Q.J. v. PowerSchool Holdings LLC

IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

Q.J., individually and on behalf of all others )

similarly situated, )

)

Plaintiff, )

) Case No. 23 C 5689

v. )

) Judge Jorge Alonso

POWERSCHOOL HOLDINGS, LLC, )

HOBSONS, INC., HEAP, INC., and )

BOARD OF EDUCATION OF THE CITY )

OF CHICAGO, )

)

Defendants, )

)

MEMORANDUM OPINION AND ORDER

In this putative class-action data-privacy case, Plaintiff, Q.J., alleges that Defendants,

PowerSchool Holdings, LLC, its predecessor Hobsons, Inc., Heap, Inc., and the Board of

Education of the City of Chicago, failed to protect personal data exposed by and through Plaintiff’s

use of Naviance, an online higher education preparedness platform available to students enrolled

in Chicago public schools. Now before the Court are Defendants’ motions to dismiss for failure to

state a claim and lack of personal jurisdiction and Plaintiff’s motion for appointment as interim

class counsel. For the following reasons, Heap, Inc.’s motion to dismiss for lack of personal

jurisdiction is granted, the remaining defendants’ motion to dismiss for failure to state a claim is

granted in part and denied in part, and Plaintiff’s motion for appointment of interim class counsel

is denied without prejudice.

Background

In the years leading up to the filing of this lawsuit, Plaintiff, Q.J., was a student enrolled in

the Chicago Public Schools system, governed and operated by Defendant, the Board of Education

of the City of Chicago (hereafter, “CPS”). CPS contracted with Defendant PowerSchool Holdings

LLC (“PowerSchool”)—formerly known as Hobsons, Inc. (“Hobsons”)—to provide its students

with access to PowerSchool’s Naviance platform. Naviance helps students prepare for higher

education by providing them with tools for assessing their strengths and interests, facilitating their

research into higher education institutions and programs, and fostering communication and

collaboration among students, their schools, their families, and their institutions of interest. CPS

first obtained access to Naviance by entering into what Plaintiff’s complaint refers to as the “Initial

Contract” with Hobsons in 2015. In 2020, after PowerSchool acquired Hobsons, the “Initial

Contract” was replaced and superseded by a “Subsequent Contract” for Naviance between CPS

and PowerSchool. Use of Naviance was mandatory for all CPS students. PowerSchool and

Hobsons (collectively, “PowerSchool”) obtained personal student data, including identifying

information such as names, birthdates, contact information, and addresses, as well as education

information such as grade point averages, test scores, schools attended and courses taken, through

students’ use of the Naviance platform.

PowerSchool allegedly configured the platform to track Naviance users on an

individualized basis, including by engaging various software providers to track, analyze, and

organize data obtained from Naviance users. One of those software providers was Defendant Heap,

Inc. (“Heap”), a Delaware corporation with its principal place of business in California. Heap is a

software-as-a-service provider offering code that permits the collection of data via a feature known

as Autocapture. A website operator can install Heap’s data analytics platform, which includes

Autocapture, by embedding and integrating Heap’s code into its website. By doing so, the website

operator can “automatically capture the user interactions on [the] site, from the moment of

2

installation forward,” including “every click, swipe, tap, pageview and fill.” (1st Am. Compl. ¶

116, ECF No. 118.) PowerSchool incorporated Heap’s software into Naviance. This allegedly

results in the interception of confidential student communications and collection of confidential

student data that students and their families expect to remain private when students use Naviance.

The operative First Amended Complaint contains nineteen counts, in which Plaintiff

asserts the following claims, on behalf of himself and all others similarly situated. First, in Counts

One, Seven, Eight, Nine, and Fourteen, Plaintiff asserts that Defendants violated numerous state

and federal statutes by improperly obtaining and/or disclosing his sensitive personal information.

These statutes include the Electronic Communications and Privacy Act (“ECPA”), 18 U.S.C.

§ 2511(a); the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 631 & 632; the

Stored Communications Act (“SCA”), 18 U.S.C. § 2702(a)(1); the Illinois Eavesdropping Act

(“IEA”), 720 ILCS 5/14-1; and the Illinois School Student Records Act (“ISSRA”), 105 ILCS

10/6. In Counts Two through Six, Plaintiff asserts that PowerSchool, Heap, and their employees,

acting under color of law by way of their contractual relationship with CPS, violated 42 U.S.C.

§ 1983 by improperly obtaining and/or disclosing student data, in violation of the Fourth

Amendment prohibition on unreasonable searches. In Counts Eleven, Twelve, Thirteen, and

Sixteen,1 Plaintiff asserts common-law claims of intrusion upon seclusion against Heap; breach of

contract against PowerSchool; and unjust enrichment against PowerSchool and Heap. Finally, in

1 The unjust enrichment count is mislabeled as Count Sixteen, although it is actually the fifteenth

count asserted in the complaint.

3

Counts Sixteen through Nineteen, Plaintiff asserts that Defendants are liable for the actions of their

agents under a respondeat superior theory.2

Analysis

Because jurisdiction is always a “threshold” issue, which deserves consideration before

others to ensure that the Court “makes no assumption of law-declaring power” in excess of

constitutional constraints, Ruhrgas AG v. Marathon Oil Co., 526 U.S. 574, 583-84 (1999) (internal

quotation marks omitted), the Court begins with Heap’s motion to dismiss for lack of personal

jurisdiction. Then, the Court takes up PowerSchool’s motion to dismiss for failure to state a claim,

in which CPS joins. Finally, the Court considers Plaintiff’s motion for appointment of interim class

counsel.

