Sifuentes v. X Corp.

[3] 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA [6] DAVID ANGEL SIFUENTES, 7 Case No. 24-cv-00590-SK Plaintiff, [8] v. ORDER GRANTING DEFENDANT’S 9 MOTION TO DISMISS AND X CORP., INC., DISMISSING WITH PREJUDICE [10] Defendant. Regarding Docket No. 37 [11] 12 Plaintiff David Angel Sifuentes, III (“Plaintiff”), proceeding pro se, brings claims under 13 state law arising from three alleged data breaches that compromised Plaintiff’s account 14 information stored with Defendant X Corp., Inc., formerly Twitter, Inc (“Defendant”). (Dkt. No. 15 32.) This matter comes before the Court upon consideration of Defendant’s motion to dismiss. 16 (Dkt. No. 37.) This Court has jurisdiction pursuant to 28 U.S.C. § 1332 . Both parties consented 17 to magistrate judge jurisdiction. (Dkt. Nos. 9, 28.) Having carefully considered the parties’ 18 papers, relevant legal authority, and the record in the case, the Court hereby GRANTS 19 Defendant’s motion for the reasons set forth below. 20 BACKGROUND 21 A. Factual Allegations. 22 The operative complaint is Plaintiff’s Second Amended Complaint. (Dkt. No. 32.) The 23 Court accepts the Second Amended Complaint’s allegations as true for the purposes of this 24 motion. 25 Plaintiff is a Michigan resident. (Id. at ¶ 2.) Defendant, a California corporation, operates 26 the social media platform, X, formerly Twitter.1 (Id. at ¶ 3.) Plaintiff created an X account in [27] 1 2011. (Id. at ¶ 2.) Plaintiff’s email address, name, IP address, location, and Facebook account 2 were linked to his X account. (Id.) In addition, Plaintiff used the same password that he used for 3 his other online accounts, including bank accounts. (Id.) 4 Defendant suffered data breaches in 2016, 2021, and 2023 that exposed Plaintiff’s email 5 address and password. (Id. at ¶ 4.) Defendant never informed Plaintiff about the breaches. (Id. at 6 6.) Plaintiff first learned of the 2016 data breach in November 2020 through a report from Credit 7 Karma, a personal finance company. (Id. at ¶ 6.) Plaintiff investigated the breach and learned that 8 Defendant had concealed the breach and did not take any remedial actions. (Id.) In January 2021, 9 Plaintiff learned from Credit Karma that X had allegedly been breached again—the alleged breach 10 occurred that same month. (Id. at ¶ 6, Ex. A.) On December 13, 2023, Plaintiff received a 11 notification from MasterCard ID Theft Protection, an identity theft monitoring service, that X had 12 been breached a third time on January 5, 2023. (Id. at ¶ 6, Ex. B.) 13 As a result of the data breaches, information linked to Plaintiff’s X account was offered for 14 sale on the “dark web.” (Id. at ¶ 5.) “[H]ackers and cybercriminals” used Plaintiff’s exposed 15 email and password information to access his other online accounts, such as Spotify, Netflix, 16 PayPal, Bank of America, and Facebook. (Id. at ¶ 5.) Plaintiff has suffered damages in 17 connection with “the persistent risk of identity theft and fraud,” including emotional distress and 18 anxiety, time and expense spent monitoring credit reports and financial accounts, and “costs 19 associated with mitigating the risk of identity theft and fraud.” (Id. at ¶ 120-21.) 20 B. Causes of Action. 21 Plaintiff brings fourteen claims for relief, consisting of claims for: 22 (1) Negligence, (id. at ¶¶ 15-19), 23 (2) Breach of Contract, (id. at ¶¶ 20-27), 24 (3) Breach of Implied Contract, (id. at ¶¶ 28-34), 25 (4) Breach of Bailment, (id. at ¶¶ 35-40), 26 (5) Public Disclosure of Private Facts, (id. at ¶¶ 41-46), 27 (6) Negligent Infliction of Emotional Distress, (id. at ¶¶ 47-52), 1 (7) Intentional Infliction of Emotional Distress (“IIED”), (id. at ¶¶ 53-57),2 2 (8) Violation of the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code § 3 1798.100 et seq., (id. at ¶¶ 82-89),3 4 (9) Violations of California Civil Code sections 1798.29 and 1798.82, (id. at ¶¶ 90-97), 5 (10) Violation of the Michigan Identity Theft Prevention Act (“MITPA”), Mich. 6 Comp. Laws § 445.61 et seq., (id. at ¶¶ 98-105), 7 (11) Violation of the Michigan Consumer Protection Act, (“MCPA”), Mich. Comp. 8 Laws § 445.901 et seq., (id. at ¶¶ 106-112), 9 (12) Conversion, Cal. Civ. Code § 3336 , (id. at ¶¶ 113-114), 10 (13) Unjust Enrichment (id. at ¶¶ 115-16), and 11 (14) Negligence Per Se (id. at ¶¶ 117-19). 