FITZWATER, District Judge.

Defendants' Fed.R.Civ.P. 12(b)(6) motions to dismiss require that the court decide whether plaintiffs have stated claims under the Electronic Communications Privacy Act-Stored Communications ("ECPA"), 18 U.S.C. § 2701 et seq., and whether plaintiffs' state-law claims are preempted by the Airline Deregulation Act of 1978 ("ADA"), and, if not, whether plaintiffs have stated state-law claims on which relief can be granted. For the reasons that follow, the court holds that plaintiffs' ECPA actions fail to state a claim, that their state-law claims, except their breach of contract action, are expressly preempted by the ADA, and that they have failed to state a breach of contract claim on which relief can be granted. The court therefore grants defendants' motions to dismiss and allows plaintiffs to replead.

I

These are consolidated cases pending in this court for coordinated or consolidated pretrial proceedings by order of the Judicial Panel on Multidistrict Litigation. See In re Am. Airlines, Inc., Privacy Litig., 342 F.Supp.2d 1355 (J.P.M.L. 2004). Plaintiffs bring putative nationwide class actions on behalf of persons allegedly injured when defendants AMR Corp. and American Airlines, Inc. (collectively, "American") authorized Airline Automation, Inc. ("AAI") to disclose highly confidential passenger information — passenger name records ("PNRs") — to the Transportation Security Administration ("TSA"), without the passengers' consent. They allege that, without the passengers' consent, and perhaps without American's permission, AAI accessed and provided the information to four private research companies: defendants Fair, Isaac and Company, Infoglide Software Corporation, Lockheed Martin Corporation (collectively, "vendor defendants"), and Ascent Technology, Inc. ("Ascent"). Plaintiffs maintain that defendants intentionally accessed, without authorization, a facility through which an electronic communication service is provided or exceeded their authority in order to obtain stored electronic communications that included plaintiffs' personally-identifiable information.

In Kimmell v. AMR Corp., et al., No. 3:04-CV-0750-D, and Baldwin v. AMR Corp., et al., No. 3:04-CV-1148-D, plaintiffs sue under 18 U.S.C. § 2707 for violations of the ECPA and on state-law claims for breach of contract, trespass to property, invasion of privacy, unjust enrichment, and deceptive trade practices under the Texas Deceptive Trade Practices — Consumer Protection Act, Tex. Bus. Com. Code Ann. §§ 17.41-17.826 (Vernon 2002 Supp. 2004-05), and similar statutes of 48 other states and the District of Columbia that prohibit unfair and deceptive acts and practices. In Rosenberg v. AMR Corp., et al., No. 3:04-CV-2564-D, plaintiff sues under the ECPA and for breach of contract, deceptive trade practices under N.Y. Gen. Bus. Law § 349 (McKinney 2004) and similar statutes of 48 other states and the District of Columbia that prohibit unfair and deceptive acts practices, trespass to property, invasion of privacy, and unjust enrichment.

American owns and operates an Internet website — http://www.aa.com — that enables customers to purchase tickets for air transportation and provides users the ability to send or receive wire or electronic communications. AAI plays a role in maintaining the website. American also owns or operates SABRE, a computer reservation system or server ("CRS") used in providing air transportation-related services, such as ticket reservations and sales. It, too, provides users the ability to send or receive wire or electronic communications. The website also enables users to send or receive electronic communications to the CRS. When American takes reservations or sells air transportation over the telephone or via the Internet, it collects personally-identifiable information from its passengers, including name, address, telephone numbers, AAdvantage account and flight information, credit/debit card information, emergency contacts, seating and dietary preferences, passport number, and country of residence. The information is bundled and maintained in a PNR.

