access at Twitter. (CCAC ¶¶ 82, 114(b), 114(g), 122, 138.) The

16 information extracted through the API defect consists of information associated with users’

17 Twitter account (username, display name, and account creation data), together with the users’ PII

18 (email address and phone number). (CCAC ¶ 82.) This data was offered for sale, on more than

19 one occasion, and/or leaked on the dark web between August 2022 and January 2023, which is

20 referred to as the “Data Breach.” Id.

21 Twitter claims to have learned of the API defect from a third party, rather than through its

22 own diligence. (CCAC ¶¶98-103.) And, after learning of the defect, Twitter claims that it failed

23 entirely to ascertain that a threat actor may have taken advantage of the defect to obtain access to

24 user PII, and that extensive data obtained in a Twitter hack was for sale on the dark web. Id.

25 Plaintiffs allege that Twitter has taken no remedial action to recover the data or mitigate the

26 damage. (CCAC ¶ 110.)

27 Plaintiffs contend that the Data Breach does not represent an isolated incident, but, rather,

1 early as 2010, Twitter came under scrutiny from the Federal Trade Commission (“FTC”) for its

2 data privacy failures, resulting in the entry of a 2011 consent order (the “FTC Order”), which

3 Twitter has continued to violate for more than a decade, including with respect to the Data Breach.

4 (CCAC ¶¶ 9, 125-132.) Peiter Zatko, who was Twitter’s Head of Security from 2020 to 2022,

5 filed a whistleblower complaint and testified before Congress regarding the dangerous and

6 pervasive lack of both internal and external data security at Twitter. (CCAC ¶¶ 112-119.) Zatko

7 provided comprehensive reports to the Twitter Board of Directors and executives regarding his

8 data security concerns, but Twitter allegedly failed and refused to implement even the most basic

9 and cost-effective measures. (CCAC ¶¶ 116-118, 120.) At the very same time, the events giving

10 rise to the Data Breach occurred. (CCAC ¶¶ 82, 112.)

11 Plaintiffs allege that had they known that Twitter failed to implement reasonable and

12 adequate data security measures, they would not have created Twitter accounts or would not have

13 provided their PII that was disclosed in the Data Breach to Twitter. (CCAC ¶¶ 24, 28, 31.)

14 Plaintiff Weitzman alleges that she has spent time monitoring her various accounts to detect and

15 prevent any misuses of her PII, which she would not have had to expend if not for the Data

16 Breach. (CACC ¶ 31.) Plaintiff Weitzman also claims to have hired a social media specialist to

17 monitor her accounts at an additional weekly cost to deal with the increased spamming and

18 spoofing she suffered as a result of the Data Breach. Id. Plaintiffs further contend that the Data

19 Breach has also caused specific and unique harm to Twitter’s impacted users that accepted its

20 invitation to operate on its platform anonymously through the use of pseudonyms, such as

21 Plaintiffs Gerber and Cohen, as the data available as a result enables any person with access to it

22 to readily ascertain the identity of the person associated with a pseudonymous Twitter account and

23 their related activity on the platform. (CCAC ¶¶ 85, 104, 147.)

24 On April 19, 2024, Plaintiffs filed the second amended consolidated class action complaint

25 alleging seven causes of action for breach of contract, breach of implied contract, negligence,

26 gross negligence, unjust enrichment, violation of California Unfair Competition Law (Cal. Bus. &

27 Prof. Code § 17200), and declaratory judgment. On June 12, 2024, Defendant filed a motion to

1 Dkt. No. 96.) On September 8, 2024, Defendant filed a reply. (Def.’s Reply, Dkt. No. 101.)

2 II. LEGAL STANDARD

3 A. Motion to Dismiss

4 Under Federal Rule of Civil Procedure 12(b)(6), a party may file a motion to dismiss based

5 on the failure to state a claim upon which relief may be granted. A motion to dismiss under Rule

6 12(b)(6) tests the legal sufficiency of the claims asserted in the complaint. Navarro v. Block, 250

7 F.3d 729, 732 (9th Cir. 2001).

8 In considering such a motion, a court must “accept as true all of the factual allegations

9 contained in the complaint,” Erickson v. Pardus, 551 U.S. 89, 94 (2007) (per curiam) (citation

10 omitted), and may dismiss the case or a claim “only where there is no cognizable legal theory” or

11 there is an absence of “sufficient factual matter to state a facially plausible claim to relief.”

12 Shroyer v. New Cingular Wireless Servs., Inc., 622 F.3d 1035, 1041 (9th Cir. 2010) (citing

13 Ashcroft v. Iqbal, 556 U.S. 662, 677-78 (2009); Navarro, 250 F.3d at 732) (internal quotation

14 marks omitted).

