Opinion
Case No. 22-cv-06823-JST
2023-05-11
J. DOE 1, et al., Plaintiffs, v. GITHUB, INC., et al., Defendants.
Cadio R. Zirpoli, Christopher Kar-Lun Young, Steven Noel Williams, Travis Luke Manfredi, Joseph R. Saveri, Elissa Amlin Buchanan, Joseph Saveri Law Firm, LLP, San Francisco, CA, Matthew Butterick, Matthew Butterick, Attorney at Law, Los Angeles, CA, for Plaintiffs. Alyssa M. Caridis, William Wayne Oxley, Orrick, Herrington & Sutcliffe LLP, Los Angeles, CA, Annette L. Hurst, Daniel Denny Justice, Orrick, Herrington & Sutcliffe LLP, San Francisco, CA, for Defendants GitHub, Inc., Microsoft Corporation. Michael A. Jacobs, Tiffany Cheung, Joseph Charles Gratz, Melody Ellen Wong, Morrison & Foerster LLP, San Francisco, CA, Alexandra Marie Ward, Los Angeles, CA, Allyson Roz Bennett, Rose S. Lee, Morrison & Foerster LLP, Los Angeles, CA, for Defendants Openai, Inc., Openai, L.P., Openai GP, L.L.C., Openai Startup Fund GP I, L.L.C., Openai Startup Fund I, L.P., Openai Startup Fund Management, LLC.
Cadio R. Zirpoli, Christopher Kar-Lun Young, Steven Noel Williams, Travis Luke Manfredi, Joseph R. Saveri, Elissa Amlin Buchanan, Joseph Saveri Law Firm, LLP, San Francisco, CA, Matthew Butterick, Matthew Butterick, Attorney at Law, Los Angeles, CA, for Plaintiffs. Alyssa M. Caridis, William Wayne Oxley, Orrick, Herrington & Sutcliffe LLP, Los Angeles, CA, Annette L. Hurst, Daniel Denny Justice, Orrick, Herrington & Sutcliffe LLP, San Francisco, CA, for Defendants GitHub, Inc., Microsoft Corporation. Michael A. Jacobs, Tiffany Cheung, Joseph Charles Gratz, Melody Ellen Wong, Morrison & Foerster LLP, San Francisco, CA, Alexandra Marie Ward, Los Angeles, CA, Allyson Roz Bennett, Rose S. Lee, Morrison & Foerster LLP, Los Angeles, CA, for Defendants Openai, Inc., Openai, L.P., Openai GP, L.L.C., Openai Startup Fund GP I, L.L.C., Openai Startup Fund I, L.P., Openai Startup Fund Management, LLC.
ORDER GRANTING IN PART AND DENYING IN PART MOTIONS TO DISMISS
Re: ECF Nos. 50, 53 JON S. TIGAR, United States District Judge
Before the Court are motions to dismiss filed by Defendants GitHub, Inc. and Microsoft Corporation, ECF No. 50; and Defendants OpenAI, Inc., OpenAI, L.P., OpenAI GP, L.L.C., OpenAI Startup Fund GP I, L.L.C., OpenAI Startup Fund I, L.P., and OpenAI Startup Fund Management, LLC (collectively "OpenAI Defendants"), ECF No. 53. Court will grant the motions in part and deny them in part.
I. BACKGROUND
Plaintiffs are software developers who challenge Defendants' development and operation of Copilot and Codex, two artificial intelligence-based coding tools. For the purposes of the present motions, the Court accepts as true the following facts in the operative complaint.
Plaintiffs define "artificial intelligence" ("AI") as "a computer program that algorithmically simulates human reasoning or inference, often using statistical methods." Compl. ¶ 2.
By stipulation and order, ECF No. 47, the operative complaint in the consolidated case is that filed in Doe 3 et al. v. GitHub, Inc. et al., No. 22-cv-7074-JST, ECF No. 1. All references to the complaint in this order refer to the operative complaint in the consolidated case.
GitHub, which was acquired by Microsoft in 2018, is the largest internet hosting service for software projects stored in Git, a widely used open-source version control system for managing software source code. Using GitHub permits software developers or programmers to collaborate on projects stored in repositories. Repositories may be private or public; anyone can view and access code stored in public repositories.
All code uploaded to GitHub is subject to the GitHub Terms of Service, which provide that users retain ownership of any content they upload to GitHub, but grant GitHub the "right to store, archive, parse, and display [the content], and make incidental copies, as necessary to provide the Service, including improving the Service over time." No. 22-cv-7074-JST, ECF No. 1-2 at 27. This "includes the right to do things like copy [the code] to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; [and] share it with other users." Id. at 27-28. Further, the Terms of Service provide that users who set their repositories to be viewed publicly "grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform [the content] through the GitHub Service and to reproduce [the content] solely on GitHub as permitted through GitHub's functionality." Id. at 28.
Without AI-based assistance, programmers generally write code "both by originating code from the writer's own knowledge of how to write code as well as by finding pre-written portions of code that—under the terms of the applicable license—may be incorporated into the coding project." Compl. ¶ 78. Plaintiffs have each published licensed materials in which they hold a copyright interest to public repositories on GitHub. When creating a new repository, a GitHub user may "select[ ] one of thirteen licenses from a dropdown menu to apply to the contents of that repository." Id. ¶ 34 n.4. Two of the suggested licenses waive copyrights and related rights. The remaining eleven suggested licenses require that any derivative work or copy of the licensed work include attribution to the owner, inclusion of a copyright notice, and inclusion of the license terms. Each Plaintiff published code to a public repository on GitHub under one of the eleven suggested licenses that include these three requirements.
These eleven licenses are (1) Apache License 2.0; (2) GNU General Public License version 3 ("GPL-3.0"); (3) MIT License; (4) The 2-Clause BSD License ("BSD 2"); (5) The 3-Clause BSD License ("BSD 3"); (6) Boost Software License; (7) Eclipse Public License 2.0; (8) GNU Affero General Public License version 3 ("AGPL-3.0"); GNU General Public License version 2 ("GPL 2"); (10) GNU Lesser General Public License version 2.1 ("LGPL-2.1"); and (11) Mozilla Public License 2.0. Compl. ¶ 34 n.4.
In June 2021, GitHub and OpenAI released Copilot, an AI-based program that can "assist software coders by providing or filling in blocks of code using AI." Id. ¶ 8. In August 2021, OpenAI released Codex, an AI-based program "which converts natural language into code and is integrated into Copilot." Id. ¶ 9. Codex is integrated into Copilot: "GitHub Copilot uses the OpenAI Codex to suggest code and entire functions in real-time, right from your editor." Id. ¶ 47 (quoting GitHub website). GitHub users pay $10 per month or $100 per year for access to Copilot. Id. ¶ 8.
Codex and Copilot employ machine learning, "a subset of AI in which the behavior of the program is derived from studying a corpus of material called training data." Id. ¶ 2. Using this data, "through a complex probabilistic process, [these programs] predict what the most likely solution to a given prompt a user would input is." Id. ¶ 79. Codex and Copilot were trained on "billions of lines" of publicly available code, including code from public GitHub repositories. Id. ¶¶ 82-83.
