BACKGROUND

In July 2018, plaintiffs sued Facebook for declaratory and injunctive relief, alleging Facebook’s data privacy practices violated the UCL and FAL. Plaintiffs alleged that a third party (Aleksandr Kogan) created a Facebook app called “This Is Your Digital Life.” The app presented as a personality test that collected data for academic research, but it also obtained the user’s consent to access the user’s data, as well as the data of the user’s Facebook friends without obtaining the friends’ consent. Thus, although approximately 300,000 users took the personality test, the app was able to access information of over 70 million Facebook users in the United States alone. Some or all of that data was then sold to a political consulting firm, Cambridge Analytica, which used it to sell targeted advertising during the 2016 presidential campaign. Plaintiffs alleged that although Facebook learned that the app violated Facebook’s policies “as early as 2015,” Facebook users were not notified until 2018. Ballejos individually alleged that she “has a Facebook account and received a notification that her personal data may have been accessed” by a third-party application “without her consent.” (Italics added.) Plaintiffs jointly alleged they have “a property interest in the data collected by Facebook,” and “Plaintiffs suffered injury in fact and have lost a property interest” due to Facebook’s violations of the UCL and FAL.

2 In September 2022, the trial court sustained with leave to amend Facebook’s demurrer to the original complaint, concluding that “Plaintiffs have not sufficiently pled standing, injury in fact, or actual reliance.”2 In October 2022, Ballejos and Martin filed the first amended complaint. The amended complaint added allegations that Ballejos “posted information and details relating to her personal life on her Facebook account that she would not have posted had she known that it would be disclosed without her consent to unauthorized parties,” including photos, “geolocation data, time

2 At a June 2019 hearing, the trial court (Judge Buchwald) orally

overruled Facebook’s demurrer, directed Facebook to answer the complaint within 20 days, and directed plaintiffs to prepare a written order and memorandum of decision, to which Facebook had the opportunity to object. The parties complied, but the court did not rule on the objections or issue a final written order or memorandum of decision. In September 2019, the federal district court in a parallel multidistrict litigation issued an order dismissing a similar UCL claim on the basis of standing because those plaintiffs had “not adequately alleged lost money or property.” (See In re Facebook Consumer Privacy User Profile Litigation (N.D. Cal. 2019) 402 F.Supp.3d 767, 784, 804.) At a status conference two days later, Facebook asked the trial court (Judge Buchwald) to reconsider its oral ruling on the demurrer in light of the federal ruling. The trial court declined to do so, stating that the final written order on Facebook’s demurrer “ought to be issued and finalized” consistent with the court’s prior oral ruling. The court further stated that “the issues underlying Facebook’s demurrer are ‘really for appellate review,’ and that the Court will ‘do a written order’ for that reason.” But a written ruling still did not issue, thus, Facebook filed a petition for a peremptory writ of mandate, which this court denied without prejudice to refiling after the trial court issued its written ruling on the demurrer. (Facebook, Inc. v. Superior Court for the County of San Mateo (Dec. 24, 2019, A159158) [nonpub. opn.].) In 2022, the case was reassigned. As there was still no written order, the new trial court (Judge Foiles) ordered supplemental briefing and reheard the motions, ultimately sustaining the demurrer with leave to amend as discussed herein.

3 stamps, videos, access to what content Plaintiffs like, their relationship status, and many other categories” of information. The amended complaint also added allegations that there “is a clear market for user data out there.” Plaintiffs cited several studies and articles reporting that, “the median [Facebook] user needed a compensation of about $48 to forgo Facebook for one month” and, although valuations for user data “vary widely” and “include evaluations of less than a dollar for an average person’s data to a slightly more generous $100 for a Facebook user,” one user sold his data for $2,733. Although plaintiffs do not allege that they had ever previously sold their personal data in the past or had ever intended or attempted to sell the data purportedly subject to the unauthorized access, plaintiffs maintain that they “could have sold their data for significant sums,” “should they choose to,” and the value of their data “dropped significantly, thus causing economic injury to Plaintiffs.” Plaintiffs further alleged they were harmed because Facebook shared “content and information with third parties who Plaintiffs did not want to see their data, leading to the loss of privacy and control over their content and information.” Facebook’s “inability to timely notify Plaintiffs of the improper release of their data left Plaintiffs open to the risks of identity theft, fraud, and targeted communications that Plaintiffs could have mitigated had they been given proper and timely notice.” Plaintiffs alleged they were further harmed by “psychographic marketing,” as they were “personally targeted by advertisers with content” that was “highly offensive to them and would be highly offensive to a reasonable person.” Finally, plaintiffs alleged they “face significant economic and privacy-related harms as a result of the aggregation of their data” because such data could predict sickness or credit suitability