American's website sets out its privacy policy, which is part of the contract of carriage with passengers. The policy states the limitations American observes in disclosing or sharing customer information and represents that information security is one of its highest priorities. In sum, the policy represents that American does not sell customer information or share a customer's email address with third parties unless required by law, and does not disclose customer information to companies affiliated with American, or unaffiliated third parties, except to fulfill products or services the customer requests, and may disclose this information to United States or other countries' tax, security, or regulatory authorities, if required by law. American represents that access to personal information about customers is limited to employees and agents who need to know the information to provide products and services, that personal information is maintained under strict physical, electronic, and procedural safeguards that comply with federal regulations, that security standards and procedures are regularly reviewed to protect against unauthorized access, and that American participates in the Council of Better Business Bureaus' online privacy program and complies with its privacy and security standards.

In or about June 2002 American, through its agent, AAI, turned over approximately 1.2 million electronically-stored PNRs. American and AAI accessed this personal information without the passengers' prior authorization and/or beyond their consent. AAI also purportedly lacked American's consent. AAI, in turn, disclosed the information to the vendor defendants and Ascent. When the news broke that JetBlue Airways Corporation had disclosed such information, American initially denied that it had released passenger personal information. In 2004, however, it admitted that it had authorized AAI to disclose highly confidential personal passenger information to TSA, although it contends that AAI exceeded its authority by accessing, transferring, or making PNRs available to the vendor defendants and Ascent. AAI maintains that American was fully aware of, and authorized, this access.

Defendants move to dismiss these actions for failure to state a claim, contending that plaintiffs cannot recover under the ECPA, their state-law actions are preempted under the ADA, and, if any causes of action are not preempted, plaintiffs have failed to state claims on which relief can be granted.

II

A

As clarified at oral argument, plaintiffs allege that AAI violated § 2701 of the ECPA by intentionally accessing without authorization, and/or in excess of its authorization, plaintiffs' PNRs and, in turn, divulging their contents to the vendor defendants. Plaintiffs assert that the vendor defendants are also liable directly and as aiders and abettors and coconspirators. AAI argues that plaintiffs' § 2701-based claim fails because, inter alia, by pleading that American authorized AAI to disclose 1.2 million PNRs to TSA, they implicitly concede that American authorized AAI to access the PNRs in any American electronic communication service. AAI also maintains that plaintiffs cannot recover because, while there may be some dispute regarding whether American provided AAI the PNRs with the understanding that it would disclose them only to TSA, they have not pleaded specific facts that support the conclusion that AAI originally obtained the data without American's consent.

The court concludes that plaintiffs have failed to state a § 2701-based claim against AAI. Their amended complaints each assert that American authorized AAI to disclose the PNRs to TSA. See, e.g., Kimmell Am. Compl. ¶ 38. As AAI points out, an implicit corollary to these averments is that AAI obtained the passengers' information with American's knowledge and consent, i.e., it had American's authorization to access the PNRs in the first place. Absent an explicit allegation that American authorized AAI to disclose the PNRs to TSA after AAI had obtained unauthorized access to American's facility — a premise that is so at odds with common sense that it cannot reasonably be inferred absent such specificity — the amended complaints undercut the premise that AAI lacked American's authorization to access its facility.

Plaintiffs are therefore limited to the contention that AAI violated § 2701 by exceeding its authorization to access American's facility. Although plaintiffs include conclusory allegations that AAI in fact exceeded its authorization, see, e.g., Kimmell Am. Compl. ¶ 51, the factual basis for these assertions is that AAI lacked authorization to disclose the PNRs to any entity other than TSA, i.e., the vendor defendants and Ascent. See, e.g., id. ¶¶ 39, 40 ("While [American] admits that it authorized AAI to disclose highly confidential personal passenger information to the TSA, it contends that AAI exceeded its authority by accessing, transferring or making PNRs available to [the vendor defendants] and non-party Ascent. AAI, however, claims that [American] was fully aware of and authorized access by [the vendor defendants] and non-party Ascent."). The facts plaintiffs plead demonstrate that they are relying on a theory of unauthorized disclosure of information, not of access that exceeded what was authorized.

