K. v. Google LLC

Background

M.K., through his mother as guardian ad litem, sued Google LLC and the Fremont Unified School District based on alleged harm arising from the District’s use of a Google platform for remote learning during the COVID-19 pandemic. The first amended complaint asserted four claims against Google: violation of the federal Video Privacy Protection Act (VPPA), violation of California’s unfair competition law (UCL), violation of the California Student Online Personal Information Protection Act (SOPIPA), and “failure to protect.”

M.K. alleged that he used a District-assigned Google account to watch videos on YouTube and Google Slide Show while attending school remotely. He alleged that District staff could see his online activity. After a teacher reported receiving a sexually explicit Google Chat message, M.K. alleged that his account had been hacked and that he did not send the message. The District investigated by obtaining information about account access, activity, and internet protocol addresses. M.K. alleged that Google failed to use adequate cybersecurity measures, failed to warn about vulnerabilities, and made his information available to the District, hackers, and unidentified third parties.

Google moved to dismiss all claims under Federal Rule of Civil Procedure 12(b)(6), which permits dismissal when a complaint does not state a legally sufficient claim. M.K. opposed the motion but withdrew his SOPIPA claim against Google.

Judicial Notice

Google asked the court to take judicial notice of Federal Trade Commission guidance concerning the Children’s Online Privacy Protection Act. Judicial notice permits a court to accept certain facts or public records without requiring formal proof. Because M.K. did not oppose the request, the court granted it, but stated that the guidance had no bearing on the motion to dismiss.

Video Privacy Protection Act claim

The VPPA generally prohibits a video-tape service provider from knowingly disclosing personally identifiable information about a consumer. To plead a VPPA claim, M.K. had to plausibly allege that Google was a video-tape service provider, that he was a consumer, that Google knowingly disclosed his personally identifiable information to someone, and that the disclosure was not statutorily permitted.

The court held that M.K. plausibly alleged that he was a “consumer” because he had a Google account with a unique login, watched Google video content while logged in, and alleged that Google associated information about the videos he watched with his account. The court concluded that obtaining the account through the District did not defeat the possibility of a subscriber relationship with Google.

The court agreed with Google that the complaint did not plausibly allege disclosure to third parties other than the District. But the court declined to dismiss the claim insofar as it challenged disclosure of M.K.’s information to the District and its employees. Google argued that such disclosures were part of its ordinary course of business in managing the education account. The court found that the complaint did not contain information about Google’s contractual obligations to the District and therefore could not determine at the pleading stage that the alleged disclosures were merely incidental to those obligations.

The court denied Google’s motion to dismiss claim 1 as to the alleged disclosure of M.K.’s personally identifiable information to the District and its employees.

California unfair-competition claim

The UCL prohibits unlawful, unfair, or fraudulent business practices and generally allows restitution and injunctive relief. To have standing to bring a private UCL action, a plaintiff must allege that he lost money or property and that the loss was caused by the challenged business practice.

M.K. alleged that his family spent money on tutors and an attorney after his suspension, and argued that these expenditures reduced his future interest in his parents’ estate. The court held that M.K. did not allege that he personally lost money or property. The court also held that he did not plausibly allege that Google’s conduct caused the expenditures. According to the court, the alleged economic harm resulted from the District’s decision to suspend M.K., not from Google’s alleged violations of privacy laws or its alleged violation of a student-privacy pledge.

The court therefore granted Google’s motion to dismiss claim 2.

Failure-to-protect claim

The court treated the “failure to protect” claim as a negligence claim. Negligence requires allegations of a legal duty, breach of that duty, causation, and damages. M.K. relied on SOPIPA and COPPA as sources of Google’s duty of care.

The court stated that the complaint did not refer to COPPA as the source of a duty owed by Google. It also found that SOPIPA did not provide a private right of action and that M.K. did not explain why he could rely on an alleged SOPIPA violation by recasting it as negligent failure to protect.

Independently, the court found that M.K. did not plausibly allege a cybersecurity defect, negligent platform design, inadequate data-handling practices, a required warning, or facts showing that any alleged failure caused his injury. The allegation that his account was hacked, standing alone, was insufficient. The court also found that allegations about advertisements and video recommendations did not plausibly show that Google shared M.K.’s school-related information with advertisers.

The court therefore granted Google’s motion to dismiss claim 4.

Leave to amend and disposition

M.K. had already received one opportunity to amend his claims against Google. He did not request another opportunity or identify additional facts that he could plead. The court concluded that another amendment would be futile and declined to grant leave to amend again.

The court granted Google’s motion to dismiss with respect to claims 2, 3, and 4. Claim 3 was the SOPIPA claim that M.K. had withdrawn. The court denied Google’s motion to dismiss claim 1 to the extent it concerned alleged disclosure of M.K.’s personally identifiable information to the District and its employees. Google’s responsive pleading was due 14 days from the date of the order.