K. v. Google LLC

Background

M.K., a minor represented by his mother as guardian ad litem, sued Google LLC and the Fremont Unified School District. He alleged that he attended school remotely through a Google platform beginning in March 2020 and that Google collected information including physical locations, websites visited, search terms, clicked links, videos watched, voice recordings, saved passwords, biometric information, and behavioral information.

M.K. also alleged, on information and belief, that his device was hacked in January 2021 and that sexually explicit material was sent to his teacher and linked to him. He claimed that Google and the school district failed to inform parents and school personnel about data collection, security risks, and the possibility of hacking or stalking in online classrooms.

The complaint asserted five claims: violation of the federal Video Privacy Protection Act; violation of California’s Student Online Personal Information Protection Act, or SOPIPA; violation of California’s unfair competition law; negligent failure to protect; and violation of the California constitutional right to privacy. M.K. sought damages and injunctive relief, including destruction of biometric information allegedly collected from him.

Google’s Motion and the Video Privacy Protection Act Claim

Google moved under Federal Rule of Civil Procedure 12(b)(6), which permits dismissal when a complaint does not state a legally sufficient claim. The court held that M.K.’s Video Privacy Protection Act claim lacked facts showing that he watched videos, identifying the relevant platform or application, or plausibly establishing that Google was a covered video service provider and that M.K. was a covered consumer. The complaint also did not identify what personally identifiable information Google allegedly disclosed or to whom it was disclosed.

The court dismissed the Video Privacy Protection Act claim but granted leave to amend. The court noted that M.K. had described additional facts for the first time in his opposition brief, but those facts were not part of the complaint and it could not conclude that amendment would be futile.

State-Law and Common-Law Claims

Google argued that the state and common-law claims were expressly preempted by the federal Children’s Online Privacy Protection Act. The court denied the motion to dismiss on that preemption ground, explaining that controlling Ninth Circuit law did not bar state-law claims that were parallel to, or prohibited the same conduct as, the federal law.

The court nevertheless dismissed the state and common-law claims for failure to plead sufficient facts. For the SOPIPA claim, M.K. alleged on information and belief that Google collected biometric and behavioral information for purposes unrelated to school purposes, but he did not explain how or why he believed Google collected his biometric information. He also did not allege facts showing Google’s role in the hacking incident or supporting an inference that Google failed to maintain reasonable security practices. The court assumed, without deciding, that SOPIPA could be privately enforced and granted leave to amend.

The court dismissed the unfair competition law claim because M.K. did not allege the economic injury required for standing under that statute. The court explained that personal information is not property for this purpose and that M.K. had not shown that the alleged harm to his education or reputation involved a loss of money or property. M.K.’s assertions about his parents paying for tutors and trying to avoid data collection appeared for the first time in his opposition and were not alleged in the complaint. The court granted leave to amend the claim to allege facts establishing standing and did not reach Google’s other arguments about the claim.

The court treated the “Failure to Protect” claim as a negligence claim, which requires allegations of a duty, breach, causation, and damages. It held that the complaint did not plausibly allege that Google breached a duty owed to M.K. or establish Google’s role in the alleged hacking. The court dismissed the claim with leave to amend.

The court also dismissed the California constitutional privacy claim with leave to amend. Although such a claim requires a legally protected privacy interest, a reasonable expectation of privacy, and conduct constituting a serious invasion, the complaint did not identify the application or technologies involved, what data was shared, or with whom it was shared.

Disposition

Judge Demarchi granted Google’s motion to dismiss with leave to amend. The court rejected Google’s COPPA-preemption argument, but dismissed M.K.’s claims against Google because the complaint did not state sufficient facts. M.K.’s amended complaint was due April 10, 2023, and Google’s response was due April 24, 2023. The order concerned Google’s motion and did not resolve the separate motion to dismiss filed by the school district.