4 and can have a “direct impact on life essentials such as health insurance, resulting in economic harm.” In December 2022, Facebook demurred to the first amended complaint. In February 2023, the trial court sustained the demurrer without leave to amend, finding the amended complaint added “no new facts sufficient to show that [plaintiffs] lost ‘money or property’ as a result of [Facebook’s] alleged conduct.” The court noted that “[t]he amended complaint addresses the loss of privacy and control over their content and information and speaks [to] the risk of identity theft, fraud, and targeted communications such as advertisements based on psychographic marketing. [Citations.] Such claims do not constitute a loss of money or property and fail to demonstrate some form of economic injury.” Additionally, the court found the new allegations “fail to show they [have] suffered an ‘injury in fact’ ” because they are “too vague and speculative to meet the requirements of the UCL.”

DISCUSSION

“On appeal from a judgment dismissing an action after sustaining a demurrer without leave to amend, the standard of review is well settled. We give the complaint a reasonable interpretation, reading it as a whole and its parts in their context. [Citation.] Further, we treat the demurrer as admitting all material facts properly pleaded, but do not assume the truth of contentions, deductions or conclusions of law. [Citations.] When a demurrer is sustained, we determine whether the complaint states facts sufficient to constitute a cause of action.” (City of Dinuba v. County of Tulare (2007) 41 Cal.4th 859, 865.) “The UCL prohibits, and provides civil remedies for, unfair competition, which it defines as ‘any unlawful, unfair or fraudulent business act or practice.’ (§ 17200.) Its purpose ‘is to protect both consumers and

5 competitors by promoting fair competition in commercial markets for goods and services.’ [Citations.] In service of that purpose, the Legislature framed the UCL’s substantive provisions in ‘ “broad, sweeping language” ’ [citations] and provided ‘courts with broad equitable powers to remedy violations’ [citations]. The state’s false advertising law (§ 17500 et seq.) is equally comprehensive within the narrower field of false and misleading advertising.” (Kwikset Corp. v. Superior Court (2011) 51 Cal.4th 310, 320 (Kwikset) [addressing the standing requirements of the unfair competition and false advertising laws in the wake of Proposition 64].) In 2004, the electorate passed Proposition 64, which revised the UCL’s and FAL’s standing requirements “to confine standing to those actually injured by a defendant’s business practice.” (Kwikset, supra, 51 Cal.4th at pp. 321–322.) Proposition 64 declares: “ ‘It is the intent of the California voters in enacting this act to prohibit private attorneys from filing lawsuits for unfair competition where they have no client who has been injured in fact under the standing requirements of the United States Constitution.’ ” (Kwikset, at p. 322, citing Prop. 64, § 1, subd. (e), italics added; see also Buckland v. Threshold Enterprises, Ltd. (2007) 155 Cal.App.4th 798, 814.) Under federal law, this “injury in fact” is “ ‘an invasion of a legally protected interest which is (a) concrete and particularized, [citations]; and (b) “actual or imminent, not ‘conjectural’ or ‘hypothetical,’ ” [citations].’ [Citations.] ‘Particularized’ in this context means simply that ‘the injury must affect the plaintiff in a personal and individual way.’ ” (Kwikset, at pp. 322–323.) While “it suffices for federal standing purposes to ‘ “allege[ ] some specific, ‘identifiable trifle’ of injury,” ’ ” (id. at p. 324) “[t]o satisfy the narrower standing requirements imposed by Proposition 64,” a private plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify

6 as injury in fact, i.e., economic injury, and (2) show that that economic injury was the result of, i.e., caused by, the unfair business practice or false advertising that is the gravamen of the claim.” (Id. at p. 322.) In other words, after the passage of Proposition 64, to allege standing under the UCL and FAL, a plaintiff must suffer injury in fact and have lost money or property. (Archer v. United Rentals, Inc. (2011) 195 Cal.App.4th 807, 815 (Archer).) The loss of money or property requirement is more difficult to satisfy than the injury in fact. (Id. at p. 816.) Nonetheless, there are “innumerable ways” to satisfy the lost money or property requirement, including, as relevant here, by having a future or present property interest diminished. (Kwikset, supra, 51 Cal.4th at p. 323.) Here Ballejos contends the trial court erred in “ignoring” her “detailed allegations” of loss and asserts the “central issue on appeal” is whether the first amended complaint’s “detailed allegations that Facebook’s unauthorized sale and provision of access to third parties of Plaintiffs’ personal information and data, as well as that of their ‘friends’ on Facebook, diminished the value of their personal data and property.” Ballejos argues that “any diminution in value of property, i.e., the digital data here, even if it’s a ‘trifle,’ constitutes loss of money or property within the framework of the UCL and FAL.” (Citing Sarun v. Dignity Health (2014) 232 Cal.App.4th 1159, 1167.) This “trifle of value” associated with her digital property, Ballejos contends, means she has standing under the UCL and FAL, regardless of any intent to sell or attempted sale of that digital property. Facebook counters, relying on Proposition 64, Kwikset, and their progeny to argue that the allegations of the first amended complaint fail to satisfy the twofold standing requirement that “plaintiffs bringing UCL or FAL claims must show that they personally (1) suffered an ‘injury in fact’ and

7 (2) ‘lost money or property as a result of’ the alleged violation.” Facebook therefore agrees with the trial court’s determination that Ballejos’s allegations “were insufficient to establish that she ‘lost money or property’ within the meaning of the UCL and Kwikset, and that her allegations of ‘injury in fact’ were ‘entirely too vague and speculative’ to establish that separate requirement of standing.” The Civil Justice Association of California (CJAC) filed an amicus brief in favor of Facebook’s position pursuant to California Rules of Court, rule 8.200(c), to which Ballejos has responded. CJAC notes Proposition 64’s focus on “unscrupulous lawyers who exploited the generous standing requirement of the UCL to file ‘shakedown’ suits to extort money from small businesses.” (In re Tobacco II Cases (2009) 46 Cal.4th 298, 316.) CJAC comments on the “tenuous nature” of Ballejos’s interest in this action, arguing, “[a]lthough she apparently claims that she posted personal information on Facebook in reliance on promises of confidentiality, she does not allege what information she posted, whether she posted it for viewing by the public at large or only by a limited audience, whether she has ever derived any economic value from information of the sort she posted on Facebook, or even whether her personal information made its way to Cambridge Analytica. In short, she is no different from any other member of the general public who reads the news and happens to have a Facebook account.” We agree with both Facebook and CJAC. Here, the issue of economic injury is dispositive. As all parties recognize, per Kwikset, “[t]here are innumerable ways in which economic injury from unfair competition may be shown. A plaintiff may (1) surrender in a transaction more, or acquire in a transaction less, than he or she otherwise would have; (2) have a present or future property interest

8 diminished; (3) be deprived of money or property to which he or she has a cognizable claim; or (4) be required to enter into a transaction, costing money or property, that would otherwise have been unnecessary.” (Kwikset, supra, 51 Cal.4th at p. 323.) This list is not exhaustive, but a “private plaintiff filing suit now must establish that he or she has personally suffered such harm.” (Ibid.) The Kwikset plaintiffs had sufficiently alleged harm because they had purchased locksets in part because they were labeled as made in USA, those representations were false, and they would not have purchased the locksets otherwise. The resulting economic harm was “the loss of real dollars from a consumer’s pocket” because the consumer “purchased a product that he or she paid more for than he or she otherwise might have been willing to pay if the product had been labeled accurately.” (Kwikset, supra, 51 Cal.4th at pp. 327– 329.) “That increment, the extra money paid, is economic injury and affords the consumer standing to sue.” (Id. at p. 330.) In the subsequent case of Murphy v. Twitter, Inc. (2021) 60 Cal.App.5th 12, 39 (Murphy), our colleagues in Division One considered a more factually similar situation. Plaintiff Murphy had posted several messages on Twitter, which Twitter took down for violation of its hateful conduct rules. After Murphy posted additional purportedly violative messages, Twitter permanently suspended her account. (Id. at p. 17.) Murphy filed suit, asserting multiple causes of action, including violation of the UCL. Specifically, Murphy alleged she was a “ ‘freelance journalist and writer who relies on Twitter for her livelihood’ ”; she and others “ ‘lost a tangible property interest in their accounts and the followers they had accumulated’ ”; and “ ‘[t]here is no public forum comparable to Twitter that would allow Murphy and other users to build a widespread following, communicate with a global