15 A claim is plausible on its face when a plaintiff “pleads factual content that allows the

16 court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”

17 Iqbal, 556 U.S. at 678 (citation omitted). In other words, the facts alleged must demonstrate “more

18 than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not

19 do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). “Threadbare recitals of the elements of

20 a cause of action” and “conclusory statements” are inadequate. Iqbal, 556 U.S. at 678; see also

21 Epstein v. Wash. Energy Co., 83 F.3d 1136, 1140 (9th Cir. 1996) (“[C]onclusory allegations of

22 law and unwarranted inferences are insufficient to defeat a motion to dismiss for failure to state a

23 claim.”). “The plausibility standard is not akin to a probability requirement, but it asks for more

24 than a sheer possibility that a defendant has acted unlawfully . . . When a complaint pleads facts

25 that are merely consistent with a defendant's liability, it stops short of the line between possibility

26 and plausibility of entitlement to relief.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at

27 557) (internal citations omitted).

1 request to amend is made “unless it determines that the pleading could not possibly be cured by

2 the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (citations

3 omitted).

4 B. Request for Judicial Notice

5 As a general rule, a district court may not consider any material beyond the pleadings in

6 ruling on a motion to dismiss for failure to state a claim. Lee v. City of Los Angeles, 250 F.3d 668,

7 688 (9th Cir. 2001). A district court may take notice of facts not subject to reasonable dispute that

8 are “capable of accurate and ready determination by resort to sources whose accuracy cannot

9 reasonably be questioned.” Fed. R. Evid. 201(b); United States v. Bernal–Obeso, 989 F.2d 331,

10 333 (9th Cir. 1993). “[A] court may take judicial notice of ‘matters of public record,’” Lee, 250

11 F.3d at 689 (citing Mack v. S. Bay Beer Distrib., 798 F.2d 1279, 1282 (9th Cir. 1986)), and may

12 also consider “documents whose contents are alleged in a complaint and whose authenticity no

13 party questions, but which are not physically attached to the pleading” without converting a

14 motion to dismiss under Rule 12(b)(6) into a motion for summary judgment. Branch v. Tunnell,

15 14 F.3d 449, 454 (9th Cir. 1994), overruled on other grounds by Galbraith v. Cnty. of Santa Clara,

16 307 F.3d 1119 (9th Cir. 2002). The court need not accept as true allegations that contradict facts

17 which may be judicially noticed. See Mullis v. United States Bankruptcy Ct., 828 F.2d 1385, 1388

18 (9th Cir. 1987).

19 III. DISCUSSION

20 A. Request for Judicial Notice

21 As a preliminary matter, Defendant asks that the Court take judicial notice of six

22 documents in support of its motion to dismiss that were not previously judicially noticed. (Def.’s

23 Req. for Judicial Notice, “RJN,” Dkt. No. 41.) The documents are purportedly true and correct

24 copies of: 1) A Twitter Help Center page titled “About your email and phone number

25 discoverability privacy settings,” available at https://help.x.com/en/safety-and-security/email-

26 andphone-discoverability-settings (last visited June 12, 2024); 2) A Twitter Help Center page

27 titled “How to upload and manage your contacts,” available at https://help.twitter.com/en/using-

1 Center page titled “About X’ account suggestions,” available at https://help.twitter.com/en/using-

2 twitter/account-suggestions (last visited June 12, 2024), which is central to the plausibility of

3 Plaintiffs’ claims; 4) The Ernst & Young Independent Assessor’s Transmittal Letter on Twitter’s

4 Information Security Program for the Period September 13, 2019, to September 12, 2021,

5 available at https://www.ftc.gov/system/files/ftc_gov/pdf/twitter-assessment-2019-2021.pdf (last

6 visited June 12, 2024); 5) Order on Motion to Dismiss, Price v. Twitter, Inc., No. 22-cv-03173-SK

7 (N.D. Cal. Dec. 6, 2022), ECF No. 50; 6) Order on Twitter’s Demurrer to Plaintiffs’ Class Action

8 Complaint and Motion to Strike, Yeh v. Twitter, Inc., No. CGC-23-605100 (Cal. Sup. Ct., S.F.

9 Cnty., May 31, 2024). (RJN at i-ii; Decl. of John MacGregor, “MacGregor Decl.,” Dkt. No. 89-1,

10 Exs. 1-6)1

11 Additionally, Defendant asks that the Court take judicial notice of the eight documents it

12 took notice of in the prior motion to dismiss: 1) Twitter’s Privacy Policy effective June 18, 2020,