12 Plaintiff seeks $375,000 in emotional distress damages or “in the alternative an award of 13 $150,000,” $5 million in punitive damages, and injunctive relief. (Id. at ¶¶ 21-22.) 14 C. Procedural History. 15 Plaintiff is a frequent litigant, both in this Court and in Plaintiff’s home state of Michigan.4 16 The Court is aware of four actions that Plaintiff has filed against Defendant arising out of alleged 17 data breaches: two in the Western District of Michigan and two in this Court, before the 18 undersigned. 19 Plaintiff filed his first action against Defendant in the Western District of Michigan on 20 November 30, 2022. Sifuentes v. Twitter Inc., No. 22-cv-01128-RJJ-PJG (W.D. Mich. filed Nov. 21 30, 2022). Plaintiff’s complaint was similar to the Second Amended Complaint, except that he 22 only alleged injuries arising from the alleged 2016 data breach, not the alleged data breaches in 23 2021 or 2023, and that Plaintiff also brought claims under federal law. (22-cv-01128-RJJ-PJG, [24] 2 The Second Amended Complaint states a claim for “intentional and or neglect [sic] [25] infliction of emotional distress.” (Dkt. No. 32, ¶ 53.) As Plaintiff already brought a claim for negligent infliction of emotional distress, the Court construes Plaintiff’s seventh claim as one for [26] IIED. 3 The Second Amended Complaint numbers this as claim 11. (Dkt. No. 32, ¶ 82.) The [27] Court uses consecutive numbering and labels the CCPA claim as claim 8. 1 Dkt. No. 1.) The Court in the Western District of Michigan dismissed Plaintiff’s complaint with 2 prejudice because plaintiff failed to state a federal claim and the court declined to exercise 3 supplemental jurisdiction over the remaining state claims. (22-cv-01128-RJJ-PJG, Dkt. Nos. 19, 4 21, 22.) The court also denied Plaintiff’s motions for reconsideration, for relief from judgment, to 5 vacate the judgment, and to disqualify the involved judicial officers. (22-cv-01128-RJJ-PJG, Dkt. 6 Nos. 35, 40, 47.) 7 Plaintiff filed an additional complaint in the Western District of Michigan on September 8 15, 2023. Sifuentes v. Twitter Inc., No. 23-cv-00981-RJJ-PJG (W.D. Mich. filed Sep. 15, 2023). 9 This complaint was identical to the complaint filed on November 30, 2022. (23-cv-00981-RJJ10 PJG, Dkt. No. 2.) As relevant here, Plaintiff also filed a declaration with his complaint, which 11 included an exhibit, entitled “Exhibit A,” which is a printout from a communication between 12 Plaintiff and Credit Karma, LLC. (23-cv-00981-RJJ-PJG, Dkt. No. 4.) Credit Karma informed 13 Plaintiff that after investigating the alleged June 2016 breach, “it looks like [X]’s database wasn’t 14 actually breached, rather, the breached info was gathered from individual infected machines. To 15 put it simply: it’s likely that [X] wasn’t hacked, [sic] you were.” (Id.) 16 The Court in the Western District of Michigan dismissed Plaintiff’s complaint with 17 prejudice because the notice that X’s database “wasn’t actually breached” made it impossible for 18 Plaintiff to establish a plausible claim for data breach or to demonstrate the injury in fact and 19 traceability necessary for Article III standing. Sifuentes v. Twitter Inc., No. 23-cv-981, 2023 WL 20 7295186, at *2 (W.D. Mich. Nov. 6, 2023). The Court also denied Plaintiff’s motion to vacate 21 and for relief from judgment. (23-cv-00981-RJJ-PJG, Dkt. Nos. 17, 24.) Plaintiff filed two 22 notices of appeal, but he filed motions to dismiss his appeals voluntarily after the United States 23 Court of Appeals for the Sixth Circuit denied his motions for leave to proceed in forma pauperis. 24 (23-cv-00981-RJJ-PJG, Dkt. Nos. 14, 18, 20, 21.) The Court of Appeals for the Sixth Circuit 25 granted Plaintiff’s motions to dismiss his appeals voluntarily. (23-cv-00981-RJJ-PJG, Dkt. Nos. 26 22, 23.) Plaintiff filed an additional motion for relief from judgment on August 27, 2024, which 27 remains pending. (23-cv-00981-RJJ-PJG, Dkt. No. 25.) 