I. Personal Jurisdiction

A motion to dismiss pursuant to Rule 12(b)(2) tests whether a federal court has personal

jurisdiction over a defendant. Central States v. Phencorp. Reins Co., 440 F.3d 870, 875 (7th Cir.

2006); Fed. R. Civ. P. 12(b)(2). Plaintiffs need not plead facts establishing personal jurisdiction in

their complaint, but “once the defendant moves to dismiss . . . for lack of personal jurisdiction, the

plaintiff bears the burden of demonstrating the existence of jurisdiction.” Purdue Rsch. Found. v.

Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003). For purposes of a Rule 12(b)(2) motion

2 Defendants purport to move to dismiss these counts, but the parties seem to agree that they do

not contain any independent claims. Plaintiff responds that he sets out his respondeat superior

theory in separate counts in an abundance of caution, to ensure that Defendants are on notice of all

theories of liability on which he may rely. With that understanding, the Court “do[es] not dismiss

th[ese] count[s], but simply clarif[ies]” that they are not independent claims. Strzykalski v. Bd. of

Educ. of Summit Hill Sch. Dist. 161, No. 23 CV 1284, 2024 WL 580012, at *6 (N.D. Ill. Feb. 13,

2024).

4

supported only by written materials, in the absence of an evidentiary hearing, the plaintiff’s burden

of proof is met by “a prima facie showing” of personal jurisdiction. Id.

To determine whether the plaintiff has met its burden, the court may consider affidavits

from both parties. Felland v. Clifton, 682 F.3d 665, 672 (7th Cir. 2012). “[O]nce the defendant has

submitted affidavits or other evidence in opposition to the exercise of jurisdiction, the plaintiff

must go beyond the pleadings and submit affirmative evidence supporting the exercise of

jurisdiction.” Purdue, 338 F.3d at 783. “When affidavits regarding the issue of personal

jurisdiction are submitted, the district court may weigh the affidavits,” accepting as true “any facts

in the defendants’ affidavits that do not conflict with . . . [the plaintiff’s] submissions.” Curry v.

Revolution Lab’ys, LLC, 949 F.3d 385, 393 (7th Cir. 2020). Courts must resolve factual disputes

in the plaintiff’s favor, but “accept as true any facts contained in the defendant’s affidavits that

remain unrefuted by the plaintiff.” GCIU-Emp. Ret. Fund v. Goldfarb Corp., 565 F.3d 1018, 1020,

1020 n.1 (7th Cir. 2009).

“Because this case involves claims under both federal law and state law, the district court’s

jurisdiction rest[s] on a federal question, 28 U.S.C. § 1331, and supplemental jurisdiction, 28

U.S.C. § 1367.” Curry, 949 F.3d at 393. “In a case involving federal question jurisdiction, a federal

court has personal jurisdiction over the defendant if either federal law or the law of the state in

which the court sits authorizes service of process to that defendant.” Id. (internal quotation marks

omitted). The parties do not address whether the federal statutes Plaintiff has invoked authorize

nationwide service of process, apparently assuming that they do not, and that Heap is therefore

subject to personal jurisdiction “under the laws of the state where the forum is located.” See

Kinslow v. Pullara, 538 F.3d 687, 690 (7th Cir. 2008) (“Though some federal statutes expressly

5

provide rules for service of process . . . § 1983 is not one of them.”). The Court assumes the parties

are correct and considers them to have waived any argument to the contrary.

Therefore, Heap is subject to personal jurisdiction to the extent “authorized both by Illinois

law”—in particular, the Illinois long-arm statute, 735 ILCS 5/2–209(c)—“and by the United States

Constitution.” be2 LLC v. Ivanov, 642 F.3d 555, 558 (7th Cir. 2011) (citing Fed. R. Civ. P.

4(k)(1)(A)). Because the Illinois long-arm statute permits the exercise of personal jurisdiction “to

the full extent permitted by the Fourteenth Amendment’s Due Process Clause,” Tamburo v.

Dworkin, 601 F.3d 693, 700 (7th Cir. 2010), there is “no operative difference between these two

constitutional limits,” Mobile Anesthesiologists Chicago, LLC v. Anesthesia Assocs. of Houston

Metroplex, P.A., 623 F.3d 440, 443 (7th Cir. 2010), so a single inquiry suffices. “The key question

is . . . whether the defendants have sufficient ‘minimum contacts’ with Illinois such that the

maintenance of the suit ‘does not offend traditional notions of fair play and substantial justice.’”

Tamburo v. Dworkin, 601 F.3d 693, 700-01 (7th Cir. 2010) (quoting Int’l Shoe Co. v. Washington,

326 U.S. 310, 316 (1945)).

The nature of the defendant’s contacts with the forum state determines what framework

courts use to analyze whether they meet minimum requirements. See Tamburo, 601 F.3d at 701.

A defendant is subject to “general jurisdiction” in the forum state if its contacts are so “continuous

and systematic” that it can be “regarded as at home” there. See Goodyear Dunlop Tires Operations,

S.A. v. Brown, 564 U.S. 915, 924 (2011); Kipp v. Ski Enter. Corp. of Wis., 783 F.3d 695, 698 (7th

Cir. 2015). But no party contends that Heap, a Delaware corporation with its principal place of

business in California, can be regarded as at home in Illinois; plainly, general jurisdiction does not

apply. That means that personal jurisdiction depends on “specific jurisdiction,” i.e., whether Heap

6

“purposely availed itself of the privilege of conducting business in the forum state or purposefully

directed its activities at the forum state,” and whether Plaintiff’s injury arose out of those forum-

related activities. Lexington Ins. Co. v. Hotai Ins. Co., Ltd., 938 F.3d 874, 878 (7th Cir. 2019)

(cleaned up).

