1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 SOUTHERN DISTRICT OF CALIFORNIA 9 10 CARSTEN ROSENOW, Case No.: 19-cv-1297-WQH-MMP

11 Plaintiff,

ORDER

12 v. 13 FACEBOOK, INC.; and YAHOO,

INC.,

14 Defendants. 15 16 HAYES, Judge: 17 The matters before the Court are the Motion to Dismiss Plaintiff’s Second Amended 18 Complaint (ECF No. 90) filed by Defendant Yahoo Holdings, Inc.1 (“Yahoo”) and the 19 Motion to Dismiss Plaintiff’s Second Amended Complaint (ECF No. 91) filed by 20 Defendant Meta Platforms, Inc. (“Facebook”).2 21 I. BACKGROUND 22 A. The Criminal Case 23 On July 19, 2017, an information was filed charging Plaintiff Carsten Rosenow 24 (“Rosenow”) with one count of travel with intent to engage in illicit sexual conduct in 25 26 27 1 Yahoo Holdings, Inc. was formerly known as Oath Holdings, Inc. and erroneously sued as Yahoo, Inc. 28 1 violation of 18 U.S.C. § 2423(b). United States v. Rosenow, S.D. Cal. Case No. 3:17-cr- 2 01937-WQH, ECF No. 20. On October 19, 2017, a three-count indictment was filed 3 charging Rosenow with one count of attempted sexual exploitation of a child in violation 4 of 18 U.S.C. § 2251(c); one count of travel with intent to engage in illicit sexual conduct 5 in violation of 18 U.S.C. § 2423(b); and one count of possession of images of minors 6 engaged in sexually explicit conduct in violation of 18 U.S.C. § 2252(a)(4)(B), (b)(2). 7 United States v. Rosenow, S.D. Cal. Case No. 3:17-cr-03430-WQH, ECF No. 1. 8 On March 19, 2018, Rosenow filed a Motion to Suppress Evidence in his criminal 9 case. Id., ECF No. 29. Rosenow moved the Court to suppress all the evidence against him 10 pursuant to the Fourth Amendment of the United States Constitution, contending that 11 “[u]ltimately, all of the evidence against Mr. Rosenow is the result of warrantless searches 12 of his private communications [by Facebook and Yahoo]—searches that were ‘government 13 action’ on these facts.” Id., ECF No. 29-1 at 9. 14 On July 27, 2018 and August 8, 2018, the Court held an evidentiary hearing on 15 Rosenow’s Motion to Suppress Evidence. Id., ECF Nos. 72, 73. 16 On September 10, 2018, Rosenow filed Supplemental Briefing in support of his 17 Motion to Suppress Evidence. Id., ECF No. 76. 18 On November 20, 2018, the Court issued an Order denying Rosenow’s Motion to 19 Suppress Evidence. Id., ECF No. 87. The Court found that Yahoo and Facebook were not 20 government actors and that they had investigated Rosenow in their own interest, in 21 accordance with their internal policies and procedures. Id., ECF No. 87 at 22–23. The Court 22 found that law enforcement conducted its investigation independently of Yahoo and 23 Facebook and utilized the information provided by Yahoo and Facebook in compliance 24 with all applicable laws. Id., ECF No. 87 at 23. The Court further found that “Yahoo and 25 Facebook reported information to the [National Center for Missing and Exploited Children 26 (‘NCMEC’)] pursuant to applicable law based upon facts and circumstances supporting an 27 apparent violation of child pornography laws.” Id. The Court considered and rejected 28 1 Rosenow’s argument that Facebook and Yahoo unlawfully disclosed Rosenow’s private 2 communications to NCMEC. See generally id. 3 On August 30, 2019, a jury found Rosenow guilty of violating 18 U.S.C. § 2251(c) 4 and (e) (attempted sexual exploitation of a child) and 18 U.S.C. § 2252(a)(4)(B) 5 (possession of images of minors engaged in sexually explicit conduct). Id., ECF No. 198. 6 On February 26, 2020, this Court sentenced Rosenow to a total of 300 months’ 7 imprisonment. Id., ECF No. 238. 8 On February 27, 2020, Rosenow filed a Notice of Appeal to the Court of Appeals 9 for the Ninth Circuit. Id., ECF No. 239. 10 On April 27, 2022, the Court of Appeals issued an opinion in the criminal appeal, 11 affirming Rosenow’s conviction. (See ECF No. 60.) 12 On October 3, 2022, the Court of Appeals issued an order and an amended opinion 13 in the criminal appeal. See United States v. Rosenow, 3:17-cr-03430-WQH, ECF No. 268. 14 The opinion affirmed Rosenow’s conviction and denied Rosenow’s petitions for rehearing 15 and rehearing en banc, stating that no further petitions for rehearing would be accepted. 16 See id. 17 On December 30, 2022, Rosenow filed a petition of certiorari to the Supreme Court 18 of the United States. See id., ECF No. 269. On February 21, 2023, the Supreme Court 19 denied Rosenow’s petition for a writ of certiorari in his criminal appeal. Id., ECF No. 270. 20 On April 25, 2023, Rosenow filed a Motion under 28 U.S.C. § 2255 to Vacate, Set 21 Aside, or Correct a Sentence by a Person in Federal Custody (“Habeas Petition”), id., ECF 22 No. 271, and a Motion for Leave to Conduct Discovery, id., ECF No. 272. 23 On July 1, 2024, as relevant here, this Court denied the Habeas Petition and the 24 Motion for Leave to Conduct Discovery. Id., ECF No. 294. 25 On July 5, 2024, Rosenow filed a Notice of Appeal to the Court of Appeals for the 26 Ninth Circuit regarding the Habeas Petition. Id., ECF No. 295. On March 10, 2025, the 27 Court of Appeals issued an Order denying Rosenow’s request for a certificate of 28 appealability as to the denial of the Habeas Petition. Id., ECF No. 304. 1 B. The Current Action 2 On July 12, 2019, Rosenow, proceeding pro se, filed a Complaint against Defendants 3 Facebook and Yahoo, (collectively, “Defendants”). (ECF No. 1.) On April 27, 2020, the 4 Court issued an Order granting Defendants’ Motions to Dismiss and dismissing the 5 Complaint without prejudice. (ECF No. 15.) 6 On October 21, 2020, Rosenow filed a First Amended Complaint (“FAC”) against 7 Defendants. (ECF No. 29.) On March 15, 2021, Rosenow filed a Motion to Stay 8 Proceedings. (ECF No. 47.) On April 8, 2021, the Court issued an Order in this action 9 granting Rosenow’s Motion to Stay Proceedings until the conclusion of his criminal appeal. 10 (ECF No. 52.) On March 2, 2023, the Court issued an Order lifting the stay of proceedings 11 in this action given the Supreme Court’s and Ninth Circuit’s rulings in Rosenow’s criminal 12 appeal. (ECF No. 70.) On March 25, 2024, the Court issued an Order granting Defendants’ 13 Motions to Dismiss and dismissing the FAC without prejudice. (ECF No. 88.) 14 On May 10, 2024, Rosenow filed the operative Second Amended Complaint 15 (“SAC”), alleging claims against Facebook and Yahoo arising from their investigations 16 into his internet accounts and disclosure of his private communications to federal agencies. 17 (SAC, ECF No. 89.) Rosenow asserts claims against Yahoo and Facebook for violations 18 of the Stored Communications Act (“SCA”) and for negligence. Additionally, Rosenow 19 brings a claim against Yahoo for violation of the Wiretap Act. Rosenow seeks general, 20 compensatory, and consequential damages, punitive and exemplary damages, civil 21 penalties, attorneys’ fees and costs, and all other relief within the Court’s jurisdiction. Id. 22 at 80–81. 23 On May 28, 2024, Yahoo and Facebook filed respective Motions to Dismiss 24 Plaintiff’s Second Amended Complaint (the “Motions to Dismiss”). (ECF Nos. 90, 91.) 25 On June 18, 2024, Rosenow filed a Consolidated Response in Opposition to 26 Defendants’ Motions to Dismiss (the “Opposition”). (ECF No. 94.) 27 On June 21, 2024, Defendants filed an Ex Parte Joint Motion to Strike the Opposition 28 and Alternative Request for an Extension to File Reply Briefs. (ECF No. 95.) On June 24, 1 2024, the Court issued an Order denying Defendants’ request to strike the Opposition and 2 granting Defendants’ request to extend the deadline to file their replies. (ECF No. 96.) 3 On June 27, 2024, Rosenow filed a Motion for Leave to Supplement Plaintiff’s 4 Opposition to the Defendants’ Motion to Dismiss (the “Motion to Supplement”). (ECF No. 5 97.) On July 29, 2024, the Court issued an Order granting the Motion to Supplement and 6 considering Plaintiff’s proposed Supplemental Opposition (id. at 6–10) as timely filed as 7 part of his Opposition. (ECF No. 100.) 8 On July 19, 2024, Defendants filed Replies in support of their respective Motions to 9 Dismiss. (ECF Nos. 98, 99.) 10 II. ALLEGATIONS OF THE SECOND AMENDED COMPLAINT 11 A. Allegations Against Yahoo 12 “All events concerning this complaint occurred exclusively on the Yahoo Messenger 13 Platform and exclusively on the downloadable Messenger client.” (SAC ¶ 21.) As recorded 14 by the Yahoo USA Account Management Tool (“YAMT”), Rosenow opened his Yahoo 15 email account, “europe_120@yahoo.com,” in the Philippines in April of 2008. Id. ¶ 16. 16 Rosenow did not agree to any of Yahoo’s terms of conditions or privacy policies. Id. ¶ 17. 17 Yahoo maintains a department called the “Electronic Crimes Investigation Team” 18 (“ECIT”) that is run by Sean Zadig (“Zadig”), a former law enforcement officer. Id. ¶¶ 29– 19 30. Zadig has maintained his relationships with law enforcement. Id. ¶ 32. 20 In the summer of 2014, the United States Secret Service sponsored an “Electronic 21 Crimes Task Force” conference that was attended by law enforcement agents and “their 22 security counterparts at private corporations,” including Yahoo. Id. ¶¶ 84–85. At the 23 conference, “employees of Xoom.com [(‘Xoom’)] (a money-transfer website) informed 24 Yahoo [ ] of potentially criminal activities on its platform involving Philippines [sic] 25 children.” Id. ¶ 87. Xoom subsequently provided Yahoo with ten CyberTipline Reports 26 concerning Yahoo accountholders’ involvement in these criminal activities, prompting 27 Yahoo’s ECIT to initiate its own investigation into the accounts. Id. ¶¶ 87–88. 28 1 Yahoo’s ECIT adopted a “scanning tool” from Yahoo’s Content Moderation Team 2 “to intercept messages while in transit and redirect, scan, store and read text messages of 3 users connected to the ten accounts reported by Xoom.” Id. ¶ 90; see also id. ¶¶ 36–37, 49– 4 50, 129, 151. In October of 2014, Yahoo’s ECIT “shared the information and profiles” 5 from the approximately one thousand users that it uncovered during this investigation in a 6 “supplemental report” and meeting with agents from NCMEC, the Federal Bureau of 7 Investigations (“FBI”), and Homeland Security Investigation (“HSI”). Id. ¶¶ 92, 100–02. 8 The report did not mention Rosenow. Id. ¶ 153. In response to these disclosures, the FBI 9 and HSI “opened a formal investigation in November 2014 codenamed ‘Operation Swift 10 Traveller [sic].’” Id. ¶ 155. 11 In November of 2014, ECIT identified Rosenow in a second investigation “through 12 unknown means” and used the scanning tool to “intercept scan, store, and monitor all his 13 communications.” Id. ¶¶ 160–62. In December of 2014, ECIT produced additional 14 supplemental reports which implicated Rosenow “in traveling ‘many times’ internationally 15 for the purpose of soliciting minors.” Id. ¶ 165. The reports included images of child 16 pornography, information which could be used to identify Rosenow, and “snippets” of his 17 chat conversations which were “sufficient to obtain the ‘gist’ of” his communications. Id. 18 ¶¶ 92, 114–15, 165. ECIT shared the supplemental reports with NCMEC, the FBI, HSI, 19 and the Department of Homeland Security (“DHS”) voluntarily and in violation of the law. 20 Id. ¶¶ 165, 175 (implying that ECIT violated the law by disclosing reports that contained 21 images of child pornography to organizations other than NCMEC); see also id. ¶¶ 52–53, 22 172, 190–91, 194, 196. “NCMEC did not generate a CyberTipline Report” for Rosenow 23 after receiving the report in December of 2014. Id. ¶ 168. The Washington branch of the 24 FBI forwarded the supplemental reports to an agent in its San Diego office, and “[t]he FBI 25 San Diego opened a case against [Rosenow] upon receipt of the lead report.” Id. ¶¶ 178– 26 79. 27 Between November 2015 and January 2016, the FBI attempted to obtain a search 28 warrant for Rosenow’s Yahoo accounts. Id. ¶ 180. 1 In July of 2015, ECIT contacted the FBI to let them know that it was working on a 2 new investigation in the Philippines that was discovered through “proactive scanning” but 3 that it wouldn’t be able to share more detailed information until it completed its 4 investigation. Id. ¶ 182. 5 In December of 2015, ECIT used a software tool typically “used for legal process” 6 “when search warrants are issued” to pull Rosenow’s full chat history concerning 7 Rosenow’s “abuse of specific children.” Id. ¶¶ 184–85, 187; see also id. ¶ 149. This 8 investigation was completed without a search warrant and there was never an indication 9 that Rosenow “was attempting to obtain or actually possessed any images of child 10 pornography or that he violated any child pornography laws.” Id. ¶¶ 149, 186. 11 That same month, ECIT sent NCMEC a “CyberTipline Report,” in which it 12 voluntarily included Rosenow’s messages with two Yahoo users, sonicegirl18 and 13 clairesweet13. Id. ¶¶ 187, 190, 193. ECIT “did not notify NCMEC that the report was 14 submitted pursuant to 18 U.S.C. § 2258A [(‘§ 2258A’)].” Id. ¶ 190. NCMEC then 15 generated CyberTipline Report #7431977 for Rosenow, labeling the report incident type 16 as “Child Sex Tourism.” Id. ¶ 192. 17 In January of 2016, ECIT emailed NCMEC supplemental information pertaining to 18 the Philippines investigation. Id. ¶ 194. Internal communications amongst NCMEC staff 19 indicate that NCMEC did not have a “formal process for [providing law enforcement with] 20 the supplement[al] information” ECIT provided. Id. ¶ 195. 21 In February of 2016, ECIT violated § 2252A by sharing over two hundred 22 CyberTipline Reports with FBI agents directly, outside the presence of NCMEC. Id. 23 ¶¶ 196–97; see also id. ¶¶ 41, 117. 24 Throughout its investigation, Yahoo never obtained consent from Rosenow to search 25 his communications. Id. ¶¶ 25, 54. Yahoo never notified Rosenow about its review of his 26 communications or the disclosure of his information to NCMEC, the FBI, HSI, or DHS. 27 Id. ¶ 199; see also id. ¶¶ 45–47, 54. In fact, ECIT avoided issuing “legal process 28 notifications” to prevent tipping off users and helping them evade capture. Id. ¶¶ 147–48. 1 Rosenow did not learn of Yahoo’s “warrantless searches of his accounts and the disclosure 2 of the contents of those accounts until discovery was provided to him by the government 3 in the months following the indictment.” Id. ¶ 311. 