Despite the fact that much of the code in public GitHub repositories is subject to open-source licenses which restrict its use, id. ¶ 20, Codex and Copilot "were not programmed to treat attribution, copyright notices, and license terms as legally essential," id. ¶ 80. Copilot reproduces licensed code used in training data as output with missing or incorrect attribution, copyright notices, and license terms. Id. ¶¶ 56, 71, 74, 87-89. This violates the open-source licenses of "tens of thousands—possibly millions—of software developers." Id. ¶ 140. Plaintiffs additionally allege that Defendants improperly used Plaintiffs' "sensitive personal data" by incorporating the data into Copilot and therefore selling and exposing it to third parties. Id. ¶¶ 225-39.
Plaintiffs filed multiple cases against Defendants, which were subsequently consolidated. ECF No. 47. Plaintiffs, on behalf of themselves and two putative classes, plead twelve counts against Defendants: (1) violation of the Digital Millennium Copyright Act ("DMCA"), 17 U.S.C. §§ 1201-05; (2) common law breach of open-source licenses; (3) common law tortious interference in a contractual relationship; (4) common law fraud; (5) false designation of origin in violation of the Lanham Act, 15 U.S.C. § 1125; (6) unjust enrichment in violation of Cal. Bus. & Prof. Code §§ 17200, et seq., and the common law; (7) unfair competition in violation of the Lanham Act, 15 U.S.C. § 1125; Cal. Bus. & Prof. Code §§ 17200, et seq., and the common law; (8) breach of contract for violation of the GitHub Privacy Policy and Terms of Service; (9) violation of the California Consumer Privacy Act ("CCPA"); (10) common law negligence; (11) common law civil conspiracy; and (12) declaratory relief under 28 U.S.C. § 2201(a) and Cal. Code Civ. Proc. § 1060. Defendants now move to dismiss the complaint. ECF Nos. 50, 53.
The "Injunctive Relief Class" and "Damages Class" are each defined as: "All persons or entities domiciled in the United States that[ ] (1) owned an interest in at least one [U.S.] copyright in any work; (2) offered that work under one of GitHub's Suggested Licenses; and (3) stored Licensed Materials in any public GitHub repositories at any time between January 1, 2015 and the present (the 'Class Period')." Compl. ¶ 34 (footnote omitted).
While Plaintiffs plead several common law tort claims, they do not identify the state law which applies to each claim. "[D]ue to variances among state laws, failure to allege which state law governs a common law claim is grounds for dismissal." In re Nexus 6P Prods. Liab. Litig., 293 F. Supp. 3d 888, 933 (N.D. Cal. 2018) (quoting Romero v. Flowers Bakeries, LLC, No. 14-cv-05189-BLF, 2016 WL 469370, at *12 (N.D. Cal. Feb. 8, 2016)). With respect to the state law claims in any future amended complaint, Plaintiffs shall identify the state under whose law the claim is brought. When claims which share a legal theory are brought under multiple laws (for example, a federal statute, a state statute, and common law, such as Plaintiffs' claim for unfair competition), Plaintiffs shall state each claim as a separate count. For the purposes of deciding the present motion to dismiss, the Court interprets the complaint as asserting the common law claims of Counts 2, 3, 4, 6, 7, 10, and 11 under California law.
II. JURISDICTION
The Court has jurisdiction over Plaintiffs' federal claims under 28 U.S.C. § 1331 and supplemental jurisdiction over Plaintiffs' state law claims under 28 U.S.C. § 1367.
III. LEGAL STANDARD
A. Rule 12(b)(1)
"Article III of the Constitution confines the federal judicial power to the resolution of 'Cases' and 'Controversies.' " TransUnion LLC v. Ramirez, 594 U.S. 413, 141 S. Ct. 2190, 2203, 210 L.Ed.2d 568 (2021). "For there to be a case or controversy under Article III, the plaintiff must have a 'personal stake' in the case—in other words, standing." Id. (quoting Raines v. Byrd, 521 U.S. 811, 819, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997)). A defendant may attack a plaintiff's assertion of jurisdiction by moving to dismiss under Rule 12(b)(1) of the Federal Rules of Civil Procedure. Cetacean Cmty. v. Bush, 386 F.3d 1169, 1174 (9th Cir. 2004); see also Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011) ("[L]ack of Article III standing requires dismissal for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1).").
"A Rule 12(b)(1) jurisdictional attack may be facial or factual." Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). "In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction." Id. Where, as here, a defendant makes a facial attack, the court assumes that the complaint's allegations are true and draws all reasonable inferences in the plaintiff's favor. Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004).
"Dismissal under [Federal Rule of Civil Procedure] 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory." Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). Facts pleaded by a plaintiff "must be enough to raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007).
"To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.' " Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Twombly, 550 U.S. at 570, 127 S.Ct. 1955). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. In determining whether a plaintiff has met this plausibility standard, the Court must "accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party." Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005).
C. Leave to Amend
Leave to amend a complaint "shall be freely given when justice so requires." Fed. R. Civ. P. 15(a)(2). The decision of whether to grant leave to amend is "within the discretion of the district court, which may deny leave due to 'undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the opposing party by virtue of allowance of the amendment, and futility of amendment.' " Leadsinger, Inc. v. BMG Music Pub., 512 F.3d 522, 532 (9th Cir. 2008) (quoting Foman v. Davis, 371 U.S. 178, 182, 83 S.Ct. 227, 9 L.Ed.2d 222 (1962)). IV. DISCUSSION
A. Article III Standing
Defendants argue that Plaintiffs lack Article III standing to assert their claims and that the Court therefore lacks subject-matter jurisdiction over this action.
Both parties impermissibly incorporate substantive material by reference across their briefs. "The incorporation of substantive material by reference is not sanctioned by the federal rules." Swanson v. U.S. Forest Serv., 87 F.3d 339, 345 (9th Cir. 1996). In the future, all arguments the parties seek to make must be raised in the briefing on a particular motion. See Woolfson v. Conn Appliances, Inc., No. 21-cv-07833-MMC, 2022 WL 3139522, at *6 (N.D. Cal. Aug. 5, 2022) (declining to consider substantive arguments purportedly incorporated by reference); Williams v. Cnty. of Alameda, 26 F. Supp. 3d 925, 947 (N.D. Cal. 2014) ("[T]he Court will not consider the arguments that Plaintiff improperly seeks to incorporate by reference. This Court only considers arguments that are specifically and distinctively raised by the parties in their briefs.").
"[T]o establish standing, a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant, and (iii) that the injury would likely be redressed by judicial relief." TransUnion, 141 S. Ct. at 2203. "The party invoking federal jurisdiction bears the burden of establishing these elements." Lujan v. Defenders of Wildlife, 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). "Where, as here, a case is at the pleading stage, the plaintiff must 'clearly . . . allege facts demonstrating' each element." Spokeo, Inc. v. Robins, 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) (quoting Warth v. Seldin, 422 U.S. 490, 518, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975)).
"A plaintiff must demonstrate constitutional standing separately for each form of relief requested." Davidson v. Kimberly-Clark, 889 F.3d 956, 969 (9th Cir. 2018). In a putative class action, named plaintiffs "must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent." Warth, 422 U.S. at 502, 95 S.Ct. 2197.