9 audience, or support themselves in the fields of journalism, politics, or public affairs.’ ” (Id. at pp. 39–40.) Relying on Kwikset, the Court of Appeal affirmed the trial court’s sustaining of the demurrer without leave to amend, holding in relevant part that Murphy’s UCL claim failed for lack of standing because she did not allege a “ ‘loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury.’ ” (Murphy, at p. 39, quoting Kwikset, supra, 51 Cal.4th at p. 322.) Other California Courts of Appeal have reached similar conclusions. For example, Archer, supra, 195 Cal.App.4th at page 816, involved a class of putative plaintiffs who had lost personal identifying information in the form of their names and residence addresses when they were required to provide their driver’s licenses at the time of equipment rentals. Similar to Ballejos’s privacy claims here, the Archer plaintiffs had alleged “the unlawful collection and recordation of their personal identification information [was] an invasion of their right of privacy, which, they maintain, constitutes an ‘injury in fact.’ ” (Id. at p. 816, citing Kwikset, supra, 51 Cal.4th at p. 322.) Yet, in affirming the trial court’s finding of no UCL standing, the Court of Appeal explained, “plaintiffs have failed to demonstrate how such privacy violation translates into a loss of money or property. Thus, the absence of ‘lost money or property’ is fatal to plaintiffs’ UCL class claim for injunctive relief.” (Archer, at p. 816.) In Fogelstrom v. Lamps Plus, Inc. (2011) 195 Cal.App.4th 986, 993–994 (Fogelstrom), the Court of Appeal again upheld the trial court’s sustaining of a demurrer to plaintiffs UCL claim. There, the defendant provided the customer’s name, credit card number, and ZIP code to a third-party credit reporting agency, which matched the information to its own records to produce a mailing list which defendant then used for further marketing. (Fogelstrom, at p. 993.) The court rejected plaintiff’s demand for “ ‘restitution

10 of the fair compensation for his personal information’ ” “because he lost ‘his intellectual property rights in his home address,’ ”and instead found that plaintiff had not suffered an “injury in fact” within the meaning of the UCL. (Fogelstrom, at pp. 993–994.) Ballejos attempts to distinguish these authorities, contending that “the sale and sharing of access to personal data like Facebook did here” renders Ballejos’s claims somehow more significant than those of Murphy, Archer, and Fogelstrom. But Ballejos’s argument overlooks the deficiencies within the allegations of the first amended complaint. Even after assuming the truth of all material facts properly pleaded, and despite the reports cited suggesting there is a market for personal data, Ballejos failed to adequately allege that she personally suffered any economic injury sufficient to support standing to pursue her claims. First, Ballejos alleges no injury specific to her; all allegations of injury in the form of diminished value or otherwise apply to all plaintiffs. Second, these generalized allegations are either conclusory or too speculative to demonstrate personal economic injury. For example, plaintiffs allege that they “posted information and details relating to their personal life” on their Facebook accounts that Facebook improperly disseminated. But Ballejos fails to detail the nature and associated value of this “personal” information, including which of it was hers and whether it was in fact kept private (as compared to public posts). The first amended complaint further omits allegations of Ballejos’s intent or ability to sell her leaked personal information before her data was potentially sold to Cambridge Analytica (i.e., if there is a buyer or market for Ballejos’s personal information, as compared to that of another plaintiff or any other Facebook user), and any actual loss suffered—through decrease in value or

11 otherwise—as a result of that private information being potentially used for targeted ads. (Moore v. Centrelake Medical Group, Inc. (2022) 83 Cal.App.5th 515, 538–539 (Moore), review den. Dec. 14, 2022 [finding lost value of personal data theory insufficient to support UCL standing where, despite properly pleading that data was stolen and disseminated and a market for it existed, appellants failed to allege they attempted or intended to participate in the market or that any prospective purchaser of their data might refuse to enter into a transaction with them or insist on less favorable terms based on the data breach].) The amended complaint’s general allegations that some users sell their private information or that personal information can have a marketable value is therefore insufficient to demonstrate a “ ‘ “specific, ‘identifiable trifle’ of injury” ’ ” that affected Ballejos in a personal and individual way. (Kwikset, supra, 51 Cal.4th at pp. 323, 324, italics added.) In addition, the amended complaint is notably silent as to Ballejos’s privacy settings and posting practices, despite their necessary connection to any injury determination. More specifically, if Ballejos’s posts and personal information were public prior to their potential sale to Cambridge Analytica, it is difficult to see how the sale of this already public information could have caused the information to lose any value, and, correspondingly, caused Ballejos any economic loss. In fact, the amended complaint’s allegations that plaintiffs “did not intend to make [their personal information] public beyond the scope of their existing Facebook friends” reveals that Ballejos did not keep her personal information private but rather published it to her Facebook friends. We therefore can only speculate if the potential sale of this already shared information caused any quantifiable violation of privacy or diminution in value. Thus, the conclusory allegation that the potential sale led “to the loss of privacy and control over [Ballejos’s] content and