The purpose of § 2701 is to prevent unauthorized access to a facility through which an electronic communication service is provided. See In re N.W. Airlines Privacy Litig., 2004 WL 1278459, at *2 (D. Minn. June 6, 2004) (dismissing § 2701-based claim because "[p]laintiffs' complaint is not with how Northwest obtained the information, but with how Northwest subsequently used the information."); Sherman Co. v. Salton Maxim Housewares, Inc., 94 F.Supp.2d 817, 821 (E.D. Mich. 2000) ("Because section 2701 of the ECPA prohibits only unauthorized access and not the misappropriation or disclosure of information, there is no violation of section 2701 for a person with authorized access to the database no matter how malicious or larcenous his intended use of that access. Section 2701 outlaws illegal entry, not larceny."); Educ. Testing Serv. v. Stanley H. Kaplan, Educ. Ctr., Ltd., 965 F. Supp. 731, 740 (D. Md. 1997) ("[I]t appears evident that the sort of trespasses to which the [ECPA] applies are those in which the trespasser gains access to information to which he is not entitled to see, not those in which the trespasser uses the information in an unauthorized way."); State Wide Photocopy, Corp. v. Tokai Fin. Servs., Inc., 909 F. Supp. 137, 145 (S.D.N.Y. 1995) ("[Section] 2701 is aimed at parties accessing facilities without authorization."). Section 2701 does not proscribe unauthorized use or disclosure of information obtained from authorized access to a facility. See N.W. Airlines, 2004 WL 1278459, at *2; Sherman Co., 94 F.Supp.2d at 820 (citing Wesley Coll. v. Pitts, 974 F. Supp. 375, 389 (D. Del. 1997, aff'd, 172 F.3d 861 (3d Cir. 1998) (unpublished table decision)). Yet this is what plaintiffs are alleging concerning AAI's disclosure of PNRs to the vendor defendants. Accordingly, the court holds that plaintiffs have failed to state a § 2701-based claim against AAI.

Plaintiffs seek to hold the vendor defendants liable under § 2701 directly and as aiders and abettors and coconspirators of American's violations of the ECPA. The court concludes that the vendor defendants are also entitled to dismissal. First, plaintiffs have failed to state a claim against them directly because, despite the conclusory allegations that these defendants accessed American's facility, the facts plaintiffs plead all point to their having received the PNRs from American and/or AAI. See, e.g., Kimmell Compl. ¶ 42 ("[American] and/or AAI accessed a facility . . . and made [the contents of the communications] available for access by [the vendor defendants] and non-party Ascent."). Plaintiffs have failed to state a direct cause of action based on unauthorized access. Second, because plaintiffs clarified at oral argument that they are not asserting § 2701-based liability against American, the vendor defendants cannot be held liable under § 2701 as aiders and abettors or conspirators of American. Third, even if plaintiffs' clarification means that they intend to hold the vendor defendants liable as aiders and abettors of or coconspirators with AAI, because the court is dismissing plaintiffs' § 2701-based claim against AAI, it follows that the vendor defendants cannot be held liable as aiders and abettors or coconspirators. See In re Managed Care Litig., 298 F.Supp.2d 1259, 1286 (S.D. Fla. 2003) (holding that civil liability for aiding and abetting requires showing that substantive offense was committed); Coppock v. Northrup Grumman Corp., 2003 WL 21730668, at *14 n. 17 (N.D. Tex. July 22, 2003) (Fitzwater, J.) ("A claim for civil conspiracy is generally not viable without the commission of an underlying wrongful act[.]").

B

American argues, inter alia, that, even assuming that its computer reservation system is an electronic communication service or a remote computing service, its conduct falls within the exception to liability set out in § 2702(b)(3), which permits disclosure of electronic communications "with the lawful consent of . . . an . . . intended recipient of such communication[.]" Plaintiffs respond that American cannot avail itself of this exception because its consent was unlawful in that it violated American's privacy policy, or because American was not the intended recipient of the electronic communications in question.