13 available at https://twitter.com/en/privacy/previous/version_16; 2) Twitter’s Privacy Policy

14 effective August 19, 2021, available at https://twitter.com/en/privacy/previous/version_17; 3)

15 Twitter’s Privacy Policy effective June 10, 2022, available at

16 https://twitter.com/en/privacy/previous/version-18; 4) Twitter’s Terms of Service effective June

17 18, 2020, available at https://twitter.com/en/tos/previous/version_15; 5) Twitter’s Terms of

18 Service effective as of August 19, 2021, available at

19 https://twitter.com/en/tos/previous/version_16; 6) Twitter’s Terms of Service effective June 10,

20 2022, available at https://twitter.com/en/tos/previous/version-17; 7) a blog post published on the

21 Twitter Privacy Center on August 5, 2022, titled “An incident impacting some accounts and

22 private information on Twitter,” available at https://privacy.twitter.com/en/blog/2022/an-issue-

23 affecting-some-anonymous-accounts; 8) a blog post published on the Twitter Privacy Center on

24 January 11, 2023, titled “Update about an alleged incident regarding Twitter user data being sold

25 online,” available at https://privacy.twitter.com/en/blog/2023/update-about-an-alleged-incident-

26 regarding-twitter-user-data-being-sold-online. (RJN at ii; Decl. of Stephen A. Broome, Dkt. No.

27

1 40-1, Exs. 1-8.)2

2 Plaintiffs oppose the request to judicial notice as it pertains to the MacGregor Exhibit Nos.

3 1-4, because Defendant is seeking to establish the truth of the documents’ contents to dispute the

4 well-pleaded facts in the complaint. (Pl.’s RJN Opp’n, Dkt. No. 98 at 1.)

5 The Court denied Defendant’s prior request to judicially notice Exhibits 1-3, which

6 Defendant acknowledges in its resubmission, but Twitter claims that the exhibits are necessary to

7 resolve Twitter’s argument that Plaintiffs’ negligence claims should be dismissed for failure to

8 plausibly plead proximate causation. (RJN at i n. 1.) The Court disagrees and again denies the

9 request for judicial notice as to these three exhibits, because Defendant is attempting to challenge

10 Plaintiffs’ well plead factual allegations on a motion to dismiss, which is inherently improper.

11 Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1014 (9th Cir. 2018) (“The incorporation-by-

12 reference doctrine does not override the fundamental rule that courts must interpret the allegations

13 and factual disputes in favor of the plaintiff at the pleading stage.”) see also Katz-Lacabe v. Oracle

14 Am., Inc., 668 F. Supp. 3d 928, 939 (N.D. Cal. 2023)(“[J]udicially noticing all of the information

15 contained on Oracle's own webpages is improper and unnecessary, as it would serve no purpose

16 other than exactly what the Ninth Circuit warned against: crafting an alternative version of

17 events.”)

18 Plaintiffs also oppose MacGregor Exhibit 4, the “Ernst & Young Independent Assessor’s

19 Transmittal Letter on Twitter’s Information Security Program,” on the grounds that it is a self-

20 serving document being used to challenged Plaintiff’s factual allegations. (Pl.’s RJN Opp’n at 3.)

21 The Court agrees for the same reasons discussed above.

22 The court “is not required to incorporate documents by reference.” Davis v. HSBC Bank

23 Nev., N.A., 691 F.3d 1152, 1159 (9th Cir. 2012). The remaining MacGregor Exhibits are court

24 orders issued in other cases, which are irrelevant, so the Court declines to incorporate them by

25 reference.3

26

2 Since these have the same exhibit numbers, these exhibits will be referred to by “RJN, Ex. _-2.”)

27

In the future Defendant is responsible for addressing all exhibits in connection with a pending

1 Finally, in connection with its reply brief, Defendant asks that the Court take judicial

2 notice of true and correct copies of Twitter account sign-up pages, available at

3 http://twitter.com/signup, at various points during the relevant time period. (Def.’s Reply RJN,

4 Dkt. 102; Decl. of John MacGregor ISO Reply, “MacGregor Reply Decl.,” Dkt. No. 101-1 at 1,

5 Ex. 1.) The Court denies this request, because the exhibit should have been presented in

6 conjunction with the original motion.