Plaintiffs advance two main theories of harm. One theory is that Defendants have shared, sold, and exposed and will continue to share, sell, and expose Plaintiffs' personal information, harming Plaintiffs' rights to privacy and the protection of their personal data. The second is that Defendants' use of licensed code as training data for Codex and Copilot harms Plaintiffs' property interests in the licensed code because Copilot already has or likely will reproduce Plaintiffs' code in violation of those licenses.
1. Injury to Privacy Rights
Defendants argue that Plaintiffs fail to plausibly allege any disclosure of personal information, and therefore fail to allege an actual or imminent injury sufficient to confer standing. In the complaint, Plaintiffs do not identify the specific sensitive or private information at issue. Plaintiffs therefore do not allege facts sufficient for the Court to infer that Plaintiffs' privacy interests are implicated by the alleged misuse of such information. See Ji v. Naver Corp., No. 21-cv-05143-HSG, 2022 WL 4624898, at *7 (N.D. Cal. Sept. 30, 2022) (dismissing privacy-based claim for lack of standing where plaintiffs "have not alleged enough facts to show that the [personal data at issue] are the type of information that could give rise to a privacy injury"); I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034, 1049 (N.D. Cal. 2022) (evaluating whether privacy interests were implicated by allegedly disclosed personal information to determine whether plaintiffs had standing).
Plaintiffs have not met their burden to allege facts demonstrating an injury-in-fact sufficient to confer standing for their privacy-based claims. Plaintiffs' claims for breach of the GitHub Privacy Policy and Terms of Service, violation of the CCPA, and negligence are dismissed with leave to amend.
2. Injury to Property Rights
Defendants argue that Plaintiffs do not identify any instance of Copilot reproducing Plaintiffs' licensed code and therefore fail to plead a particularized injury sufficient to confer standing.
"For an injury to be 'particularized,' it 'must affect the plaintiff in a personal and individual way.' " Spokeo, 578 U.S. at 339, 136 S.Ct. 1540 (quoting Lujan, 504 U.S. at 560 n.1, 112 S.Ct. 2130). "[A]t an irreducible minimum, Art. III requires the party who invokes the court's authority to 'show that he personally has suffered some actual or threatened injury.' " Valley Forge Christian Coll. v. Ams. United for Separation of Church and State, Inc., 454 U.S. 464, 472, 102 S.Ct. 752, 70 L.Ed.2d 700 (1982) (quoting Gladstone Realtors v. Village of Bellwood, 441 U.S. 91, 99, 99 S.Ct. 1601, 60 L.Ed.2d 66 (1979)).
Plaintiffs argue that they "have alleged the requisite particularized injury" because they "allege that Defendants have violated provisions of [the] open-source licenses" under which Plaintiffs published their code. ECF No. 67 at 14. In the complaint, Plaintiffs allege that Defendants violate those licenses because Copilot reproduces Plaintiffs' code as output with missing or incorrect attribution, copyright notices, and license terms. However, while Plaintiffs identify several instances in which Copilot's output matched licensed code written by a Github user, Compl. ¶¶ 56, 71, 74, 87-89, none of these instances involve licensed code published to GitHub by Plaintiffs. Because Plaintiffs do not allege that they themselves have suffered the injury they describe, they do not have standing to seek retrospective relief for that injury.
In opposition, Plaintiffs suggest they were also injured by Defendants' use of Plaintiffs' licensed code as training data for Codex and Copilot. ECF No. 66 at 12, 21. But Plaintiffs' complaint does not describe such an injury. In the complaint, Plaintiffs allege that "Defendants had access to but were not licensed by Plaintiffs . . . to train any . . . functional prediction engine using the Licensed Materials." Compl. ¶ 149; see also id. ¶ 37 (describing one question common to the putative class as "[w]hether Defendants violated the Licenses governing use of the Licensed Materials by using them to train Copilot"). However, Plaintiffs do not actually allege that Defendants' use of licensed code to train Codex and Copilot constituted a breach of the open-source licenses at issue. See id. ¶¶ 172-87 (alleging that Defendants breached the licenses by failing to provide attribution in output, failing to provide copyright notices in output, and failing to identify applicable licenses and the text of those licenses in output). Because Plaintiffs do not allege they were injured by Defendants' use of licensed code as training data, the Court does not address whether such an injury is sufficient to confer standing.
This problem is related to redressability: Plaintiffs allege no injury redressable by the monetary damages they seek.
Plaintiffs also argue that they "also allege an imminent and significant harm—now that their software code is part of the training data . . . , [it] can be output at any time without the legally necessary notices and attribution, leading to increased and imminent risk of misappropriation." ECF No. 67 at 15. To the extent that Plaintiffs allege an injury based on the increased risk of misappropriation of their own licensed code, that injury is sufficiently particularized. However, an increased risk of future harm alone is not sufficiently concrete to confer standing for damages. TransUnion, 141 S. Ct. at 2210-11 (finding "persuasive" argument that, "in a suit for damages, the mere risk of future harm . . . cannot qualify as a concrete harm . . . unless the exposure to the risk of future harm itself causes a separate concrete harm") (emphasis in original); id. at 2213 (holding that "the risk of future harm on its own does not support Article III standing for the plaintiffs' damages claims"). Plaintiffs do not allege any additional, concrete harm associated with this increased risk of misappropriation. Thus, an increased risk of misappropriation cannot provide standing for Plaintiffs' damages claims.
Finally, Plaintiffs argue that, "[g]iven the number of times users may use Copilot, it is a virtual certainty [that] any particular plaintiff's code will be displayed either with copyright notices removed or in violation of Plaintiffs' open-source licenses for profit." ECF No. 67 at 15. Though this does not support standing for retrospective damages - for which, as discussed above, Plaintiffs must allege that they have suffered a qualifying injury-in-fact that has actually occurred to them - it may support standing for injunctive relief.
"[A] person exposed to a risk of future harm may pursue forward-looking, injunctive relief to prevent the harm from occurring, at least so long as the risk of harm is sufficiently imminent and substantial." TransUnion, 141 S. Ct. at 2210. "An allegation of future injury may suffice if the threatened injury is 'certainly impending,' or there is a 'substantial risk that the harm will occur.' " Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158, 134 S.Ct. 2334, 189 L.Ed.2d 246 (2014) (quoting Clapper v. Amnesty Int'l USA, 568 U.S. 398, 414 n.5, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013)). A substantial risk means there is a "realistic danger of sustaining a direct injury." Pennell v. City of San Jose, 485 U.S. 1, 8, 108 S.Ct. 849, 99 L.Ed.2d 1 (1988) (quoting Babbitt v. United Farm Workers Nat'l Union, 442 U.S. 289, 298, 99 S.Ct. 2301, 60 L.Ed.2d 895 (1979)).
