Gerber v. Twitter, Inc.

Background

The plaintiffs alleged that, from approximately June 2021 through January 2022, a defect in Twitter’s application programming interface allowed unauthorized actors to obtain personal information associated with an estimated 200 million Twitter users. The information allegedly included usernames, display names, account-creation data, email addresses, and phone numbers. The data was allegedly offered for sale or leaked on the dark web between August 2022 and January 2023.

The plaintiffs alleged that Twitter knew about security problems but failed to address them adequately. They claimed that they would not have created accounts or provided their personal information had they known about Twitter’s alleged security deficiencies. One plaintiff alleged spending time and money monitoring accounts, while other plaintiffs alleged harm from the exposure of information connecting pseudonymous accounts to their users’ identities.

The second amended consolidated class action complaint asserted seven causes of action: breach of contract, breach of implied contract, negligence, gross negligence, unjust enrichment, violation of California’s Unfair Competition Law, and declaratory judgment. X Corp., identified as Twitter’s successor in interest, moved to dismiss the complaint. The opinion refers to X Corp. and Twitter, Inc. collectively as “Twitter.”

Judicial Notice

The court considered Twitter’s requests for judicial notice, meaning requests that the court accept certain documents or facts without ordinary proof. The court denied the request as to the three Twitter Help Center exhibits because Twitter was attempting to challenge the complaint’s factual allegations at the pleading stage. It also denied the request as to the Ernst & Young information-security assessment for the same reason.

The court declined to incorporate by reference the remaining MacGregor exhibits, which were court orders from other cases and were irrelevant to the motion. It denied Twitter’s request concerning sign-up pages submitted with the reply because those materials should have been submitted with the original motion. The court granted the request only as to the previously judicially noticed Broome exhibits. Overall, the request for judicial notice was granted in part and denied in part.

Motion-to-Dismiss Standard

The court applied Federal Rule of Civil Procedure 12(b)(6), which permits dismissal when a complaint does not state a legally sufficient claim. At this stage, the court generally accepts the complaint’s factual allegations as true and asks whether they plausibly support relief. The court also noted that a request to amend is generally granted unless the pleading could not possibly be corrected by adding other facts.

Terms of Service and Liability Limits

Twitter argued that its Terms of Service barred the first five causes of action through disclaimers and liability limitations. The court held that the Terms of Service could not limit liability for gross negligence under California law. It therefore considered whether the provisions could potentially bar the other claims.

The court found that the plaintiffs had adequately alleged both procedural and substantive unconscionability. Procedural unconscionability concerns unfairness in how a contract was presented or agreed to; substantive unconscionability concerns overly harsh or one-sided terms. The court found the Terms of Service at least somewhat procedurally unconscionable because the challenged provisions were buried in lengthy standard-form terms. It also found the provisions substantively unconscionable because the complaint alleged that Twitter knew about inadequate security measures, was better positioned than individual users to manage data-security risks, and nevertheless sought to disclaim broad liability.

The court therefore found the Terms of Service unconscionable for purposes of the motion and concluded that the negligence and contract claims were actionable at the pleading stage. The court stated that Twitter could later move to limit available damages at summary judgment or another appropriate time.

Individual Claims

Unjust enrichment. The court denied the motion to dismiss the unjust-enrichment claim. It explained that unjust enrichment is a quasi-contract claim and may be pleaded in the alternative at this stage, even though the parties had a written Terms of Service agreement.

Express breach of contract. The court granted the motion as to the first cause of action and dismissed it with prejudice. The plaintiffs argued that Twitter’s website statements and blog posts were incorporated into the User Agreement and created enforceable promises about data security. The court disagreed, finding that the User Agreement did not reference or incorporate those statements. It also concluded that the Privacy Policy’s promise concerning disclosure of information was not the same as a promise to maintain adequate data-security measures.

Breach of implied contract. The court denied the motion as to the second cause of action. It found that, at the pleading stage, Twitter’s website representations about protecting users’ personal information could support an implied contract. The plaintiffs’ allegation that Twitter failed to safeguard their information was sufficient to state a claim for breach of that implied contract.

Negligence and gross negligence. The court denied the motion as to both negligence claims. It relied on its prior ruling, which had found that the plaintiffs sufficiently alleged gross negligence and that the negligence claim would also survive under the circumstances. Because the court found the Terms of Service unenforceable for unconscionability, those liability provisions did not require dismissal of the negligence claims.

California Unfair Competition Law claim. The court denied the motion as to the sixth cause of action. California’s Unfair Competition Law requires a plaintiff to show that they personally lost money or property because of the alleged unfair competition. The plaintiffs alleged that they did not receive the benefit of their bargain and that they incurred monitoring expenses that would not otherwise have been necessary. The court found those allegations sufficient to establish standing at this stage, even though it had dismissed the express-contract claim.

Declaratory judgment. The court denied the motion as to the seventh cause of action. The plaintiffs sought a declaration that Twitter owed duties to secure users’ personal information and timely notify them of a data breach, and that Twitter continued to breach those duties. The court found that several predicate claims were sufficiently pleaded and that a dispute remained concerning the continuing risk to the plaintiffs and similarly situated users.

Disposition

The court granted in part and denied in part Twitter’s motion to dismiss. It granted the motion with prejudice as to the first cause of action for breach of contract and denied it in all other respects. Twitter was ordered to file an answer within 21 days.