Al-Ahmed v. Twitter, Inc.

Background

Ali Al-Ahmed alleged that, between 2013 and 2015, two Twitter employees accessed user data without authorization and provided it to Saudi government officials. He alleged that his Arabic-language account was among the accounts accessed and that private information—including messages, chats, contacts, and other account data—was compromised. He also alleged that the disclosure put him and people connected to him at risk.

Al-Ahmed brought claims against Twitter under federal statutes concerning electronic communications and computer access, California’s unfair-competition law, contract and related legal theories, privacy-related tort law, negligence, conspiracy, replevin, fiduciary-duty theories, and interference with prospective economic advantage. He also challenged Twitter’s 2018 suspension of his Arabic-language account, alleging that the suspension caused him to lose access to followers and income and reflected Twitter’s complicity with, or approval of, the former employees’ conduct.

Twitter moved to dismiss the First Amended Complaint based on lack of constitutional standing, the statute of limitations, alleged lack of vicarious liability, immunity under Section 230 of the Communications Decency Act, Twitter’s Terms of Service, and claim-specific defects. The court addressed only standing, limitations, and Section 230 immunity because it concluded that every claim failed for one of those reasons.

Standing

The court denied Twitter’s argument that Al-Ahmed lacked Article III standing for all claims related to the alleged espionage. The court held that an alleged invasion of privacy—particularly the unauthorized access to private messages and other nonpublic account information—was a concrete and particularized injury. It also held that the alleged conduct of the former Twitter employees was sufficiently connected to Twitter for standing purposes because they were Twitter employees and allegedly obtained access through Twitter’s failures.

The court distinguished standing from the merits of vicarious liability. Whether Twitter could ultimately be held legally responsible for the employees’ conduct was a merits question, not a reason to find that Al-Ahmed lacked standing. The court nevertheless held that allegations concerning the disappearance, arrest, or execution of followers did not establish causation because the complaint did not provide facts connecting those events to the alleged privacy breach.

Statute of Limitations

The court held that Al-Ahmed could not use California’s delayed-discovery rule to postpone accrual of his claims based on the unauthorized account access. Twitter had sent notices in December 2015 warning that the account may have been targeted by state-sponsored actors. Although Al-Ahmed alleged that he did not receive the notices and did not know Twitter employees were involved until their 2019 indictments, the court held that he was presumed to have knowledge of his injury because the notices had been sent and were available to him.

The court concluded that the allegations did not show the diligence required to invoke delayed discovery. It therefore held that the claims based on the unauthorized access were barred by the statute of limitations, including the claims under the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, Stored Communications Act, California’s unfair-competition law, contract and related theories, intrusion upon seclusion, negligence, negligent hiring and supervision, conspiracy, replevin, and interference with prospective economic advantage.

The court separately held that the breach-of-duty-of-loyalty claim was time-barred because its substance was interference with prospective economic advantage. It held that the aiding-and-abetting fiduciary-duty claim was also time-barred, applying the two-year period for intrusion upon seclusion. The court rejected Al-Ahmed’s argument that continuing account suspension created repeated, timely injuries, reasoning that the unauthorized access and the 2018 suspension were discrete events rather than a continuing or recurring obligation.

Section 230 and Suspension Claims

Section 230(c)(1) generally protects an interactive computer service from being treated as the publisher or speaker of information supplied by another content provider. The court held that Section 230 applied to Al-Ahmed’s claims concerning Twitter’s suspension of his account because suspending an account was a publishing decision related to user-provided information. The court rejected Al-Ahmed’s arguments that Twitter had helped create the allegedly offensive message, that the suspension was inconsistent with Section 230’s policy goals, and that Twitter had to prove good faith. The court held that the subsection at issue did not require a showing of good faith.

The court held that Section 230 immunity covered the suspension-based claims under the Stored Communications Act, civil conspiracy, California’s unfair-competition law, breach of contract, and promissory estoppel. It held that immunity did not cover Al-Ahmed’s contract claim based on Twitter’s alleged failure to provide an adequate explanation for the suspension or meaningfully address his appeal. That claim nevertheless failed because Al-Ahmed did not identify the specific contract provision Twitter allegedly breached.

Disposition

The court granted Twitter’s motion to dismiss in its entirety. It granted Al-Ahmed leave to amend only to plead due diligence under the delayed-discovery rule. The court stated that any Second Amended Complaint was due within 30 days of the order. Judge Edward M. Chen signed the order on January 3, 2023.