To establish specific jurisdiction, the plaintiff “‘cannot be the only link between the

defendant and the forum.’” Advanced Tactical Ordnance Sys., LLC v. Real Action Paintball, Inc.,

751 F.3d 796, 802 (7th Cir. 2014) (quoting Walden v. Fiore, 571 U.S. 277, 276 (2014)). “Due

process requires that a defendant be haled into court in a forum State based on his own affiliation

with the State, not based on the random, fortuitous, or attenuated contacts he makes by interacting

with other persons affiliated with the State.” Walden, 571 U.S. at 286 (internal quotation marks

omitted). The Seventh Circuit has “consistently . . . declined to fashion a special jurisdictional test

for Internet-based cases”; instead, it makes the same “traditional due process inquiry” it makes in

all other contexts. Curry, 949 F.3d at 398 (internal quotation marks omitted). Thus, to determine

whether certain “online activity translates into ‘contacts’ for purposes of the ‘minimum contacts’

analysis,” district courts are to assess whether the defendant “purposefully exploited” or “targeted”

the forum state somehow. Advanced Tactical, 751 F.3d at 802-03 (internal quotation marks

omitted). It is settled that “simply operating a website accessible in the forum state” does not

amount to targeting a jurisdiction, such that the defendant is subject to personal jurisdiction there.

Id. at 802. Similarly, sending blast emails to a list of all past customers does not subject a defendant

to personal jurisdiction in any state where any such customer might be found; “[s]uch a relation

would be entirely fortuitous, depending entirely on activities out of the defendant’s control.” Id. at

803.

7

Plaintiff argues that this case is different from the typical internet-based case because Heap

installed “cookies,” which are files on a user’s device that store metadata about the user, here

including distinct User IDs, in the devices of Illinois-based users. But even if there is any

meaningful distinction to be made on this ground, Plaintiff has not adduced evidence to

substantiate it. Heap has submitted a declaration from David Fullerton, its Senior Vice President

of Engineering, to establish that Heap does not directly install software on end users’ devices; the

installation of cookies is a function of Heap software that website operators—Heap’s customers—

integrate into their platforms. (Fullerton Decl. ¶ 4, ECF No. 167-1.) According to Mr. Fullerton,

this process is automated, Heap has no control over where its customers’ website users might be

found, and Heap has made no effort to target Illinois or any other jurisdiction; it simply provides

its software to website operators who want it. (Id. ¶¶ 5-6, 8.) The installation of cookies is thus

“fortuitous” and depends on “activities out of [Heap’s] control,” just like the sending of blast

emails in Advanced Tactical. See Castelaz v. Estee Lauder Companies., Inc., No. 22 CV 5713,

2024 WL 136872, at *4-5 (N.D. Ill. Jan. 10, 2024); Mayhew v. Candid Color Sys., Inc., 743 F.

Supp. 3d 994, 1004-05 (S.D. Ill. 2024).

Plaintiff attempts to support his position with only the bare allegations of the complaint

concerning installation of cookies (see 1st Am. Compl. ¶¶ 42-43) and certain deposition testimony

of Vijay Umapathy, Heap’s Senior Director of Product Management. He must go beyond the

pleadings, so citing the complaint allegations gets him nowhere, and Mr. Umapathy’s deposition

testimony does not refute the evidence Heap has adduced.

True, Mr. Umapathy made certain statements that, viewed in isolation, may seem to create

a factual dispute as to whether Heap reaches out to Illinois users on its own. For example, when

8

asked whether “Heap, in connection with the Heap platform, installs cookies on users’ devices,”

he answered, “Yes.” (Umapathy Dep. at 36:19-21, ECF No. 156-1 at 20.) But immediately

afterward, when asked, “How does Heap do that,” he answered, “I’m not familiar with the

technical details.” (Id. at 36:22-23.) Mr. Umapathy is not an engineer or developer, and his job is

not coding or programming; he explained that, as a product manager, he assesses and devises plans

for adding capabilities to the Heap analytics platform from the standpoint of customer needs. And

he confirmed that the Heap platform must first be installed on a customer website before its

tracking abilities come into play, which is consistent with Mr. Fullerton’s declaration stating that

installation of cookies is an automated function of Heap-enabled websites, not a function Heap

deliberately performs. (Umapathy Dep., ECF No. 156-1, at 27, 37.) While the Court must resolve

any conflict in the evidence in Plaintiff’s favor at this stage, it may not manufacture a conflict by

reading more into Mr. Umapathy’s deposition transcript than is there. See Salkauskaite v. Sephora

USA, Inc., No. 18-CV-08507, 2020 WL 2796122, at *5 (N.D. Ill. May 30, 2020) (ruling that

deposition testimony taken during jurisdictional discovery did not support the plaintiff’s theory of

personal jurisdiction); see also Tianjin Universal Link Enters., Ltd. v. Midwest Contracting

Concepts, Inc., No. 16 C 08352, 2017 WL 4157702, at *6 (N.D. Ill. Sept. 19, 2017) (“[W]hile we

construe factual disputes in Plaintiff’s favor, the evidence [Plaintiff] offers in support of its prima

facie case relies on speculation and fails to draw a connection between [the defendant] and the

forum state.”). Taking the deposition testimony as a whole, it does not refute the statements in the

Fullerton Declaration unless the Court reads more into Mr. Umapathy’s testimony than he actually

said, which would amount to indulging in speculation.