7 Accordingly, Defendant’s request for judicial notice is GRANTED IN PART AND

8 DENIED IN PART. The motion is granted only as to the previously judicially noticed Broome

9 Exhibits and denied as to all of the MacGregor exhibits.

10 B. Motion to Dismiss

11 i. Terms of Service

12 As an initial matter, Defendant argues that the first five causes of action for breach of

13 contract, breach of implied contract, negligence, gross negligence, and unjust enrichment are

14 barred by the Terms of Service (“TOS”) disclaimer and the limitation of liability clauses. (Def.’s

15 Mot. at 5.) The Court notes that, in connection with the first motion to dismiss, Defendant

16 conceded that California law forbids limiting liability for gross negligence, so it is unclear why

17 Defendant would raise this argument here. (See 3/29/24 Order, Dkt. No. 69 at 8 (citing In re

18 Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 800 (N.D. Cal. 2019).)

19 Nonetheless, the Court finds that the TOS cannot limit liability for gross negligence, so the TOS

20 can only potentially bar the other four causes of action.

21 Section 6 of the TOS provides that California law governs both the terms and any claim

22 that may arise between the consumer and Twitter. (RJN, Ex. 6-2 at 9-10.) “With respect to claims

23 for breach of contract, limitation of liability clauses are enforceable unless they are

24 unconscionable, that is, the improper result of unequal bargaining power or contrary to public

25 policy.” Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 209 Cal. App. 4th 1118, 1126 (2012).

26 Specifically, Section 5 of the TOS contained disclaimers and limitations of liability. First, users

27 were advised that the services were being made available “AS-IS”:

risk. . . . [T]he Services are provided to you on an “AS IS” . . . basis.

1 The Twitter Entities make no warranty or representation and disclaim

all responsibility and liability for: (i) the . . security or reliability of

2 the Services or any Content; (ii) any harm to your computer system,

loss of data, or other harm that results from your access to or use of

3 the Services or any content; . . . and (iv) whether the Services will

meet your requirements or be available on an uninterrupted, secure,

4 or error-free basis.

5 (RJN, Ex. 6-2 at 8) (emphasis added). Next, the limitation of liability clause was as follows:

6 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE

LAW, THE TWITTER ENTITIES SHALL NOT BE LIABLE FOR

7 ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL

OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR

8 REVENUES, WHETHER INCURRED DIRECTLY OR

INDIRECTLY, OR ANY LOSS OF DATA . . . OR OTHER

9 INTANGIBLE LOSSES, RESULTING FROM (i) YOUR ACCESS

TO OR USE OF OR INABILITY TO ACCESS OR USE THE

10 SERVICES; (ii) ANY CONDUCT OR CONTENT OF ANY THIRD

PARTY ON THE SERVICES, INCLUDING WITHOUT

11 LIMITATION, ANY DEFAMATORY, OFFENSIVE OR ILLEGAL

CONDUCT OF OTHER USERS OR THIRD PARTIES; (iii) ANY

12 CONTENT OBTAINED FROM THE SERVICES; OR (iv)

UNAUTHORIZED ACCESS, USE OR ALTERATION OF YOUR

13 TRANSMISSIONS OR CONTENT… THE LIMITATIONS OF

THIS SUBSECTION SHALL APPLY TO ANY THEORY OF

14 LIABILITY, WHETHER BASED ON WARRANTY,

CONTRACT, STATUTE, TORT (INCLUDING NEGLIGENCE)

15 OR OTHERWISE….

16 (RJN, Ex. 6-2 at 9) (emphasis added).

17 Courts in this district have found liability limitation provisions to be generally enforceable

18 for similar services. See, e.g., Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1038 (N.D. Cal.

19 2019) (contract claims barred by TOS). Broad provisions such as these, however, have also been

20 found to be unconscionable because they “are overly one-sided and bar any effective relief.” In re

21 Yahoo! Inc. Customer Data Sec. Breach Litig., 313 F. Supp. 3d 1113, 1137 (N.D. Cal. 2018).

22 Unconscionability requires the plaintiff to allege facts “showing that the term is both procedurally

23 and substantively unconscionable.” Id. at 1136. Substantive and procedural unconscionability are

24 comparatively assessed on a “sliding scale” – i.e., “the more substantively oppressive the contract

25 term, the less evidence of procedural unconscionability is required to come to the conclusion that

26 the term is unenforceable, and vice versa.” Sanchez v. Valencia Holding Co., LLC, 61 Cal. 4th

27 899, 910 (Cal. 2015).

1 a. Procedural Unconscionability

2 Plaintiffs allege that the As-Is Limitation and Liability clauses are procedurally

3 unconscionable, because they “suffer[] from both oppression and surprise.” (CCAC ¶ 157.)

