Diep v. Apple, Inc.

Background

Hadona Diep alleged that she downloaded the Toast Plus app in March 2021, entered her private cryptocurrency key, and later lost approximately $5,000 in cryptocurrency. Ryumei Nagao alleged that he downloaded the app in December 2020, deposited cryptocurrency into it, and later lost approximately $500,000. The complaint alleged that Toast Plus was a fake or phishing application that obtained users’ cryptocurrency information and sent the cryptocurrency to hackers.

The plaintiffs sued Apple on behalf of themselves and proposed classes. Their claims included claims under the federal Computer Fraud and Abuse Act and Electronic Communications Privacy Act, California and Maryland consumer-protection and privacy laws, and negligence. They alleged that Apple negligently distributed Toast Plus while representing that the App Store was a safe and trusted place.

Procedural History and Judicial Notice

The case was originally filed in the District of Maryland and was transferred to the Northern District of California based on a forum-selection provision in Apple’s user agreements. After the transfer, plaintiffs filed a first amended complaint. Apple moved to dismiss the entire complaint, arguing that the claims were legally insufficient and that Nagao had not named the proper defendant.

The court granted Apple’s request to take judicial notice of the Apple Media Services Terms and Conditions and the Japanese terms that applied when the plaintiffs allegedly downloaded the app. Judicial notice allows a court to consider facts or documents whose authenticity and accuracy are not reasonably disputed. The plaintiffs did not object to consideration of the terms.

Section 230 Immunity

The court applied Section 230 of the Communications Decency Act, a federal law that can protect providers of interactive computer services from liability based on content supplied by third parties. The court used a three-part test: whether Apple was an interactive computer service provider, whether plaintiffs sought to treat Apple as a publisher or speaker, and whether the app’s content was provided by another information-content provider.

The court found all three requirements satisfied. Apple operated the App Store as an online marketplace that made applications created primarily by other developers available to consumers. Plaintiffs’ claims sought to hold Apple responsible for reviewing, authorizing, and distributing Toast Plus. The court treated those activities as publishing decisions protected by Section 230. The complaint alleged that a third party, rather than Apple, developed Toast Plus, and it did not allege facts showing that Apple created the app or was responsible for developing it.

The plaintiffs argued that Section 230 did not protect Apple from their federal claims because those claims arose from federal criminal statutes. The court rejected that argument, explaining that the relevant exception applies to criminal prosecutions, not civil lawsuits based on criminal statutes.

Consumer-Protection Claims

The court separately considered claims under California’s Unfair Competition Law and Consumers Legal Remedies Act and Maryland’s Consumer Protection Act. Plaintiffs argued that these claims were based only on Apple’s own statements that the App Store was safe. The court disagreed with that characterization. It found that the complaint combined Apple’s safety representations with Apple’s review and publication of Toast Plus, making the allegations inseparable.

Because the consumer-protection claims sought to hold Apple liable for publishing the third-party app, the court held that Section 230 immunity applied to them as well. The court also held that these claims sounded in fraud and therefore had to satisfy Federal Rule of Civil Procedure 9(b), which requires a complaint to identify the alleged fraud’s who, what, when, where, and how. The court found the allegations too unclear and conclusory to meet that standard. It dismissed the consumer-protection claims on both grounds: Section 230 immunity and failure to plead fraud with sufficient detail.

Limitation of Liability

The court also held that Apple’s limitation-of-liability provision was valid and enforceable as applied to the claims pleaded. The provision stated that Apple was not liable for damages arising from or related to use of third-party apps. The court reasoned that plaintiffs were seeking to hold Apple liable for conduct by the Toast Plus developers, rather than for Apple’s own fraud, so the provision did not improperly waive liability for Apple’s own unlawful conduct.

The court further found that the provision applied to all of plaintiffs’ claims because those claims arose from their use of Toast Plus. This provided an additional basis for dismissal.

Disposition

The court held that the claims failed under Section 230, that the consumer-protection claims also failed to satisfy Rule 9(b), and that Apple’s limitation-of-liability provision applied. The court did not reach the question whether Nagao had named the proper defendant because the claims failed on other grounds.

Judge Hamilton granted Apple’s motion to dismiss the first amended complaint in its entirety. The court dismissed all claims with prejudice, finding that amendment would be futile because the claims were based on Apple’s protected role as publisher of Toast Plus.