K. v. Google LLC

Background

M.K., a minor represented by his guardian ad litem, sued Google LLC and the Fremont Unified School District over alleged privacy violations involving a Google platform used for remote learning during the COVID-19 pandemic. The complaint alleged that Google collected information including physical locations, websites visited, search terms, clicked links, watched videos, voice recordings, saved passwords, biometric information, and other behavioral information.

M.K. also alleged that his device was hacked and that the hacker sent sexually explicit content to his classroom teacher. According to the complaint, the content was linked to M.K., who was exposed to and disciplined for it. M.K. alleged that Google and the District failed to warn parents, teachers, and school staff about hacking and stalking risks and failed to obtain parental consent for the collection of information.

The complaint asserted claims under the federal Video Privacy Protection Act, the California Student Online Personal Information Protection Act, California’s unfair-competition law, a “Failure to Protect” theory, and the California Constitution’s privacy provision. M.K. later confirmed that the Video Privacy Protection Act and unfair-competition claims were asserted only against Google, and he withdrew the Student Online Personal Information Protection Act claim against the District. The remaining claims against the District were “Failure to Protect” and violation of the California constitutional right to privacy.

Legal standard

The District moved under Rule 12(b)(6), which permits dismissal when a complaint does not state a legally sufficient claim. The court was required to accept well-pleaded factual allegations as true and view them favorably to M.K., but conclusory statements and speculative allegations were not enough. The complaint had to include enough factual content to make the claims plausible.

Discussion and rulings

Federal preemption. The District argued that federal children’s online privacy law, known as the Children’s Online Privacy Protection Act, preempted M.K.’s state and common-law claims. The court understood this argument to be based on the same theory advanced by Google: that M.K. could not privately enforce violations of that federal law through state or common-law claims. Relying on Ninth Circuit precedent, the court held that the federal law’s preemption provision did not bar state-law claims addressing the same conduct. The court therefore denied the District’s motion to dismiss on express-preemption grounds.

“Failure to Protect” claim. M.K. alleged that the District negligently allowed Google to obtain his information, required students to use Google’s platforms, failed to train teachers about hackers and predators, and failed to protect him from privacy and data-collection risks. The District argued that the claim lacked a statutory basis because California public entities generally are liable for torts only when a statute provides for liability. The court agreed that M.K. had not identified a statute supporting the claim. Although M.K. referred to the federal children’s privacy law and the California Consumer Privacy Act elsewhere in the complaint, he had not asserted those claims against the District and had not shown that either statute could support this tort theory. The court dismissed the “Failure to Protect” claim, with leave to amend.

California constitutional privacy claim. California’s constitutional privacy provision requires allegations showing a legally protected privacy interest, a reasonable expectation of privacy in the circumstances, and conduct amounting to a serious invasion of privacy. M.K. alleged a privacy expectation in his devices and online behavior and alleged that Google and the District could monitor his behavior. The court found, however, that the complaint did not plausibly allege that the District actually took the monitoring actions described. It also did not identify the application referenced in the complaint or facts showing that the District helped design it. The court dismissed the California constitutional privacy claim, with leave to amend.

Leave to amend and conclusion. The court stated that amendment should generally be allowed when it can facilitate decisions on the merits. Although the court was uncertain whether M.K.’s proposed additional facts would cure all pleading defects, it allowed amendment limited to the claims asserted in the complaint. The amended complaint was due April 10, 2023.

The opinion contains an apparent inconsistency: its opening discussion and analysis address and grant the District’s motion to dismiss, while the conclusion states that “Google’s motion to dismiss is granted with leave to amend.” The supplied text does not clarify whether “Google’s” in the conclusion is a transcription error or reflects a separate ruling.