1 No. 23-cv-1758-SK (N.D. Cal. filed Apr. 12, 2023). That complaint similarly alleged that 2 Plaintiff was harmed by a data breach of X, but it only referenced the alleged 2021 breach. (233 cv-1758-SK, Dkt. No. 7.) That case proceeded before the undersigned through a hearing on 4 Defendant’s motion to dismiss (23-cv-1758-SK, Dkt. No. 52); however, following the hearing, 5 Plaintiff voluntarily dismissed the matter in November 2023. (23-cv-1758-SK, Dkt. No. 55.) 6 Plaintiff filed this action on January 29, 2024, along with a motion to proceed in forma 7 pauperis. (Dkt. Nos. 1, 2.) The Court granted the application to proceed in forma pauperis and 8 dismissed the complaint with leave to amend pursuant to 28 U.S.C. § 1915 . (Dkt. No. 4.) After 9 Plaintiff filed his First Amended Complaint, the Court allowed his action to proceed. (Dkt. Nos. 10 7, 13.) Defendant filed a motion to dismiss, but the Court allowed Plaintiff to file a Second 11 Amended Complaint and dismissed the motion as moot. (Dkt. Nos. 18, 25, 27.) Defendant filed a 12 second motion to dismiss and accompanying request for judicial notice, which are currently before 13 the Court. (Dkt. Nos. 37, 38.) Plaintiff opposed the motion. (Dkt. No. 41.) Because the parties 14 did not discuss the issue of res judicata in the motion and opposition, the Court directed 15 Defendant to include a discussion of res judicata in its reply and allowed Plaintiff to file a sur16 reply. (Dkt. Nos. 46, 54, 56.) Defendant’s reply included a supplemental request for judicial 17 notice. (Dkt. No. 54-1.) Plaintiff filed several supplemental pleadings in addition to his 18 opposition and sur-reply, which violates the Court’s local rules and which the Court will not 19 consider. (Dkt. Nos. 43, 57, 58, 60, 61.) In its discretion, the Court determined to rule on this 20 motion without a hearing. (Dkt. No. 42.) 21 ANALYSIS 22 A. Applicable Legal Standard on Motion to Dismiss. 23 A motion to dismiss is proper under Federal Rule of Civil Procedure 12(b)(6) where the 24 pleadings fail to state a claim upon which relief can be granted. On a motion to dismiss under 25 Rule 12(b)(6), the Court construes the allegations in the complaint in the light most favorable to 26 the non-moving party and takes as true all material allegations in the complaint. Sanders v. 27 Kennedy, 794 F.2d 478, 481 (9th Cir. 1986) (per curiam). A plaintiff’s obligation to provide the 1 recitation of the elements of a cause of action will not do.” Bell Atlantic Corp. v. Twombly, 550 2 U.S. 544 , 555 (2007). Rather, a plaintiff must instead allege “enough facts to state a claim to 3 relief that is plausible on its face.” Id. at 570 . “The plausibility standard is not akin to a 4 ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted 5 unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 556). 6 “[A]s a general rule, a district court may not consider materials beyond the pleadings in 7 ruling on a Rule 12(b)(6) motion.” Skilstaf, Inc. v. CVS Caremark Corp., 669 F.3d 1005 , 1016 n.9 8 (9th Cir. 2012). However, documents subject to judicial notice, such as matters of public record, 9 may be considered on a motion to dismiss. See id. In considering such documents, the Court does 10 not convert a motion to dismiss into one for summary judgment. See id. “The court need not . . . 11 accept as true allegations that contradict matters properly subject to judicial notice . . . .” Sprewell 12 v. Golden State Warriors, 266 F. 3d 979, 988 (9th Cir. 2001). 13 If the allegations in a complaint are insufficient to state a claim, a court should grant leave 14 to amend, unless amendment would be futile (i.e., “the pleading could not possibly be cured by the 15 allegation of other facts”). Cook, Perkiss & Lieche, Inc. v. N. Cal. Collection Serv., Inc., 911 F.2d 16 242, 246-47 (9th Cir. 1990) (per curiam). 17 B. Defendant’s Motion to Dismiss. 18 1. Defendants’ Request for Judicial Notice is Granted. 