Opinion
CV 20-04855 DDP (SKx)
08-06-2021
CONNOR BURNS, Plaintiff, v. MAMMOTH MEDIA, INC., Defendants.
ORDER GRANTING DEFENDANT'S MOTION TO DISMISS [DKT. 19]
DEAN D. PREGERSON UNITED STATES DISTRICT JUDGE.
Presently before the court is Defendant Mammoth Media, Inc. (“Mammoth”)'s Motion to Dismiss. Having considered the submissions of the parties and heard oral argument, the court grants the motion and adopts the following Order.
I. Background
Plaintiff Connor Burns, a citizen of Idaho, downloaded Mammoth's mobile “Wishbone” application (“app”) when he was fourteen years old. (First Amended Complaint (“FAC”) ¶ 2.) To use the app, Plaintiff was required to create an account, select a username and password, and provide his e-mail address. (Id.). Plaintiff deleted the app soon after downloading it, but did not delete his account. (FAC ¶ 3.)
Four years later, Mammoth informed Plaintiff that it had suffered a data breach, and that Wishbone users' “usernames, emails, phone numbers, timezone/region, full name, bio, gender, hashed [i.e., encrypted, ] passwords, and profile pictures” may have been compromised. (FAC ¶ 4.) Plaintiff also alleges that Mammoth collected and maintained other types of user data that were also compromised, including date of birth, location information, user settings, social media profiles, and “access tokens.” (Id. ¶¶ 15, 25.) Plaintiff further alleges that data pertaining to 40 million Wishbone users was circulated for sale on the dark web, and ultimately released for free. (Id. ¶ 22.)
Plaintiff alleges that, following the Wishbone data breach, his Spotify and Reddit accounts were compromised, forcing him to change his passwords. (FAC ¶¶ 57-58.) Plaintiff also began receiving spam e-mails. (Id.) Plaintiff spent about three hours changing other online passwords, setting up fraud alerts, and reviewing his bank accounts for fraudulent transactions. (Id. ¶ 58.) Plaintiff alleges that the theft of his data will result in identity theft and fraud, lowered credit scores resulting from fraudulent activity, loss of access to online and financial accounts, and the loss of time and enjoyment stemming from efforts to mitigate or prevent identity theft. (Id. ¶ 64.)
The FAC alleges, on behalf of a putative class, five causes of action for negligence, declaratory judgment, breach of confidence, violation of California's Unfair Competition Law (Cal. Bus. & Prof. Code ¶¶ 17220, et seq.), and violations of “data breach statutes” of thirty-eight different states. Defendant Mammoth now seeks to dismiss the FAC pursuant to Federal Rule of Procedure 12(b)(1) and Rule 12(b)(6).
II. Legal Standard
A motion under Rule 12(b)(1) may challenge the court's jurisdiction facially, based on the legal sufficiency of the claim, or factually, based on the legal sufficiency of the jurisdictional facts. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000)(citing 2 James Wm. Moore et al., Moore's Federal Practice 12.30[4], at 12-38 to 12-41 (3d ed.1999)). Where the motion attacks the complaint on its face, the court considers the complaint's allegations to be true, and draws all reasonable inferences in the plaintiff's favor. Doe v. Holy See, 557 F.3d 1066, 1073 (9th Cir. 2009). In a factual challenge, the court is not required to accept the allegations of the complaint as true and may consider additional evidence outside of the pleadings. Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). Once the moving party has presented evidence showing a lack of subject-matter jurisdiction, the burden shifts to “the party opposing the motion [to] furnish affidavits or other evidence necessary to satisfy its burden of establishing subject matter jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). If the plaintiff cannot meet its burden of establishing the jurisdiction it seeks to invoke, the court must dismiss the case. Fed.R.Civ.P. 12(h)(3).