4 Defendant argues that there is no procedural unconscionability. (Def.’s Mot. at 6.) First,

5 Twitter contends that there is no rule that an adhesion contract is per se unconscionable. Id. (citing

6 Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1038 (N.D. Cal. 2019)). While true, that does not

7 mean that there is no procedural unconscionability. In fact, the Ninth Circuit has indicated that, at

8 the very least, the degree of procedural unconscionability in an adhesive contract is low when a

9 customer has “reasonably available” alternative sources of supply from which to obtain the desired

10 service. Darnaa, LLC v. Google LLC, 756 F. App'x 674, 676 (9th Cir. 2018) (quoting Lennar

11 Homes of Cal., Inc. v. Stephens, 232 Cal. App. 4th 673, 181 Cal.Rptr.3d 638, 651-52 (2014)).

12 In opposition, Plaintiffs argue that, since Darnaa, the California Court of Appeal has

13 clarified that the existence of market alternatives do not preclude procedural unconscionability

14 when surprise is alleged. (Pls.’ Opp’n at 8, n. 8 (citing Fisher v. MoneyGram Int'l, Inc., 66 Cal.

15 App. 5th 1084, 1096 (2021).) In Fisher, the Court of Appeal found that the “‘meaningful choice’

16 rationale is employed only where surprise is not seriously in issue, and the plaintiff relies solely on

17 the defendant’s use of an adhesion contract to show procedural unconscionability.” 66 Cal. App.

18 5th at 1096. This rationale makes sense, because if the oppression is not apparent, a user cannot

19 be expected to fully understand the TOS.

20 Even so, Defendant argues that Plaintiffs cannot claim “surprise” because “these clauses

21 appear under a bolded header in 30-point font on pages nine and ten of the TOS—which are only

22 12 pages long.” (Def.’s Mot. at 7 (citing CCAC ¶ 161).) Moreover, Defendant contends that

23 Plaintiffs’ allegations that “the contested provisions do not appear on Twitter’s ‘landing page’ and

24 that numerous ‘click[s]’ are supposedly required to navigate to the provisions… ignore the fact

25 that Twitter alerted Plaintiffs in advance each time Twitter changed the TOS, either via email or

26 an in-app prompt.” (Def.’s Mot. at 8 (citing CCAC ¶¶ 159-161; RJN, Exs. 4-2 at 10–11, Ex. 5-2 at

27 11, Ex. 6-2 at 10–11.) Furthermore, Defendant argues that “the TOS were accessible on Twitter’s

1 In opposition, Plaintiffs contend that this ignores the fact that these terms were buried in

2 lengthy forms drafted by the party who wished to enforce them. (Pls.’ Opp’n at 8 (citing Yahoo!,

3 313 F. Supp. 3d at 1137 (liability limitation was near end of 12-page, adhesive TOS)).) The Court

4 agrees and finds that the TOS was at least somewhat procedurally unconscionable.

5 b. Substantive Unconscionability

6 Defendant argues that the TOS is not substantively unconscionable, and that similar terms

7 that include limiting the language “to the maximum extent permitted by applicable law” are

8 frequently not invalidated on unconscionability grounds. (Def.’s Mot. at 9 (citing Adkins v.

9 Facebook, Inc., No. C 18-05982 WHA, 2019 WL 3767455, at *2-3 (N.D. Cal. Aug. 9, 2019)).)

10 In opposition, Plaintiffs argue that the limitations are substantively unconscionable,

11 because Defendant seeks to “disclaim any duty to ‘secure [users’] personal information’ based on

12 a broad provision stating that its services are provided on an ‘AS IS’ basis” and it “makes no

13 ‘warranty or representation and disclaim[s] all responsibility and liability for’ broad categories of

14 harm encompassing virtually any harm that could arise from use of its services.” (Pls.’ Opp’n at 8

15 (citing CCAC ¶163) (emphasis in original).) Plaintiffs also argue that there is no reasonable

16 commercial justification for limiting Plaintiffs’ ability to pursue claims and remedies, because

17 Twitter is already required by law to maintain reasonable data security systems. (Pls.’ Opp’n at 9

18 (citing CCAC ¶¶ 268-270).) The Court agrees. As Plaintiffs argue, Twitter, as a large technology

19 company, “provided the services at issue on the premise that user data would be safe, and Twitter

20 is in a far superior position than its users to address and manage the risk of data security matters.”

21 (Pls.’ Opp’n at 10.) In Yahoo!, the district court found that the limitations’ allocation of risk was

22 unreasonable because technology giants are better equipped to bear the risk of data security than

23 individual users, particularly when the companies are obligated to maintain acceptable levels of

24 data security under state and federal law. In re Yahoo! Inc. Customer Data Sec. Breach Litig., 313

25 F. Supp. 3d 1113, 1138 (N.D. Cal. 2018). As a result, the district court found that the plaintiffs

26 adequately pled that the limitations of liability were substantively unconscionable by pleading that

27 “Defendants took minimal action despite knowing about their inadequate security measures.” Id.