19 Defendant filed two requests for judicial notice. (Dkt. Nos. 38, 54-1.) Plaintiff summarily 20 opposes the requests. (Dkt. No. 41, p. 4.) Together, the requests ask the Court take judicial notice 21 of the following documents for the purposes of ruling on this motion: 22 (1) Plaintiff’s Initial Complaint in this action, including attached exhibits, 23 (2) Defendant’s signup page as it existed on January 1, 2011, 24 (3) Defendant’s signup page as it existed on December 31, 2011, 25 (4) Defendant’s Terms of Service in effect on January 1, 2011, 26 (5) Defendant’s Terms of Service in effect on December 31, 2011, 27 (6) Defendant’s Privacy Policy in effect on January 3, 2011, 1 (8) The PACER docket sheet for Sifuentes v. Twitter Inc., No. 23-cv-1758-SK (N.D. 2 Cal. filed Apr. 12, 2023), 3 (9) Plaintiff’s First Amended Complaint filed in Sifuentes v. Twitter Inc., No. 23-cv4 1758-SK (N.D. Cal. filed Apr. 12, 2023), 5 (10) Plaintiff’s Complaint filed in Sifuentes v. Twitter Inc., No. 23-cv-981, 2023 WL 6 7295186, at *2 (W.D. Mich. Nov. 6, 2023), 7 (11) Plaintiff’s Declaration filed at Dkt. No. 4 in Sifuentes v. Twitter Inc., No. 23-cv8 981, 2023 WL 7295186 , at *2 (W.D. Mich. Nov. 6, 2023), and 9 (12) The Judgment entered in Sifuentes v. Twitter Inc., No. 23-cv-981, 2023 WL 10 7295186, at *2 (W.D. Mich. Nov. 6, 2023). 11 (Dkt. Nos. 38, 54-1.) 12 The Court may take judicial notice of facts “not subject to reasonable dispute” because 13 they are (1) “generally known within the trial court’s territorial jurisdiction,” or (2) “capable of 14 accurate and ready determination from sources whose accuracy cannot reasonably be questioned.” 15 See Fed. R. Evid. 201(b). Defendants’ noticed documents all fall under the second category. 16 Documents 1 and 8-12 are court filings. Courts “may take judicial notice of undisputed 17 matters of public record, including documents on file in federal or state courts.” Harris v. Cnty. of 18 Orange, 682 F.3d 1126, 1132 (9th Cir. 2012) (citation omitted). 19 Documents 2 and 3 are publicly available webpages. Courts regularly take judicial notice 20 of the contents of webpages because they “can be accurately and readily determined.” E.g., 21 Makaeff v. Trump Univ., LLC, 715 F.3d 254, 259 (9th Cir. 2013); Garcia v. E.L. Heritage Inn of 22 Sacramento, LLC, No. 21-15674, 2022 WL 3359175 , at *1 (9th Cir. Aug. 15, 2022). 23 Documents 4-7 are Defendants’ Terms of Service and Privacy Policy. These documents 24 are not the subject of reasonable dispute, and their authenticity is not in question. See, e.g., 25 Trudeau v. Google LLC, 349 F. Supp. 3d 869, 876 (N.D. Cal. 2018) (taking judicial notice of 26 Google’s Terms of Service); Matera v. Google Inc., 2016 WL 5339806 , at *7 (N.D. Cal. Sept. 23, 27 2016) (same). Moreover, Plaintiff refers to these documents in his Second Amended Complaint, 1 v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003) (explaining that a document “may be incorporated by 2 reference into a complaint if . . . the document forms the basis of the plaintiff’s claim.”). 3 Accordingly, the Court GRANTS Defendant’s two requests for judicial notice. 4 2. California Law Applies to Plaintiff’s Claims. 5 Defendant argues that California law governs Plaintiff’s claims because Plaintiff agreed to 6 Defendant’s Terms of Service (“Terms”), which provides that California law governs disputes 7 between Defendant and its users. (Dkt. No. 37, p. 15.) Plaintiff does not dispute that California 8 law governs, (Dkt. No. 41), and Plaintiff’s Second Amended Complaint alleges that Plaintiff 9 “agreed to the terms of service and privacy policy of Defendant,” which constituted “a valid and 10 enforceable contract between Plaintiff and Defendant,” (Dkt. No. 32. ¶¶ 21-22). Further, this 11 Court has already determined that Defendant’s terms set forth a valid choice-of-law clause. 12 Trump v. Twitter Inc., 602 F. Supp. 3d 1213 , 1226 (N.D. Cal. 2022). Accordingly, California 13 substantive law applies to Plaintiff’s claims. 14 3. The Doctrine of Res Judicata Bars Plaintiff’s Claims Arising from the Alleged 2016 Breach. [15] Defendant argues that Plaintiff’s claims are precluded by the judgment in Sifuentes v. [16] Twitter Inc., No. 23-cv-00981-RJJ-PJG (W.D. Mich. filed Sep. 15, 2023) (hereinafter, “Sifuentes [17] I”). (Dkt. No. 54, pp. 7-10.) Plaintiff argues that this action is not precluded because he did not [18] have a “full and fair opportunity to litigate” in Sifuentes I. (Dkt. No. 61, pp. 1-2.) [19] Although California law applies to Plaintiff’s claims, the question of whether res judicata [20] applies is determined by Michigan law. “Where the allegedly preclusive decision was a diversity [21] action, federal common law requires us to apply ‘the law that would be applied by state