When considering a Rule 12(b)(6) motion, a court must “accept as true all allegations of material fact and must construe those facts in the light most favorable to the plaintiff.” Resnick v. Hayes, 213 F.3d 443, 447 (9th Cir. 2000). A complaint will survive a motion to dismiss when it “contain[s] sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)(quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Although a complaint need not include “detailed factual allegations, ” it must offer “more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Iqbal, 556 U.S. at 678. Conclusory allegations or allegations that are no more than a statement of a legal conclusion “are not entitled to the assumption of truth.” Id. at 679. In other words, a pleading that merely offers “labels and conclusions, ” a “formulaic recitation of the elements, ” or “naked assertions” will not be sufficient to state a claim upon which relief can be granted. Id. at 678 (citations and internal quotation marks omitted).
“When there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement of relief.” Iqbal, 556 U.S. at 679. Plaintiffs must allege “plausible grounds to infer” that their claims rise “above the speculative level.” Twombly, 550 U.S. at 555-56. “Determining whether a complaint states a plausible claim for relief” is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679.
III. Discussion
A party invoking federal jurisdiction bears the burden of demonstrating that he has Article III standing. Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992). To meet that burden, “a plaintiff must show (1) it has suffered an ‘injury in fact' that is . . . actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Friends of the Earth, Inc. v. Laidlaw Env't Servs. (TOC), Inc., 528 U.S. 167, 181 (2000). “Rule 12(b)(1) jurisdictional attacks can be either facial or factual.” White, 227 F.3d at 1242. “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air, 373 F.3d 1035 at 1039. The distinction is important. When considering a facial attack, the court considers all factual allegations to be true and draws all inferences in favor of the plaintiff. Doe, 557 F.3d at 1073. “In resolving a factual attack on jurisdiction, [however], the district court may review evidence beyond the complaint without converting the motion to dismiss into a motion for summary judgment.” Safe Air, 373 F.3d at 1039.
Here, although Mammoth's factual and facial challenges are interwoven to some extent, Mammoth clearly asserts a factual challenge to Plaintiff's standing. (E.g., Memorandum in Support of Motion at 1:20-21 (“Mammoth asserts both a facial and factual attack . . .), 6:24-25 (“Mammoth makes both a facial and a factual challenge here.”) A party making a factual challenge under Rule 12(b)(1) must present affidavits or other evidence. Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 F.3d 1036, 1039 n.2 (9th Cir. 2003) (citing St. Clair v. City of Chico, 880 F.2d 199, 201 (9th Cir. 1989)). Mammoth supports its factual challenge with the Declaration of Brian DeBoer, Mammoth's Chief Technology Officer. DeBoer states that Plaintiff's compromised information includes “his name, his username for the Wishbone app, his email address, a record of the date he created his Wishbone profile, his gender, the user ID number that Mammoth assigned to him, his encrypted password, his Mammoth assigned access token, an authorization token, a Facebook ID, a url to an image, country, time zone, Apple idfa, stickers left, and the date last updated.” (DeBoer Decl. ¶ 6.) DeBoer further states that Plaintiff's compromised information did not include his birth date, address, social security number, or any financial information. (Id. ¶ 7.) And, critically, DeBoer's declaration states that the nature of Plaintiff's information is such that it cannot be used to access Spotify, Reddit, or any other account. (Id. ¶¶ 9-14.)
As Plaintiff acknowledges, the FAC does not allege that Plaintiff used his Wishbone password, an encrypted version of which was compromised, as his Spotify or Reddit password.
Rather than address these facts directly, Plaintiff contends that the DeBoer declaration is not sufficient to raise a factual challenge because it does not cast doubt on the veracity of any of Plaintiff's allegations. (Response at 4:19-24.) Plaintiff's FAC, however, is premised largely on the allegation that “[a]s a result of Mammoth's failure to protect the [information] it was entrusted with, Plaintiff and class members have been exposed to and/or are at a significant risk of identity theft, financial fraud, and other identity-related fraud into the indefinite future.” (FAC ¶ 8.) The FAC goes on to allege a host of other harms flowing from the data breach, including expenses associated with credit monitoring and protection services, the loss of access to online accounts, lowered credit scores, and loss of time and enjoyment related to mitigation efforts in the wake of fraud and identity theft. (FAC ¶ 64.) These allegations are impossible to square with DeBoer's declaration that Plaintiff's compromised information is essentially useless. If, as DeBoer's declaration suggests, Plaintiff's allegations as to the likelihood of identity theft and fraud are false, Plaintiff cannot possibly establish an injury in fact, let alone an injury that is traceable to Mammoth or redressable by order of this Court.