Plaintiffs plausibly allege that there is at least a substantial risk that Defendants' programs will reproduce Plaintiffs' licensed code as output. Plaintiffs allege that both Codex and Copilot were trained on data that included all public GitHub repositories. Plaintiffs further allege that the programs reproduce well-known code in response to related prompts and offer several concrete examples of such reproduction. Finally, Plaintiffs allege that GitHub's own internal research shows that Copilot reproduces code from training data "about 1% of the time." Compl. ¶¶ 56, 71, 74, 87-90. Plaintiffs thus plausibly allege that, absent injunctive relief, there is a realistic danger that Codex or Copilot will reproduce Plaintiffs' licensed code as output. Plaintiffs further allege that Defendants have modified Copilot to ensure that it no longer reproduces license text, attribution, and copyright notices. Taking the facts of the complaint as true and construing all inferences in the Plaintiffs' favor, the Court can reasonably infer that, should Plaintiffs' code be reproduced as output, it will be reproduced in a manner that violates the open-source licenses under which Plaintiffs published their code.
Defendants argue that Plaintiffs must also allege facts regarding the type of code they published, what problem that code solves, how frequently that code might appear on GitHub, and how likely it is that a user would enter a prompt that would generate a match to that code. ECF No. 50 at 16. Defendants suggest that, absent such facts, Plaintiffs' alleged injury is too "conjectural or hypothetical" to confer standing. Id. (quoting Lujan, 504 U.S. at 560, 112 S.Ct. 2130). Defendants ask too much of Plaintiffs at the pleading stage. Such facts might help Defendants—the only parties with knowledge of how Copilot and Codex were designed and operate—understand whether Plaintiffs' alleged injury has already occurred or how soon it is likely to occur. However, taking the facts in the complaint as true, and construing all inferences in Plaintiffs' favor, their alleged future injury is neither conjectural nor hypothetical: their licensed code was used to train these programs and there is presently a realistic danger that the code will be reproduced as output.
While Plaintiffs have failed to establish an injury-in-fact sufficient to confer standing for their claims for damages based on injury to property rights, they have standing to pursue injunctive relief on such claims.
B. Proceeding Pseudonymously
Defendants argue that the complaint should be dismissed because Plaintiffs are not entitled to proceed under fictitious names.
Because the caselaw uses "pseudonymous" and "anonymous" interchangeably, this Court does so as well.
"The normal presumption in litigation is that parties must use their real names." Doe v. Kamehameha Schs./Bernice Pauahi Bishop Est., 596 F.3d 1036, 1042 (9th Cir. 2010). Parties may proceed pseudonymously only "in the 'unusual case' when nondisclosure of the party's identity 'is necessary . . . to protect a person from harassment, injury, ridicule or personal embarrassment." Does I Thru XXIII v. Advanced Textile Corp., 214 F.3d 1058, 1067-68 (9th Cir. 2000) (alteration in original) (quoting United States v. Doe, 655 F.2d 920, 922 n.1 (9th Cir. 1981)).
Threats of physical harm "present[ ] the paradigmatic case for allowing anonymity." Kamehameha, 596 F.3d at 1043. Where a party seeks to proceed pseudonymously on the basis of retaliatory harm, "a district court must balance five factors: '(1) the severity of the threatened harm, (2) the reasonableness of the anonymous party's fears, . . . (3) the anonymous party's vulnerability to such retaliation,' (4) the prejudice to the opposing party, and (5) the public interest." Id. at 1042 (quoting Advanced Textile, 214 F.3d at 1068).
Plaintiffs seek to proceed pseudonymously because, "through their counsel, [they] have received legitimate and credible threats of physical violence." ECF No. 67 at 17. Plaintiffs highlight three threatening emails sent to counsel prior to the filing of the operative complaint. All three emails contain veiled threats wishing death upon Plaintiffs' counsel on the basis of his involvement in this lawsuit. ECF No. 68-1 at 2 ("[I]magine shooting against [AI] . . . . [G]o kys . . . . [K]ill urself."); ECF No. 68-2 at 2 ("I hope you f*cking die you piece of sh*t. It's people like you why this world sucks so f*cking bad and we can't have nice things. I literally hope someone murder [sic] you. Go f*cking die."); ECF No. 68-3 at 2 ("[G]o f*cking cry about [G]it[H]ub you f*cking piece of sh*t n****r, [I] hope your throat gets cut open and every single family member of you [sic] is burnt to death."). Plaintiffs' counsel have received "many" such messages. ECF No. 67 at 17. Plaintiffs argue they should be permitted to proceed pseudonymously because they reasonably fear they will be subject to threats of retaliation and violence if their identities are disclosed.
The first two factors of the balancing test for retaliatory harm - severity of the threatened harm and the reasonableness of the fear of such harm - "are intricately related and should be addressed together." Kamehameha, 596 F.3d at 1040. Plaintiffs need not prove the speakers "intend to carry out the threatened retaliation," but rather "that a reasonable person would believe that the threat might actually be carried out." Advanced Textile, 214 F.3d at 1071. "It is in the particular purview of the district court to view alleged threats in context and determine what the 'reasonable' person in the plaintiffs' situation would fear." Kamehameha, 596 F.3d at 1044. "In context, a plaintiff might reasonably fear a veiled threat of violence." Id.
Of note, the Ninth Circuit has explained that the standard for reasonable fear in this context is more permissive than in First Amendment "true threat" cases. Kamehameha, 596 F.3d at 1044 n.6 ("The First Amendment cases discussing the concept of a 'true threat' . . . pose a higher bar to finding a reasonable fear. In those cases, one party's fear of the threat must be weighed against the opposing party's first amendment right to speak freely because the threatened party seeks to prevent the other party's speech.").
The threatened harm in this case - death - is plainly severe. Id. at 1043 (describing threats of physical retaliation, including death, as "undoubtedly severe"); Doe v. Stegall, 653 F.2d 180, 186 (5th Cir. 1981) (permitting plaintiffs to proceed pseudonymously where they faced "threats of violence," including veiled death threats, "generated by this case"); Doe v. Univ. Acct. Serv., LLC, No. 09-CV-01563-BAS-JLB, 2022 WL 623913, at *4 (S.D. Cal. Mar. 3, 2022) (permitting plaintiff to proceed pseudonymously where he received death threats). While the threatening emails were not sent to Plaintiffs directly, the emails wish death upon Plaintiffs' counsel on the basis of their involvement in this lawsuit. It is reasonable for Plaintiffs to fear that such threats might be carried out against them if their identities were to become public.
GitHub and Microsoft suggest that Plaintiffs' fear is unreasonable because "the types of nasty messages at issue here are a fact of modern life in the era of internet 'trolls.' " ECF No. 72 at 19. GitHub and Microsoft do not explain why the rise of internet trolls renders Plaintiffs' fears of harm unreasonable. Cf. United States v. Bagdasarian, 652 F.3d 1113, 1126-27 (9th Cir. 2011) (Wardlaw, J., concurring in part) (describing the connection between anonymous internet posts and subsequent real-world violence). Sending direct messages containing veiled death threats would seem to constitute behavior beyond trolling. See Merriam Webster's Collegiate Dictionary 1341 (11th ed. 2003) (defining "troll," in relevant part, as "to antagonize (others) online by posting inflammatory, irrelevant, or offensive comments or content" and "to harass, criticize, or antagonize (someone) esp[ecially] by provocatively disparaging or mocking public statements, postings, or acts") (emphasis added). These were not public posts mocking or antagonizing Plaintiffs' counsel, but rather private emails, sent directly to Plaintiffs' counsel, wishing him and his family violent death. Where many individuals take the time to send private, threatening emails, it is reasonable to fear that some of those individuals might carry out their threats. The Court finds that the first two factors weigh in favor of permitting Plaintiffs to proceed pseudonymously.