courts in [22] the State in which the federal diversity court sits.’” Vazquez v. Jan-Pro Franchising Int’l, Inc., [23] 986 F.3d 1106 , 1114 (9th Cir. 2021) (quoting Semtek Int’l Inc. v. Lockheed Martin Corp., 531 24 U.S. 497 , 508 (2001). “Because the allegedly preclusive decisions were rendered by federal courts [25] located in [Michigan], we look to [Michigan] preclusion law.” Id. [26] The purpose of res judicata is to prevent multiple lawsuits litigating the same cause of [27] action. Washington v. Sinai Hosp. of Greater Detroit, 733 N.W.2d 755, 759 (Mich. Ct. App. 1 2007). “The doctrine bars a second, subsequent action when (1) the prior action was decided on 2 the merits, (2) both actions involve the same parties or their privies, and (3) the matter in the 3 second case was, or could have been, resolved in the first.” Adair v. Michigan, 680 N.W.2d 386 , 4 396 (Mich. Ct. App. 2004). 5 With respect to the third prong, Michigan courts apply a broad “transactional” test. 6 Garrett v. Washington, 886 N.W.2d 762, 766 (Mich. Ct. App. 2016). Under the transactional test, 7 the determinative question is whether the claims in the instant case arose as part of the same 8 transaction as did the plaintiff’s claims in the original action. Id. “Whether a factual grouping 9 constitutes a transaction for purposes of res judicata is to be determined pragmatically, by 10 considering whether the facts are related in time, space, origin or motivation, and whether they 11 form a convenient trial unit.” Adair v. State, 680 N.W.2d 386, 398 (Mich. 2004) (citation omitted, 12 cleaned up). “Res judicata bars every claim arising from the same transaction that the parties, 13 exercising reasonable diligence, could have raised but did not.” Id. at 397 . 14 The first and second prongs of Michigan’s res judicata test are easily satisfied. First, 15 Sifuentes I was dismissed with prejudice. Sifuentes, 2023 WL at *3. Contrary to Plaintiff’s claims 16 that he did not have a full and fair opportunity to litigate, Plaintiff was able to file an objection to 17 the dismissal of his case before judgment was entered. (23-cv-00981-RJJ-PJG, Dkt. No. 10.) 18 Moreover, it is clearly established that “[a] dismissal with prejudice amounts to an adjudication on 19 the merits and bars a further action based on the same facts.” Grimmer v. Lee, 872 N.W.2d 725 , 20 729 (Mich. Ct. App. 2015). Second, the parties in Sifuentes I are the same parties in this action: 21 Sifuentes and X Corp., Inc. (formerly Twitter). 22 However, the third prong is only satisfied as to Plaintiff’s claims arising out of the alleged 23 breach in 2016. Both Sifuentes I and this action allege that Plaintiff had an account with 24 Defendant, that Defendant suffered data breaches that compromised Plaintiff’s information, that 25 Defendant did not provide adequate notice of those breaches to Plaintiff, that Plaintiff learned of 26 the data breach in November 2020 through a report from an external credit and breach monitoring 27 service, and that Plaintiff suffered resulting emotional distress. (23-cv-00981-RJJ-PJG, DKT. No. 1 breach in 2016, whereas this action alleges harm arising out of alleged breaches in 2016, 2021, 2 and 2023. Each alleged data breach constitutes a separate transaction, for the facts pertaining to 3 each breach are unrelated in time and could each potentially give rise to separate statutory 4 penalties. In Sifuentes I, the court determined that Plaintiff’s own pleadings suggested no breach 5 occurred, but that reasoning does not necessarily apply to the 2021 and 2023 breaches. Further, 6 Plaintiff alleges that he did not even have notice of the 2023 breach until after he filed Sifuentes I. 7 (Compare 23-cv-00981-RJJ-PJG, Dkt. No. 2 (filing Sifuentes I on September 15, 2023) with Dkt. 8 No. 32, Ex. B (receiving notice of 2023 breach on December 13, 2023).) 9 In sum, res judicata bars Plaintiff’s claims premised on the alleged breach in 2016, and the 10 Court GRANTS Defendant’s motion to dismiss with respect to those claims. Because no 11 amendment to the pleadings could possibly get around the res judicata bar, amendment would be 12 futile. The Court therefore DISMISSES the claims based on the 2016 breach WITH PREJUDICE. 