The FAC also makes reference to Plaintiff's loss of the “inherent value” of his information. (FAC ¶¶ 34, 64(c).) Although Plaintiff's response to Mammoth's Motion to Dismiss does mention this theory as it relates to standing under California's Unfair Competition Law (Response at 18), Plaintiff does not discuss the inherent value theory as it pertains to Article III standing. It is not entirely clear that Mammoth's factual challenge encompasses this theory. Although the DeBoer declaration could, perhaps, be read to suggest that Plaintiff's compromised data has no value, insofar as DeBoer opines that the data is essentially useless, the declaration does not use the term “inherent value” or take an express position on the truth of Plaintiff's allegation as to the existence of any such value. The court notes, however, that several courts have rejected similar theories as implausible, speculative, or otherwise infirm, especially where, as here, there is no allegation of a legitimate market for the information. See, e.g., In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F.Supp.3d 767, 784 (N.D. Cal. 2019) (“The plaintiffs do not plausibly allege that they intended to sell their non-disclosed personal information to someone else. Nor, in any event, do they plausibly allege that someone else would have bought it as a stand-alone product. The plaintiffs' economic-loss theory is therefore purely hypothetical and does not give rise to standing.”); Svenson v. Google Inc., 65 F.Supp.3d 717, 724-25 (N.D. Cal. 2014); Low v. LinkedIn Corp., No. 11-CV-01468-LHK, 2011 WL 5509848, at *5 (N.D. Cal. Nov. 11, 2011); LaCourt v. Specific Media, Inc., No. SACV 10-1256 GW JCGX, 2011 WL 1661532, at *4-5 (C.D. Cal. Apr. 28, 2011); Chambliss v. Carefirst, Inc, 189 F.Supp.3d 564, 572 (D. Md. 2016); Green v. eBay Inc., No. CIV.A. 14-1688, 2015 WL 2066531, at *5 (E.D. La. May 4, 2015); cf. In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 149 (3d Cir. 2015); Adkins v. Facebook, Inc., No. C 18-05982 WHA, 2019 WL 3767455, at *3 (N.D. Cal. Aug. 9, 2019); but see In re Anthem, Inc. Data Breach Litig., No. 15-MD-02617-LHK, 2016 WL 3029783, at *15 (N.D. Cal. May 27, 2016).
Plaintiff's reliance on In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018) is misplaced. Although Plaintiff correctly observes that the Zappos court refused to consider material extrinsic to the plaintiff's complaint, it did so because, as the court explicitly noted, the defendant “presented its arguments as a facial, not a factual, attack on standing.” Zappos, 888 F.3d at 1023 n.2, 1028. Where, as here, “the defendant raises a factual attack, the plaintiff must support h[is] jurisdictional allegations with competent proof, under the same evidentiary standard that governs in the summary judgment context.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (internal quotation marks and citation omitted); see also Augustine v. United States, 704 F.2d 1074, 1077 (9th Cir. 1983). “The plaintiff bears the burden of proving by a preponderance of the evidence that each of the requirements for subject-matter jurisdiction has been met.” Leite, 749 F.3d at 1121 (emphasis added). “Once the moving party has converted the motion to dismiss into a factual motion by presenting affidavits or other evidence properly brought before the court, the party opposing the motion must furnish affidavits or other evidence necessary to satisfy its burden . . . .” Savage, 343 F.3d at 1039 n. 2; see also Johnson v. Oishi, 362 F.Supp.3d 843, 847 (E.D. Cal. 2019) (“If the plaintiff's allegations of jurisdictional facts are challenged by the adversary in the appropriate manner, the plaintiff cannot rest on the mere assertion that factual issues may exist.”); Strojnik v. 8757 Rio San Diego Mission Valley Owner, LLC, No. 20CV0384 DMS (MSB), 2020 WL 5544220, at *2 (S.D. Cal. Sept. 16, 2020). Plaintiff has produced no such evidence here.
