United States District Court, N.D. California, San Jose Division
March 28, 2014
IN RE LINKEDIN USER PRIVACY LITIGATION
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT'S MOTION TO DISMISS [Re: Docket No. 81]
EDWARD J. DAVILA, District Judge.
Plaintiff Khalilah Wright ("Wright" or "Plaintiff") brings this putative class action against Defendant LinkedIn Corporation ("Defendant" or "LinkedIn"). Presently before the Court is LinkedIn's Motion to Dismiss Plaintiff's Second Amended Consolidated Complaint ("SAC"). The Court has fully reviewed the parties' submissions and heard oral arguments of counsel presented at the hearing on November 22, 2013. For the reasons explained below, the Court has determined that LinkedIn's Motion will be GRANTED IN PART and DENIED IN PART.
The following facts are taken from Plaintiff's SAC. LinkedIn owns and operates the website www.LinkedIn.com, which provides an online community for professional networking.
Prospective members may sign up for a membership by providing a valid email address and registration password, which LinkedIn stores on its database. Once registered, a member may create a free online professional profile containing such information as employment and educational history.
Plaintiff alleges that sometime in 2012 hackers infiltrated LinkedIn's computer systems and services. On June 6, 2012, the hackers posted approximately 6.5 million stolen LinkedIn users' passwords on the Internet. On or around June 9, 2012, LinkedIn released a statement on its blog stating that it had recently completed a switch of its password encryption method from a system that stored member passwords in a hashed format to one that used both salted and hashed passwords for increased security.
II. LEGAL STANDARDS
a. Motion to dismiss under Rule 12(b)(1)
A Rule 12(b)(1) motion to dismiss tests whether a complaint alleges grounds for federal subject matter jurisdiction. If the plaintiff lacks standing under Article III of the U.S. Constitution, then the court lacks subject matter jurisdiction, and the case must be dismissed. See Steel Co. v. Citizens for a Better Env't , 523 U.S. 83, 101-02 (1998).
A jurisdictional challenge may be facial or factual. Safe Air for Everyone v. Meyer , 373 F.3d 1035, 1039 (9th Cir. 2004). Where the attack is facial, the court determines whether the allegations contained in the complaint are sufficient on their face to invoke federal jurisdiction, accepting all material allegations in the complaint as true and construing them in favor of the party asserting jurisdiction. See Warth v. Seldin , 422 U.S. 490, 501 (1975). Where the attack is factual, however, "the court need not presume the truthfulness of the plaintiff's allegations." Safe Air for Everyone , 373 F.3d at 1039. In resolving a factual dispute as to the existence of subject matter jurisdiction, a court may review extrinsic evidence beyond the complaint without converting a motion to dismiss into one for summary judgment. See id.; McCarthy v. United States , 850 F.2d 558, 560 (9th Cir. 1988) (holding that a court "may review any evidence, such as affidavits and testimony, to resolve factual disputes concerning the existence of jurisdiction"). Once a party has moved to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1), the opposing party bears the burden of establishing the Court's jurisdiction. See Kokkonen v. Guardian Life Ins. Co. , 511 U.S. 375, 377 (1994); Chandler v. State Farm Mut. Auto. Ins. Co. , 598 F.3d 1115, 1122 (9th Cir. 2010).
b. Motion to dismiss under Rule 12(b)(6) and Rule 9(b)
A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed.R.Civ.P. 8(a). A motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure tests the legal sufficiency of the claims asserted in the complaint. Fed.R.Civ.P. 12(b)(6); Navarro v. Block , 250 F.3d 729, 731 (9th Cir. 2001). The court must accept all factual allegations pleaded in the complaint as true, and must construe them and draw all reasonable inferences from them in favor of the nonmoving party. Cahill v. Liberty Mutual Ins. Co. , 80 F.3d 336, 337-38 (9th Cir. 1996). The Court is not bound, however, to accept "legal conclusions" as true. Ashcroft v. Iqbal , 556 U.S. 662 (2009).