“Both parties have had a sufficient opportunity to develop the record,” and Plaintiff has not

9

adduced evidence “indicat[ing[ that a hearing would be helpful,” so the Court resolves the

jurisdictional issue based on the documents the parties have submitted. See Initiatives Inc. v. Korea

Trading Corp., 991 F. Supp. 476, 477-78 (E.D. Va. 1997). Plaintiff has not made a prima facie

showing of personal jurisdiction because he has not shown that Heap purposely exploited or

targeted Illinois; to the contrary, any connections between Heap and Illinois appear to be merely

fortuitous. See Advanced Tactical, 751 F.3d at 802-03 Mayhew, 743 F. Supp. 3d at 1004-05;

Castelaz, 2024 WL 136872, at *4-5, Salkauskaite, 2020 WL 2796122, at *5.

Having concluded that Plaintiff has failed to show minimum contacts with Illinois, the

Court need not consider whether requiring Heap to litigate this suit in Illinois offends traditional

notions of fair play and substantial justice. N. Grain Marketing, LLC v. Greving, 743 F.3d 487,

496 (7th Cir. 2014). Heap’s motion to dismiss for lack of personal jurisdiction is granted.

II. Failure to State a Claim

A motion under Federal Rule of Civil Procedure 12(b)(6) tests whether the complaint states

a claim on which relief may be granted. Richards v. Mitcheff, 696 F.3d 635, 637 (7th Cir. 2012).

To state a claim, the plaintiff must “give the defendant fair notice of what the claim is and the

grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal

quotation marks and alteration marks omitted). Under this standard, a plaintiff’s “[f]actual

allegations must be enough to raise a right to relief above the speculative level.” Id. Stated

differently, the “complaint must contain sufficient factual matter, accepted as true, to ‘state a claim

to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting

Twombly, 550 U.S. at 570). “A claim has facial plausibility when the plaintiff pleads factual

content that allows the court to draw the reasonable inference that the defendant is liable for the

10

misconduct alleged.” Id. (citing Twombly, 550 U.S.at 556). The Court must “construe the

complaint in the light most favorable to plaintiff, accept all well-pleaded facts as true, and draw

reasonable inferences in plaintiff’s favor.” Taha v. Int’l Bhd. of Teamsters, Loc. 781, 947 F.3d 464,

469 (7th Cir. 2020). However, it need not “accept as true legal conclusions, or threadbare recitals

of the elements of a cause of action, supported by mere conclusory statements.” Brooks v. Ross,

578 F.3d 574, 581 (7th Cir. 2009). The Court may consider, “in addition to the allegations set forth

in the complaint itself, documents that are attached to the complaint, documents that are central to

the complaint and are referred to in it, and information that is properly subject to judicial notice.”

Williamson v. Curran, 714 F.3d 432, 436 (7th Cir. 2013).

Because the Court has concluded that it lacks personal jurisdiction over Heap, it need not

reach Heap’s arguments concerning failure to state a claim. That leaves PowerSchool’s motion to

dismiss, which CPS joins as to certain claims, namely, those in Counts One, Seven, Nine, Ten,

Fourteen, and Nineteen. Where the Court refers below to arguments made by PowerSchool, it shall

be understood that CPS adopts them as to the above-referenced claims, and the same reasoning

applies to both defendants. Additionally, where the court refers to “PowerSchool,” it shall be

understood to refer to collectively to PowerSchool and Hobsons; the Court agrees with

PowerSchool that, although Plaintiff asserts claims against Hobsons separately, it is pointless to

differentiate between PowerSchool and Hobsons, now that they have merged.

A. ECPA

Under the Electronic Communications Privacy Act (“ECPA”), any person who

“intentionally intercepts . . . or procures any other person to intercept any wire, oral or electronic

communication” may be subject to criminal or civil liability. 18 U.S.C. § 2511(1)(a), 18 U.S.C.

11

§ 2520. According to one of several exceptions, however, it is “not . . . unlawful . . . for a person .

. . to intercept a[n] . . . electronic communication where such person is a party to the

communication . . . unless such communication is intercepted for the purpose of committing any

criminal or tortious act.” 18 U.S.C. § 2511(2)(d) (emphasis added). PowerSchool argues that it is

not liable because (1) the party exception applies and (2) no “procure[r]” theory is available against

civil defendants. The Court is not convinced by either argument.

1. Section 2511(2)(d) Party Exception

PowerSchool argues that the exception in § 2511(2)(d) applies because PowerSchool was

a “party” to any “communication” between class members and Naviance, and, to whatever extent

PowerSchool “intercept[ed]” any such communications, it did not do so for any criminal or tortious

purpose. Plaintiff responds that PowerSchool “procure[d]” Heap and other third-parties to

“intercept” class members’ communications, and, even if it matters under that theory whether

PowerSchool was itself a “party” to those communications,3 PowerSchool is still liable because

the communications were intercepted for criminal or tortious purposes, namely, the use of

information that had been obtained from class members unlawfully.

3 At least one court has observed that the statutory language is at least fuzzy as to whether the party

exception applies when the defendant is sued under a procurer theory, rather than as the party who

intercepted the communications in question. In Mekhail v. North Memorial Health Care, 726 F.

Supp. 3d 916, 926 (D. Minn. 2024), the plaintiff argued “that only a direct interceptor can invoke

the party exception, and . . . no party exception applies in procurement and use scenarios.” The

court observed that “the statute’s plain language appears to support the interpretation that the party

exception was drafted with active interceptors[, not party procurers and users of others’

interceptions,] foremost in mind.” Id. However, the court did not decide the issue, finding no need

to reach it because it concluded that the plaintiff’s claim survived dismissal, even assuming that

the party exception applied. Id. at 926-28. Although this Court shares the Mekhail court’s concern,

Plaintiff does not raise the issue, and, as in Mekhail, the Court need not reach it because Plaintiff’s

claim survives dismissal, even if the Court assumes that the party exception applies, because the

crime/tort exception-to-the-exception also applies.