Plaintiffs have failed sufficiently to plead that American's consent was unlawful because it was given in violation of its privacy policy. Nor do they cite authority in their opposition memorandum that supports the assertion that consent under § 2702(b)(3) is not lawful if given in breach of a contract. Section 2702 is a criminal statute, and the mere breach of a contract normally is not "unlawful" in a criminal sense. See United States v. Blankenship, 382 F.3d 1110, 1133 (11th Cir. 2004) ("It is not illegal for a party to breach a contract[.]"); Benderson Dev. Co. v. United States Postal Serv., 998 F.2d 959, 962 (Fed. Cir. 1993) ("To breach a contract is not unlawful; the breach only begets a remedy in law or in equity."); Cram Roofing Co. v. Parker, 131 S.W.3d 84, 91 (Tex.App. 2003, no pet.) (en banc) ("While a contract may indeed have the force of law, breach of a contract is not necessarily an illegal activity."). Moreover, the concept of "lawful consent" in § 2702(b)(3) is probably more akin to that found in other criminal statutes, i.e., consent given by one who has the legal capacity to consent. Cf., e.g., United States v. Chavarriya-Mejia, 367 F.3d 1249, 1251 (11th Cir.) (noting that law presumes children cannot lawfully consent to sexual contact), cert. denied, ___ U.S. ___, 125 S. Ct. 95 (2004). Even if American was contractually bound by its privacy policy not to disclose passenger information and can be held liable for breach of contract, this obligation did not deprive it of the legal capacity under § 2702(b)(3) to consent to disclosure.

Plaintiffs also maintain that § 2702(b)(3) is inapplicable on the basis that the intended recipient of their electronic communications was SABRE instead of American. This contention is not supported, however, by their amended complaints. Plaintiffs allege that they conveyed personal information to American. Under § 2702(b)(3), American need only be an intended recipient, not the intended recipient. They also aver that they sent their personal information in reliance upon American's promise not to disclose it to third parties, except to provide travel services. This allegation of reliance on American's promise is inconsistent with the argument that they did not intend American to be a recipient of their personal information.

Accordingly, the court holds that plaintiffs have failed to state a § 2702-based claim against American. Plaintiffs' ECPA claim against all defendants is dismissed.

III

A

The court turns first to express preemption.

1

It is beyond question that, by enacting the ADA, Congress intended to preempt aspects of state law that govern air carriers. Section 41713(b)(1) provides:

Except as provided in this subsection, a State . . . may not enact or enforce a law, regulation, or other provision having the force and effect of law related to a price, route, or service of an air carrier that may provide air transportation under this subpart.

Not all claims that may have economic repercussions, however, are sufficiently related to an airline's prices, routes, or services to be preempted. "'[S]ome state actions may affect [airline fares] in too tenuous, remote, or peripheral a manner' to have pre-emptive effect." Morales, 504 U.S. at 390 (quoting Shaw v. Delta Air Lines, Inc., 463 U.S. 85, 100 n. 21 (1983)). Thus, for example, in Smith v. America West Airlines, Inc., 44 F.3d 344 (5th Cir. 1995) (en banc), the claims of passengers who alleged that an airline was negligent in permitting a hijacker to board an aircraft were not preempted, despite the potential economic effects that could arise from a damages award. Id. at 345. The effects were too remotely related to fares to trigger ADA preemption. Id. at 347 ("If [plaintiffs] ultimately recover damages, the judgment could affect the airline's ticket selling, training or security practices, but it would not regulate the economic or contractual aspects of boarding. Any such effect would be 'too tenuous, remote or peripheral' to be preempted by [the statutory predecessor to § 41713]." (quoting Morales, 504 U.S. at 390)). Moreover, ADA preemption "does not displace state tort actions for personal physical injuries or property damage caused by the operation and maintenance of aircraft." Witty v. Delta Air Lines, Inc., 366 F.3d 380, 382 (5th Cir. 2004) (quoting Hodges, 44 F.3d at 336).