Defendants identify no prejudice from Plaintiffs proceeding pseudonymously. The Ninth Circuit has explained that, where a defendant does not know the plaintiff's name, "at some later point in the proceedings it may be necessary to reveal plaintiffs' identities to defendants so that defendants may refute [their] individualized accusations." Advanced Textile, 214 F.3d at 1058. "But where the defendants know the plaintiffs' names, 'anonymity need not, and should not, impede either party's ability to develop its case' even though it is 'foreseeable that anonymity [will] raise problems for discovery.' " Doe 1 v. Nat'l Collegiate Athletic Assoc., No. 22-cv-01559-LB, 2022 WL 3974098, at *2 (N.D. Cal. Aug. 30, 2022) (quoting Jane Roes 1-2 v. SFBSC Mgmt., LLC, 77 F. Supp. 3d 990, 996 (N.D. Cal. 2015)). Plaintiffs have disclosed their true names to Defendants subject to a protective order, so pseudonymity should not impede Defendants' ability to develop their case. Though pseudonymity may pose certain logistical challenges during discovery, this case remains at the pleadings stage. See Doe v. County of El Dorado, No. 2:13-CV-01433-KJM, 2013 WL 6230342, at *5 (E.D. Cal. Dec. 2, 2013) (explaining that, "at the prediscovery stage . . . the court need not yet consider the prejudice defendant will suffer during discovery," as "the relevant prejudice is that which defendant presently suffers as a result of plaintiff's anonymity"). Defendants do not articulate any prejudice associated with Plaintiffs proceeding pseudonymously at this stage of the litigation, and this Court is not aware of any. Therefore, the Court finds that the prejudice factor does not weigh against permitting Plaintiffs to proceed pseudonymously at this stage.
Finally, the public interest factor does not weigh against permitting Plaintiffs to proceed pseudonymously. "The normal presumption in litigation . . . that parties must use their real names . . . is loosely related to the public's right to open courts and the right of private individuals to confront their accusers." Kamehameha, 596 F.3d at 1042. Where the plaintiffs' identities are not central to the issues raised by a case, however, the public interest may not be harmed by permitting plaintiffs to proceed pseudonymously. See Advanced Textile, 214 F.3d at 1072 (reversing denial of anonymity where "[t]he district court did not explain, and we fail to see, how disguising plaintiffs' identities will obstruct public scrutiny of the important issues in th[e] case"); Kamehameha, 596 F.3d at 1043 (noting that, where plaintiffs brought "claims of widespread discrimination," "it [wa]s difficult to see 'how disguising plaintiffs' identities w[ould] obstruct public scrutiny of the important issues in th[e] case' ") (quoting Advanced Textile, 214 F.3d at 1072). Withholding the true identities of the individual software developers who bring this case will not obstruct public scrutiny of the issues raised. Plaintiffs' names and identities have no bearing on the central issues of this case, including whether Defendants' AI-based coding tools illegally reproduce licensed code used as training data. The Court finds that the public interest factor does not weigh against anonymity at this stage of the litigation. See El Dorado, 2013 WL 6230342, at *6 (finding public interest factor weighed in favor of anonymity where the "[p]laintiff's identity appears to have no bearing on the resolution of the issues, and a pseudonym will not impede public access to the substance of the proceedings").
The Court is mindful that, like the other factors, the public interest in Plaintiffs' identities may change as the suit progresses. See Doe v. NFL Enters., LLC, No. C 17-00496 WHA, 2017 WL 697420, at *2 (N.D. Cal. Feb. 22, 2017) (noting that "class members will . . . have a right to know the identity of their representative in this litigation" in later stages of the case).
Balancing these factors, the Court finds that Plaintiffs may proceed pseudonymously at this time.
C. Rule 8(a)
Defendants argue that the complaint should be dismissed under Federal Rule of Civil Procedure 8(a) because Plaintiffs do not plead sufficient facts regarding the role of each Defendant in the alleged misconduct.
A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). "[T]he 'short and plain statement' must provide the defendant with 'fair notice of what the plaintiff's claim is and the grounds upon which it rests.' " Dura Pharms., Inc. v. Broudo, 544 U.S. 336, 346, 125 S.Ct. 1627, 161 L.Ed.2d 577 (2005) (quoting Conley v. Gibson, 355 U.S. 41, 47, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957)). To comply with Rule 8(a), a plaintiff "must allege the basis of his claim against each defendant . . . to put defendants on sufficient notice of the allegations against them." Gauvin v. Trombatore, 682 F. Supp. 1067, 1071 (N.D. Cal. 1988).
The OpenAI Defendants argue that Plaintiffs plead claims against all six OpenAI entities without specifying the role or conduct of each entity, thus violating Rule 8(a). But Plaintiffs allege that two of the OpenAI Defendants - OpenAI, Inc. and OpenAI, L.P. - "programmed, trained, and maintain[ ]" Codex, and that OpenAI, Inc. owns and controls all of the other OpenAI Defendants. Compl. ¶ 23. Plaintiffs plead additional specific facts regarding the ownership and control of each of the OpenAI Defendants. See, e.g., id. ¶ 24 ("OpenAI, L.P. is a wholly owned subsidiary of OpenAI, Inc. . . . [and] the OpenAI entity that co-created Copilot and offers it jointly with GitHub."); id. ¶ 25 ("OpenAI GP is the general partner of OpenAI, L.P. OpenAI GP manages and operates the day-to-day business and affairs of OpenAI, L.P. . . . OpenAI GP was aware of the unlawful conduct alleged herein and exercised control over OpenAI, L.P."). Such allegations sufficiently put each OpenAI entity on notice of the basis on which Plaintiffs allege it may be liable for the challenged conduct.
The Court does not decide here whether such alleged relationships in fact provide a sufficient basis for liability against each of the OpenAI entities for any of the pleaded claims, because that issue is not presently before the Court. The function of Rule 8 in this context is to "give Defendants fair notice of the allegations against them," Ketayi v. Health Enrollment Grp., 516 F. Supp. 3d 1092, 1120 (S.D. Cal. 2021) (citations omitted), whereas the purpose of a Rule 12(b)(6) motion is to "test[ ] the legal sufficiency of the pleadings and allow[ ] a court to dismiss a complaint upon a finding that the plaintiff has failed to state a claim upon which relief may be granted," Lessin v. Ford Motor Co., 600 F. Supp. 3d 1137, 1141 (S.D. Cal. 2022) (citation omitted). See also Olson v. Puckett, No. 221CV01482KJMDMC, 2023 WL 2602174, at *1 (E.D. Cal. Mar. 22, 2023) ("To the extent there is a difference between the standards imposed by Rule 8 and Rule 12(b)(6), this court interprets the Rule 8 requirement as the lesser of the two.").