12

Both sides cite non-binding district court decisions in favor of their position. The Court

finds Plaintiff’s cases more persuasive, at least at this early stage. These cases reason that a

defendant who procures a third-party entity to intercept communications and obtain data from

users of the defendant’s website, when that data is protected from disclosure by law, is liable under

the crime/tort exception-to-the-exception. See A.D. v. Aspen Dental Mgmt., Inc., No. 24 C 1404,

2024 WL 4119153, at *3 (N.D. Ill. Sept. 9, 2024); Kurowski v. Rush Sys. for Health, No. 22 C

5380, 2023 WL 8544084, at *3 (N.D. Ill. Dec. 11, 2023); Mayer v. Midwest Physician Admin.

Servs., LLC, No. 23-CV-3132, 2025 WL 963779, at *3 (N.D. Ill. Mar. 31, 2025). K.L. v. Legacy

Health, No. 23-CV-1886, 2024 WL 4794657, at *6 (D. Or. Nov. 14, 2024). PowerSchool purports

to distinguish these cases based on how the defendants used the intercepted data and because they

concerned health data protected by HIPAA, the Health Insurance Portability and Accountability

Act, see 42 U.S.C. § 1320d-6, not educational data protected by other statutes, including ISSRA

and the Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g. Relevant

distinctions between HIPAA and the statutes that Plaintiff invokes in this case, or between the use

of the intercepted data in this case and in the cases Plaintiff cites, might appear at later stages of

the case. But at this early stage, the Court sees none, and it agrees with the reasoning of the above-

cited cases. The party exception does not warrant dismissal because it is at least plausible that the

crime/tort exception-to-the-exception applies.

2. Whether Defendants Can Be Liable As “Procur[ers]”

PowerSchool argues that it cannot be liable in this civil suit for “procur[ing]” the

interception of communications because the term “procure” does not appear in 18 U.S.C. § 2520,

the statutory provision that provides a private right of action under ECPA. That provision states,

13

in pertinent part, that “any person whose wire, oral, or electronic communication is intercepted,

disclosed, or intentionally used in violation of [ECPA] may in a civil action recover from the

person or entity . . . which engaged in that violation.” Id. The Fifth Circuit has adopted the

interpretation of ECPA that PowerSchool argues for, see Peavy v. WFAA-TV, Inc., 221 F.3d 158,

168 (5th Cir. 2000), but other courts have differed, reasoning that § 2520 broadly “allow[s] for

recovery against the ‘person or entity’ which engaged in the violation of § 2511(1)(a).” Boseovski

v. McCloud Healthcare Clinic, Inc., No. 16 CV 2491, 2020 WL 68578, at *6 (E.D. Cal. Jan. 7,

2020) (citing Lonegan v. Hasty, 436 F. Supp. 2d 419, 428 (E.D.N.Y. 2006)). The statute does not

specify any particular theory by which the “person or entity” must have violated the statute to be

subject to civil liability, nor is the Court aware of any reason, textual or otherwise, to read the

statute in such a restrictive fashion. Plaintiffs argue for reading the statute in accord with Boseovski

and like cases, and the Court agrees. Therefore, Defendants’ motion is denied as to the ECPA

claims in Count I.

B. Section 1983

PowerSchool argues that Plaintiffs’ § 1983 claims must be dismissed because PowerSchool

is not a state actor. The Civil Rights Act of 1871, 42 U.S.C. § 1983, provides that any person who

deprives another of constitutional rights “under color” of state law may be held liable in a civil suit

for causing the deprivation. “The ultimate issue in determining whether a person is subject to suit

under § 1983 is the same question posed in cases arising under the Fourteenth Amendment: is the

alleged infringement of federal rights ‘fairly attributable to the State?’” Rendell-Baker v. Kohn,

457 U.S. 830, 838 (1982) (quoting Lugar v. Edmondson Oil Co., 457 U.S. 922, 937 (1982)); see

Scott v. Univ. of Chicago Med. Ctr., 107 F.4th 752, 757 n.6 (7th Cir. 2024) (“The state action

14

requirement of the Fourteenth Amendment and the ‘under color of state law’ requirement of § 1983

are treated as identical.”)

There is no single test for determining whether the state-action requirement is met, but

“[t]he Supreme Court has recognized several scenarios when private entities will be considered

state actors for the purpose of a claim pursuant to § 1983.” Scott, 107 F.4th at 757. One such

scenario arises when “the state effectively directs, controls, or encourages” a private party’s

actions, whether by “‘exercis[ing] coercive power’” or “‘provid[ing] such significant

encouragement, either overt or covert, that the choice must in law be deemed to be that of the

State.’” Wade v. Byles, 83 F.3d 902, 905 (7th Cir. 1996) (quoting Blum v. Yaretsky, 457 U.S. 991,

1009 (1982)); see also Manhattan Cmty. Access Corp. v. Halleck, 587 U.S. 802, 809 (2019)

(explaining that, under Blum, 457 U.S. at 1009, “a private entity can qualify as a state actor . . .

when the government compels the private entity to take a particular action”). Other recognized

scenarios in which the state action requirement is met include the following:

Under the “joint action” or “conspiracy” theory, a private party who conspires with

the government to infringe on a plaintiff’s rights will be classified as a state actor.

Adickes v. S.H. Kress & Co., 398 U.S. 144, 152 (1970). So, too, will a party

performing a function that has traditionally been “the exclusive prerogative of the

State.” Jackson v. Metro. Edison Co., 419 U.S. 345, 353 (1974). Courts will also

find state action when a private party and the State are interdependent “to the point

of largely overlapping identity.” Brentwood Acad. v. Tenn. Secondary Sch. Athletic

Ass’n, 531 U.S. 288, 303 (2001).