4 Yahoo’s “stated purpose in engaging in ‘proactive scanning’ of [Rosenow’s] private 5 electronic communications was to help the government get arrests and convictions and to 6 stop the activity.” Id. ¶ 201. “Voluminous emails reveal the extent of [Yahoo’s] 7 collaboration and joint investigation” with the FBI and other government agencies. Id. 8 ¶ 209; see also id. ¶¶ 210–15. All of Yahoo’s disclosures to NCMEC concerning Rosenow 9 were voluntary, as disclosures concerning child sex tourism can be made but are not 10 required under the law. Id. ¶ 141; see also id. ¶¶ 43, 128–29, 138 n.30, 152, 165, 172, 190– 11 91, 194. 12 B. Allegations Against Facebook 13 “All activities related to this complaint occurred on Facebook’s private messenger 14 app.” Id. ¶ 227. Rosenow opened his “private” Facebook account, under the moniker 15 “carlos.senta” in July of 2010 in either the United States or Germany. Id. ¶¶ 226, 230, 234. 16 If he opened the account in the United States, Facebook’s April 2010 Statements of Rights 17 and Responsibilities (“SRR”) “would be the only terms [Rosenow] agreed to.” Id. ¶ 231. 18 The SRR states that users “may also want to review” Facebook’s Privacy and Data Use 19 policy. Id. ¶¶ 232–33. If he opened his account in Germany, “a complete separate policy 20 would govern the relationship between [Rosenow] and Facebook.” Id. ¶ 234. Facebook’s 21 Terms of Service (“TOS”) “generally states that Facebook can collect data and 22 information” but also states that “the user owns all of the content and information and can 23 control how they share it.” Id. ¶ 235. “Facebook’s 2010 SRR does not include adequate 24 notice that they would monitor, read, and voluntarily disclose communications to NCMEC 25 or that they would search content upon receiving legal process from the government 26 indicating ‘child exploitation.’” Id. ¶ 236. 27 In early 2017, the FBI obtained Rosenow’s Facebook information through unknown 28 means, breathing “new life into an otherwise stalled investigation.” Id. ¶¶ 238–39. The FBI 1 served Facebook with a preservation request under 18 U.S.C. § 2703(f) for Rosenow’s 2 Facebook account and notified Facebook that the FBI was investigating Rosenow for child 3 exploitation. Id. ¶¶ 243–44. Facebook has a policy in place that “anytime law enforcement 4 submits a subpoena or preservation request marked ‘child safety’ … Facebook conducts a 5 [limited] review of the account.” Id. ¶ 263. Thus, Facebook conducted a review of 6 Rosenow’s account. 7 “Facebook … willfully engaged in joint action with the government when it 8 searched [Rosenow’s] messages between January 2017 and April 2017, looked for 9 messages of child exploitation[,] and reported them voluntarily to NCMEC.” Id. ¶ 253. 10 Facebook provided the FBI “with notice about child sex exploitation messages” “including 11 a message exchange between [Rosenow] and [an alleged minor] on March 7–8, 2017.” Id. 12 ¶ 255. The disclosure of these messages triggered the FBI “to issue a subpoena to 13 Facebook” for Rosenow’s account on March 15, 2017. Id. ¶ 256. 14 On March 25, 2017, Facebook notified Rosenow of the subpoena for his account and 15 seized its contents, but Facebook “never notified [Rosenow] that it was reading and 16 reviewing his private” communications. Id. ¶¶ 272, 301. “Upon belief and information [the 17 FBI and Facebook] conspired to preserve [Rosenow’s] account on March 25, 2017[,] upon 18 obtaining knowledge about [Rosenow’s] alleged child exploitation message with [a minor] 19 and the fact that Facebook intended to disclose the subpoena to Plaintiff on March 25, 20 2017.” Id. ¶ 275. Facebook did not terminate Rosenow’s account following the March 25, 21 2017 search. Id. ¶ 276. 22 In April of 2017, Facebook searched Rosenow’s account again. Id. ¶ 277. 23 On May 1, 2017, a Facebook employee “intentionally and voluntarily reported to 24 NCMEC [Rosenow’s] private messages” “stating that he had discovered evidence of 25 alleged ‘Child Sex Tourism’ in [Rosenow’s] account.” Id. ¶ 278. “No facts or 26 circumstances of violations of child pornography laws were mentioned in” the reports to 27 NCMEC, and Facebook did not indicate that the tips were made pursuant to § 2258A. Id. 28 ¶ 281; see also id. ¶¶ 292–95. Rather, these reports contained information that was not 1 required by NCMEC but was voluntarily provided, such as “the reported date of birth of 2 the minor victims and extensive private communications with four individuals located in 3 the Philippines.” Id. ¶ 283; see also id. ¶ 299. After its own investigation, NCMEC 4 classified the incident type as child sex tourism and issued CyberTipline Report 5 #20711118. Id. ¶ 285. 6 That same day, NCMEC sent an email to the FBI classifying CyberTipline Report 7 #20711118 as a “priority 2 escalated report” and explaining that the account user “‘appears 8 to be going abroad to engage in sexual activities with underage girls in exchange for 9 money.’” Id. ¶ 298. 10 On May 4, 2017, Facebook closed Rosenow’s account. Id. ¶ 279. 11 Facebook “knowingly and intentionally” searched Rosenow’s account without his 12 consent and “with malicious and illegal motives” “for the purpose of providing probable 13 cause for arrest and prosecution and to stop” Rosenow’s activity. Id. ¶¶ 257, 260, 299. 14 Facebook neither informed Rosenow of its searches nor sought his consent to them, nor 15 did it notify him of any TOS violations. Id. ¶¶ 300–03. As a result of these searches, the 16 government obtained information that led it to issue arrest and search warrants against 17 Rosenow. Id. ¶ 306. 18 Rosenow did not learn of “Facebook’s warrantless searches of his accounts and the 19 disclosure of the contents of those accounts until discovery was provided to him by the 20 government in the months following the indictment.” Id. ¶ 311. During litigation of the 21 criminal case, Facebook and the government “conspired to withhold material evidence” to 22 avoid “impeachment of [Facebook employee] Jason Berry.” Id. ¶¶ 312–13. 23 III. CONTENTIONS 24 Yahoo and Facebook contend that Rosenow’s SCA claim fails because their 25 disclosures were proper under the SCA’s exceptions for (1) reports to NCMEC, (2) user 26 consent, and (3) protecting the rights of the provider. Yahoo contends that Rosenow’s 27 Wiretap Act claim should be dismissed because his allegations that Yahoo intercepted his 28 communications are too conclusory. Yahoo additionally contends that, even if Rosenow 1 sufficiently alleges an “interception,” Yahoo’s actions fall within two exceptions to the 2 Wiretap Act: (1) consent and (2) protecting the rights of the provider. Yahoo and Facebook 3 additionally contend that Rosenow’s SCA claims fail because in making their disclosures, 4 they acted in good faith reliance on statutory authorization. Yahoo contends the same for 5 Rosenow’s Wiretap Act claim. Yahoo and Facebook contend that Rosenow’s negligence 6 claim fails because he does not allege sufficient facts to establish that they owed him a 7 legal duty. Yahoo and Facebook contend that Rosenow’s claims are time-barred and 8 constitute an impermissible collateral attack on his conviction, barred by the doctrine of 9 collateral estoppel. 10 Rosenow contends that the SCA and Wiretap Act exceptions invoked by Defendants 11 are inapplicable because they are “general exceptions” whereas both Acts contain more 12 “specific exceptions” that preclude Defendants’ reliance on them. Alternatively, Rosenow 13 contends that he did not consent to Yahoo’s or Facebook’s disclosures to government 14 agencies or Yahoo’s interception of his communications. Rosenow contends that 15 Defendants’ good-faith arguments should be rejected. Rosenow contends that he 16 adequately states a claim for Yahoo’s violations of the Wiretap Act because his allegations 17 that Yahoo used an “automated content scanning tool” give rise “to a ‘plausible inference’ 18 that Yahoo violated the Wiretap Act.” Rosenow contends he adequately alleges negligence 19 claims against Defendants because he has shown that Defendants breached their duties to 20 comply with the Electronic Communications Privacy Act and their own privacy policies 21 and terms of service. Rosenow contends that his claims were timely filed upon discovering 22 Defendants’ disclosures during the discovery phase of his criminal trial. Rosenow contends 23 that Heck v. Humphrey does not bar his claims and that they are not precluded by collateral 24 estoppel or res judicata. 25 IV. LEGAL STANDARD 26 Rule 12(b)(6) of the Federal Rules of Civil Procedure permits dismissal for “failure 27 to state a claim upon which relief can be granted.” To state a claim for relief, a pleading 28 “must contain … a short and plain statement of the claim showing that the pleader is 1 entitled to relief.” Fed. R. Civ. P. 8(a)(2). Dismissal under Rule 12(b)(6) “is proper only 2 where there is no cognizable legal theory or an absence of sufficient facts alleged to support 3 a cognizable legal theory.” Shroyer v. New Cingular Wireless Servs., Inc., 622 F.3d 1035, 4 1041 (9th Cir. 2010) (quotation omitted). 5 “To survive a motion to dismiss, a complaint must contain sufficient factual matter, 6 accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 7 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). 8 “A claim has facial plausibility when the plaintiff pleads factual content that allows the 9 court to draw the reasonable inference that the defendant is liable for the misconduct 10 alleged.” Id. (citation omitted). However, “a plaintiff’s obligation to provide the ‘grounds’ 11 of his ‘entitle[ment] to relief’ requires more than labels and conclusions, and a formulaic 12 recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 13 (alteration in original) (quoting Fed. R. Civ. P. 8(a)). A court is not “required to accept as 14 true allegations that are merely conclusory, unwarranted deductions of fact, or 15 unreasonable inferences.” Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 16 2001). “In sum, for a complaint to survive a motion to dismiss, the non-conclusory factual 17 content, and reasonable inferences from that content, must be plausibly suggestive of a 18 claim entitling the plaintiff to relief.” Moss v. U.S. Secret Serv., 572 F.3d 962, 969 (9th Cir. 19 2009) (quotation omitted). 20 “When ruling on a Rule 12(b)(6) motion to dismiss, if a district court considers 21 evidence outside the pleadings, it must normally convert the 12(b)(6) motion into a Rule 22 56 motion for summary judgment, and it must give the nonmoving party an opportunity to 23 respond.” United States v. Ritchie, 342 F.3d 903, 907 (9th Cir. 2003) (citing Fed. R. Civ. 24 P. 12(b)). However, a court may “consider certain materials—documents attached to the 25 complaint, documents incorporated by reference in the complaint, or matters of judicial 26 notice—without converting the motion to dismiss into a motion for summary judgment.” 27 Id. (citing Van Buskirk v. CNN, 284 F.3d 977, 980 (9th Cir. 2002); Barron v. Reich, 13 28 F.3d 1370, 1377 (9th Cir. 1994)). 1 Where the documents are not physically attached to the complaint, they may be 2 considered if the documents’ “authenticity ... is not contested” and “the plaintiff’s 3 complaint necessarily relies” on them. Parrino v. FHP, Inc., 146 F.3d 699, 705–06 (9th 4 Cir. 1998) (quotation omitted); see also Ritchie, 342 F.3d at 908 (“Even if a document is 5 not attached to a complaint, it may be incorporated by reference into a complaint if the 6 plaintiff refers extensively to the document or the document forms the basis of the 7 plaintiff’s claim. The defendant may offer such a document, and the district court may treat 8 such a document as part of the complaint, and thus may assume that its contents are true 9 for purposes of a motion to dismiss under Rule 12(b)(6).”); see also Knievel v. ESPN, 393 10 F.3d 1068, 1076 (9th Cir. 2005) (“We have extended the ‘incorporation by reference’ 11 doctrine to situations in which the plaintiff’s claim depends on the contents of a document, 12 the defendant attaches the document to its motion to dismiss, and the parties do not dispute 13 the authenticity of the document, even though the plaintiff does not explicitly allege the 14 contents of that document in the complaint.”). 15 Judicial notice under Federal Rule of Evidence 201 permits a court to notice an 16 adjudicative fact if it is “not subject to reasonable dispute.” Fed. R. Evid. 201(b). A fact is 17 “not subject to reasonable dispute” if it is “generally known,” or “can be accurately and 18 readily determined from sources whose accuracy cannot reasonably be questioned.” Khoja 19 v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018) (quoting Fed. R. Evid. 20 201(b)(1)–(2)); see also Reyna Pasta Bella, LLC v. Visa USA, Inc., 442 F.3d 741, 746 n.6 21 (9th Cir. 2006) (explaining that courts “may take judicial notice of court filings and other 22 matters of public record” because such documents are “are readily verifiable and, therefore, 23 the proper subject of judicial notice”). 24 V. DISCUSSION 25 A. Stored Communications Act Claims 26 The SCA, which is Title II of the Electronic Communications Privacy Act 27 (“ECPA”), broadly prohibits providers of electronic communication and remote computing 28 1 services from “divulg[ing] to any person or entity the contents” of electronically stored 2 communications, records, and other information. 18 U.S.C. § 2702(a).3 3 However, the SCA provides numerous exceptions to this prohibition. Section 4 2702(b) outlines eight circumstances under which a provider “may divulge the contents of 5 a communication” and § 2702(c) describes seven circumstances under which a provider 6 may divulge non-content information—that is, any “record or other information pertaining 7 to a subscriber to or customer of such service.” Id. § 2702(b), (c). As relevant here, under 8 § 2702(b)(6) and (c)(5), a provider may disclose customers’ communications or records 9 “to [NCMEC], in connection with a report submitted thereto under section 2258A.” Id. 10 § 2702(b)(6), (c)(5). Additionally, § 2702(b) and (c) permit the disclosure of customers’ 11 communications or records “with the lawful consent of the originator” or “as may be 12 necessarily incident to the rendition of the service or to the protection of the rights or 13 property of the provider of that service.” Id. § 2702(b)(3), (b)(5), (c)(2), (c)(3). 14 15