To avoid a Rule 12(b)(6) dismissal, a complaint need not contain detailed factual allegations; rather, it must plead "enough facts to state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570 (2007). However, "a plaintiff's obligation to provide the grounds' of his entitle[ment] to relief' requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Id. at 555 (citation omitted). "Factual allegations must be enough to raise a right to relief above the speculative level, on the assumption that all the allegations in the complaint are true (even if doubtful in fact)." Id . (citation omitted). In spite of the deference the court is bound to pay to the plaintiff's allegations, it is not proper for the court to assume that "the [plaintiff] can prove facts that [he or she] has not alleged or that defendants have violated the... laws in ways that have not been alleged." Associated Gen. Contractors of Cal., Inc. v. Cal. State Council of Carpenters , 459 U.S. 519, 526 (1983).
But "[w]hen there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief." Iqbal , 556 U.S. at 679. A claim has "facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. at 677 (citing Twombly , 550 U.S. at 556). "The plausibility standard is not akin to a probability requirement, ' but it asks for more than a sheer possibility that a defendant has acted unlawfully." Id . "Where a complaint pleads facts that are merely consistent with' a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief.'" Id . (quoting Twombly , 550 U.S. at 557).
Complaints alleging fraud must satisfy the heightened pleading requirements of Federal Rule of Civil Procedure 9(b). Rule 9(b) requires that in all averments of fraud or mistake, the circumstances constituting fraud or mistake shall be stated with particularity. Malice, intent, knowledge, and other conditions of a person's mind may be alleged generally. A pleading is sufficient under Rule 9(b) if it "state[s] the time, place and specific content of the false representations as well as the identities of the parties to the misrepresentation." Misc. Serv. Workers, Drivers & Helpers v. Philco-Ford Corp. , 661 F.2d 776, 782 (9th Cir. 1981) (citations omitted); see also Vess v. Ciba-Geigy Corp. USA , 317 F.3d 1097, 1106 (9th Cir. 2003) (quoting Cooper v. Pickett , 137 F.3d 616, 627 (9th Cir. 1997)) ("Averments of fraud must be accompanied by the who, what, when, where, and how' of the misconduct charged.") Additionally, "the plaintiff must plead facts explaining why the statement was false when it was made." Smith v. Allstate Ins. Co. , 160 F.Supp.2d 1150, 1152 (S.D. Cal. 2001) (citation omitted); see In re GlenFed, Inc. Sec. Litig. , 42 F.3d 1541, 1549 (9th Cir. 1994) (en banc) (superseded by statute on other grounds).
Regardless of the title given to a particular claim, allegations grounded in fraud are subject to Rule 9(b)'s pleading requirements. See Vess , 317 F.3d at 1103-04. Even where fraud is not an essential element of a consumer protection claim, Rule 9(b) applies where a complaint "rel[ies] entirely on [a fraudulent course of conduct] as the bases of that claim... the claim is said to be grounded in fraud' or to sound in fraud, ' and the pleading... as a whole must satisfy the particularity requirement of Rule 9(b)." Kearns v. Ford Motor Co. , 567 F.3d 1120, 1125 (9th Cir. 2009) (quoting Vess , 317 F.3d at 1103-04); Bros. v. Hewlett-Packard Co. , 2006 WL 3093685, at *7 (N.D. Cal. Oct. 31, 2006).
Linkedln moves to dismiss all claims in the SAC for lack of standing pursuant to Rule 12(b)(1) and failure to state a claim pursuant to Rule 12(b)(6).
The SAC contains three claims for: 1) violation of the fraud prong of California's Unfair Competition Law ("UCL"), Cal. Bus. & Prof. Code, § 17200 et seq., 2) violation of the unfair prong of the UCL, and 3) breach of contract. Plaintiff concedes that her second and third claims should be dismissed and asks that the Court do so without prejudice. Docket No. 87, Pl.'s Opp. Brief at 3. Linkedln asks that the Court dismiss all three claims with prejudice.
