Opinion
21-cv-08465-VKD
03-27-2023
M.K., a minor by and through his guardian ad litem Melanie Kirksey, Plaintiff, v. GOOGLE LLC and FREMONT UNIFIED SCHOOL DISTRICT, Defendants.
ORDER GRANTING FREMONT UNIFIED SCHOOL DISTRICT'S MOTION TO DISMISS
GOOGLE LLC AND FREMONT UNIFIED RE: DKT. NO. 21
VIRGINIA K. DEMARCHI UNITED STATES MAGISTRATE JUDGE
Plaintiff M.K., through his mother as guardian ad litem, sues Google, LLC (“Google”) and the Fremont Unified School District (“District”), alleging that defendants violated his right to privacy through a Google platform used for remote learning during the COVID-19 pandemic. The District moves pursuant to Rule 12(b)(6) to dismiss the complaint. M.K. opposes the motion. Upon consideration of the moving and responding papers, as well as the oral arguments presented, the Court grants the District's motion to dismiss the complaint, with leave to amend.
All parties have expressly consented that all proceedings in this matter may be heard and finally adjudicated by a magistrate judge. 28 U.S.C. § 636(c); Fed.R.Civ.P. 73; Dkt. Nos. 6, 19, 32.
I. BACKGROUND
The following background facts are based on the allegations of the complaint.
M.K. is a minor who attends a public elementary school in the District. Dkt. No. 1 ¶ 1. In March 2020, due to the COVID-19 pandemic, M.K. began attending school remotely through a Google platform that allowed schools and students to transition to “online and internet based systems to access their education.” Id. ¶¶ 1-3. According to the complaint, “[p]arents were not given an option to opt out or an alternative to receive education if they did not wish to risk their child's privacy.” Id. ¶ 3. The complaint further alleges that “[w]ithout notice to parents Google has collected troves of personal information, including: M.K.'s physical locations, websites visited, every search term used in Google's search engine and links clicked on, the videos watched, voice recordings, saved passwords, biometrics and other behavioral information.” Id. ¶ 6.
M.K. alleges, on information and belief, that his “device was hacked in January 2021 and the hacker sent sexually explicit content to [his] classroom teacher.” Id. ¶ 7. The content reportedly sent by the hacker “was linked to M.K.,” and M.K. was both exposed to, and disciplined for, that content. Id. The complaint further alleges, on information and belief, that “Google will log the hacker's explicit conduct as conduct of M.K.” and that M.K. “has no means of clearing his reputation and ensuring that data associated with him and [sic] is his data.” Id. ¶ 8.
According to M.K., “Google and [the District] failed to inform teachers, school staff and parents of the risk of stalking or hacking into the classroom.” Id. ¶ 7. Google allegedly failed to “provide the school with full notice of its collection, use, and disclosure practices” and did not “enable [learning education agencies] to review and have deleted the personal information collected from its students.” Id. ¶¶ 11, 14. As such, the District reportedly “could not consent to Google's collection of data[.]” Id. ¶ 14. M.K. states that the District failed “to inform parent[s] of what Google would collect and use” and of “the security risks” presented by “predators and hackers while in online classrooms,” and “failed to obtain parental consent.” Id. ¶¶ 11, 14, 15. Reportedly, neither defendant informed parents that M.K.'s “biometric data would be collected and stored[.]” Id. ¶ 14.
The complaint asserts five claims for relief for alleged violation of the federal Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710 (claim 1); violation of the California Student Online Personal Information Protection Act (“SOPIPA”), Cal. Bus. & Prof. Code § 22584 (claim 2); violation of California's unfair competition law (“UCL”), Cal. Bus. & Prof. Code § 17200, et seq. (claim 3); “Failure to Protect” (claim 4); and violation of the California constitutional right to privacy (claim 5). The complaint seeks damages, as well as injunctive relief, including an order requiring the District to “offer an alternative to students who wish to maintain their privacy and do not wish to submit to Google's platforms.” Id. at 14.
Although the complaint did not clearly indicate which claims are asserted against each defendant, M.K. subsequently confirmed that the VPPA and UCL claims are asserted only against Google. See Dkt. No. 25 at 3, 5; Dkt. No. 59 at 3. M.K. has also withdrawn the SOPIPA claim against the District. See Dkt. No. 43 at 5. Accordingly, the only remaining claims against the District are for alleged “Failure to Protect” and violation of M.K.'s privacy right under the California constitution.