2

The court initially decides whether plaintiffs' state-law claims for trespass to property, invasion of privacy, deceptive trade practices, and unjust enrichment are expressly preempted. Defendants contend, inter alia, that they are because PNRs are created when passengers make reservations for air carrier service and contain information necessary or convenient to provide the services American renders as an air carrier, and plaintiffs admit they conveyed personally-identifiable information to American when purchasing tickets for air transportation. They also cite plaintiffs' allegation that American's statements about privacy, customer information, and security are part of the contract of carriage.

Plaintiffs respond to this argument at two levels. As a general matter, they maintain that Congress enacted the ADA to ensure, following airline deregulation, that the states would not enact their own forms of economic regulation. They therefore assert that courts, including the Fifth Circuit, hold that claims are preempted only when their purpose or effect inhibits or frustrates this goal. Plaintiffs posit that their claims seeking redress for privacy rights violations have no connection to airline competition or economic deregulation of the airline industry, nor would they frustrate Congress' goal in enacting the ADA. At a more specific level, plaintiffs contend that these claims do not relate to American's rates, routes, or services. Concerning the pertinent component of airline services, they cite authority from outside this circuit to argue that the ADA definition encompasses only "the actual provision of transportation service." Ps. Consol. Mem. at 31 (emphasis omitted).

The court holds that plaintiffs' actions for trespass to property, invasion of privacy, deceptive trade practices, and unjust enrichment are expressly preempted because they relate to at least one of American's services. This conclusion follows from analyzing in combination the Fifth Circuit's definition of "services," the Supreme Court's expansive construction of the term "relate to" in § 41713(b)(1), and the factual bases for plaintiffs' claims. In Hodges the en banc court adopted the panel opinion's definition of "services."

"Services" generally represent a bargained-for or anticipated provision of labor from one party to another. If the element of bargain or agreement is incorporated in our understanding of services, it leads to a concern with the contractual arrangement between the airline and the user of the service. Elements of the air carrier service bargain include items such as ticketing, boarding procedures, provision of food and drink, and baggage handling, in addition to the transportation itself. These matters are all appurtenant and necessarily included with the contract of carriage between the passenger or shipper and the airline. It is these [contractual] features of air transportation that we believe Congress intended to de-regulate as "services" and broadly to protect from state regulation.

Plaintiffs allege that American collects personally-identifiable information from customers when taking reservations or selling air transportation. They also assert that American's privacy policy is part of the contract of carriage and prohibits American or its agents from disclosing their personal information, except in limited circumstances. See Ps. Consol. Mem. at 25 ("The privacy policy is unquestionably one of a number of terms that form the basis for the transportation agreement between passengers and American."). Their state-law claims for trespass to property, invasion of privacy, deceptive trade practices, and unjust enrichment are preempted because they have a connection at least with American's ticketing service, including the reservation component. Congress surely intended to immunize airlines from a host of potentially-varying state laws and state-law causes of action that could effectively dictate how they manage personal information collected from customers to facilitate the ticketing and reservation functions that are integral to the operation of a commercial airline.

These claims are likewise preempted to the extent asserted against AAI and the vendor defendants. See Lyn-Lea Travel, 283 F.3d at 287 n. 8 (stating that ADA preemption is not limited to claims brought directly against air carriers but also preempts claims that relate to air carrier's services). The court recognizes that there will be instances in which state-law claims that would be preempted if brought against an airline will be too attenuated, remote, or peripheral to be preempted if asserted against an entity such as a vendor to an airline. The court need not decide today, however, precisely where that line should be drawn. See Hodges, 44 F.3d at 336 (noting that, in Morales, Supreme Court had "[r]efus[ed] to state exactly where the line would be drawn in a close case[.]"). Although perhaps tautologically phrased, it can be said to occur on a relatedness continuum at the point where the state law's regulation of the entity's conduct is too attenuated, remote, or peripheral to be related to an airline's services. In the present case that point is not reached. Plaintiffs allege that American authorized AAI — whom plaintiffs assert plays a role in maintaining American's website — to disclose passenger information to TSA, and that it disclosed the information — perhaps without American's permission — to the vendor defendants. E.g., Kimmell Am. Compl. ¶¶ 27, 38-39. They assert, inter alia, that the vendor defendants aided and abetted and conspired with American to commit trespass to property, invasion of privacy, deceptive trade practices, and unjust enrichment. E.g., id. ¶ 47. Their claims against AAI and the vendor defendants are based on conduct that relates to American's ticketing service and its reservation component and for that reason are preempted.