Scott, 107 F.4th at 757 (internal citations altered). These scenarios “‘do not so much enunciate a

test or series of factors, but rather demonstrate examples of outcomes in a fact-based assessment,’”

which helps to organize the analysis. Id.

PowerSchool argues that it merely contracted with CPS to provide a service, and if doing

so made it a state actor under § 1983, then any government contractor is a state actor. See Rendell-

15

Baker, 457 U.S. at 840-41 (explaining that “many private corporations . . . depend[] primarily on

contracts . . . [with] the government,” but “[a]cts of such private contractors do not become acts of

the government by reason of their significant or even total engagement in performing public

contracts”). Plaintiff responds that his theory of state action finds support in several of the scenarios

the Supreme Court has recognized. The Court agrees with PowerSchool, however, that Plaintiff

does not state a claim in accord with any of the recognized theories of state action.

First, Plaintiff argues that PowerSchool acted under CPS’s direction and control when it

permitted CPS students to use and access the Naviance system at the cost of their personal data,

and there is a symbiotic relationship between them with respect to students’ access to the Naviance

system. In support of this argument, Plaintiff relies on Woods v. Maryville Academy, No. 17 C

8273, 2018 WL 6045219, at *6 (N.D. Ill. Nov. 19, 2018), and, to a lesser extent, Rodriguez v.

Plymouth Ambulance Service, 577 F.3d 816, 823 (7th Cir. 2009). These cases are not analogous.

They involve circumstances in which private entities have taken over the state’s responsibility to

care for inmates or children in the state’s custody. That custodial function, in a context in which

vulnerable people depend entirely on the state for their health and safety, is nothing like the

function at issue here, namely, handling student data.

Second, Plaintiff argues that CPS delegated a public function—educational

recordkeeping—to PowerSchool. But Plaintiff cites no authority establishing that CPS may have

delegated to PowerSchool a public function rising to the level of the “exclusive prerogative of the

State.” Rendell-Baker, 457 U.S. at 842 (cleaned up). CPS contracted with PowerSchool for a

service that required it to handle sensitive student data, but, as PowerSchool argues, the Supreme

Court has explained that providing education to high school students generally does not qualify as

16

an “exclusive” public function, and it follows that the element of that function at issue here—

handling their data—is likewise not an exclusive public function. See id. (“That a private entity

performs a function which serves the public does not make its acts state action.”).

Finally, Plaintiff argues that CPS conspired with PowerSchool to obtain student data in

violation of their constitutional rights. But Plaintiff makes no allegation plausibly suggesting a

“concerted effort between a state actor and” private individuals such as PowerSchool employees

to deprive students of their constitutional rights, nor is there any apparent “nexus between the state

and the private actors to support a finding that the deprivation committed by the private actor is

fairly attributable to the state.” L.P. v. Marian Cath. High Sch., 852 F.3d 690, 696 (7th Cir. 2017)

(cleaned up). To the contrary, the allegations are that CPS contracted with PowerSchool so that

PowerSchool would provide a service to CPS students, and in providing that service, PowerSchool

improperly obtained and disclosed sensitive student data. There is no allegation that CPS was

involved in the improper collection of sensitive data, nor that the improper elements of the

collection and use of data were essential to the agreement—or even foreseeable, from CPS’s point

of view. See id. at 696-97. There is no basis for attributing PowerSchool’s actions to CPS, nor, for

similar reasons, does Plaintiff plausibly allege that PowerSchool employees conspired with CPS

to deprive students of their constitutional rights. For all these reasons, the motion to dismiss is

granted as to the § 1983 claims against PowerSchool and its employees.

C. CIPA

CIPA imposes liability on anyone who, among other things, “intentionally taps, or makes

any unauthorized connection . . . with any . . . instrument,” or who “intentionally and without the

consent of all parties to a confidential communication, uses an electronic amplifying or recording

17

device to eavesdrop upon or record the confidential communication” of another. Cal. Penal Code

§§ 631, 632. Plaintiff claims that Heap eavesdropped on Plaintiff’s communications via Naviance,

using student data for its own purposes, and PowerSchool violated the statute by aiding or

conspiring with Heap in that endeavor. Defendants argue that this Court should dismiss the CIPA

claim because, as some district courts have held, a party to a conversation does not violate CIPA

by using a third-party’s data analytics software, where the use of the software represents only the

adoption of a tool—a virtual “tape recorder”—rather than the clandestine inclusion of a third-party

eavesdropper in the conversation. See, e.g., Graham v. Noom, Inc., 533 F. Supp. 3d 823, 832 (N.D.

Cal. 2021). Other decisions have differed where the data analytics vendor recorded the

communication itself, such that it was capable of using its record of the communication for its own

purposes, even if was engaged to do no more than make the recording. See Turner v. Nuance

Commc’ns, Inc., 735 F. Supp. 3d 1169, 1183 (N.D. Cal. 2024) (citing Javier v. Assurance IQ, LLC,

649 F. Supp. 3d 891, 900 (N.D. Cal. 2023)); Cody v. Ring LLC, 718 F. Supp. 3d 993, 1002 (N.D.

Cal. 2024). In response to the motion to dismiss, Plaintiff points to allegations of action by Heap

that make the reasoning of the latter cases more apposite here than the former. It is at least plausible

that Heap eavesdropped on Plaintiff’s communications, and that PowerSchool suborned the

eavesdropping, so Plaintiff’s CIPA claim survives the motion to dismiss.4 PowerSchool also

4 The Court notes that Plaintiff may not be able to substantiate these allegations, if his failure to

substantiate the allegations going to personal jurisdiction over Heap is any indication. But, under

Rule 12(b)(6), unlike under Rule 12(b)(2), the Court does not assess the evidence, nor does it ask

what is probable, as opposed to plausible; it “will ask itself could these things have happened, not

did they happen.” Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir. 2010); see Alexander v.

