Young v. Platforms

Background

Karen Young proceeded without a lawyer. She alleged that her personal Facebook page and a Facebook page titled “Math4cure, LCC” were compromised during hacking attempts, including a June 2023 data breach. She alleged that the breach led to fraudulent messages, advertisements for fraudulent products, and unauthorized payment activity. She also alleged that Meta did not properly respond to her reports, leaving her data and the data of Math4cure’s followers compromised.

Young’s amended complaint asserted six causes of action: negligence, breach of contract, negligent misrepresentation, breach of fiduciary duty, violation of the Computer Fraud and Abuse Act, and violation of the Stored Communications Act. She sought damages totaling $5 million, punitive damages, and declaratory or other relief.

Rule 12(b)(6) Standard

The court considered the defendants’ motion under Federal Rule of Civil Procedure 12(b)(6), which permits dismissal for failure to state a claim on which relief can be granted. The court noted that a self-represented complaint is read less strictly than a lawyer-drafted complaint, but that a court cannot supply essential elements that were not pleaded.

Terms of Service Claims

The court considered Facebook’s Terms of Service and Commercial Terms because Young referred to the Terms in her complaint, relied on them for some claims, did not deny agreeing to them, and did not dispute the documents’ authenticity.

The Terms stated that Meta’s products were provided “as is,” made no guarantee that they would be safe, secure, or error-free, and disclaimed responsibility for third-party conduct. They also limited liability for certain damages and capped aggregate liability at the greater of $100 or the amount paid to Meta during the preceding twelve months.

The court held that the Terms barred Young’s negligence, breach-of-contract, negligent-misrepresentation, and breach-of-fiduciary-duty claims. The court found that those claims were based on the alleged failure to keep her account secure and free from disruptions caused by hackers.

Computer Fraud and Abuse Act Claim

Young alleged that Meta violated the Computer Fraud and Abuse Act by allowing unauthorized access to continue and failing to act on reports of security breaches. The court explained that the statute prohibits intentionally accessing a computer without authorization or exceeding authorized access.

The court held that Young alleged that hackers, not Meta, accessed her account without authorization. Because she did not allege that Meta itself intentionally accessed her account without authorization, the court granted the motion to dismiss the Computer Fraud and Abuse Act claim. The court also stated that she could not truthfully and plausibly amend this claim without contradicting the basic facts already alleged in her two complaints.

Stored Communications Act Claim

Young alleged that the defendants violated the Stored Communications Act by failing to protect her stored electronic communications and account data from unauthorized access. The court described that statute as limited and concluded that it imposes liability on those who intentionally access stored internet communications without authorization or exceed authorized access.

The court granted the motion to dismiss this claim because Young could not allege that the defendants unlawfully accessed her Facebook account without authorization.

Disposition

The court granted the motion to dismiss in its entirety. It dismissed the case against the defendants without leave to amend because Young had already received an opportunity to amend and had not cured the identified legal deficiencies. The Clerk was directed to enter judgment in favor of Meta Platforms, Inc. and against Young and to close the case.

The opinion also notes that this was not the first dismissal in the district of claims brought by Young involving Facebook, but it does not alter the disposition stated in this order.