3

In American Airlines, Inc. v. Wolens, 513 U.S. 219 (1995), the Supreme Court recognized that the ADA's preemption clause does not "shelter airlines from suits alleging no violation of state-imposed obligations, but seeking recovery solely for the airline's alleged breach of its own, self-imposed undertakings." Id. at 228. "[T]erms and conditions airlines offer and passengers accept are privately ordered obligations and thus do not amount to a State's enact[ment] or enforce[ment] [of] any law, rule, regulation, standard, or other provision having the force and effect of law within the meaning of [the ADA preemption provision]." Id. (citations, footnote, and internal quotation marks omitted); see also Trujillo v. Am. Airlines, Inc., 938 F. Supp. 392, 394 (N.D. Tex. 1995) (Fitzwater, J.) ("State causes of action are available to enforce bargains for services into which an airline voluntarily entered[.]"), aff'd, 98 F.3d 1338 (5th Cir. 1996) (per curiam) (unpublished table decision). Plaintiffs' breach of contract action against American rests on a self-imposed undertaking concerning the handling of passengers' confidential information and therefore is not preempted under the holding in Wolens.

American maintains, however, that Wolens, Smith v. Comair, Inc., 134 F.3d 254 (4th Cir. 1998), and Delta Air Lines, Inc. v. Black, 116 S.W.3d 745 (Tex. 2003), cert. denied, 540 U.S. 1181 (2004), support the conclusion that the breach of contract claim is preempted because it cannot be adjudicated without resort to outsides sources of law. In particular, American points out that its privacy policy informs customers that their personal information may be shared as required by law and provided to United States or foreign tax, security, and regulatory authorities, if required by law. In Wolens the Supreme Court held:

The ADA's preemption clause . . ., read together with the [Federal Aviation Act's] saving clause, stops States from imposing their own substantive standards with respect to rates, routes, or services, but not from affording relief to a party who claims and proves that an airline dishonored a term the airline itself stipulated. This distinction between what the State dictates and what the airline itself undertakes confines courts, in breach-of-contract actions, to the parties' bargain, with no enlargement or enhancement based on state laws or policies external to the agreement.

The court concludes that the principle stated in Wolens is factually inapposite to plaintiffs' breach of contract claim, and that Comair and Delta Air Lines are also distinguishable. Wolens differentiates between holding an airline to the bargain it struck and to one enlarged or enhanced by state laws or policies external to the agreement. In this case, as plaintiffs have pleaded their claim, American agreed to be bound to its privacy policy, except as required by law. In other words, the laws that American maintains are external to the contract are expressly incorporated into it. Unlike Comair, which was an appeal from a summary judgment in which the airline had raised federal-law defenses, Comair, 134 F.3d at 256, 258, plaintiffs in this case rely on a contract that incorporates the laws that American contends are external, and the court is assessing at the Rule 12(b)(6) stage whether they have a stated a claim. And as distinguished from Delta Air Lines, plaintiffs do not seek to modify the contract to press a right that is external to its terms. As pleaded, this case presents a question more like one that the Supreme Court held in Wolens was not external to the contract. As the Comair court explained in interpreting Wolens:

American Airlines argued that whether it breached the frequent-flyer contract depended on resolution of the external policy issue of whether to recognize American's express reservation of the right to modify the rules governing its frequent-flyer contracts. The Court summarily rejected this argument, explaining that interpretation of the company's express reservation was merely another issue within the parties' contractual relationship and therefore not preempted.