The District moves pursuant to Rule 12(b)(6) to dismiss each of M.K.'s claims. For the reasons discussed below, the Court dismisses each of M.K.'s claims with leave to amend.
II. LEGAL STANDARD
A motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) tests the legal sufficiency of the claims in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). Dismissal is appropriate where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory. Id. (citing Balistreri v. Pacifica Police Dep't, 901 F.2d 696, 699 (9th Cir. 1990)). In such a motion, all material allegations in the complaint must be taken as true and construed in the light most favorable to the claimant. Id.
However, “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Moreover, “the court is not required to accept legal conclusions cast in the form of factual allegations if those conclusions cannot reasonably be drawn from the facts alleged.” Clegg v. Cult Awareness Network, 18 F.3d 752, 754-55 (9th Cir. 1994).
Rule 8(a)(2) requires only “a short and plain statement of the claim showing that the pleader is entitled to relief.” This means that the “[f]actual allegations must be enough to raise a right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citations omitted). However, only plausible claims for relief will survive a motion to dismiss. Iqbal, 556 U.S. at 679. A claim is plausible if its factual content permits the court to draw a reasonable inference that the defendant is liable for the alleged misconduct. Id. A plaintiff does not have to provide detailed facts, but the pleading must include “more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Id. at 678.
Documents appended to or incorporated into the complaint or which properly are the subject of judicial notice may be considered along with the complaint when deciding a Rule 12(b)(6) motion. Khoja v. Orexigen Therapeutics, 899 F.3d 988, 998 (9th Cir. 2018); Coto Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010).
III. DISCUSSION
A. COPPA Preemption
In its motion papers, the District's primary contention is that M.K.'s claims cannot be maintained against public entities, such as the District. See Dkt. Nos. 21, 26. At the motion hearing, the District also argued that M.K.'s claims are preempted by the federal Children's Online Privacy Protection Act of 1998 (“COPPA”). See Dkt. No. 59 at 4, 10. Although the preemption argument was not presented in the District's motion papers, M.K. was given leave to file a supplemental brief addressing those arguments. See Dkt. No. 59 at 14-16; see also Dkt. Nos. 40, 43.
The Court understands the District to assert express preemption based on the same arguments presented by Google in its separately filed motion to dismiss the complaint. See Dkt. No. 59 at 4, 10. Google's preemption argument is based on the premise that M.K. cannot sue under state or common law claims to privately enforce violations of COPPA. See Dkt. No. 33 at 12-14; Dkt. No. 47 at 3-16. The current rule in the Ninth Circuit is that “COPPA's preemption clause does not bar state-law causes of action that are parallel to, or proscribe the same conduct forbidden by, COPPA.” Jones v. Google LLC, 56 F.4th 735, 741 (9th Cir. 2022). Accordingly, the District's motion to dismiss M.K.'s state and common law claims for relief based on express preemption under COPPA is denied.
The Court understands that there is a pending request before the Ninth Circuit for a rehearing in the Jones matter. See Petition for Panel Rehearing or Rehearing En Banc (Dkt. No. 63), Jones v. Google LLC, No. 21-16281 (9th Cir. Jan. 25, 2023).
B. Failure to Protect
M.K. alleges that the District was negligent when it “allowed Google LLC to obtain biometric and personal information,” “required students to submit to Google's platforms to obtain educational services during Covid-Related shutdowns,” and “failed to train its teachers on the risk of hackers and predators infiltrating the online platform and how to respond and identify individuals who hacked into the online class programs and protect student safety.” Dkt. No. 1 ¶¶ 75-77. He further states that the District “failed to offer reasonable care to ensure [he] would not be subjected to the invasion of his privacy and data collection of Google to access his education.” Id. ¶ 79. Additionally, M.K. alleges that as “the provider of education services,” the District “had a duty to protect [him] from predators while he was participating in his online school.” Id. ¶ 82. According to the complaint, M.K. “was harmed when he was punished and excluded from school and when the District failed to identify the source and IP address of the inappropriate comments” reportedly made by the hacker. Id. ¶ 84. M.K. also alleges that he suffered harm to his reputation, as well as harm “from the exclusions from his online class during a pandemic that had excluded him from in person learning.” Id.
