BACKGROUND

This being an appeal from a motion to dismiss, we describe the case as Plaintiff presents it. We take her plausible allegations as true and draw all reasonable inferences in her favor.

Experience Project was a social networking website made up of various online communities or groups where users anonymously shared their first-person experiences, posted and answered questions, and interacted with other users about different topics. The site did not limit or promote the types of experiences users shared. The site’s “blank box” approach to user content resulted in an array of topics and forums ranging from “I like dogs” and “I am going to Stanford” to “I have lung cancer” and “I Love Heroin.”

Users registered with the site anonymously; in other words, the site did not collect users’ identifying information, including name, phone number, or mailing address. The site’s operator, Ultimate Software, believed that anonymity would promote users to share more personal and authentic experiences without inhibition. Experience Project’s

DYROFF V. THE ULTIMATE SOFTWARE GROUP 5

founder stated, “We don’t want to know [users’] real name, their phone number, what town they’re from.” Id. “The impetus behind this policy [of anonymity] was to encourage users to share experiences with the least amount of inhibition possible. The greater the anonymity, the more ‘honest’ the post . . . .”

Experience Project was live from 2007 until March 2016, during which its users shared 67 million experiences, made 15 million connections, and asked 5 million questions. Users could join groups and the site also recommended groups for users to join, based on the content of their posts and other attributes, using machine-learning algorithms. When a user posted content to a group, the site would send an email notification to the other users active in that group. The site generated revenue through advertisements and the sale of tokens that users used to post questions to other users in their groups.

Some of the site’s functions, including user anonymity and grouping, facilitated illegal drug sales. Wesley Geer was involved in one such transaction, which turned fatal. Wesley suffered from drug addiction, which began when a doctor overprescribed him opioid pain killers after a serious sports-related injury. After several unsuccessful rehabilitation attempts, Wesley bought what he believed to be heroin from a fellow Experience Project user. Wesley posted in a heroin-related group, “where can i [sic] score heroin in jacksonville, fl.” The site sent him an email notification when another user, Hugo Margenat-Castro or “Potheadjuice,” an Orlando-based drug dealer, posted in the same group. Wesley and Margenat-Castro connected off the site and Wesley bought heroin from Margenat-Castro on August 18, 2015. Wesley died the next day from fentanyl toxicity. He did not know that the heroin Margenat-Castro sold him was laced with fentanyl. Margenat-Castro was ultimately arrested and prosecuted. He pleaded guilty in March 2017 admitting that he sold heroin laced with fentanyl while active on Experience Project.

In March 2016, Experience Project announced, in an open letter to its users, that it was shutting down. The letter expressed concern for the future of online privacy because of government overreach. It stated that the site always supported proper law enforcement efforts but recognized that it did not have the resources to respond to increased government information requests. The site shut down on April 21, 2016.

Plaintiff Kristanalea Dyroff, Wesley Greer’s mother, filed a complaint in San Francisco Superior Court. She alleges that Ultimate Software: (1) allowed users to traffic anonymously in illegal, deadly narcotics and to create groups dedicated to their sale and use; (2) steered users to additional groups dedicated to the sale and use of narcotics; (3) sent users alerts to posts within groups that were dedicated to the sale and use of narcotics; (4) permitted users to remain active accountholders despite evidence that they openly engaged in drug trafficking and that law enforcement had undertaken related investigations; and (5) demonstrated antipathy toward law enforcement efforts to stop illegal activity on Experience Project.

Ultimate Software removed the action from state court based on diversity jurisdiction and filed a motion to dismiss all claims under Federal Rule of Civil Procedure 12(b)(6). The district court granted the motion without prejudice. Dyroff filed a notice stating that she would not file an

DYROFF V. THE ULTIMATE SOFTWARE GROUP 7

amended complaint and asked the district court to enter judgement. Dyroff timely appealed the judgment.

STANDARD OF REVIEW

We review de novo both a district court order dismissing a plaintiff’s claims pursuant to Federal Rule of Civil Procedure 12(b)(6) and questions of statutory interpretation. Fields v. Twitter, Inc., 881 F.3d 739, 743 (9th Cir. 2018). The Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029–30 (9th Cir. 2009). Only a complaint that states a plausible claim for relief may survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Plausibility exists when a court may “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id.