1 claims, the district court found that “Facebook’s mere failure to discover the vulnerability might

2 be barred by the clause, but if it had acquiesced to, or known of the vulnerability, the claim would

3 certainly be allowed through.” 394 F. Supp. 3d 1024, 1038 (N.D. Cal. 2019). Here, Plaintiffs

4 clearly allege that Twitter knew of the vulnerability and declined to address it.

5 Additionally, Plaintiffs contend that California Civil Code § 1668 renders the disclaimers

6 unenforceable. (Pls.’ Opp’n at 10.) California Civil Code Section 1668 “invalidates limitations on

7 liability per public policy for three categories of claims: fraud, willful injury, and violations of a

8 statute.” Adkins v. Facebook, Inc., No. 18-cv-05982 WHA, 2019 WL 3767455, at *2 (N.D. Cal.

9 Aug. 9, 2019).

10 In reply, Defendant argues that § 1668 is limited to violations of statute, and cites Adkins,

11 2019 WL 3767455, at *2, for the proposition that the TOS is only invalidated if it exempted

12 Twitter from “violations of statute.” (Def.’s Reply at 8.) Defendant contends that it is not seeking

13 to bar a statutory violation; rather, the clauses merely bar Plaintiffs’ claims for breach of contract,

14 negligence, and unjust enrichment. Id.

15 Other district courts, however, have invoked § 1668 to invalidate liability limitations when

16 intentional conduct is alleged. See Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 1084 (N.D.

17 Cal. 2023), motion to certify appeal denied, No. 22-CV-03580-WHO, 2024 WL 4375776 (N.D.

18 Cal. Oct. 2, 2024) (“defendants acted intentionally by refusing to stop the data transfer or employ

19 a stronger filter mechanism”). Here, Plaintiffs allege that Defendant is obligated by law to

20 maintain reasonable data security systems. (CCAC ¶ 165.) Despite this obligation, Twitter

21 allegedly “took minimal action despite knowing about its inadequate security measures. …

22 Twitter’s security regime was woefully insufficient (and Twitter was callously ignoring dangerous

23 vulnerabilities in its data security apparatus at the very time it was purportedly disclaiming any

24 liability for these vulnerabilities), rendering the disclaimer and limitation clauses unconscionable.”

25 (CCAC ¶ 166.)

26 Thus, in light of Plaintiffs’ allegations of intentional conduct, the Court finds that the TOS

27 is unconscionable, such that the negligence and contract claims are actionable. The Court further

1 Doe v. Meta Platforms, Inc., Defendant may move to limit the damages available “on summary

2 judgment or at another appropriate juncture.” 690 F. Supp. 3d at 1085.

3 ii. First, Second, and Fifth Causes of Action: Contract Claims

4 Plaintiffs first, second, and fifth causes of action are for breach of contract, breach of

5 implied contract, and unjust enrichment. (CCAC ¶¶ 176-215, 244-254.)

6 a. Unjust Enrichment

7 As an initial matter, Defendant briefly moves to separately dismiss the unjust enrichment

8 claim due to the existence of the TOS, which is a valid contract. (Def.’s Mot. at 25.) Unjust

9 enrichment is considered to be quasi-contract claim, which may be pled in the alternative at this

10 juncture. See Doe v. Meta Platforms, Inc., 690 F. Supp. 3d at 1086. Thus, the Court denies the

11 motion as to the unjust enrichment claim.

12 b. Express Contract Claim

13 In regard to the express contract claim, the parties agree that the User Agreement consists

14 of the TOS, Privacy Policy, “Rules and Policies,” and “incorporated policies.” (CCAC ¶ 38; Def.’s

15 Mot. at 10.)

16 Defendant argues that the express breach of contract claim should be dismissed because

17 Plaintiffs fail to identify a single promise in the User Agreement that Twitter breached. (Def.’s

18 Mot. at 10.)

19 In opposition, Plaintiffs contend that blog posts and website statements are also

20 incorporated into the User Agreement and are actionable representations that further evidence the

21 promises Twitter made to users. (Pls.’ Opp’n at 11; see also CCAC ¶¶ 177-178, 182. 193-197.)

22 Thus, Plaintiffs contend that “Twitter’s representations and promises made on its website and

23 public blog related to Twitter’s Privacy Policy, regarding the safety and security of PII and were

24 also incorporated into Twitter’s User Agreement with Plaintiffs and the Class.” (CCAC ¶ 178.)