Similarly, Microsoft and GitHub argue that Plaintiffs' complaint fails to satisfy Rule 8(a) because Plaintiffs do not allege which specific acts taken by each Defendant violate the DMCA. But Plaintiffs allege facts which sufficiently provide notice of the basis on which each GitHub and Microsoft are sued. Microsoft is alleged to maintain an ownership interest in GitHub and OpenAI, L.P., which allegedly co-created Copilot. Compl. ¶ 22 ("Microsoft owns and operates GitHub. Through its corporate ownership, control of the GitHub Board of Directors, active management, and other means, Microsoft sells, markets and distributes Copilot."); id. ¶ 7 ("Microsoft obtained a partial ownership interest in OpenAI . . . . As OpenAI's largest investor . . . Microsoft exerts considerable control over OpenAI."); id. ¶ 24 ("OpenAI, L.P. is the OpenAI entity that co-created Copilot and offers it jointly with GitHub."). Plaintiffs further allege, on information and belief, that "Microsoft, GitHub, [and] OpenAI . . . have worked together to create Copilot." Id. ¶ 241. Such allegations provide sufficient notice of the basis of Plaintiffs' DMCA claims against each Defendant. The complaint is not deficient under Rule 8(a).
Again, the Court does not determine whether such allegations are sufficient to plead a basis for liability against any Defendant. See supra note 13.
Defendants move to dismiss most of Plaintiffs' claims for failure to state a claim on which relief may be granted. In opposition, Plaintiffs do not address Defendants' substantive arguments about the sufficiency of Plaintiffs' claims for violation of Section 1202(a) of the DMCA, tortious interference, fraud, false designation of origin, or violation of the CCPA. Plaintiffs instead state that they "do not concede" these claims "have been inadequately pled," but request leave to amend the claims. ECF No. 66 at 30; ECF No. 67 at 32 n.17. Without briefing from both parties, the Court will not evaluate the merits of Defendants' arguments as to those claims.
Mindful that leave to amend should be freely granted, the Court dismisses Plaintiffs' claims for violation of Section 1202(a) of the DMCA, tortious interference, fraud, false designation of origin, and violation of the CCPA with leave to amend.
1. Copyright Preemption
Defendants argue that several of Plaintiffs' state law claims are preempted by Section 301 of the Copyright Act. Because most of these claims were previously dismissed, the Court only considers whether Plaintiffs' unjust enrichment claim is subject to copyright preemption.
The Copyright Act of 1976 expressly preempts state claims where the plaintiff's work "come[s] within the subject matter of copyright" and the state law grants "legal or equitable rights that are equivalent to any of the exclusive rights within the general scope of copyright." 17 U.S.C. § 301(a). The Ninth Circuit has established a two-part test to determine whether state law claims are preempted. First, "[the court must] decide 'whether the "subject matter" of the state law claim falls within the subject matter of copyright as described in 17 U.S.C. §§ 102 and 103.' " Maloney v. T3Media, Inc., 853 F.3d 1004, 1010 (9th Cir. 2017). If it does, the court must "determine 'whether the rights asserted under state law are equivalent to the rights contained in 17 U.S.C. § 106, which articulates the exclusive rights of copyright holders.' " Id. "If a state law claim includes an 'extra element' that makes the right asserted qualitatively different from those protected under the Copyright Act, the state law is not preempted by the Copyright Act." Altera Corp. v. Clear Logic, Inc., 424 F.3d 1079, 1089 (9th Cir. 2005).
Plaintiffs' opposition generally does not address Defendants' preemption arguments. However, Plaintiffs do argue generally that their state law claims are qualitatively different from claims under the Copyright Act because they are not solely about the unauthorized reproduction of Plaintiffs' code, but also the unauthorized use of such code. Plaintiffs suggest that state law tort claims concerning unauthorized use are not preempted by the Copyright Act, and that "Plaintiffs allege that Defendants, through their unauthorized use of Plaintiffs' code to train Codex and Copilot, and their display of Plaintiffs' code to others for commercial gain, violated Plaintiffs' rights under state and common law." ECF No. 66 at 18 (emphasis added).
Plaintiffs focus this part of their opposition on their breach of open-source license claims, which Defendants do not move to dismiss on copyright preemption grounds. ECF No. 66 at 17-18. Plaintiffs additionally argue that their negligence claim and UCL unlawful conduct claim based on violation of the DMCA are not preempted. Id. Defendants did not move to dismiss Plaintiffs' negligence claims on copyright preemption grounds, and only moved to dismiss Plaintiffs' UCL claims to the extent they were based on preempted state law claims.
Plaintiffs are correct that state law tort claims concerning unauthorized use are not preempted by the Copyright Act. "The [exclusive] rights protected under the Copyright Act include the rights of reproduction, preparation of derivative works, distribution, and display." Ryan v. Editions Ltd. W., Inc., 786 F.3d 754, 760 (9th Cir. 2015) (alteration in original) (quoting Altera, 424 F.3d at 1089). "A state law tort claim concerning the unauthorized use of the software's end-product is not within the rights protected by the federal Copyright Act." Altera, 424 F.3d at 1079. However, in their complaint, Plaintiffs do not allege that Defendants' use of Plaintiffs' code for training purposes violated their rights. Rather, Plaintiffs base their unjust enrichment claim on Defendants' reproduction of Plaintiffs' code as output and Defendants' preparation of derivative works, both of which are rights protected under the Copyright Act. Compl. ¶¶ 204-09 (pleading unjust enrichment claim based on profit derived from both reproduction and preparation of derivative works). Because the rights on which Plaintiffs base their unjust enrichment claim are within those protected by the federal Copyright Act, Plaintiffs' unjust enrichment claim is subject to preemption.
Plaintiffs' claim for unjust enrichment is dismissed with leave to amend.
2. DMCA Section 1202(b) Claim
Because the Court previously dismissed Plaintiffs' claim under Section 1202(a) of the DMCA, the Court now only considers the sufficiency of Plaintiffs' Section 1202(b) claim.
"Copyright law restricts the removal or alteration of copyright management information ("CMI") - information such as the title, the author, the copyright owner, the terms and conditions for use of the work, and other identifying information set forth in a copyright notice or conveyed in connection with the work." Stevens v. Corelogic, Inc., 899 F.3d 666, 671 (9th Cir. 2018). Section 1202(b) of the DMCA provides that one cannot, without authority, (1) "intentionally remove or alter any" CMI, (2) "distribute . . . [CMI] knowing that the [CMI] has been removed or altered," or (3) "distribute . . . copies of works . . . knowing that [CMI] has been removed or altered" while "knowing, or . . . having reasonable grounds to know, that it will induce, enable, facilitate, or conceal" infringement. 17 U.S.C. § 1202(b).
Plaintiffs allege that their licensed code contains CMI including copyright notices, titles, authors' names, copyright owners' names, terms and conditions for use of the code, and identifying numbers or symbols. Compl. ¶ 144. Plaintiffs allege that Defendants removed or altered that CMI from licensed code, distributed CMI knowing CMI had been removed or altered, and distributed copies of the code knowing that CMI had been removed or altered, all while knowing and possessing reasonable grounds to know that doing so would induce infringement. Id. ¶¶ 148, 153-55, 157.