For the reasons explained below, the Court DISMISSES Plaintiff's second and third claims with prejudice. Linkedln's motion is DENIED as to Plaintiff's first claim.
a. Standing under Article III and the UCL
The Court dismissed Plaintiff's First Amended Complaint ("FAC") for lack of Article III standing. See Docket No. 72. Plaintiff had attempted to establish standing based on the theories that she had suffered an injury in fact because 1) she did not receive the benefit of her bargain with Linkedln, and 2) she now faces an increased risk of future harm as a result of the 2012 hacking incident. The Court rejected both standing theories, finding, inter alia, that the promise of industry standard security had not been a part of Plaintiff's bargain for premium services.
With these amendments, the SAC's allegations are sufficient to confer both standing under Article III and statutory standing under the UCL.
ii. The parties' positions
The parties essentially divide the UCL standing and Article III standing cases into two categories. Plaintiff relies primarily on a line of cases in which courts find standing under the UCL and under Article III for plaintiffs who purchase deceptively labeled or advertised products in reliance on the misinformation contained in the labels or advertisements.
As to UCL standing, in Kwikset Corp. v. Superior Court, the California Supreme Court held that "[a] consumer who relies on a product label and challenges a misrepresentation contained therein can satisfy the standing requirement of [the UCL] by alleging... that he or she would not have bought the product but for the misrepresentation." 51 Cal.4th 310, 330 (2011). In Hinojos v. Kohl's Corp. , 718 F.3d 1098 (9th Cir. 2013), the Ninth Circuit Court of Appeals applied Kwikset in "a straightforward manner" to hold that "when a consumer purchases merchandise on the basis of false price information, and when the consumer alleges that he would not have made the purchase but for the misrepresentation, he has standing to sue under the UCL and FAL because he has suffered an economic injury." 718 F.3d at 1107.
The Article III standing cases in the Ninth Circuit agree that plaintiffs who make allegations similar to those made in Kwikset and Hinojos would also satisfy Article III's standing requirements. For example, Article III standing has been found for class members who "paid more for [a product] than they otherwise would have paid, or bought it when they otherwise would not have done so, because [the defendant] made deceptive claims and failed to disclose the [product's] limitations." Mazza v. Am. Honda Motor Co., Inc. , 666 F.3d 581, 595 (9th Cir. 2012) (citing Stearns v. Ticketmaster Corp. , 655 F.3d 1013, 1021 (9th Cir. 2011)). Another Ninth Circuit case found Article III standing by applying the rule from Kwikset to the plaintiffs' allegation that they paid more for a product due to reliance on false advertising. See Degelmann v. Advanced Med. Optics, Inc. , 659 F.3d 835, 840 (9th Cir. 2011) vacated, 699 F.3d 1103 (9th Cir. 2012).
Linkedln instead points to a number of other consumer cases in which courts have rejected theories of injury in fact that, like Plaintiff's theory, were premised on payment or overpayment for a product. In Linkedln's cases, courts have required plaintiffs to allege "something more" than "overpaying for a defective' product" in order to establish an Article III injury in fact. In re Toyota Motor Corp. , 790 F.Supp.2d 1152, 1165 n.11 (C.D. Cal 2011); see also Whitson v. Bumbo , 2009 WL 1515597 (N.D. Cal. Apr. 16, 2009); Boysen v. Walgreen Co. , 2012 WL 2953069 (N.D. Cal. July 19, 2012); In re McNeil Consumer Healthcare , 877 F.Supp.2d 254 (E.D. Pa. 2012); Williams v. Purdue Pharma Co. , 297 F.Supp.2d 171 (D.D.C. 2003). Based on these cases, Linkedln contends that Plaintiff has not alleged sufficient facts to establish Article III standing.
Linkedln argues that the rationale behind the labeling/advertising cases is that "the overpayment injury does not depend on how the product functions because labels' and brands' have independent economic value." In re Toyota, 790 F.Supp.2d at 1165 n.H. Based on that rationale, Linkedln argues, courts in such cases find economic harm when the consumer paid money for a defendant's product over a competitor's product due to the mislabeling. Plaintiff makes no such allegations here. She does not allege, for example, that she purchased Linkedln's services over another networking website's services because of the promise regarding industry standard security.