16 17 3 Section 2702(a) provides: 18 (a) Prohibitions.--Except as provided in subsection (b) or (c)-- (1) a person or entity providing an electronic communication service to the public shall 19 not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service; and 20 (2) a person or entity providing remote computing service to the public shall not 21 knowingly divulge to any person or entity the contents of any communication which is carried or maintained on that service-- 22 (A) on behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of 23 electronic transmission from), a subscriber or customer of such service; (B) solely for the purpose of providing storage or computer processing services to 24 such subscriber or customer, if the provider is not authorized to access the contents 25 of any such communications for purposes of providing any services other than storage or computer processing; and 26 (3) a provider of remote computing service or electronic communication service to the public shall not knowingly divulge a record or other information pertaining to a 27 subscriber to or customer of such service (not including the contents of communications covered by paragraph (1) or (2)) to any governmental entity. 28 1 Rosenow asserts his second and third causes of action against Defendants, 2 respectively, for violations of the SCA. Rosenow alleges that Yahoo and Facebook 3 “voluntarily, unlawfully[,] and knowingly accessed and divulged” his communications and 4 personal identifying information to government agencies in violation of 18 U.S.C. § 2702 5 (“§ 2702”). (SAC ¶¶ 383–90, 416–21.)4 Yahoo and Facebook contend that their disclosures 6 were lawful under the SCA’s exceptions for: (1) reports to NCMEC, (2) user consent, and 7 (3) protection of the provider’s rights. 8 1. Application of the Exceptions in General 9 Rosenow contends that Defendants cannot rely on the exceptions under § 2702(b) 10 and (c) because they are merely “general exceptions,” whereas more specific provisions 11 govern how government entities may obtain information and content from electronic 12 service providers (“ESPs”) through legal processes. (ECF No. 94 at 14–15.) Rosenow 13 contends that these specific provisions (18 U.S.C. §§ 2703; 2016; 2517; 2702(b)(6), (b)(7), 14 (b)(8), (c)(3); 2511(3)(b)(iv)) reflect Congress’s deliberate intent to regulate such 15 disclosures explicitly, making the general exceptions (§§ 2702(b)(3), (b)(5), (b)(6), (c)(2), 16 (c)(3), (c)(5); 2258A(a)) inapplicable in this context. Id. 17 Rosenow correctly observes that courts frequently apply a canon of statutory 18 interpretation in which “the specific governs the general” when interpreting statutes such 19 as the SCA. RadLAX Gateway Hotel, LLC v. Amalgamated Bank, 566 U.S. 639, 645 (2012) 20 (citations and quotations omitted); see, e.g., ECF No. 94 at 14–15, 19. However, as 21 22 23 4 Rosenow also appears to allege that Yahoo violated 18 U.S.C. § 2701 (“§ 2701”) (see, e.g., SAC ¶ 371), 24 which provides a cause of action against anyone who “(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an 25 authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. § 2701(a)(1), (2). However, the 26 statute explicitly exempts “the person or entity providing a wire or electronic communications service” from its scope. Id. § 2701(c)(1). Rosenow’s own pleading alleges that Yahoo “operates as an electronic 27 communication service.” (SAC ¶ 361.) Accordingly, the Court dismisses this claim to the extent it is 28 alleged. 1 RadLAX explains, this canon is invoked only when a general provision either contradicts 2 or renders superfluous a specific provision. Id. 3 Here, none of the “general exceptions” identified by Rosenow contradict or nullify 4 the more “specific exceptions.” For example, § 2702(b)(3), which permits disclosure of 5 electronic communications “with the lawful consent of the originator,” does not conflict 6 with or render superfluous exceptions such as § 2702(b)(7), which explicitly permits 7 disclosure to law enforcement agencies when a service provider inadvertently obtains a 8 communication that appears to pertain to a crime. The mere fact that a disclosure might fall 9 under multiple exceptions does not create a conflict or redundancy. An ESP may disclose 10 information to law enforcement agencies both because it has the user’s consent and because 11 the communication was inadvertently obtained and appears to relate to criminal activity— 12 regardless of whether the user consented. Each exception serves a distinct function within 13 the statutory framework. 14 In Meta Platforms, Inc. v. District of Columbia, the District of Columbia Court of 15 Appeals considered whether § 2703—which permits government actors to compel the 16 disclosure of the contents of wire or electronic communications “only pursuant to a 17 warrant”—precluded the government from relying on the exceptions outlined in § 2702(b). 18 301 A.3d 740, 749 (D.C. Cir. 2023). The court concluded that “Congress provided the 19 government with an additional tool to compel disclosures that no private party has; it did 20 not erect an obstacle to disadvantage the government from compelling information that a 21 private party could obtain.” Id. at 750. Accordingly, “when a § 2702(b) exception applies 22 to lift the bar on disclosure, it would make no sense if the government’s additional grant of 23 authority [(§ 2703)] could be weaponized against it.” Id. The Court finds that this reasoning 24 is persuasive and provides additional support that Congress did not intend for the principle 25 that the “specific governs the general” to prevent ESPs from relying on the exceptions 26 found in § 2702(b) and (c) when disclosing information to governmental agencies. 27 28 1 Accordingly, Rosenow’s contention lacks merit, and the Court will consider whether 2 Defendants’ actions fall within the exceptions to the SCA defined by § 2702(b)(3), (b)(5), 3 (b)(6), (c)(2), (c)(3), (c)(5). 4 2. Reports to NCMEC 5 Section 2702(b) and (c) provide an exception for disclosures of communications and 6 customer records to NCMEC, “in connection with a report submitted thereto under section 7 2258A.” 18 U.S.C. § 2702(b)(6), (c)(5). 8 18 U.S.C. § 2258A “requires ESPs to report ‘any facts or circumstances from which 9 there is an apparent violation of’ specified criminal offenses involving child pornography.” 10 United States v. Rosenow, 50 F.4th 715, 725 (9th Cir. 2022) (emphasis added) (quoting 18 11 U.S.C. § 2258A(a)(1)–(2)). Section 2258A states that a provider that “obtains actual 12 knowledge of any facts or circumstances” from which there is “an apparent violation” of a 13 federal child sexual exploitation law “that involves child pornography” shall: 14 (A) provide to the CyberTipline of the National Center for Missing and Exploited Children, or any successor to the CyberTipline operated by such 15 center, the mailing address, telephone number, facsimile number, electronic 16 mail address of, and individual point of contact for, such electronic communication service provider or remote computing service provider; and 17