The District contends that to the extent M.K. seeks to hold the District liable in tort, his claim fails to identify the statutory basis for his claim. Indeed, in California, “public entity tort liability is exclusively statutory.” C.A. v. William S. Hart Union High Sch. Dist., 53 Cal.4th 861, 868 (2012). The California Tort Claims Act thus provides that, “[e]xcept as otherwise provided by statute,” public entities are “not liable for an injury, whether such injury arises out of an act or omission of the public entity or a public employee or any other person.” Cal. Govt. Code § 815(a). M.K. contends that elsewhere in his complaint, he has alleged violations of COPPA and the California Consumer Privacy Act, Cal. Civ. Code § 1798.100. See Dkt. No. 25 at 5 (citing Dkt. No. 1 ¶¶ 20-24). However, no such claims have been asserted against the District. Nor has M.K. cited any authority that any such claims could be asserted against the District, or that those statutes properly could serve as the basis for a tort claim against the District. Accordingly, M.K.'s “Failure to Protect” claim is dismissed, with leave to amend.
C. California Constitutional Right to Privacy
The right to privacy embodied in article I, section 1 of the California Constitution “creates a right of action against private as well as government entities.” Hill v. Nat'l Collegiate Athletic Ass'n, 7 Cal.4th 1, 20 (1994). To state a claim for invasion of privacy under the California Constitution, M.K. must plead facts establishing “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.” Id. at 39-40. “Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right. Thus, the extent and gravity of the invasion is an indispensable consideration in assessing an alleged invasion of privacy.” Id. at 37.
In his complaint, M.K. alleges that he “has a reasonable expectations [sic] of privacy in his mobile devices and his online behavior, generally.” Dkt. No. 1 ¶ 87. He further alleges that both Google and the District were in a “unique position to monitor [his] behavior through their access to [his] privately owned personal computer and his Chrome Book during non[-]school hours.” Id. ¶ 88. However, the complaint contains no allegations that would permit a plausible inference that the District took any such actions. While the complaint also asserts that both defendants “intentionally design[ed] the App to secretly obtain, and improperly gain knowledge of, review, and or retain [M.K.]'s activities” (id. ¶ 89), M.K. fails to plead facts identifying the “App” being referred to, much less any facts plausibly establishing that the District had any role in designing it. Accordingly, M.K.'s claim for violation of his California constitutional right to privacy is dismissed with leave to amend.
IV. LEAVE TO AMEND
Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely given when justice so requires,” because “the court must remain guided by the underlying purpose of Rule 15 . . . to facilitate decisions on the merits, rather than on the pleadings or technicalities.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (internal quotation marks and citation omitted). “The decision of whether to grant leave to amend nevertheless remains within the discretion of the district court,” which may deny leave to amend if allowing amendment would unduly prejudice the opposing party, cause undue delay, or be futile, or if the party seeking amendment has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ'g, 512 F.3d 522, 532 (9th Cir. 2008) (citing Foman v. Davis, 371 U.S. 178, 182 (1962)).
Although M.K. has articulated some additional facts that he believes could be alleged on an amendment, the Court harbors some uncertainty whether those additional facts will correct all of the pleading deficiencies identified in the District's present motion. Nevertheless, as the law generally favors resolving matters on the merits, the Court will permit M.K. to amend his claims. Amendment is limited to the claims asserted in his complaint.
In the proceedings concerning the District's present motion to dismiss, as well as the separate motion to dismiss filed by Google, M.K. has alluded to potential other claims he believes he may have, but has not pled. Needless to say, M.K. has not taken steps to properly seek leave to amend his complaint to add any other claims for relief.
V. CONCLUSION
Based on the foregoing, Google's motion to dismiss is granted with leave to amend, consistent with the rulings in this order. M.K.'s amended complaint shall be filed by April 10, 2023. The District's response to the amended complaint shall be filed by April 24, 2023.
The initial case management conference is re-set for May 30, 2023, 1:30 p.m. The parties' joint case management statement is due by May 23, 2023. All other related deadlines in the Court's Order Setting Initial Case Management Conference and ADR Deadlines (Dkt. No. 4) are adjusted accordingly.
IT IS SO ORDERED.