13 Res judicata does not preclude Plaintiff’s claims premised on the 2021 and 2023 breaches, but 14 those claims are also not viable for the reasons set forth below. 15 4. The Terms Bar Plaintiff’s Claims under Common Law (other than IIED) (Claims 1-6, 13-14). [16] Defendants argue that the Terms bar Plaintiff’s common law claims (other than IIED). [17] (Dkt. No. 37, pp. 15-16.) Plaintiff argues that the Terms do not shield against liability for tort and [18] statutory claims. (Dkt. No. 41, p. 3.) [19] Both parties agree the Terms are a valid and enforceable agreement between them. See [20] supra p. 6. The Terms include the following language: [21] Your access to and use of the Services or any Content is at your own [22] risk . . . . Twitter will not be responsible or liable for any harm to your 23 computer system, loss of data, or other harm that results from your access to or use of the Services, or any Content . . . . We make no 24 warranty that the Services will meet your requirements or be available on an uninterrupted, secure, or error-free basis . . . . [26] Limitation of Liability TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE 27 LAW, TWITTER . . . WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR LOSS OF PROFITS, DATA, USE, GOOD-WILL, OR OTHER [1] INTANGIBLE LOSSES, RESULTING FROM (i) YOUR ACCESS 2 TO OR USE OF . . . THE SERVICES; . . . (iv) UNAUTHORIZED ACCESS, USE OR ALTERATION OF YOUR TRANSMISSIONS 3 OR CONTENT, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE) OR ANY 4 OTHER LEGAL THEORY, WHETHER OR NOT TWITTER HAS BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGE, [5] AND EVEN IF A REMEDY SET FORTH HEREIN IS FOUND TO 6 HAVE FAILED OF ITS ESSENTIAL PURPOSE. (Dkt. Nos. 38-5, pp. 3-4; 38-6, pp. 3-4.) [7] California courts enforce “clear, unambiguous, and explicit” liability limiting provisions [8] unless they are unconscionable. Murphy v. Twitter, Inc., 274 Cal. Rptr. 3d 360 , 377-78 (Ct. App. [9] 2021) (citation omitted). Plaintiff does not argue that the Terms are unconscionable. “Courts [10] have also recognized service providers that offer free services to Internet users may have a [11] legitimate commercial need to limit their liability and have rejected claims that such limitations [12] are so one-sided as to be substantively unconscionable.” Id. at 378 . Moreover, this Court has [13] already concluded that Defendants’ Terms bar liability for a data breach absent specific allegations [14] of unconscionability. Gerber v. Twitter, Inc., No. 4:23-CV-00186-KAW, 2024 WL 1354449 , at [15] *4-5 (N.D. Cal. Mar. 29, 2024). [16] Under California law, companies may limit liability for claims under contract and claims [17] for torts involving ordinary negligence, see Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 147 18 Cal. Rptr. 3d 634, 642 (Ct. App. 2012), but not for intentional torts, fraud, and statutory claims. [19] See Cal. Civ. Code § 1668 . Accordingly, the Terms bar all of Plaintiff’s claims except for IIED [20] (claim 7) and statutory violations (claims 8-12). [21] The Court GRANTS Defendants’ motion to dismiss as to claims 1-6 and 13-14. Because [22] no amendment to the pleadings could possibly get around these liability limiting provisions, [23] amendment would be futile. The Court therefore DISMISSES claims 1-6 and 13-14 WITH [24] PREJUDICE. [25] 5. Plaintiff’s Second Amended Complaint Does Not State a Claim for IIED [26] (Claim 7). [27] Plaintiff fails to state a claim for intentional infliction of emotional distress. “To state a 1 cause of action for intentional infliction of emotional distress, the plaintiff must allege (1) extreme 2 and outrageous conduct with the intention of causing, or reckless disregard of the probability of 3 causing, emotional distress; (2) the plaintiff’s suffering severe or extreme emotional distress; and 4 (3) actual and proximate causation of the emotional distress by the defendant's outrageous 5 conduct.” Mintz v. Blue Cross of California, 92 Cal. Rptr. 3d 422, 432-33 (Cal. App. 2009). 6 “Further, the conduct alleged must be so extreme and outrageous as to go beyond all possible 7 bounds of decency, and to be regarded as atrocious, and utterly intolerable in a civilized 8 community.” Id. (citations and quotation marks omitted, cleaned up). 