18 (B) make a report of such facts or circumstances to the CyberTipline, or any successor to the CyberTipline operated by such center. 19

20 18 U.S.C. § 2258A(a)(1)(A)–(B), (a)(2) (2008).5 The report “may include the following 21 information”: 22 (1) Information about the involved individual.-- Information relating to the identity of any individual who appears to have violated a Federal law 23 described in subsection (a)(2), which may, to the extent reasonably 24 practicable, include the electronic mail address, Internet Protocol address, 25 26 27 5 Rosenow alleges in the SAC that the 2008 version of § 2258A governs in this case. (See SAC Exhibit C at 88.) Defendants do not contest this assertion or suggest that a different version of the statute is 28 1 uniform resource locator, or any other identifying information, including self-reported identifying information. 2

3 (2) Historical reference.--Information relating to when and how a customer or subscriber of an electronic communication service or a remote computing 4 service uploaded, transmitted, or received apparent child pornography or 5 when and how apparent child pornography was reported to, or discovered by the electronic communication service provider or remote computing service 6 provider, including a date and time stamp and time zone. 7 (3) Geographic location information.-- 8

9 (A) In general.--Information relating to the geographic location of the involved individual or website, which may include the Internet Protocol 10 address or verified billing address, or, if not reasonably available, at 11 least 1 form of geographic identifying information, including area code or zip code. 12

13 (B) Inclusion.--The information described in subparagraph (A) may also include any geographic information provided to the electronic 14 communication service or remote computing service by the customer 15 or subscriber.

16 (4) Images of apparent child pornography.--Any image of apparent child 17 pornography relating to the incident such report is regarding.

18 (5) Complete communication.--The complete communication containing 19 any image of apparent child pornography, including--

20 (A) any data or information regarding the transmission of the 21 communication; and

22 (B) any images, data, or other digital files contained in, or attached to, 23 the communication.