25 The Court disagrees. Nowhere in the User Agreement are these statements referenced or

26 cited. In fact, the portion of the Privacy Policy Plaintiffs appear to cite is a list of links below the

27 end of the document. (See RJN, Ex. 4-2 at 10-11.) As a result, the user is not guided to the other

1 the bottom of the same webpage, rather than in the body of the Agreement. But see Brown v.

2 Google LLC, 685 F. Supp. 3d 909, 929-30 (N.D. Cal. 2023) (quoting Shaw v. Regents of

3 University of California, 58 Cal.App.4th 44, 54, 67 Cal.Rptr.2d 850 (1997)) (found certain

4 documents were incorporated due to embedded hyperlinks in the body of the privacy policy).

5 Moreover, Plaintiffs conflate the Privacy Policy’s promise of not disclosing users’

6 information to third parties without their consent with a promise to maintain adequate data

7 security measures. (See Pls.’ Opp’n at 12 (citing CCAC ¶¶ 184-185.) This is simply not the same,

8 as “disclosure” is tantamount to selling user information. See Bass v. Facebook, Inc., 394 F. Supp.

9 3d 1024, 1038 (N.D. Cal. 2019) (Using social media is not “cost-free,” because “[t]he user incurs

10 the cost of having his information mined and shared.”) Thus, there are no express promises made

11 in the User Agreement regarding data security.

12 Accordingly, the Court finds that the statements and blog posts are not incorporated into

13 the User Agreement, which requires that the first cause of action for breach of contract be

14 dismissed with prejudice.

15 c. Implied Contract Claim

16 Without providing any analysis or cogent argument, Defendant moves to dismiss the

17 implied contract claim presumably based on the same rationale as the express contract claim—

18 namely that Plaintiffs fail to identify a single promise in the User Agreement that Twitter

19 breached. (See Def.’s Mot. at 10.)

20 In opposition, Plaintiffs argue that Defendant failed to analyze Plaintiffs’ allegations under

21 an implied contract standard, which does not require a single express written promise or contract,

22 but can be inferred through a series of documents, statements, and website representations. (Pl.’s

23 Opp’n at 11 (citing In re Pepperdine Univ. Tuition & Fees COVID-19 Refund Litig., 659 F. Supp.

24 3d 1086, 1094 (C.D. Cal. 2023)).) While the Court agrees that Defendant has waived any

25 argument in reply by failing to address this issue in the initial motion, California law supports the

26 existence of an implied contract so long as the implied terms do not vary from the express terms.

27 In re Pepperdine, 659 F. Supp. 3d at 1093.

1 ‘give effect to the mutual intention of the parties as it existed at the time the contract was

2 executed.’” In re Pepperdine, 659 F. Supp. 3d at 1094 (quoting Kashmiri v. Regents of Univ. of

3 California, 156 Cal. App. 4th 809, 831-832 (2007), as modified (Nov. 15, 2007), as modified

4 (Nov. 28, 2007)). In In re Pepperdine, the court found that a reasonable jury could find, based on

5 Pepperdine’s representations on its website and academic catalogs, that the parties intended to

6 contract for in-person classes. In re Pepperdine, 659 F. Supp. 3d at 1094. There, Pepperdine

7 offered online-only degrees, and some of those programs did not allow online-only students to

8 register for in-person classes and vice versa. Id.

9 Here, Twitter’s User Agreement provides how Defendant would or would not use

10 Plaintiffs’ user data and how Plaintiffs could control their data’s disclosure. On its website,

11 Twitter made numerous representations regarding the security and privacy of Plaintiffs’ user data,

12 including its representation that it is “committed to protecting the information you share with us”

13 on its Security and Privacy Webpage; representing that its “security procedures strictly limit

14 access to and use of users’ personal information and require that each of us take measures to

15 protect user data from unauthorized access” in its Code of Business Conduct and Ethics; and

16 representing that “[p]rotecting and defending user privacy is at the heart of our work.” (CCAC ¶¶

17 43, 56, 70, 192.) Plaintiffs, therefore, signed up for Twitter with the understanding that Twitter

18 would protect their PII, and they trusted the company to so. At the pleadings stage, these promises

19 to protect users’ PII are sufficient to establish the existence of an implied contract, and Twitter’s

20 alleged failure to safeguard that information is sufficient to state a claim for its breach.

21 Accordingly, the motion is denied as to the second cause of action for breach of implied

22 contract.

23 iii. Third and Fourth Causes of Action: Negligence claims

24 Plaintiffs’ third and fourth causes of action are for negligence and gross negligence.

25 (CCAC ¶¶ 216-243.)