9 Defendant argues that Plaintiff has not alleged that Defendant behaved in an “extreme and 10 outrageous” manner or intended to cause Plaintiff emotional distress (or recklessly disregarded the 11 probability thereof). (Dkt. No. 37, pp. 26-27.) Plaintiff does not respond specifically to this 12 argument, but generally argues that he has satisfied the Twombly plausible pleading standard. On 13 the contrary, Twombly instructs that Plaintiff must provide “factual allegation . . . enough to raise a 14 right to relief above the speculative level” and that “a formulaic recitation of the elements of a 15 cause of action will not do.” Twombly, 550 U.S. at 555 (citation and quotation marks omitted). 16 Plaintiff’s allegations are a literal “formulaic recitation of the elements of IIED.” (See Dkt. No. 32 17 ¶¶ 54-56 (“Defendant acted intentionally or recklessly . . . . Defendant’s conduct was extreme and 18 outrageous, and exceeded all bounds of decency . . . . Defendant’s conduct caused Plaintiff to 19 suffer emotional distress.”).) “As such, the allegations are conclusory and not entitled to be 20 assumed true.” Ashcroft, 556 U.S. at 681 (citing Twombly, 550 U.S. at 554-55). 21 As Plaintiff has not stated a plausible claim for IIED, the Court GRANTS Defendant’s 22 motion to dismiss with respect to Plaintiff’s seventh cause of action but dismisses WITH LEAVE 23 TO AMEND. 24 6. Plaintiff Cannot Bring Claims Under the CCPA and California Civil Code Sections 1798.29 and 1798.82 Because He is Not a California Resident (Claims 25 8-9). 26 Defendants argue that the CCPA and California Civil Code sections 1798.29 and 1798.82 27 only provide a private right of action to California residents. (Dkt. No. 37, pp. 27-28.) Plaintiff 1 he should be able to seek relief under these statutes because holding otherwise would violate the 2 equal protection clause, because the language and policy of the statutes supports extraterritorial 3 reach, because Plaintiff is connected to California through his use of California-based online 4 platforms, and because the harm occurred in California. (Dkt. No. 32, pp. 11-16.) Plaintiff’s 5 arguments are not sufficient to allow him to assert these claims, though. 6 The CCPA creates a private right of action for “[a]ny consumer whose nonencrypted and 7 nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or 8 disclosure as a result of the business’s violation of the duty to implement and maintain reasonable 9 security procedures and practices appropriate to the nature of the information.” Cal. Civ. Code § 10 1798.150(a). A “consumer” is defined as “a natural person who is a California resident, as defined 11 in Section 17014 of Title 18 of the California Code of Regulations, as that section read on 12 September 1, 2017, however identified, including by any unique identifier.” Cal. Civ. Code § 13 1798.140(g). Section 17014 of Title 18 of the California Code of Regulations defines “resident” 14 as “(1) every individual who is in the State for other than a temporary or transitory purpose, and 15 (2) every individual who is domiciled in the State who is outside the State for a temporary or 16 transitory purpose. All other individuals are nonresidents.” Cal. Code Regs. tit. 18, § 17014 . 17 Therefore, the CCPA is clear that it does not apply to non-resident plaintiffs. Delgado v. Meta 18 Platforms, Inc., 718 F. Supp. 3d 1146 , 1154 (N.D. Cal. 2024) (“[T]he CCPA does not apply to 19 Illinois citizens.”). 20 Similarly, California Civil Code sections 1798.29 and 1798.82 impose requirements for 21 disclosure of “breach[es] in the security of the data to a resident of California.” Cal. Civ. Code. §§ 22 1798.29, 1798.82. Based on that plain language, non-California residents lack standing to bring 23 claims under these provisions. See e.g., In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 24 16-MD-02752-LHK, 2017 WL 3727318 , at *34 (N.D. Cal. Aug. 30, 2017). 25 On this basis, his eighth and ninth claims necessary fail. Accordingly, the Court GRANTS 26 Defendant’s motion to dismiss as to Plaintiff’s eighth and ninth causes of action. Because no 27 amendment to the pleadings could possibly get around these statutory bars, amendment would be 7. Plaintiff’s Claims Under Michigan Law are Barred by the Terms’ Choice of 1 Law Clause (Claims 10 and 11). 