24 Id. § 2258A(b). After NCMEC reviews any report, it is required to provide the report to 25 federal or state law enforcement. Id. § 2258A(c). 26 Rosenow contends that Defendants exceeded their authority under 18 U.S.C. 27 § 2258A by reporting his communications to NCMEC, asserting that the statute limits such 28 1 reports to communications containing images of child pornography. (ECF No. 94 at 19.) 2 Because his communications did not contain or involve child pornography, he contends 3 that Defendants’ disclosures fell outside the statute’s scope. Id. at 19–20. 4 The Court has considered these same allegations on several occasions, including in 5 Rosenow’s criminal case.6 After substantial briefing and an evidentiary hearing in the 6 criminal case, the Court determined that, “[t]he record shows that Yahoo and Facebook 7 reported information to NCMEC pursuant to applicable law based upon facts and 8 circumstances supporting an apparent violation of child pornography laws.” United States 9 v. Rosenow, 3:17-cr-03430-WQH, ECF No. 87 at 23. 10 Rosenow’s conviction in the criminal case was affirmed on appeal, and the Supreme 11 Court denied his petition for certiorari. This civil action would require this Court to 12 reconsider its Order on Rosenow’s Motion to Suppress Evidence in his criminal case and 13 would “necessarily require [Rosenow] to prove the unlawfulness of his conviction or 14 confinement.” Heck v. Humphrey, 512 U.S. 477, 487 (1994). A civil tort action is “not [an] 15 appropriate vehicle[ ] for challenging the validity of outstanding criminal judgments … .” 16 Id. Rosenow’s contention that Heck “cannot apply to any civil suit” “[u]ntil the final 17 decision in his habeas corpus petition is issued,” (ECF No. 94 at 42), is without merit. “[I]t 18 is well-settled that ‘the preclusive effects of a lower court judgment simply cannot be 19 20 6 Yahoo requests the Court take judicial notice of the entire record in Rosenow’s criminal case. (ECF No. 21 90-2 at 2–4.) Facebook requests the Court take judicial notice of specific documents within the record of Rosenow’s criminal case. (ECF No. 91-7 at 6 (requesting judicial notice of copies of the April 28, 2017 22 CyberTipline Report with a generated CT# 20647168, the May 1, 2017 CyberTipline Report with a generated CT# 20711118, and the substantive portion of the subpoena filed by Rosenow in United States 23 v. Rosenow, 3:17-cr-03430-WQH, ECF Nos. 29-13 & 92-2 (S.D. Cal. Mar. 19, 2018)).) Rosenow objects 24 to Yahoo’s request to take judicial notice of the entire record in his criminal case because his “§2255 [sic] is still pending a decision.” (ECF No. 94 at 11–12.) Additionally, Rosenow objects to the Court taking 25 judicial notice of “the 2014 Yahoo USA Privacy Policy and all related court holdings around this specific Policy.” Id. The Court takes judicial notice of the entire record in Rosenow’s criminal case, including the 26 CyberTipline Reports identified by Facebook, as they are court filings that “are readily verifiable.” Reyna Pasta Bella, LLC, 442 F.3d at 746 n.6. The Court notes that court holdings, particularly the holdings of 27 the Ninth Circuit in Rosenow’s criminal appeal, are not subject to judicial notice but have preclusive 28 effect, as this Court is bound by the rulings of the Ninth Circuit Court of Appeals. 1 suspended by taking an appeal that remains undecided.’” SEC v. Mogler, No. CV-15- 2 01814-PHX-SPL, 2020 WL 1065865, at *4 (D. Ariz. Mar. 5, 2020) (quoting Hawkins v. 3 Risley, 984 F.2d 321, 324 (9th Cir. 1993)) (citations omitted). In any event, after briefing 4 concluded, the Ninth Circuit denied Rosenow’s request for a certificate of appealability as 5 to this Court’s denial of Rosenow’s Habeas Petition. 6 As to Rosenow’s allegations and contentions that Defendants’ disclosures were 7 unlawful because his accounts did not contain photographs of or involve child 8 pornography, the Ninth Circuit addressed this same issue when considering whether there 9 was probable cause for a search warrant issued in the criminal case. The Ninth Circuit 10 considered Rosenow’s argument that the government lacked probable cause because the 11 government’s search warrant “did not include any images of child pornography or any 12 reasonable factual descriptions of such images.” Rosenow, 50 F.4th at 738. On this issue, 13 the Ninth Circuit explained as follows: 14 [T]he government’s affidavit included excerpts from Rosenow’s messages with adolescent girls in the Philippines, demonstrating that he took and kept 15 illicit pictures and videos of his sex tourism. For example, in one of 16 Rosenow’s Facebook chats, he sends a girl nude photos he had previously taken of her and states, “I am always looking at your pictures on my phone ... 17 and I want more.” In another chat, he negotiates sex acts with a girl and states, 18 “baby, I want to take a video too.” 19 The affidavit also described Yahoo’s internal investigation and the resulting 20 findings that Rosenow was negotiating, purchasing, and producing images and videos of child sexual exploitation, as well as the information that 21 Facebook reported to NCMEC after searching Rosenow’s accounts. These 22 descriptions include an account of Rosenow’s communications with girls in the Philippines, wherein Rosenow describes in graphic detail the sexual 23 activities that he wanted to do with them and confirms that he wanted to record 24 those activities. … Thus, we conclude, as did the district court, that the affidavit supporting the search warrant established a “fair probability” that 25 child pornography would be found on Rosenow’s electronic devices. 26 Id. at 738–39. 27 28 1 In the Court’s prior Order, the Court elaborated on the information contained within 2 the CyberTipline Reports—the same Reports that are again before the Court: 3 In the December 2, 2015, CyberTipline Report, Yahoo provided NCMEC with the contents of Rosenow’s messages in which Rosenow appeared to be 4 making arrangements to pay young girls ages eight to sixteen in the 5 Phillippines for sex. (See generally, USA v. Rosenow, 3:17-cr-03430-WQH, Ex. 8, ECF No. 49-8). In the Yahoo messages, Rosenow requested pictures of 6 the young girls. (See id. at 10 (“do you have pics”); Id. at 12 (“if you can send 7 pic or show me before I can pick”); Id. at 13 (“can I see them now;” “can I see the girls first here in [Yahoo Messenger]”)). In the April 28, 2017, 8 CyberTipline Report, Facebook provided NCMEC with the contents of 9 Rosenow’s messages in which Rosenow appeared to be making arrangements to pay young girls in the Philippines for sex. (See generally, Ex. 5, Declaration 10 of Christin J. Hill in Support of Facebook’s Motion to Dismiss, ECF No. 7- 11 3). The messages contained three images Rosenow described in the message as “naked pic[s].” (Id. at 79). 12 13 (ECF No. 15 at 12.) Based upon the contents of the CyberTipline Reports and Ninth Circuit 14 precedent, the Court finds that Defendants obtained knowledge of facts or circumstances 15 indicating “apparent” violations by Rosenow of the federal child sexual exploitation laws 16 involving child pornography and were therefore required to disclose his communications 17 under § 2258A and are exempted from SCA liability under § 2702(b)(6) and (c)(5). 18 18 U.S.C. §§ 2258A(a); 2702(b)(6), (c)(5). Rosenow’s contentions that Defendants’ 19 disclosures pursuant to § 2258A were unlawful because the disclosures involved sex 20 tourism and did not involve child pornography are without merit, as § 2258A specifically 21 applies to “apparent violations” that “involve[ ] child pornography” and does not 22 necessarily require evidence of a clear violation. 23 Rosenow also appears to contend that the First Amendment negates the exceptions 24 under § 2702(b) and (c) for reports to NCMEC because “unlike child pornography, nude 25 photos of children receive First Amendment protection” and that to “qualify as any crime 26 related to child-pornography … messages without images must ‘actually depict’” “‘the sex 27 act rather than merely the suggestion that it is occurring.’” (ECF No. 94 at 21 (first citing 28 1 New York v. Ferber, 458 U.S. 747, 764–65 (1982); then quoting United States v. Williams, 2 553 U.S. 285, 297 (2008)).) 3 Rosenow’s contention that his messages were protected under the First Amendment 4 is immaterial, because the SCA permits disclosure of any communication—regardless of 5 whether it is constitutionally protected speech—so long as the disclosure falls within a 6 statutory exception. To find otherwise would render the exceptions to the SCA 7 meaningless, as nearly all speech is constitutionally protected. See United States v. Alvarez, 8 617 F.3d 1198, 1205 (9th Cir. 2010) (stating that the Constitution “presumptively protect[s] 9 all speech against government interference”), aff’d, 567 U.S. 709 (2012). 10 Accordingly, the Court finds that Yahoo’s and Facebook’s disclosures to NCMEC 11 were lawful under § 2702(b)(6) and (c)(5). 12 3. User’s Consent 13 The SCA allows an ESP to “divulge the contents of a communication” or “record” 14 “with the lawful consent of the originator or an addressee or intended recipient of such 15 communication” or “record.” 18 U.S.C. § 2702(b)(3), (c)(2). The SCA does not define 16 “lawful consent” or describe how it may be established. In re JSC Com. Bank Privatbank, 17 No. 21-mc-80216-VKD, 2021 WL 4355334, at *5 (N.D. Cal. Sept. 24, 2021). 18 Rosenow alleges that Yahoo “did not explicitly notify” him of, and he did not 19 consent to, ECIT’s “repeated[ ] disclos[ures] [of] his personal information and private 20 communication[s] to law enforcement agencies” and NCMEC. (SAC ¶¶ 46–47.) Rosenow 21 alleges that he “never consented to [Facebook’s] search of his accounts or to the disclosure 22 of his private communications for law enforcement purposes.” Id. ¶ 303. 23 Yahoo and Facebook contend that Rosenow consented to their disclosures by 24 agreeing to their respective privacy policies. 25 Rosenow contends that Defendants cannot invoke the consent exception because he 26 never consented to their disclosures to government entities. (ECF No. 94 at 22.) Relying 27 on contracts principles, Rosenow contends that Defendants bear the burden of proving he 28 1 consented to their disclosures and that neither has met this burden. Id. at 23 (citing Stover 2 v. Experian Holdings, Inc., 978 F.3d 1082 (9th Cir. 2020)). 3 As to Yahoo, in assessing whether its searches involved sufficient government 4 participation to trigger Fourth Amendment protections, the Ninth Circuit concluded that 5 “Yahoo’s conduct was permissible … [as] Yahoo had a contractual right under the terms 6 of its privacy policy, to which Rosenow agreed, ‘to investigate, prevent, or take action 7 regarding illegal activities’ or ‘violations of Yahoo’s terms of use.’” Rosenow, 50 F.4th at 8 732 (emphasis added). Rosenow is thus collaterally estopped from relitigating this issue. 9 Accordingly, Yahoo’s disclosures were lawful under the SCA’s consent exception. 10 As to Facebook, Rosenow’s allegations create ambiguity concerning whether he 11 opened his Facebook account in the United States—in which case the “2010 SRR would 12 be the only terms [he] agreed to,” (SAC ¶¶ 230–31)—or in Germany, where “a complete 13 separate policy would govern [his] relationship [with] [ ] [ ] Facebook,” id. ¶ 234. 14 The Court takes judicial notice of Facebook’s 2010 SRR (ECF No. 91-2) which is 15 incorporated by reference into the SAC. (See SAC ¶ 231 (“Facebook’s April 2010 SRR 16 would be the only terms Plaintiff agreed to if he opened his account in the USA.”).) The 17 2010 SRR states that “[c]ertain specific terms [ ] apply only for German users.” (ECF No. 18 91-2 at 4.) The Court takes judicial notice of these German-specific terms (ECF Nos. 99-2 19 & 99-4), which Rosenow characterized as a “complete separate policy” in the SAC. (SAC 20 ¶ 234.) The Court finds that the German-specific terms modify the 2010 SRR but do not 21 pertain to the issue of whether Rosenow consented to Facebook’s disclosures.7 Therefore, 22 the Court considers only Facebook’s 2010 SRR in its analysis. 23