III. Application and conclusion
Having carefully considered the cases, the Court finds that Plaintiff has alleged facts sufficient to confer standing. The critical distinction between Plaintiff's theory of economic injury and the theories of economic injury rejected in Linkedln's cited cases is that Plaintiff alleges her payment or overpayment was caused by Linkedln's alleged misrepresentations, which she alleges she read and relied on in making her decision to purchase a premium subscription. The plaintiffs in Linkedln's cases did not, or could not, attempt to establish standing under the same theory as Plaintiff's. In Williams and Whitson, although the plaintiffs alleged that the defendants had made misrepresentations about the products at issue, the plaintiffs failed to allege that they were deceived by or even that they were exposed to the misrepresentations. 297 F.Supp.2d at 177; 2009 WL 1515597, at *4. Similarly, neither Boysen nor In re McNeil contained allegations that the plaintiffs purchased the product in reliance on the defendant's misrepresentations. In re Toyota is inapposite because, while the court did require some plaintiffs to allege "something more" than pure economic loss, it did so only for those plaintiffs who were seeking to establish an economic loss based on a "market effect" theory. 790 F.Supp.2d at 1165-1166. Plaintiff's theory is not based on a loss in market value.
First, it is not clear that the reach of the Kwikset line of cases is limited only to misrepresentations that are also labels or advertisements. As the California Supreme Court put it, to satisfy the UCL's standing requirements, "a party must now (1) establish a loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury, and (2) show that that economic injury was the result of, i.e., caused by, the unfair business practice or false advertising that is the gravamen of the claim." Kwikset, 51 Cal.4th at 322 (emphasis added). While it is true that the final holding in Kwikset specifically identified the type of "unfair business practice or false advertising" at issue, that holding was an application of the broader rule identified in the preceding sentence of this paragraph. The Kwikset court did not indicate that the requirements for establishing UCL standing would be any different if the challenged misrepresentation was contained in something other than a deceptive product label. And although Kwikset was a California case concerning standing under the UCL, not Article III, the Ninth Circuit cases indicate that plaintiffs whose allegations meet the Kwikset criteria will at least satisfy the Article III injury in fact requirement. See Hinojos , 718 F.3d at 1104, n.3 ("There is no difficulty in this case regarding Article III injury in fact, and neither party suggests otherwise. We have explained that when, as here, Plaintiffs contend that class members paid more for [a product] than they otherwise would have paid, or bought it when they otherwise would not have done so' they have suffered an Article III injury in fact.")
Second, even if the Kwikset line of cases was read to apply solely to advertisements and labels, the term "advertisement" is defined broadly under California law. The UCL expressly incorporates the Fair Advertising Law's ("FAL") prohibition on unfair advertising as one form of unfair competition. Hinojos , 718 F.3d at 1103 (citing Cal. Bus. & Prof. Code § 17200). The FAL is broadly written and broadly construed, and a wide range of statements can qualify as an advertisement. Cal. Bus. & Prof. Code § 17500; see Chern v. Bank of Am. , 15 Cal.3d 866, 875 (1976). For example, a statement made in a letter denying a borrower's request for a loan modification qualifies as "advertising." Gabali v. OneWest Bank, FSB, 2013 WL 1320770 (N.D. Cal. Mar. 29, 2013). Applying one set of standing requirements to labeling/advertising and another set of standing requirements to other types of misrepresentations, as Linkedln advocates, would be untenable given the lack of distinction California law places between misleading advertising and other forms of misleading statements.
Applying the cases discussed above, the Court finds that Plaintiff's allegations are sufficient to establish standing under the UCL and Article III. She alleges that she purchased her premium subscription on the basis of Linkedln's statement that its users' data will be secured with industry standards and technology, she alleges that the statement was false when she read and relied on it, and she alleges that she would not have made the purchase (or that she would have negotiated for a lower price) but for the misrepresentation. Her injury (the purchase induced by the misrepresentation) is fairly traceable to Linkedln's conduct because Linkedln made the misrepresentation. And finally, her injury is likely to be redressed by a favorable decision because restitution is an available remedy under the UCL. Cal. Bus. & Prof. Code § 17203.
b. Plaintiff's first claim: Fraudulent business practices
i. Stating a claim
To state a claim under either the fraudulent business practices prong of the UCL, it is necessary only to show that members of the public are likely to be deceived. In re Tobacco II Cases , 46 Cal.4th 298, 312 (2009) (internal quotations and citations omitted).