2 Disputes between Plaintiff and Defendant are governed by California law. See supra, pp. 3 7-8. To disregard this choice, Plaintiff must show that California’s data protection law is contrary 4 to a fundamental policy of Michigan’s data protection law and that Michigan has a materially 5 greater interest in the determination of the matter. See Ruiz v. Affinity Logistics Corp., 667 F.3d 6 1318, 1323 (9th Cir. 2012). Plaintiff presents no argument why the Court should disregard the 7 choice of California law in favor of the Michigan statutes. Consequently, Plaintiff cannot bring 8 claims against Defendant under Michigan law. See Trump, 602 F. Supp. 3d at 1226-27 (holding 9 that Twitter’s California choice-of-law provision barred claim under another state’s statute where 10 the plaintiff did not carry burden of demonstrating conflict of laws). The Court GRANTS 11 Defendant’s motion to dismiss as to claims 10 and 11. Because no amendment to the pleadings 12 could possibly get around the choice of law provision, amendment would be futile. The Court 13 therefore DISMISSES claims 10 and 11 WITH PREJUDICE. 14 8. Plaintiff’s Claim for Conversion Fails as a Matter of Law (Claim 12). 15 Defendant argues that Plaintiff’s claim for conversion fails as a matter of law because 16 Plaintiff voluntarily provided his allegedly stolen information to Defendant and because his 17 account information does not constitute property capable of exclusive possession of control. (Dkt. 18 No. 37, pp. 30-31.) Plaintiff does not respond to these arguments. Defendants are correct. 19 Under California law, “[c]onversion is the wrongful exercise of dominion over the 20 property of another. The elements of a conversion are the plaintiff’s ownership or right to 21 possession of the property at the time of the conversion; the defendant’s conversion by a wrongful 22 act or disposition of property rights; and damages.” Greka Integrated, Inc. v. Lowrey, 35 Cal. 23 Rptr. 3d 684, 692 (Ct. App. 2005). Because conversion requires a wrongful act, there can be no 24 conversion claim if a plaintiff willingly provided his property to a defendant. See Farrington v. A. 25 Teichert & Son, 139 P.2d 80, 82 (Cal. 1943). Plaintiff says himself that he used his email address, 26 password, full name, IP address, and location to create his X account. (Dkt. No. 31, p. 1.) Thus, 27 Defendant did not wrongfully convert this information; Plaintiff gave it to Defendant. 1 See Holistic Supplements, L.L.C. v. Stark, 275 Cal. Rptr. 3d 791 , 806-07 (Ct. App. 2021). 2 || However, the Ninth Circuit consistently applies a three-part test to determining the property 3 element in California cases: “First, there must be an interest capable of precise definition; second, 4 it must be capable of exclusive possession or control; and third, the putative owner must have 5 established a legitimate claim to exclusivity.” Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 6 2003). This Court has held that “personal information” such as “a user’s location, zip code, device 7 || identifier, and other data” is incapable of precise definition and is not capable of exclusive 8 possession or control, such that there can be no conversion of such personal information. In re 9 iPhone Application Litig., 844 F. Supp. 2d 1040, 1075 (N.D. Cal. 2012). 10 The Court GRANTS Defendant’s motion to dismiss as to Plaintiff's 12" cause of action. 11 Because Plaintiff's own admissions destroy his conversion claim, amendment would be futile. 12 || The Court therefore DISMISSES this claim WITH PREJUDICE.° 13 CONCLUSION 14 For the foregoing reasons, the Court GRANTS Defendant’s motion to dismiss, GRANTS 3 15 || Defendant’s requests for judicial notice, and dismisses all claims other than the claim for ITED in a 16 || Plaintiff's Second Amended Complaint WITH PREJUDICE. Plaintiff may amend his claim 3 17 (Claim 7) for IED by December 16, 2024. No other amendment is allowed. 18 IT IS SO ORDERED. 19 Dated: December 2, 2024 4 ( . a, . [20] SALLIE KIM 21 United States Magistrate Judge [27] 28 > The Court declines to reach Defendant’s alternative arguments for dismissal of □□□□□□□□□□ Second Amended Complaint.