24 25 7 The German-specific terms state: 26 For users resident in Germany: 27 1. Section 2 applies with the proviso that our use of this content is limited to use on or in 28 connection with Facebook. 1 Despite Rosenow’s allegation that “[t]he 2010 SRR does not incorporate the Privacy 2 or Data Policy,” (SAC ¶ 233), this Court finds that Facebook’s 2010 SRR incorporates its 3 Privacy Policy, published in April of 2010. (Compare ECF No. 91-2 (encouraging users to 4 review its Privacy Policy in at least three instances), with Calhoun v. Google LLC, 526 F. 5 Supp. 3d 605, 621 (N.D. Cal. 2021) (finding that Google’s Terms of Service did not 6 incorporate its Privacy Policy where it explicitly stated “[a]lthough [the Privacy Policy] is 7 not a part of these terms, we encourage you to read it ….”).) 8 Accordingly, the Court finds that Rosenow consented to the terms of Facebook’s 9 2010 Privacy Policy, which contains the following language: 10 We may also share information when we have a good faith belief it is necessary to prevent fraud or other illegal activity, to prevent imminent bodily 11 harm, or to protect ourselves and you from people violating our Statement of 12 Rights and Responsibilities. This may include sharing information with other companies, lawyers, courts or other government entities. 13 14 15

16 2. Section 15.1 is replaced by: This notice is subject to German law. 17 3. Section 15.3 is replaced by: We are liable exclusively as follows: We are liable without 18 limitation in accordance with the statutory provisions (i) for damages resulting from injury 19 to life, body or health; (ii) in the event of intent; (iii) in the event of gross negligence; and (iv) in accordance with the German Product Liability Act. Without limiting the foregoing, 20 we shall only be liable for slight negligence in the event of a breach of a “material” obligation under this contract. “Material” obligations in this sense are obligations that are 21 necessary for the performance of the contract, the breach of which would jeopardize the achievement of the purpose of the contract, and on whose observance you can therefore 22 regularly rely. In these cases, liability is limited to typical and foreseeable damages; in 23 other cases, there is no liability for slight negligence. 24 4. Notwithstanding section 13, changes will take effect 30 days after the date on which we notify you of the proposed changes. If you do not wish to accept the changes, you must 25 delete your account and failure to do so will constitute acceptance of the changes. We will specifically draw your attention to this 30-day period and its significance in our email 26 announcing the changes. 27 (ECF No. 94-4.) These terms do not affect the incorporation of the Privacy Policy into the SRR, 28 which occurs in section 1 and is central to the determination of this issue. 1 (ECF No. 91-3 at 6; see also Rosenow, 50 F.4th at 724 (“Facebook’s privacy policy 2 likewise stated that it has the right to ‘access, preserve and share information when [it] 3 ha[s] a good faith belief it is necessary to: detect, prevent and address fraud and other illegal 4 activity.’” (alterations in original) (citing to Facebook’s 2016 Data Policy)).) 5 Courts have held that, “exceptions to the SCA are to be construed narrowly.” Suraju 6 v. Yahoo!, Inc., No. 22-mc-80072-SK, 2022 WL 3365086, at *4 (N.D. Cal. July 13, 2022) 7 (citing Suzlon Energy Ltd. v. Microsoft Corp., 671 F.3d 726, 730 (9th Cir. 2011)), appeal 8 dismissed, No. 22-16231, 2022 WL 18671555 (9th Cir. Dec. 14, 2022). Moreover, the 9 burden of proving consent falls on the party seeking to invoke the exception. Calhoun, 526 10 F. Supp. 3d at 620 (citing Matera v. Google Inc., No. 15-CV-04062-LHK, 2016 WL 11 5339806, at *17 (N.D. Cal. Sept. 23, 2016)). Consent may be explicit or implied, but it 12 must be actual. In re Google, Inc., No. 13–MD–02430–LHK, 2013 WL 5423918, at *12 13 (N.D. Cal. Sept. 26, 2013). For consent to be actual, the disclosures must “explicitly notify” 14 users of the specific practice at issue. Id. at *13; see also Campbell v. Facebook, Inc., 77 15 F. Supp. 3d 836, 847–48 (N.D. Cal. 2014) (holding that, for consent to be valid, disclosures 16 must inform users of the “specific practice” being challenged). The disclosures must also 17 be unambiguous. In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 18 3d 767, 794 (N.D. Cal. 2019) [hereinafter “Facebook Consumer Profile”]. “[I]f a 19 reasonable ... user could have plausibly interpreted the contract language as not disclosing 20 that [the defendant] would engage in particular conduct” then the defendant cannot rely on 21 the user’s consent to except its conduct. Id. at 789–90. 22 Here, Facebook’s Privacy Policy is not “reasonably susceptible to more than one 23 interpretation.” Id. at 789. The policy explicitly states that Facebook may “share [users’] 24 information” with “government entities” “when [it] ha[s] a good faith belief it is necessary 25 to prevent … illegal activity.” (ECF No. 91-3 at 6.) Unlike cases where courts have 26 determined that a company’s policy was too “general” or too “vague” to establish consent 27 for a particular disclosure, Facebook’s language here is clear and unequivocal. Cf. In re 28 Google Assistant Priv. Litig., 457 F. Supp. 3d 797, 823 (N.D. Cal. 2020) (finding that a 1 reasonable user could not be expected to connect two separate sections of a privacy policy 2 to anticipate the Defendant’s use of their data); Campbell, 77 F. Supp. 3d at 847 (finding 3 that the disclosure that Facebook “‘may use the information we received about you’” for 4 “‘data analysis’” was “not specific enough to establish that users expressly consented to 5 the scanning of the content of their messages … for alleged used in targeted advertising”); 6 Facebook Consumer Profile, 402 F. Supp. 3d at 792. In Rosenow’s criminal case, this 7 Court found that: 8 After reading the data and privacy policies of Yahoo and Facebook, it is hard to imagine a scenario where any individual, including an educated one like 9 Defendant, could possibly have a subjective expectation of privacy in his 10 communications on those online platforms, especially where his conduct flagrantly violated the terms of use. 11 12 United States v. Rosenow, 3:17-cr-03430-WQH, ECF No. 49 at 31. 13 Accordingly, Defendants have satisfied their burden and shown that Rosenow 14 “actually” consented to their disclosures. The Court finds Yahoo’s and Facebook’s 15 disclosures to governmental entities were permitted under § 2702(b)(3), (c)(2). 16 4. To Protect the Rights of the Provider 17 Section 2702(b)(5) and (c)(3) govern the disclosure of customer communications 18 and records “as may may be necessarily incident to the rendition of the service or to the 19 protection of the rights or property of the provider of that service.” 18 U.S.C. § 2702(b)(5), 20 (c)(3). 21 Yahoo and Facebook additionally contend that their disclosures were permitted 22 under § 2702(b)(5) and (c)(3) because they were made to protect their rights and property. 23 Although Rosenow contends that Defendants cannot invoke § 2702(b)(5) and (c)(3) 24 because it is a “general” and not “specific” exception, the Court has already rejected this 25 contention. Rosenow does not otherwise oppose Defendants’ contentions that their 26 disclosures were exempt from SCA liability to protect their rights and property. (See 27 generally ECF No. 94.) 28 1 Additionally, the Ninth Circuit has already determined that Defendants had 2 “legitimate business reasons for purging child pornography and exploitation from their 3 platforms, and they acted in furtherance of those reasons when they investigated 4 Rosenow.” Rosenow, 50 F.4th at 733. This finding supports the conclusion that 5 Defendants’ actions align with the SCA exceptions under § 2702(b)(5) and (c)(3). 6 The terms “rights” and “property” are not “intended to … permit a provider to 7 contract with an unauthorized party an obligation to divulge all stored messages, without 8 notice to or any consent from the originator of the message, and then to claim that such 9 divulgence is to protect the rights in such a contract” but rather are intended to refer to 10 interests such as “intellectual property rights” and “the right to be free from the theft of 11 services.” H.R. Rep. No. 99-647, at 67 (1986). Here, Yahoo and Facebook disclosed 12 Rosenow’s communications and records to remove his unlawful activity from their 13 platforms and protect their business interests. Such disclosures are analogous to the rights 14 Congress specified that the exception intended to protect. 15 Therefore, the Court finds that, based upon the allegations of the SAC and the 16 judicially noticed materials, the Defendants’ actions fall under § 2702(b)(5) and (c)(3), as 17 they disclosed the results of their investigations to protect their rights and purge Rosenow’s 18 unlawful activity from their platforms. 19 5. Conclusion 20 The Court finds that Defendants’ disclosures to NCMEC were lawful pursuant to 21 § 2702(b)(6) and (c)(5) which provide for disclosures of customer communications and 22 records “to [NCMEC], in connection with a report submitted thereto under section 2258A.” 23 18 U.S.C. § 2702(b)(6), (c)(5). Additionally, and in the alternative, the Court finds that 24 Defendants’ disclosures to all government entities were lawful because Rosenow had 25 consented to the disclosures and because the disclosures were necessary to protect 26 Defendants’ rights. Id. § 2702(b)(3), (b)(5), (c)(2), (c)(3). Accordingly, Defendants’ 27 Motions to Dismiss the SAC’s second and third causes of action are granted. 28 /// 1 B. Wiretap Act Claim 2 Rosenow brings a cause of action against Yahoo for violations of the Wiretap Act, 3 Title I of the federal ECPA. Rosenow alleges that Yahoo intercepted his private 4 communications and unlawfully divulged the content of these messages in violation of 18 5 U.S.C. § 2511 (“§ 2511”). 6 The Wiretap Act makes it unlawful to “intentionally intercept[ ] … any wire, oral, 7 or electronic communication” or to “use[ ]” or “disclose[ ]” the contents of any 8 intentionally intercepted communication. 18 U.S.C. § 2511(1). The Wiretap Act defines 9 “intercept” as “the aural or other acquisition of the contents of any wire, electronic, or oral 10 communication through the use of any electronic, mechanical, or other device.” 18 U.S.C. 11 § 2510(4). 12 Yahoo contends that Rosenow’s allegations regarding its alleged interception of his 13 communications are too conclusory to support a claim under the Wiretap Act. (See ECF 14 No. 90-1 at 19–21.) In the alternative, Yahoo contends that its alleged disclosures fall under 15 the Wiretap Act’s exceptions for (1) disclosures to which a user has consented (18 U.S.C. 16 § 2511(2)(d), (3)(b)(ii)) and (2) disclosures made to protect the rights of the provider (18 17 U.S.C. § 2511(2)(a)(i), (3)(b)(i)). Id. at 21–25. 18 Rosenow contends that the SAC alleges sufficient facts to support a plausible 19 inference that Yahoo violated the Wiretap Act. (ECF No. 94 at 35 (citing Iqbal, 556 U.S. 20 at 682).) Rosenow contends that Yahoo cannot invoke § 2511(2)(d) because he did not 21 consent to the alleged interception of his communications. Id. at 31–34. Rosenow further 22 contends that Yahoo cannot invoke § 2511(2)(a)(i) because § 2511(2)(a)(i) applies only 23 when an ESP’s interception is incidental to or facilitates the provision of its electronic 24 communication services. Id. at 17 (citing In re Google, Inc., 2013 WL 5423918, at *11).8 25