A representation is material if a reasonable consumer would attach importance to it or if the maker of the representation knows or has reason to know that its recipient regards or is likely to regard the matter as important in determining his choice of action. Hinojos , 718 F.3d at 1107 (internal quotations and citations omitted). The materiality of a misrepresentation is typically an issue of fact, and therefore should not be decided at the motion to dismiss stage. See In re Steroid Hormone Product Cases , 181 Cal.App.4th 145 (2010). In some circumstances, courts have found, as a matter of law, that no reasonable consumer could have been misled by the misrepresentation. See Rice v. Fox Broad. Co. , 330 F.3d 1170, 1181 (9th Cir. 2003) (false statements on videotape cover were immaterial because videotape cover could not be observed by potential consumer and therefore could not influence the purchasing decision).
Linkedln points out that Plaintiff fails to allege that, even if Linkedln had disclosed the fact that it used unsalted, SHA-1 encryption, Plaintiff would have actually understood such a disclosure to mean that Linkedln was not employing industry standard security. However, Plaintiff does allege that if Linkedln had disclosed its security protocols, consumers would have learned that those protocols did not meet the "industry standard" through word of mouth or the media. She supports this reasoning by arguing, essentially, that even if the average consumer would not have understood that unsalted, SHA-1 encryption was below the industry standard, the popular media would have found that disclosure newsworthy and would have disseminated the information to consumers.
Given the above, the Court does not find Plaintiff's claim barred as a matter of law. The only case that Linkedln has cited on this point is Rice, and in Rice, it was impossible for the representation to deceive a consumer when no consumer could have viewed the representation prior to making a purchase. Here, the representation was available for the public to read, and, as explained below, Plaintiff has alleged a plausible explanation for why it is likely to deceive the public.
ii. Rule 8
Linkedln contends that the SAC does not satisfy Rule 8 of the Federal Rules of Civil Procedure. A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed.R.Civ.P. 8(a). A court considering a motion to dismiss can choose to begin by identifying pleadings that, because they are no more than conclusions, are not entitled to the assumption of truth. Iqbal , 556 U.S. at 679. While legal conclusions can provide the framework of a complaint, they must be supported by factual allegations. Id . When there are wellpleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief. Id.
1. Whether Plaintiff plausibly alleges that she read Linkedln's representation
2. Whether Plaintiff plausibly alleges that Linkedln's representation was false
Linkedln argues that Plaintiff's allegation that Linkedln failed to use industry standards to encrypt member passwords is conclusory and unsupported. Plaintiff supports this conclusion with the following factual allegations:
1) When Plaintiff purchased her premium subscription, Linkedln protected its users' personal information using the SHA-1 hash function. Linkedln did not salt the information.
2) Since at least 2006, industry standards have required that users' personal information, and login credentials in particular, be stored in salted and hashed format.
3) The National Institute of Standards and Technology ("NIST") recommended that all government agencies stop using SHA-1.
4) Salting has been standard encryption practice since the 1970s, and salting and hashing (with a stronger algorithm than SHA-1) together is the preferred industry practice.
5) Three days after the breach, Linkedln stated that it would transition from a password database system that hashed passwords, i.e. provided one layer of encoding, to a system that both hashed and salted the passwords, i.e. provided an extra layer of protection that is a widely recognized best practice within the industry.
6) The bare minimum practice within Linkedln's industry is to "salt" the input before hashing it, preferably with a multi-digit salt long enough to render rainbow tables (a method of encryption-breaking) entirely useless.
7) The more common industry practice is to (1) salt passwords and then hash them using a more recent and secure algorithm than SHA-1, (2) salt the resulting hash value, and (3) then again run the resulting value through a hashing function. Finally, that fully encrypted password should be stored on a separate and secure server apart from all other user information.