Defendants argue that Plaintiffs have not plausibly alleged claims under Sections 1202(b)(1) or (b)(3) because these provisions require some active conduct that removes or alters CMI. Defendants argue that the complaint merely alleges "the passive non-inclusion of CMI" by neutral technology which excerpts code without the accompanying CMI, rather than the active removal of CMI from licensed code. ECF No. 50 at 22. This semantic distinction is not meaningful. Plaintiffs allege that the relevant CMI was affixed to their licensed code and that Defendants were aware that such CMI appeared repeatedly across the data used to train Codex and Copilot. Compl. ¶ 92 (CMI "usually appears just before a given block of code"); id. ¶ 94 ("[I]n a blog post, GitHub noted[,] 'In one instance, GitHub Copilot suggested starting an empty file with something it had even seen more than a whopping 700,000 different times during training—that was the GNU General Public License.' "). Defendants subsequently trained these programs to ignore or remove CMI and therefore stop reproducing it. Id. ¶¶ 94-95 ("As GitHub explains: 'GitHub Copilot has changed to require a minimum file content.' . . . Copilot no longer reproduces these types of CMI . . . . It has been altered not to.") (emphasis in original). Defendants knew that these programs reproduced training data as output. Id. ¶ 90. Plaintiffs thus plead sufficient facts to support a reasonable inference that Defendants intentionally designed the programs to remove CMI from any licensed code they reproduce as output.
In other words, Plaintiffs allege that Defendants designed "neutral" programs to effectuate the "non-inclusion" of CMI by actively removing it from Plaintiffs' licensed code.
Defendants further argue that Plaintiffs do not sufficiently plead scienter. As the Ninth Circuit has explained, "the mental state requirement in Section 1202(b) must have a more specific application than the universal possibility of encouraging infringement." Stevens, 899 F.3d at 674. Stevens involved software that allegedly removed metadata from image files which the defendant subsequently distributed in violation of the DMCA. The Ninth Circuit affirmed the grant of summary judgment to the defendant because the plaintiffs had not offered any evidence that the removal of CMI would impair their policing of infringement. Id. at 675. At summary judgment, "specific allegations as to how identifiable infringements 'will' be affected are necessary"; a plaintiff "must make an affirmative showing, such as by demonstrating a past 'pattern of conduct' or 'modus operandi,' that the defendant was aware or had reasonable grounds to be aware of the probable future impact of its actions." Id. at 674.
On a motion to dismiss, a plaintiff must allege sufficient facts to support the reasonable inference that the defendant "knew or had a reasonable basis to know that the removal or alteration of CMI . . . w[ould] aid infringement." Harrison v. Pinterest, Inc., No. 20-cv-05290-EJD, 2022 WL 4348460, at * 5 (N.D. Cal. Sept. 19, 2022). At the pleading stage, mental conditions generally need not be alleged with specificity. "Federal Rule of Civil Procedure 9(b) provides that 'intent, knowledge, and other conditions of a person's mind may be alleged generally.' Language in Stevens . . . does not indicate otherwise; there, the Ninth Circuit held that 'a plaintiff bringing a Section 1202(b) claim must make an affirmative showing' of scienter in the summary judgment context." Logan v. Meta Platforms, Inc., 636 F. Supp. 3d 1052, 1064 (N.D. Cal. Oct. 25, 2022) (emphasis in original) (internal citation omitted) (quoting Stevens, 899 F.3d at 674); see also Izmo, Inc. v. Roadster, Inc., No. 18-cv-06092-NC, 2019 WL 13210561, at *4 (N.D. Cal. Mar. 26, 2019) ("Whether [the defendant] knew or should have known that its activities would induce or enable an infringement of [the plaintiff's] rights is more suited to summary judgment.").
Plaintiffs allege that Defendants knew the code they used as training data for Codex and Copilot routinely contained CMI. Compl. ¶ 94. Plaintiffs also allege that GitHub knew that CMI was important for protecting copyright interests. GitHub regularly processed DMCA takedowns, such that it was aware its platform was used to distribute code with removed or altered CMI in a manner which induced infringement. Id. ¶ 165-67. Plaintiffs' allegations raise the reasonable inference that Defendants knew or had reasonable grounds to know that removal of CMI carried a substantial risk of inducing infringement. See, e.g., Schneider v. Youtube, LLC, No. 20-cv-04423-JD, 2022 WL 3031212, at *2 (N.D. Cal. Aug. 1, 2022) (finding plaintiffs sufficiently pleaded scienter where they alleged that the defendant knew files "routinely contain CMI, that CMI is valuable for protecting copyright holders, and that the distribution of works with missing CMI on [defendant's platform] has induced . . . infringement," supporting a "plausible inference" that defendant removed CMI "with knowledge that doing so carried a 'substantial risk' of inducing infringement") (quoting Stevens, 899 F.3d at 676); Batra v. PopSugar, No. 18-cv-03752-HSG, 2019 WL 482492, at *2 (N.D. Cal. Feb. 7, 2019) (finding plaintiffs' allegations regarding removal of CMI supported a "plausible inference" that the defendant "kn[ew] that removing the CMI would help to conceal the alleged infringement").
Defendants further argue that Plaintiffs fail to plausibly allege that Defendants distribute CMI "knowing the [CMI] has been removed or altered" in violation of Section 1202(b)(2). Plaintiffs' opposition does not directly address this argument. In the complaint, Plaintiffs allege that "Defendants have a business practice of asserting and/or implying that Copilot is the author of the Licensed Materials" and that "Defendants' false description of the source of Copilot's Output facilitated or concealed infringement by Defendants and Copilot users." Compl. ¶¶ 158-59. Plaintiffs do not identity the assertions, implications, and/or false descriptions of authorship or source at issue, nor do they plead facts that suggest such unidentified statements could constitute CMI. Plaintiffs separately allege that Copilot previously "would sometimes produce [CMI] . . . [which] was not always accurate," but that Copilot "no longer reproduces these types of CMI, incorrect or otherwise, on a regular basis." Id. ¶ 95. Plaintiffs plead no specific facts regarding the allegedly inaccurate CMI Copilot once produced alongside output, nor do they plead facts suggesting such inaccurate CMI is likely to be produced alongside their output in the future. Because the allegations in the complaint do not sufficiently allege the distribution of altered CMI, the Court finds that Plaintiffs have failed to state a claim under Section 1202(b)(2).
The Court denies Defendants' motions to dismiss Plaintiffs' claim under Sections 1202(b)(1) and 1202(b)(3). Plaintiffs' claim under Section 1202(b)(2) is dismissed with leave to amend.
3. Breach of License Claim
Defendants argue that Plaintiffs fail to plead the existence of a contract because they do not indicate which licenses are at issue or which provisions Defendants allegedly breached.
Defendants additionally argue that, to the extent Plaintiffs' breach of license claim is based on Defendants' training of Codex and Copilot using licensed code, it is foreclosed by GitHub's Terms of Service. Because Plaintiffs' breach of license claim is not based on such training, see Compl. ¶¶ 180-83, this argument is irrelevant.
Under California law, breach of contract requires plaintiffs to "plead 'the contract, plaintiff's performance (or excuse for nonperformance), defendant's breach, and damage to plaintiff therefrom." Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1028 (N.D. Cal. 2012) (quoting Gautier v. Gen. Tel. Co., 234 Cal. App. 2d 302, 305, 44 Cal.Rptr. 404 (1965)). "Identifying the specific provision of the contract allegedly breached by the defendant does not require the plaintiff to attach the contract or recite the contract's terms verbatim. Rather, the plaintiff must identify with specificity the contractual obligations allegedly breached by the defendant." Williams v. Apple, Inc., 449 F. Supp. 3d 892, 908 (N.D. Cal. 2020) (quoting Kaar v. Wells Fargo Bank, N.A., No. C 16-01290 WHA, 2016 WL 3068396, at *1 (N.D. Cal. June 1, 2016)).