United States, 721 F.3d 418, 424 (7th Cir. 2013). Under this liberal standard, Plaintiff states a

claim.

18

attacks the CIPA claim on grounds of extraterritoriality, but, as the Court will discuss in more

detail below, that line of argument is likewise premature at this stage.

D. SCA

Under the Stored Communications Act, no “person or entity providing an electronic

communication service to the public” may “knowingly divulge to any person or entity the contents

of a communication while in electronic storage by that service.” 18 U.S.C. § 2702(a). PowerSchool

argues that (1) it does not provide an “electronic communication service to the public,” and (2) it

did not divulge student data while it was in “electronic storage by that service.” Neither argument

supports dismissal at this stage.

The first argument depends on whether PowerSchool provided its Naviance product “to

the public,” i.e., “to the community at large.” Andersen Consulting LLP v. UOP, 991 F. Supp.

1041, 1042 (N.D. Ill. 1998). PowerSchool contends that it did not because its Naviance product is

not available to any student who wants it; it is only available to students in school systems that

have contracted for student access to Naviance. But the Court fails to see why it matters whether

PowerSchool’s customers are school systems, rather than students. Whether its direct commercial

relationships are with students or schools, PowerSchool is in the business of providing Naviance

to students in school systems that pay for access to it, and presumably it will provide Naviance to

any school system that wants it. It is at least plausible that PowerSchool provides an electronic

communication service to the public, i.e., the community at large.

As for the second argument, the “electronic storage” that qualifies for protection under the

SCA is “temporary, intermediate storage of a wire or electronic communication incidental to the

electronic transmission thereof” or “storage of such communication by an electronic

19

communication service for purposes of backup protection of such communication.” 18 U.S.C.

§ 2510(17). PowerSchool argues that “electronic storage” of student data incidental to the use of

the Naviance system is not the sort of transitory “storage” that occurs during the transmission of

communications, so it is not the kind that the SCA protects. Some courts have found this line of

argument convincing, see, e.g., Wesch v. Yodlee, Inc., No. 20-CV-05991, 2021 WL 1399291, at

*4 (N.D. Cal. Feb. 16, 2021), and there may be some force in it, but it requires an assessment of

the evidence that is inappropriate at the pleading stage. It is at least plausible that Naviance

performs the sort of “electronic storage” that the SCA requires. The claim survives dismissal,

although PowerSchool may return to the issue at summary judgment, if the evidence supports its

position.

E. Extraterritoriality and IEA, ISSRA, and CIPA

PowerSchool argues that the IEA, ISSRA, and CIPA claims should all be dismissed

because these Illinois and California statutes do not apply to wrongful conduct that takes place in

other states. Plaintiff responds that the argument is premature at the pleading stage. The Court

agrees. Wilk v. Brainshark, Inc., 631 F. Supp. 3d 522, 528 (N.D. Ill. 2022) (“[C]ourts frequently

find it premature to dismiss claims at the pleading stage based upon the extraterritorial doctrine

given the doctrine’s fact-intensive inquiry.”); Cherkin v. PowerSchool Holdings, Inc., No. 24-CV-

02706-JD, 2025 WL 844378, at *7 (N.D. Cal. Mar. 17, 2025) (ruling that an extraterritoriality

challenge to CIPA claims was “premature and may be raised again at the class-certification stage

as the record and circumstances warrant”). It is at least plausible that these statutes apply

extraterritorially to Plaintiff or other class members; in-depth consideration of the issue is better

left for later stages of the case.

20

F. Breach of Contract

Plaintiff claims that PowerSchool breached both the Initial Contract and Subsequent

Contract by failing to protect his sensitive student data, and that he is entitled to enforce the

contracts as a third-party beneficiary.

“To succeed on a breach of contract claim, a plaintiff must plead and prove (1) the existence

of a valid and enforceable contract, (2) substantial performance by the plaintiff, (3) breach by the

defendant, and (4) damages caused by that breach.” Ivey v. Transunion Rental Screening Sols.,

Inc., 215 N.E.3d 871, 877 (Ill. 2022). A non-party is not entitled to sue to enforce a contract unless

he is “someone whom the parties intended to directly benefit by the performance of the contract,”

as evidenced by “the language of the contract and the circumstances surrounding its execution.”

Crawford v. Belhaven Realty LLC, 109 N.E.3d 763, 776 (Ill. App. Ct. 2018). “Because parties

typically enter into contracts to benefit themselves rather than third parties, there is a presumption

against intended beneficiary status that can only be overcome by an implication so strong as to be

practically an express declaration.” Id. (internal quotation marks omitted). But “if the promisee

bargains with the promisor to render a performance directly to a third party, in nearly every case

the promisee will have intended to benefit that third party.” Advanced Concepts Chicago, Inc. v.

CDW Corp., 938 N.E.2d 577, 581 (Ill. App. Ct. 2010). And “the contract does not need to

specifically name the third-party beneficiary as long as it adequately defines a class of individual

beneficiaries.” Crawford, 109 N.E.3d at 777.

Defendants argue that Plaintiff and students like him are not entitled to sue as third-party

beneficiaries of CPS’s contracts with PowerSchool for access to Naviance, arguing that there are

no terms in the contract that imply so strongly as to amount to an “express declaration” that the

21

parties intended to benefit Plaintiff and the other class members, rather than themselves. The Court

bears in mind, as Defendants argue, that “every contract made by the government is presumed to

be for the benefit of its citizens,” and it does not follow that the public has the right to enforce

every such contract. Hodges by Hodges v. Pub. Bldg. Comm’n of Chicago, 864 F. Supp. 1493,

1510 (N.D. Ill. 1994). But the fact remains that the contracts at issue required PowerSchool to

provide a service directly to students, see Crawford, 109 N.E.3d at 776 (citing Advanced Concepts,

938 N.E.2d at 581), and imposed certain obligations as to how PowerSchool protected student

data. Although, in the final analysis, it may turn out that students are mere “user[s],” see Fed. Ins.