26 8 Rosenow also contends that Yahoo cannot invoke § 2511(2)(a)(i), as it is a general exception to the 27 Wiretap Act and more specific exceptions exist for disclosures to law enforcement, relying on the same “the specific governs the general” principles he relied on to support his SCA claim. The Court rejects this 28 1 1. Insufficient Allegations of an Interception 2 The Ninth Circuit has explained that a “narrow definition of ‘intercept’ applies to 3 electronic communications.” Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 4 2002). For a communication “to be ‘intercepted’ in violation of the Wiretap Act, it must be 5 acquired during transmission, not while it is in electronic storage.” Konop, 302 F.3d at 878; 6 see also In re Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204, 1226 (C.D. Cal. 7 2017) (“In so holding, Konop strove to distinguish between information acquired 8 contemporaneously to its transmission and information that resides in electronic 9 storage. … Access to information maintained in electronic storage is governed by the 10 Stored Communications Act, while the Wiretap Act regulates access to information 11 acquired contemporaneously to its transmission.”). “[A]cquisition occurs ‘when the 12 contents of a [ ] communication are captured or redirected in any way.’” Noel v. Hall, 568 13 F.3d 743, 749 (9th Cir. 2009) (quoting United States v. Rodriguez, 968 F.2d 130, 136 (2d 14 Cir. 1992)). Once “received by the destination server, a communication becomes ‘stored’ 15 and contemporaneous interception is no longer possible.” In re Carrier IQ, Inc., 78 F. 16 Supp. 3d 1051, 1077–78 (N.D. Cal. 2015) (citing NovelPoster v. Javitch Canfield Grp., 17 140 F. Supp. 3d 938, 951–52 (N.D. Cal. 2014)). 18 Rosenow alleges that Yahoo’s ECIT adopted an “automated scanning tool” 19 originally “used by [Yahoo’s] ‘Content Moderation team’” “to intercept, redirect and scan 20 users’ incoming and outgoing emails and text messages during transit and then store[ ] 21 them for future use.” (SAC ¶¶ 36–37.) Rosenow alleges that the tool enabled “ECIT to read 22 the last line of chat messages to get the ‘gist’ of the communication.” Id. ¶ 36; see also id. 23 ¶ 38. Rosenow alleges that Yahoo disclosed the information it learned from these 24 interceptions in reports to federal agents. See, e.g., id. ¶¶ 98, 105, 129, 184–85. To support 25 his allegation that the tool used by ECIT actually intercepted his communications while in 26 transit, Rosenow alleges that a “Compliance Guide for Law Enforcement” created by 27 Yahoo “[i]nforms [l]aw [e]nforcement that Yahoo ‘does not store content for the 28 downloadable Messenger client’ or ‘archive the content or communications for the 1 downloadable messenger client.’” Id. ¶¶ 27–28. Rosenow also alleges that Zadig “testified 2 under oath that Yahoo [ ] does not store any images and videos shared on the messenger 3 Platform.” Id. ¶ 33. But somehow, “Yahoo [ ] nevertheless reported images and messages 4 from their messenger platform.” Id. ¶ 97 n.4; see also id. ¶ 105. Rosenow alleges that, 5 therefore, “the only way that ECIT could have obtained the reported images was by 6 intercepting the images and videos, while in transit, as part of their Philippines Webcam 7 Investigation.” Id. ¶ 109. Rosenow makes a number of additional conclusory allegations 8 that ECIT utilized this tool to “intercept[ ] [a] targeted person’s private messages while in 9 transit.” Id. ¶ 44; see also id. ¶¶ 36, 45, 90, 109. 10 Courts have held that given the speed of internet communications, “‘interception of 11 [such communications] within the prohibition of the Wiretap Act is virtually impossible.’” 12 NovelPoster, 140 F. Supp. 3d at 951–52 (quoting United States v. Steiger, 318 F.3d 1039, 13 1050 (11th Cir. 2003)); see also Martin v. Sephora USA, Inc., No. 1:22-cv-01355-JLT- 14 SAB, 2023 WL 2717636, at *10 (E.D. Cal. Mar. 30, 2023) (considering the argument that 15 “because internet communications travel so quickly, there is only an incredibly narrow 16 window during which an interception could occur; moreover, such transmissions may 17 generally be improperly accessed either on the originating or receiving end, but are not 18 typically intercepted during transmission”). 19 Rosenow alleges that the “Law Enforcement Guide” states that Yahoo does not store 20 any content for the downloadable Messenger client and that Zadig testified that Yahoo does 21 not “store any images.” Yahoo asks the Court not to credit the Law Enforcement Guide, 22 contending that it is unauthenticated and undated and because it “provides that Messenger 23 communications may be stored and that its policies are subject to change without notice.” 24 (ECF No. 98 at 5.) Yahoo also contends that Rosenow’s allegations regarding Zadig’s 25 testimony are irrelevant because he does not allege that Yahoo did not store “the text 26 content of message chats,” only that Yahoo did not “store any images.” Id. 27 Even accepting Rosenow’s allegations as true, the Court finds that any implications 28 intended by them are contradicted by Rosenow’s own allegation that Yahoo used the same 1 tool he alleges was used to intercept his messages to “pull[ ] [Rosenow’s] full chat history 2 on the Yahoo USA Messenger.” (SAC ¶ 184; see also ECF No. 94 at 36 (referring to the 3 fact that Yahoo used the tool to “pull Plaintiff’s entire chats” and asserting that therefore 4 he has plausibly alleged that ECIT used the tool to intercept users’ communications).) As 5 discussed above, once a communication has reached its destination server, its interception 6 is no longer possible. In re Carrier IQ, Inc., 78 F. Supp. 3d at 1077–78 (citing NovelPoster, 7 140 F. Supp. 3d at 951–52). Therefore, an interception of Rosenow’s communications 8 would require that Yahoo acquired the communication before it reached whoever Rosenow 9 was communicating with. If, as Rosenow alleges, Yahoo “pulled his full chat history,” 10 (SAC ¶ 184), then his chat history must have been stored somewhere. Any implications 11 Rosenow intended to suggest by referencing the Law Enforcement Guide and Zadig’s 12 testimony are thereby contradicted by Rosenow’s own allegations in the SAC that Yahoo 13 “pulled his full chat history.” Id. 14 Rosenow’s remaining allegations are too conclusory to support an inference that 15 Yahoo “captured or redirected” the contents of Rosenow’s communications while in 16 transit. Noel, 568 F.3d at 749; see, e.g., In re Vizio, 238 F. Supp. 3d at 1227–28 (“Besides 17 their conclusory allegation that Vizio intercepted their electronic communications ‘during 18 transmission’ …, Plaintiffs rely on a rather inscrutable graphic with no textual explanation 19 … and vague allegations about how Vizio’s data collection occurs ‘in real time.’”); Martin, 20 2023 WL 2717636, at *10 (same, collecting cases). Therefore, the Court finds that 21 Rosenow has failed to allege a Wiretap Act claim against Yahoo. 22 2. User’s Consent 23 In the alternative, Yahoo contends that the Wiretap Act claim should be dismissed 24 on the ground that Yahoo obtained express consent for any alleged interception of 25 Rosenow’s communications when Rosenow agreed to Yahoo’s Additional Terms of 26 Service (“ATOS”). (See ECF No. 90 at 17.) 27 Like the SCA, the Wiretap Act includes an exception for interceptions and 28 disclosures made with a user’s consent. See 18 U.S.C. § 2511(2)(d) (excepting from 1 liability interceptions where “one of the parties to the communication has given prior 2 consent”), (3)(b)(ii) (permitting disclosure of the contents of a communication “with the 3 lawful consent of the originator”). 4 The Court takes judicial notice of Yahoo’s ATOS and the record produced by the 5 YAMT because they are “incorporated by reference in the complaint.” Ritchie, 342 F.3d at 6 907; see, e.g., SAC ¶¶ 16 n.3, 18–20.)9 Rosenow’s complete YAMT record explicitly 7 shows that Rosenow agreed to the ATOS on July 5, 2011. (See ECF No. 90-5 at 6.) The 8 2011 ATOS states in relevant part: 9 Please note that your Yahoo! Messenger account is tied to your Yahoo! Mail account. Therefore, your use of Yahoo! Messenger and all Yahoo! Messenger 10 services will be subject to the TOS and laws applicable to the Applicable 11 Yahoo! Company in Section 10. By using the Services, you consent to allow Yahoo!’s automated systems to scan and analyze all incoming and outgoing 12 communications content sent and received from your account (such as Mail 13 and Messenger content including instant messages and SMS messages) including those stored in your account to, without limitation, provide 14 personally relevant product features and content, to match and serve targeted 15 advertising and for spam and malware detection and abuse protection. Unless 16 17 9 Rosenow contests the Court’s judicial notice of the ATOS and the YAMT. Rosenow contends that the 18 YAMT should not be judicially noticed because the SAC does not reference “any AMT tool nor did he know such a tool existed” and that he only made reference “to a document (not a tool) titled Yahoo 19 Account management Tool (YAMT) that was provided to him during discovery in his criminal 20 proceedings.” (ECF No. 94 at 31.) Rosenow contends that the various iterations of ATOS submitted by Yahoo should not be judicially noticed because although he “does not contest the content of the ATOS 21 and uses some of its language in his SAC,” “the declaration [submitting them] lacks critical information.” Id. at 32. “[I]ncorporation by reference is a judicially created doctrine that treats certain documents as 22 though they are part of the complaint itself. The doctrine prevents plaintiffs from selecting only portions of documents that support their claims, while omitting portions of those very documents that weaken—or 23 doom—their claims.” Khoja, 899 F.3d at 1002. The SAC states “[b]ased on information and belief the 24 YAMT has a section on when the account owner agreed to any specific terms. Plaintiff did not agree to any specific terms when he opened or maintained his [ ] account.” (SAC ¶ 20 n.4.) The SAC also quotes 25 directly from Yahoo’s ATOS. Id. ¶ 16 n.3. Rosenow’s complete YAMT record and the ATOS contradict his allegations that he did not agree to any terms or consent to Yahoo’s interceptions. Thus, their 26 incorporation by reference serves to ensure that Rosenow cannot “select[ ] only portions of [the] documents that support [his] claim.” (See ECF No. 90-5 at 6; see also Steckman v. Hart Brewing, Inc., 27 143 F.3d 1293, 1295–96 (9th Cir. 1998) (finding that a court is “not required to accept as true conclusory 28 allegations which are contradicted by documents referred to in the complaint”).) 1 expressly stated otherwise, you will not be allowed to opt out of this feature. If you consent to this ATOS and communicate with non-Yahoo! users using 2 the Services, you are responsible for notifying those users about this feature. 3 (ECF No. 90-4 at 6 (emphasis added).) The ATOS explicitly states that Yahoo will scan 4 and analyze all incoming and outgoing communications content for several reasons, 5 including “abuse protection,” and that Yahoo Messenger clients will be subject to the TOS. 6 Thus, to the extent that Yahoo intercepted Rosenow’s communications, the interception 7 was permitted under § 2511(2)(d), (3)(b)(ii), as Rosenow consented to such interceptions 8 when he agreed to the ATOS. 9 3. To Protect the Rights of the Provider 10 Lastly, Yahoo contends that any alleged interception was necessary to protect its 11 rights and thus permitted under § 2511(2)(a)(i). 12 The Wiretap Act provides that: 13 It shall not be unlawful under this chapter for an … officer, employee, or agent 14 of a provider of wire or electronic communication service, whose facilities are 15 used in the transmission of a wire or electronic communication, to intercept, disclose, or use that communication in the normal course of his employment 16 while engaged in any activity which is a necessary incident to the rendition of 17 his service or to the protection of the rights or property of the provider of that service, except that a provider of wire communication service to the public 18 shall not utilize service observing or random monitoring except for 19 mechanical or service quality control checks. 20 18 U.S.C. § 2511(2)(a)(i) (emphasis added). 21 Rosenow cites to In re Google, Inc., 2013 WL 5423918, to contend that Yahoo 22 cannot invoke § 2511(2)(a)(i) to make its actions lawful under the Wiretap Act. Rosenow 23 is correct in asserting that In re Google, Inc. states that 18 U.S.C. § 2510(5)(a)(ii), which 24 is an exception to the Wiretap Act for actions taken by a provider in the “ordinary course 25 of business,” “is narrow and designed only to protect electronic communication service 26 providers against a finding of liability under the Wiretap Act where the interception 27 facilitated or was incidental to provision of the electronic communication service at issue.” 28 2013 WL 5423918, at *11. However, the Court finds this analysis is not relevant to 1 Yahoo’s contention regarding § 2511(2)(a)(i), which is an entirely different exception 2 under the Wiretap Act allowing ESPs to intercept communications to protect their rights. 3 In re Google, Inc. discusses § 2511(2)(a)(i) only to provide evidence that 18 U.S.C. 4 § 2510(5)(a)(ii) was not intended to be read broadly. 2013 WL 5423918, at *9 (stating that 5 § 2511(2)(a)(i) “would be superfluous if the ordinary course of business exception were as 6 broad as Google suggests”). 7 In its analysis of Rosenow’s SCA claims, the Court found that, based upon the 8 allegations of the SAC and the judicially noticed materials, Yahoo acted to protect its rights 9 and purge Rosenow’s activity from its platform. Thus, to the extent that Rosenow alleges 10 an interception, the Court finds that the interception was permitted under § 2511(2)(a)(i) 11 for the same reasons. 12 Accordingly, Rosenow fails to adequately state a claim under the Wiretap Act 13 against Yahoo. Yahoo’s Motion to Dismiss Rosenow’s first cause of action is granted, 14 leaving no federal claims remaining against Defendants.10 15 C. State Law Claims 16 Rosenow’s claims for negligence arise under California state law. The federal 17 supplemental jurisdiction statute provides: 18 [I]n any civil action of which the district courts have original jurisdiction, the district courts shall have supplemental jurisdiction over all other claims that 19 are so related to claims in the action within such original jurisdiction that they 20 21