12 information” is both insufficient to demonstrate economic loss under Archer and contradicted by Ballejos’s own allegations. Plaintiffs’ remaining allegations of economic injury, such as the risk of identity theft or fraud, or the “impact on life essentials, such as health insurance” are purely speculative and hypothetical as, again, the amended complaint asserts no related damage to Ballejos. (See Kwikset, supra, 51 Cal.4th at pp. 322.) In her reply brief, Ballejos asserts a different theory of economic injury, namely that she surrendered more in her transaction with Facebook than she otherwise would have had she known Facebook was not going to protect her private data.3 (See Brown v. Google LLC (N.D. Cal., Dec. 22, 2021, No. 20- CV-03664-LHK) 2021 WL 6064009, at p. *15 [recognizing as a cognizable theory of economic injury that “Google caused Plaintiffs to ‘acquire in a transaction less[ ] than [they] otherwise would have”]; In re Meta Pixel Tax Filing Cases (N.D. Cal., Mar. 25, 2024, No. 22-CV-07557-PCP) 2024 WL 1251350, at p. *24 [“If a user shares information with the expectation that it will be protected but the recipient does not actually protect it, then the user has surrendered in that transaction more than she otherwise would have”].) This argument fails for the same reasons. Without alleging more specific facts, such as when Ballejos opened her Facebook account or what data use policy or disclosures she read and agreed to before she created her account and posted her information, we cannot determine whether Ballejos received

3 Despite being inappropriately raised for the first time in the reply

brief (Simpson v. The Kroger Corp. (2013) 219 Cal.App.4th 1352, 1370 [“[r]aising a new theory in a reply brief is improper and unfair”]), we address this new theory of economic damages because our review requires us to determine whether the pleadings allege facts “sufficient to constitute a cause of action.” (City of Dinuba v. County of Tulare, supra, 41 Cal.4th at p. 865.)

13 the benefit of her bargain with Facebook. The amended complaint again fails to show Ballejos suffered any economic harm and therefore cannot establish standing to sue under the UCL or FAL. Last, Ballejos asks us to reverse the ruling on the demurrer and allow her an opportunity to amend her pleadings to show standing under this new theory of economic harm. We decline to do so. “ ‘Review of the trial court’s failure to grant leave to amend is conducted under the abuse of discretion standard.’ [Citation.] ‘The plaintiff-appellant has the burden of demonstrating abuse of discretion by showing how the complaint can be amended to state a cause of action.’ [Citations.] Although ‘such showing may be made in the first instance to the appellate court,’ the plaintiff and appellant ‘must still offer details on how the amendment would cure the defects.’ ” (Moore, supra, 83 Cal.App.5th at p. 537.) But, as with the trial court, Ballejos does not “ ‘offer details’ ” on “ ‘how the complaint can be amended to state a cause of action.’ ” (Moore, supra, 83 Cal.App.5th at p. 537.) Moreover, the trial court already granted Ballejos leave to amend to address the original complaint’s deficiencies in standing, injury in fact, and actual reliance. Yet, other than adding generalized allegations that could apply to any plaintiff or any Facebook user, Ballejos again failed to plead personal and specific economic injury sufficient to demonstrate UCL or FAL standing. As such, the trial court did not abuse its discretion in sustaining Facebook’s demurrer without leave to amend.

DISPOSITION

The judgment is affirmed. Facebook is entitled to its costs on appeal. (Cal. Rules of Court, rule 8.278(a)(2).)

14 _________________________

DESAUTELS, J.

We concur:

_________________________

STEWART, P.J.

_________________________

RICHMAN, J.

Ballejos v. Meta Platforms, Inc. (A167824)

15