Plaintiffs advance claims for breach of the eleven suggested licenses GitHub presents to users that require (1) attribution to the owner, (2) inclusion of a copyright notice, and (3) inclusion of the license terms. Compl. ¶ 34 n.4. Plaintiffs attach each of these licenses to the complaint. Plaintiffs allege that use of licensed code "is allowed only pursuant to the terms of the applicable Suggested License," and that each such license requires that any derivative work or copy include attribution, a copyright notice, and the license terms. Id. ¶¶ 173, 34 n.4. Plaintiffs further allege that Codex and Copilot reproduce licensed code as output without attribution, copyright notice, or license terms, thereby violating the relevant provisions of each license. While Plaintiffs do not identify the specific subsections of each suggested license that correspond to each of these requirements, the Court finds that Plaintiffs have sufficiently identified "the contractual obligations allegedly breached," as required to plead a breach of contract claim. Williams, 449 F. Supp. 3d at 908.
Defendants' motions to dismiss Plaintiffs' claim for breach of license is denied.
4. Unfair Competition
Plaintiffs assert claims for unfair competition under the Lanham Act, the UCL, and California common law against GitHub and OpenAI Defendants. These claims are predicated on Plaintiffs' claims for violation of the DMCA, tortious inference, false designation of origin, violation of the CCPA, and negligence.
Defendants move to dismiss Plaintiffs' UCL claims for failure to sufficiently allege predicate claims. To the extent the predicate claims have been dismissed, Plaintiffs' derivative UCL claims must also dismissed with leave to amend. See Eidmann v. Walgreen Co., 522 F. Supp. 3d 634, 647 (N.D. Cal. 2021) ("If the 'plaintiff cannot state a claim under the predicate law . . . [the UCL] claim also fails.' ") (alterations in original) (quoting Hadley v. Kellogg Sales Co., 243 F. Supp. 3d 1074, 1094 (N.D. Cal. 2017)). Plaintiffs' UCL claims predicated upon violation of Sections 1202(a) and 1202(b)(2) of the DMCA, tortious interference, false designation of origin, violation of the CCPA, and negligence are dismissed with leave to amend.
Plaintiffs' UCL claims predicated on violation of Sections 1202(b)(1) and (b)(3) of the DMCA remain. Defendants argue that Plaintiffs fail to plead any economic injury arising from the predicate violation, as required for statutory standing under the UCL. To plead a cause of action under the UCL, a plaintiff must allege that the challenged conduct caused "some form of economic injury," like "lost money or property." Kwikset Corp. v. Super. Ct., 51 Cal. 4th 310, 323, 120 Cal. Rptr.3d 741, 246 P.3d 877 (2011). As the California Supreme Court explained, a plaintiff may suffer economic injury by "hav[ing] a present or future property interest diminished" or "be[ing] deprived of money or property to which he or she has a cognizable claim." Id.
Plaintiffs allege that they "have suffered monetary damages" as a result of all of the predicate violations listed in their UCL claim. Compl. ¶ 213. From the allegations in the complaint, however, the Court cannot discern how Defendants' alleged violations of the DMCA have caused or will cause Plaintiffs economic injury. Plaintiffs' opposition argues they "lost the value of [their] work, including their ability to receive compensation as well as the likelihood they would be retained or hired in the future," and have suffered injury to their intellectual property rights, including "loss of value of the computer code and the value to code authors of their attribution rights." ECF No. 66 at 25. However, no such injury is alleged in the complaint. Accordingly, Plaintiffs' UCL claim predicated on violation of the DMCA is dismissed with leave to amend.
The OpenAI Defendants also move to dismiss Plaintiffs' claims for unfair competition under the Lanham Act and California common law. Plaintiffs do not address these arguments in opposition, and therefore abandon the claims. See Diamond S.J. Enter., Inc. v. City of San Jose, No. 18-cv-01353-LHK, 2018 WL 5619746, at *4 (N.D. Cal. Oct. 29, 2018) ("An opposition brief's failure to address a motion to dismiss'[s] challenges to a claim constitutes abandonment of that claim."). Plaintiffs' claims for unfair competition under the Lanham Act and California common law are dismissed with leave to amend.
5. Civil Conspiracy
Defendants argue that Plaintiffs' civil conspiracy claim must be dismissed because civil conspiracy is not a standalone cause of action.
"Conspiracy is not a cause of action, but a legal doctrine that imposes liability on persons who, although not actually committing a tort themselves, share with the immediate tortfeasors a common plan or design in its perpetration." Applied Equip. Corp. v. Litton Saudi Arabia Ltd., 7 Cal. 4th 503, 510-11, 28 Cal.Rptr.2d 475, 869 P.2d 454 (1994) (in bank); see also AccuImage Diagnostics Corp. v. Terarecon, Inc., 260 F. Supp. 2d 941, 947-48 (N.D. Cal. 2003) (dismissing standalone civil conspiracy claim with prejudice because "civil conspiracy is not a separate and distinct cause of action under California law" and explaining that any "amended [civil conspiracy] allegations . . . must be made within the sections of the complaint that contain plaintiff's claims for the underlying" violations).
Because Plaintiffs cannot plead civil conspiracy as an independent cause of action, this claim must be dismissed with prejudice.
6. Declaratory Relief
Defendants move to dismiss Plaintiffs' claim for declaratory relief, arguing that declaratory relief is not a standalone cause of action. Plaintiffs do not address Defendants' arguments as to this claim in their opposition briefs, and therefore have abandoned the claim. See Diamond S.J., 2018 WL 5619746, at *4.
"[D]eclaratory relief is not a standalone claim." Mayen v. Bank of Am. N.A., No. 14-cv-03757-JST, 2015 WL 179541, at *5 (N.D. Cal. Jan. 14, 2015); see also Sowinski v. Wells Fargo Bank, N.A., No. 11-6431-SC, 2012 WL 5904711, at *1 (N.D. Cal. Nov. 26, 2012) (dismissing declaratory relief claim with prejudice and noting that "Plaintiff may still seek declaratory . . . relief in any further pleading, provided that he asserts a claim that could give rise to such relief"). Because declaratory relief is not a claim, granting leave to amend would be futile. Accordingly, Plaintiffs' claim for declaratory relief is dismissed with prejudice.
CONCLUSION
Defendants' motions to dismiss are granted in part and denied in part. Plaintiffs' claims for violation of Sections 1202(a) and 1202(b)(2) of the DMCA, tortious interference in a contractual relationship, fraud, false designation of origin, unjust enrichment, unfair competition, breach of the GitHub Privacy Policy and Terms of Service, violation of the CCPA, and negligence are dismissed with leave to amend. Plaintiffs' claims for civil conspiracy and declaratory relief are dismissed with prejudice.
Plaintiffs shall file an amended complaint within 28 days of this order.
IT IS SO ORDERED.