22 10 The SAC’s factual allegations suggest that Yahoo also violated 18 U.S.C. § 2252(a)—which, as relevant 23 here, prohibits the distribution of child pornography—by sharing aspects of its investigation directly with federal law enforcement agents, instead of limiting its disclosures to NCMEC. (See, e.g., SAC ¶¶ 8, 41, 24 52–53, 97, 117, 119, 122–23, 196.) However, Rosenow does not assert a separate claim against Yahoo for 25 this alleged violation. Even if such a claim were implied, Rosenow fails to allege any facts that would support an inference that this criminal statute provides him standing to sue for Yahoo’s alleged distribution 26 of child pornography. Accordingly, to the extent that such a claim is alleged, the Court dismisses it. See Zhang v. Twitter Inc., No. 23-cv-00980-JSC, 2023 WL 3919546, at *2 (N.D. Cal. June 8, 2023) (“To the 27 extent Plaintiff also alleges claims under 18 U.S.C. [§] 2252 … criminal statutes generally do not give rise to a private right of action.” (citing Cent. Bank of Denver, N.A. v. First Interstate Bank of Denver, 28 1 form part of the same case or controversy under Article III of the United States Constitution. 2 3 28 U.S.C. § 1367(a). “The district courts may decline to exercise supplemental 4 jurisdiction” for a number of reasons, including if “the district court has dismissed all 5 claims over which it has original jurisdiction[.]” Id. § 1367(c)(3). 6 “While discretion to decline to exercise supplemental jurisdiction over state law 7 claims is triggered by the presence of one of the conditions in § 1367(c), it is informed by 8 the [United Mine Workers of America v.] Gibbs[,] [383 U.S. 715 (1966),] values of 9 economy, convenience, fairness, and comity.” Acri v. Varian Assocs., 114 F.3d 999, 1001 10 (9th Cir. 1997) (quotation omitted). “‘[I]n the usual case in which federal-law claims are 11 eliminated before trial, the balance of factors ... will point toward declining to exercise 12 jurisdiction over the remaining state law claims.’” Schneider v. TRW, Inc., 938 F.2d 986, 13 993 (9th Cir. 1991) (quoting Carnegie-Mellon Univ. v. Cohill, 484 U.S. 343, 350 n.7 14 (1970)). 15 Rosenow’s federal claims have been dismissed. The Court declines to exercise 16 supplemental jurisdiction over Rosenow’s state law claims. 17 Defendants’ Motions to Dismiss are granted.11 Rosenow’s SAC is dismissed without 18 prejudice. 19 D. Leave to Amend 20 “A district court … may in its discretion deny leave to amend due to … repeated 21 failure to cure deficiencies by amendments previously allowed … [or] futility of 22 amendment.” Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 1007 (9th Cir. 2009) 23 (internal quotation marks omitted)); see also Finley v. Williams, No. 2:21-CV-06277- 24 RGK-PD, 2022 WL 2036309, at *3 (C.D. Cal. Jan. 24, 2022) (denying Plaintiff’s motion 25 to amend the complaint for her “repeated failure to cure deficiencies”); Schmier v. U.S. Ct. 26

27 28 11 The Court need not consider the remainder of the arguments raised in the parties’ briefing. 1 || Appeals for Ninth Cir., 279 F.3d 817, 824 (9th Cir. 2002) (recognizing that “[f]utility of 2 ||amendment” is a proper basis for dismissal without leave to amend); Cantu v. Tapestry, 3 || Inc., 697 F. Supp. 3d 989, 992 (S.D. Cal. 2023) (finding that “if the plaintiff previously 4 ||amended his complaint, the court’s ‘discretion to deny leave to amend is particularly 5 || broad’”’) (quoting Salameh v. Tarsadia Hotel, 726 F.3d 1124, 1133 (9th Cir. 2013)). 6 The Court has provided Rosenow the opportunity to amend his complaint twice to 7 ||no avail. (See ECF Nos. 15 & 88.) Although Rosenow claims that he “can cure any legal 8 defects identified by the Court by pleading additional facts and doing additional legal 9 || research,” (ECF No. 94 at 43), Rosenow still has not shown any legal basis for his claims 10 has failed to address the deficiencies highlighted by the Court in its prior orders 11 || dismissing the Complaint and FAC. See id.; see also Bonin v. Calderon, 59 F.3d 815, 845 12 || (9th Cir. 1995) (“[W]e have held that a district court does not abuse its discretion in denying 13 |}a motion to amend where the movant presents no new facts but only new theories and 14 || provides no satisfactory explanation for his failure to fully develop his contentions 15 originally.’’). In its Order dismissing Rosenow’s FAC, the Court cautioned that “this will 16 Rosenow’s final grant of leave to amend, absent extraordinary circumstances.” (ECF 17 || No. 88 at 27 n.7.) As the record reflects no such circumstances, the Court declines to grant 18 || Rosenow leave to amend for a third time. 19 || VI. CONCLUSION 20 IT IS HEREBY ORDERED that Defendants’ Motions to Dismiss Plaintiff's SAC 21 (ECF Nos. 90, 91) are granted. Plaintiff's SAC is dismissed without prejudice and without 22 || leave to amend. The Clerk of the Court is directed to issue judgment and close this case. 23 Dated: March 28, 2025 itt Z. Maa 24 Hon. William Q. Hayes 5 United States District Court 26 27 28