Gerber v. Twitter, Inc.

Background

Twitter users were required to enter a User Agreement and provide personal information, including names and other information. The agreement included Twitter’s Terms of Service and Privacy Policy. Plaintiffs alleged that, from about June 2021 through January 2022, a defect in Twitter’s application programming interface allowed unauthorized actors to obtain information associated with an estimated 200 million accounts, including usernames, display names, account-creation data, email addresses, and phone numbers. The information was allegedly offered for sale or leaked online between August 2022 and January 2023.

Plaintiffs alleged that Twitter failed to use reasonable data-security measures and that the breach exposed the identities of users who had used pseudonymous accounts. One plaintiff alleged spending time monitoring accounts to detect and prevent misuse of personal information. The consolidated amended complaint asserted eight causes of action: breach of contract, negligence, negligence per se, gross negligence, unjust enrichment, violation of California’s Unfair Competition Law, violation of the California Consumers Legal Remedies Act, and declaratory judgment.

Judicial Notice

Twitter asked the court to take judicial notice of 14 documents, including versions of its Privacy Policy and Terms of Service, Twitter blog posts, articles, government materials, and Twitter help pages. The court declined to incorporate Exhibits 9 through 14 by reference because they were not needed to resolve the motion, and also declined to incorporate Exhibit 10 because it was unnecessary. The court took judicial notice of Exhibits 1 through 8 under the incorporation-by-reference doctrine. The request for judicial notice was therefore granted in part and denied in part.

Motion to Dismiss

The court applied Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint alleges enough facts to plausibly support a legal claim. The court considered Twitter’s argument that the Terms of Service barred or limited liability. It explained that such provisions may be unenforceable if they are unconscionable, meaning unfair because of unequal bargaining power or because they conflict with public policy. The court also noted that California law does not permit a contract to limit liability for gross negligence.

The court concluded that the complaint did not specifically allege that the Terms of Service were unconscionable. It therefore granted the motion to dismiss the first, second, third, and fifth causes of action—breach of contract, negligence, negligence per se, and unjust enrichment—with leave to amend. The court allowed plaintiffs to amend their contract and unjust-enrichment claims to identify specific promises in the Terms of Service and related privacy policies. It also stated that negligence per se is not an independent cause of action and directed plaintiffs to plead it as a theory of negligence.

The court denied the motion as to the fourth cause of action, gross negligence. It found that the alleged time spent monitoring accounts could constitute a non-economic injury rather than only a purely financial loss, and that the economic-loss rule therefore did not bar the claim at the pleading stage. The court also concluded that the Terms of Service could not bar a gross-negligence claim under California law.

Unfair Competition Claim

The court dismissed the sixth cause of action under California’s Unfair Competition Law with leave to amend. Plaintiffs argued that they suffered economic injury through the lost monetary value of their personal information and the loss of the benefit of their bargain with Twitter. The court rejected the lost-value theory as pleaded because the existence of a market for stolen information did not show that plaintiffs intended or attempted to participate in that market or otherwise derive economic value from their information.

The court found that plaintiffs could potentially plead economic injury based on the benefit of their bargain. It allowed them to amend the claim to allege more clearly that Twitter violated privacy-policy protections. The court stated that adequately pleading such a violation could satisfy the harm requirement for the claim.

Consumer-Protection and Declaratory-Judgment Claims

Plaintiffs conceded the seventh cause of action under the California Consumers Legal Remedies Act. The court therefore granted the motion with prejudice as to that claim.

The eighth cause of action sought a declaration that Twitter owed a legal duty to secure users’ personal information and timely notify them of a data breach, and that Twitter continued to violate that duty. The court denied the motion as to this claim because a dispute remained about the continuing risk faced by plaintiffs and similarly situated users.

Disposition

Judge Kandis Westmore granted in part and denied in part Twitter’s motion to dismiss. The motion was granted with leave to amend as to the first, second, third, fifth, and sixth causes of action; granted with prejudice regarding the seventh cause of action; and denied as to the fourth and eighth causes of action. Plaintiffs were ordered to file a second amended complaint within 21 days of the order.