Sifuentes v. X Corp.

Background

David Angel Sifuentes, III, proceeding without a lawyer, sued X Corp., Inc., formerly Twitter, Inc., under state law. He alleged that X suffered data breaches in 2016, 2021, and 2023 that exposed his email address and password. He alleged that information linked to his X account was offered for sale on the dark web and that hackers used his email and password to access other online accounts. He claimed emotional distress, anxiety, time and expense spent monitoring credit reports and financial accounts, and costs of reducing the risk of identity theft and fraud.

The Second Amended Complaint asserted 14 claims: negligence; breach of contract; breach of implied contract; breach of bailment; public disclosure of private facts; negligent infliction of emotional distress; intentional infliction of emotional distress; violations of the California Consumer Privacy Act; violations of California Civil Code sections 1798.29 and 1798.82; violations of the Michigan Identity Theft Prevention Act; violations of the Michigan Consumer Protection Act; conversion; unjust enrichment; and negligence per se. Sifuentes sought emotional-distress damages, punitive damages, and injunctive relief.

Rulings

The court granted X’s motion to dismiss. It also granted X’s two requests for judicial notice, which concerned court filings, webpages, terms of service, and a privacy policy.

2016 breach claims

The court held that claim preclusion, also called res judicata, barred Sifuentes’s claims based on the alleged 2016 breach. The court found that an earlier related case had been dismissed with prejudice, that the parties were the same, and that the claims based on the 2016 breach arose from the same transaction. The court concluded that amendment could not overcome the bar and dismissed the claims based on the 2016 breach with prejudice. The court stated that claim preclusion did not bar the claims based on the alleged 2021 and 2023 breaches.

Common-law claims and the terms of service

The court applied California substantive law because the terms of service contained a valid California choice-of-law provision. The terms also limited X’s liability for harm resulting from use of the service, including unauthorized access to or use of transmissions or content, whether the claim was based on contract, negligence, or another legal theory.

The court concluded that California law allowed the terms to limit liability for contract claims and ordinary-negligence tort claims, while not allowing such limits for intentional torts, fraud, or statutory claims. It therefore granted the motion as to claims 1–6 and 13–14 and dismissed those claims with prejudice. The court treated the intentional-infliction-of-emotional-distress claim separately.

Intentional infliction of emotional distress

The court held that Sifuentes did not plausibly allege intentional infliction of emotional distress. His allegations that X acted intentionally or recklessly, behaved outrageously, and caused emotional distress were, in the court’s view, conclusory recitations of the claim’s elements rather than sufficient factual allegations. The court granted the motion as to claim 7 but dismissed that claim with leave to amend.

California statutory claims

The court held that Sifuentes could not bring a private claim under the California Consumer Privacy Act because he alleged that he was a Michigan resident, not a California resident. The court likewise held that California Civil Code sections 1798.29 and 1798.82 require disclosure of breaches to California residents and therefore did not support claims by Sifuentes. The court granted the motion as to claims 8 and 9 and dismissed them with prejudice under the order’s conclusion that all claims other than claim 7 were dismissed with prejudice.

Michigan statutory claims

The court held that the terms’ California choice-of-law clause barred Sifuentes’s claims under the Michigan Identity Theft Prevention Act and the Michigan Consumer Protection Act. Sifuentes did not show that Michigan law conflicted with a fundamental policy of California law or that Michigan had a materially greater interest in the dispute. The court granted the motion as to claims 10 and 11 and dismissed them with prejudice.

Conversion

The court held that the conversion claim failed as a matter of law. Sifuentes had voluntarily provided the information when creating his X account, and the court also explained that personal information such as location, device identifiers, and similar data was not capable of precise definition or exclusive possession or control for purposes of conversion. The court granted the motion as to claim 12 and dismissed it with prejudice.

Disposition

The court granted X’s motion to dismiss and dismissed all claims other than the intentional-infliction-of-emotional-distress claim with prejudice. Sifuentes was permitted to amend claim 7 by December 16, 2024; the court allowed no other amendment. The court declined to reach X’s alternative arguments for dismissal.