Co. v. Turner Constr. Co., 660 N.E.2d 127, 132 (Ill. App. Ct. 1995), who lack rights as third-party

beneficiaries, Plaintiff has alleged at least enough facts, taken as true, to demonstrate a right to

relief that rises above the level of mere speculation. See Bayer HealthCare LLC v. Aeropres Corp.,

727 F. Supp. 3d 738, 752 (N.D. Ill. 2024). The briefing is thin on this issue, with the parties

occasionally arguing past each other, and the decision may turn on details and “surrounding

circumstances” that have not yet been fully aired at this early stage. ReceiverShip Mgmt., Inc. v.

A.J. Corso & Assocs., Inc., No. 19-CV-01385, 2021 WL 1222897, at *17 (N.D. Ill. Mar. 31, 2021)

(citing In re Chicago Flood Litig., No. 93 C 1214, 1993 WL 239041, at *9 (N.D. Ill. Jun. 28,

1993)). Here, again, the “prudent course is to permit the . . . claims to proceed, with the

understanding that Defendants may renew their argument at summary judgment.” Summerland v.

Exelon Generation Co., 510 F. Supp. 3d 619, 631 (N.D. Ill. 2020).

Defendants also argue that, even putting aside whether Plaintiff is entitled to enforce the

contract as a third-party beneficiary, he does not state a claim for breach of contract because the

contract permits the disclosure of data to “subcontractors” such as Heap. (See PowerSchool Mem.

22

Ex. 1, CPS/Hobsons Software and Servs. Agr., § 11, ECF No. 136-1 at 9-14.) Plaintiff responds

that the collection of data by Heap went much farther than the contract authorized or contemplated.

Again, the briefing is thin on this issue, without citations to case law, so the better course is to

allow the claims to proceed, at least until summary judgment, when PowerSchool may renew this

argument, if the evidence supports it.

G. Motion for a More Definite Statement

PowerSchool asks, in the alternative, for a more definite statement under Federal Rule of

Civil Procedure 12(e), to the extent Plaintiff asserts claims based on allegations of “other online

products,” in addition to Naviance, without providing any additional factual detail. A more definite

statement is not warranted in the present circumstances. Motions for more definite statement are

disfavored, particularly when they are “used to gain additional information,” rather than to correct

a pleading that is “unintelligible.” MacNeil Auto. Prods., Ltd. v. Cannon Auto. Ltd., 715 F. Supp.

2d 786, 790 (N.D. Ill. 2010) (internal quotation marks omitted). They “should not be used as a

substitution for discovery,” Coleman v. Majestic Star Casino, LLC, No. 2:11-CV-391-PPS-PRC,

2012 WL 1424396, at *1 (N.D. Ind. Apr. 24, 2012), or “when the complaint merely lacks detail,”

Panah v. California Dep't of Corr. & Rehab., No. 14-CV-00166-BLF, 2015 WL 1263494, at *5

(N.D. Cal. Mar. 19, 2015); see Boswell v. Panera Bread Co., 91 F. Supp. 3d 1141, 1144 (E.D. Mo.

2015); Allstate Indem. Co. v. Dixon, 304 F.R.D. 580, 582 (W.D. Mo. 2015). Plaintiff’s complaint

23

is sufficiently specific to permit PowerSchool to frame a response, and doubts about the scope of

the claim can be resolved in discovery.

III. Motion for Interim Class Counsel

Under Federal Rule of Civil Procedure 23(g)(3), the Court may “designate interim counsel

to act on behalf of a putative class before determining whether to certify the action as a class

action.” “Interim class counsel might be appropriate where overlapping, duplicative, or competing

class suits are pending before a court, so that appointment of interim counsel is necessary to protect

the interests of class members.” Levey v. Concesionaria Vuela Compania de Aviacion, S.A.P.I. de

C.V., 529 F. Supp. 3d 856, 866 (N.D. Ill. 2021) (internal quotation marks omitted). Plaintiff seeks

appointment as interim class counsel based on other, overlapping cases against PowerSchool,

including the above-cited Cherkin action. PowerSchool opposes the motion, and the Court agrees

with PowerSchool that Plaintiff has not demonstrated that the sort of rivalry between prospective

counsels over substantially overlapping cases that would warrant the appointment of interim class

counsel exists here. See McFadden v. Nationstar Mortg. LLC, No. CV 20-166 (EGS), 2022 WL

18542489, at *3 (D.D.C. Mar. 31, 2022). The purportedly related cases that Plaintiff relies on

appear to present mostly distinct issues, and the Court considers appointment of interim class

counsel to be premature. Plaintiff may re-raise the matter in the future, if circumstances change.

Conclusion

For the foregoing reasons, Plaintiff’s motion for appointment of interim class counsel [125]

is denied; Heap’s motion to dismiss for lack of personal jurisdiction [134] is granted; and

PowerSchool/CPS’s motion to dismiss for failure to state a claim [135] is granted in part and

denied in part. The motion is granted as to the claims asserted under 42 U.S.C. § 1983; it is

24

otherwise denied. Plaintiff's motion to seal [154] is granted because the redactions are minimal

and they appropriately protect certain limited confidential information, while leaving the substance

of the dispute open to public view.

SO ORDERED. ENTERED:

JORGE L. ALONSO

United States District Judge

25