Linkedln points out that "Plaintiff never explicitly alleges that SHA-1 was below industry standards during the class period. She instead alleges that the National Institute of Standards and Technology [NISI] recommended that all government agencies stop using SHA-1." Docket No. 81, Def.'s Memo ISO MTD at 19 (internal quotations omitted). Linkedln then cites to an extrinsic document written by the NIST which purportedly states that the use of SHA-1 hashing is acceptable.
However, even assuming that the Court must disregard Plaintiff's allegations concerning the NIST's position on the use of SHA-1 hashing, the rest of Plaintiff's allegations are sufficient to support her conclusion that Linkedln's representation was false. She alleges that Linkedln used a particular security practice, is specific about what that security practice entailed, alleges that Linkedln's practice fell below the "bare minimum" security practice in Linkedln's industry, and she is specific about what that "bare minimum" security practice entails. Furthermore, Linkedln does not contend that the phrase "industry standard" amounts to puffery or is otherwise impossible to define.
Accordingly, dismissal for this reason is unwarranted.
3. Whether Plaintiff plausibly alleges that she was denied the benefit of her bargain
Next, Linkedln contends that Plaintiff "does not plausibly allege that she did not receive all of the benefits that she bargained for, " arguing that the promise of industry standard security was not one of the benefits included in Plaintiff's bargain because industry standard security is available to all members whether or not they have upgraded to premium memberships. This was an argument that the Court found convincing and became one of the grounds for dismissal of the FAC.
This contention is less relevant now that Plaintiff no longer seeks to establish standing based on being deprived of the benefit of her bargain. Furthermore, when a plaintiff alleges economic injury based on being induced by misrepresentations to purchase products that she would not otherwise have purchased, the benefit of the bargain defense is permissible only if the misrepresentation that the consumer alleges was not "material." Hinojos , 718 F.3d at 1107. Thus, Linkedln's contention that Plaintiff received all of the benefits she bargained for is not a sufficient basis for dismissal of the SAC.
iii. Rule 9
Linkedln contends that the SAC's averments of fraud do not satisfy Rule 9(b) after disregarding the allegations discussed above on Rule 8 grounds. However, these allegations are sufficiently pleaded and must be regarded as true at this stage in the proceedings.
In alleging fraud or mistake, a party must state with particularity the circumstances constituting fraud or mistake. Fed.R.Civ.P. 9(b).
c. Plaintiff's second and third claims
As to the SAC's second and third claims, the Court limits its decision to whether these claims should be dismissed with or without prejudice.
Dismissal with prejudice and without leave to amend is not appropriate unless it is clear on that the complaint could not be saved by amendment. Chang v. Chen , 80 F.3d 1293, 1296 (9th Cir. 1996). Dismissal with prejudice may be appropriate where a plaintiff presents no new facts but only "new theories" and "provided no satisfactory explanation for his failure to fully develop his contentions originally." Vincent v. Trend Western Technical Corp. , 828 F.2d 563, 570-71 (9th Cir. 1987).
Here, although Plaintiff has added new, critical facts to her complaint (particularly, the allegation that she read Linkedln's representation before purchasing her premium subscription), she fails to explain how the new facts affect her second and third claims. She concedes that both claims fall within the scope of the Court's previous order dismissing the FAC. She provides no explanation for why she should be given another chance to amend those claims, other than that she only became aware that her second and third claims fell within the scope of the previous dismissal order after certain evidence was produced by Linkedln and that she might discover facts through discovery that would allow her to reassert the claims.
Accordingly, Plaintiff's second and third claims are DISMISSED with prejudice because allowing for further amendment would be futile.
For the foregoing reasons, Linkedln's Motion to Dismiss Plaintiff's Second Amended Consolidated Complaint is GRANTED IN PART and DENIED IN PART. Plaintiff's second and third claims are DISMISSED with prejudice. Linkedln's Motion is DENIED as to Plaintiff's first claim.
The court schedules this action for a Case Management Conference at 10:00 a.m. on June 6, 2014. The parties shall file a Joint Case Management Statement on or before May 30, 2014.
IT IS SO ORDERED.