Accordingly, the court concludes that plaintiffs' breach of contract claim against American is not expressly preempted.

B

American also maintains that plaintiffs' state-law claims are impliedly preempted. The court need only address this argument in connection with plaintiffs' breach of contract claim.

American argues that plaintiffs' state-law claims are impliedly preempted because "[t]here simply is no room for the laws of the several states in the regulation of interactions between air carriers and the TSA, or cooperation between the airlines and TSA." American Sept. 23, 2004 Br. at 15. Without suggesting a view concerning whether any of plaintiffs' other claims are impliedly preempted, the court holds that the breach of contract action is not. In this respect, it is American's own contractual undertaking, enforceable under state contract law, that regulates its relationship with TSA, not the laws of the several states.

American also asserts, based on Buckman Co. v. Plaintiffs' Legal Committee, 531 U.S. 341 (2001), and Brown v. Nationsbank Corp., 188 F.3d 579 (1999), that the claims are preempted because the relationship between TSA and American is inherently federal in character, and the question whether American properly authorized AAI to release PNR information to TSA is a question for federal regulatory agencies, not state common law. Whatever force these authorities may otherwise have, they do not compel the conclusion that American urges in the breach-of-contract context.

The court holds that plaintiffs' breach of contract claim is not impliedly preempted.

IV

The district court may dismiss a claim when it is clear that the plaintiff can prove no set of facts in support of his claim that would entitle him to relief. In analyzing the complaint, [the court] will accept all well-pleaded facts as true, viewing them in the light most favorable to the plaintiff. [The court] will not, however, accept as true conclusory allegations or unwarranted deductions of fact. The issue is not whether the plaintiff will ultimately prevail, but whether he is entitled to offer evidence to support his claim. Thus, the court should not dismiss the claim unless the plaintiff would not be entitled to relief under any set of facts or any possible theory that he could prove consistent with the allegations in the complaint.

The elements of a cause of action for breach of contract under Texas and New York law are: (1) existence of a contract, (2) performance or tendered performance by the plaintiff, (3) breach of the contract by the defendant, and (4) damages incurred by the plaintiff as a result of the breach. E.g., Lee v. Tyco Elecs. Power Sys., Inc., 2005 WL 1017821, at *4 (N.D. Tex. Apr. 27, 2005) (Fitzwater, J.) (Texas law); Kasada, Inc. v. Access Capital, Inc., 2004 WL 2903776, at *21 (S.D.N.Y. Dec. 14, 2004) (New York law). Plaintiffs allege that they sustained injury as a result of defendants' deceptive practice and invasion of privacy. E.g., Kimmell Am. Compl. ¶¶ 46, 67, 77. Their assertion that they were injured in these respects is insufficient to allege the inelecutable element that they incurred damages as a result of American's breach of contract.

Plaintiffs appear to complain of two separate disclosures of their personal information: one to TSA (with American's permission) and the other to the vendor defendants (with or without American's authorization). It is unclear whether the disclosure giving rise to plaintiffs' deceptive trade practices and invasion of privacy claims against American also supports their breach of contract claim or whether they allege that they incurred damages as a result of both disclosures. When the court assesses whether plaintiffs would be entitled to relief under any set of facts or any possible theory that they could prove consistent with the allegations in their complaints, it becomes clear that they have failed to plead the essential element of damages flowing from the breach. Accordingly, the court concludes that plaintiffs have failed to state a claim for breach of contract.

V

[i]n view of the consequences of dismissal on the complaint alone, and the pull to decide cases on the merits rather than on the sufficiency of pleadings, district courts often afford plaintiffs at least one opportunity to cure pleading deficiencies before dismissing a case, unless it is clear that the defects are incurable or the plaintiffs advise the court that they are unwilling or unable to amend in a manner that will avoid dismissal.

* * *

SO ORDERED.