26 In the prior order, the Court found that Plaintiffs sufficiently alleged a claim for gross

27 negligence and found that the negligence claim would similarly survive “should Plaintiffs

1 Since the TOS is unenforceable for unconscionability reasons, the Court incorporates the

2 prior order as if set forth fully herein, and denies the motion as to the negligence claims.

3 iv. Sixth Cause of Action: Unfair Competition Law, Bus. & Prof. Code § 17200

4 In order to establish standing for the UCL Claim, plaintiffs must show that they personally

5 lost money or property “as a result of the unfair competition.” CAL. BUS. & PROF. CODE § 17204;

6 Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 330 (2011). Under California law:

[t]here are innumerable ways in which economic injury from unfair

7 competition may be shown. A plaintiff may (1) surrender in a

transaction more, or acquire in a transaction less, than he or she

8 otherwise would have; (2) have a present or future property interest

diminished; (3) be deprived of money or property to which he or she

9 has a cognizable claim; (4) be required to enter into a transaction,

costing money or property, that would otherwise have been

10 unnecessary.

11 Kwikset, 51 Cal. 4th at 323.

12 Here, Plaintiffs allege that they failed to receive the benefit of their bargain with Twitter.

13 (CCAC ¶ 272.) If either harm is plausibly alleged, Plaintiffs would satisfy the standing

14 requirement for this cause of action. Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1040 (N.D.

15 Cal. 2019).

16 Plaintiffs allege economic injury based on “benefit of the bargain.” (See Pls.’ Opp’n at 20-

17 21.) Business and Professions Code § 22576 prohibits “an operator of a commercial website” that

18 collects PII from consumers from violating “its posted privacy policy.” Plaintiffs argue that they

19 have UCL standing based on a breach of the contractual privacy protections governing the sales in

20 violation of Section 22576. (Id.; see also CCAC ¶¶ 270, 272.) Thus, Plaintiffs have standing so

21 long as they have adequately alleged that Defendant breached the terms of its privacy agreement.

22 See In re Anthem, Inc. Data Breach Litig., No. 15-md-2617-LHK, 2016 WL 3029783, at *13, *30

23 (N.D. Cal. 2016) (finding defendant’s breach of privacy policies incorporated into customers’

24 insurance contracts deprived plaintiffs of the benefit of their bargain and caused economic injury

25 sufficient to establish UCL standing). As discussed above, Plaintiffs’ express breach of contract

26 claim for violations of the privacy policy is not actionable, which does not satisfy the harm

27 requirement for the UCL claim. See discussion, supra, Part III.B.ii.b.

1 monitoring that would not otherwise been unnecessary if not for the Data Breach. (PI.’s Opp’n at

2 || 21 (citing CCAC ¥ 273.) Courts have found that such allegations are sufficient to establishing

3 standing to pursue a UCL claim. See In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-

4 || MD-02752-LHK, 2017 WL 3727318, at *22 (N.D. Cal. Aug. 30, 2017).

5 Thus, the motion is denied as to the sixth cause of action.

6 v. Seventh Cause of Action: Declaratory Judgment

7 The seventh cause of action is for declaratory judgment. (CCAC ff] 275-284.)

8 Specifically, Plaintiffs allege that Twitter’s data security measures remain inadequate, and they

9 || seek a declaratory judgment that Twitter owes a legal duty to secure consumers’ PII and to timely

10 || notify them of a data breach, and that it continues to breach that duty by failing to employ

11 reasonable measures to secure consumers’ PIT. (CCAC J 277-280.)

12 Defendant acknowledges that this cause of action merely requires a predicate claim.

5 13 (Def.’s Mot. at 25.) Several of Plaintiffs’ claim are sufficiently pled. Furthermore, a dispute

14 || exists as to the continued risk Plaintiffs and similarly situated users face, rendering the dismissal

3 15 of the declaratory judgment claim premature. See Bass v. Facebook, Inc., 394 F. Supp. 3d 1024,

a 16 1040 (N.D. Cal. 2019).

3 17 Accordingly, the motion to dismiss is denied as to the seventh cause of action.

18 IV. CONCLUSION

19 For the reasons set forth above, Defendant’s motion to dismiss is GRANTED IN PART

20 || AND DENIED IN PART. The motion is granted with prejudice as to the first cause of action for

21 breach of contract. It is denied in all other respects.

22 Defendant shall file an answer within 21 days.

23 IT IS SO ORDERED.

24 || Dated: December 18, 2024

26 Unitet States Magistrate Judge

27

28