Plaintiff also argues, briefly, that dismissal under Rule 12(b)(1) is not appropriate because the factual questions regarding jurisdiction are “inextricably intertwined.” (Response at 6 n.2.) Generally, “[j]urisdictional finding of genuinely disputed facts is inappropriate when ‘the jurisdictional issue and substantive issues are so intertwined that the question of jurisdiction is dependent on the resolution of factual issues going to the merits' of an action.” Sun Valley Gasoline, Inc. v. Ernst Enterprises, Inc., 711 F.2d 138, 139 (9th Cir. 1983) (quoting Augustine, 704 F.2d at 1077) (emphasis added). “Normally, the question of jurisdiction and the merits of an action will be considered intertwined where . . .a statute provides the basis for both the subject matter jurisdiction of the federal court and the plaintiff's substantive claim for relief.” Sun Valley, 711 F.2d at 139. Because such is not the case here, Defendant suggests that the jurisdictional facts are not “intertwined” with the merits. (Reply at 3.) Defendant, however, takes too narrow a view. Although situations where a federal statute provides both the jurisdictional and substantive basis for a claim may present archetypical examples of intertwined facts, courts have not limited their inquiries to the question whether or to what extent a federal statute is at issue. See, e.g., Autery v. United States, 424 F.3d 944, 956 (9th Cir. 2005); Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987); Rosales v. United States, 824 F.2d 799, 803 (9th Cir. 1987).
Here, there is significant overlap of jurisdictional and substantive allegations regarding Plaintiff's risk of identity theft, fraud, and related harms. There is, however, no corresponding intertwining of jurisdictional and merits-related, disputed facts. As discussed above, Plaintiff has failed to meet his burden to respond to Defendant's evidence with any competent proof. Under such circumstances, courts have concluded that “material facts concerning Article III's causation element are undisputed since Plaintiffs did not produce evidence to support that issue. Consequently, any factual overlap between Plaintiffs' standing and the merits is not an impediment to granting [a] Rule 12(b)(1) motion.” Foster v. Essex Prop., Inc., No. 5:14-CV-05531-EJD, 2017 WL 264390, at *4 (N.D. Cal. Jan. 20, 2017); cf. Leite, 749 F.3d at 1122 n.3 ([“[A] court must leave the resolution of material factual disputes to the trier of fact when the issue of subject-matter jurisdiction is intertwined with an element of the merits of the plaintiff's claim.”)(emphasis added); Sun Valley, 711 F.2d at 139 (“Jurisdictional finding of genuinely disputed facts is inappropriate when the jurisdictional issue and substantive issues are so intertwined . . . .”)(internal quotation mark omitted) (emphasis added); Augustine, 704 F.2d at 1077 (“In ruling on a jurisdictional motion involving factual issues which also go to the merits, the trial court should employ the standard applicable to a motion for summary judgment. . . . [T]he moving party should prevail only if the material jurisdictional facts are not in dispute . . . .”)(emphasis added); Williams v. Facebook, Inc., 498 F.Supp.3d 1189, 1195-96 (N.D. Cal. 2019) ([]Plaintiffs initially failed to submit any competing evidence to create a dispute of material fact warranting deferral . . . .”).
Because the only evidence in the record currently before the court indicates that the Mammoth data breach could not possibly have caused the risk of identity theft, fraud, and attendant harms alleged in the FAC, Plaintiff's complaint must be dismissed for lack of standing.
Having concluded that the FAC must be dismissed for lack of standing, the court does not reach Defendant's other arguments.
IV. Conclusion
For the reasons stated above, Defendant's Motion to Dismiss is GRANTED. Plaintiff's FAC is DISMISSED, with leave to amend. Any amended complaint shall be filed within fourteen days of the date of this Order.
IT IS SO ORDERED.