DISCUSSION

Plaintiff argues that in granting the motion to dismiss, the district court made three errors. First, she argues, the district court erred when it held that Communications Decency Act (CDA) Section 230 immunizes Defendant Ultimate Software. Plaintiff reasons that Ultimate Software, as the operator of the Experience Project website, was an information content provider, as defined by the statute, because its recommendation and notification functions were “specifically designed to make subjective, editorial decisions about users based on their posts.” Second, according to Plaintiff, the district court erred when it found that her allegations of collusion between Ultimate Software and drug dealers using Experience Project were not plausible. Her third argument is that the district court erred in finding that Ultimate Software owed no duty of care to her son, Wesley Greer, an Experience Project user. We affirm because the district court did not err in any of these respects.

I. CDA Section 230 Immunizes Ultimate Software from

Plaintiff’s Claims

The CDA provides that website operators are immune from liability for third-party information (or content, like the posts on Experience Project) unless the website operator “is responsible, in whole or in part, for the creation or development of [the] information.” 47 U.S.C. §§ 230(c)(1) & (f)(3). Ultimate Software did not create content on Experience Project, in whole or in part. Accordingly, Ultimate Software, as the operator of Experience Project, is immune from liability under the CDA because its functions, including recommendations and notifications, were content- neutral tools used to facilitate communications. See Fair Hous. Council of San Fernando Valley v. Roommates.com, 521 F.3d 1157, 1167–69 (9th Cir 2008) (en banc).

A. Scope of CDA Section 230 Immunity

The CDA instructs us that “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” 47 U.S.C. § 230(c)(1) (emphasis added). The CDA defines an “interactive computer service” as

[A]ny information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or

DYROFF V. THE ULTIMATE SOFTWARE GROUP 9

services offered by libraries or educational institutions.

47 U.S.C. § 230(f)(2).

On the other hand, an “information content provider” is

[A]ny person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.

47 U.S.C. § 230(f)(3).

“The prototypical service qualifying for [CDA] immunity is an online messaging board (or bulletin board) on which Internet subscribers post comments and respond to comments posted by others.” Kimzey v. Yelp! Inc., 836 F.3d 1263, 1266 (9th Cir. 2016) (internal quotations omitted). In other words, a website like Experience Project. Taking the relevant statutory definitions and case law in account, it becomes clear that, in general, Section 230(c)(1) “protects websites from liability [under state or local law] for material posted on the[ir] website[s] by someone else.” Doe v. Internet Brands, Inc., 824 F.3d 846, 850 (9th Cir. 2016); see also 47 U.S.C. § 230(e)(3).

Combining the above principles, in Barnes v. Yahoo!, Inc., we created three-prong test for Section 230 immunity. 570 F.3d 1096, 1100 (9th Cir. 2009). Immunity from liability exists for “(1) a provider or user of an interactive computer service (2) whom a plaintiff seeks to treat, under a state law cause of action, as a publisher or speaker (3) of information provided by another information content provider.” Id. at 1100–01. When a plaintiff cannot allege enough facts to overcome Section 230 immunity, a plaintiff’s claims should be dismissed. See Kimzey, 836 F.3d at 1268–71. Ultimate Software satisfies all three prongs of the test.

B. Section 230 Immunity—The Barnes test

1. Defendant is an Interactive Computer Service

We interpret the term “interactive computer service” expansively. Kimzey, 836 F.3d at 1268. Ultimate Software was an interactive computer service because it did not create or publish its own content under the plain language of the statute. Rather, Ultimate Software published Experience Project users’ posts and did not materially contribute to its users’ posts.

Millions of users, including Plaintiff’s son, Wesley Greer, set up accounts on Experience Project, a website, to communicate with each other. Websites are the most common interactive computer services. Kimzey, 836 F.3d at 1268; see also Roommates.com, 521 F.3d at 1162 n.6 (“[t]oday, the most common interactive computer services are websites”).

No binding legal authority supports Plaintiff’s contention that Ultimate Software became an information content provider, losing its Section 230 immunity, by facilitating communication on Experience Project through content-neutral website functions like group recommendations and post notifications. Ultimate Software, therefore, satisfies the first prong.

DYROFF V. THE ULTIMATE SOFTWARE GROUP 11

2. Plaintiff Treats Ultimate Software as a Publisher or Speaker of Other’s Information/Content

An interactive computer service, like Ultimate Software, can also be an information content provider, but that is only relevant, for the purposes of Section 230 immunity, if the website it operates creates or develops the specific content at issue. Carafano v. Metrosplash.com, Inc., 339 F.3d 1119, 1124 (9th Cir. 2003). Here, Ultimate Software was not an information content provider because it did not create or develop information (or content). 47 U.S.C. § 230(f)(3). Rather, it published information created or developed by third parties. Specifically, Experience Project did not create or develop the posts that led to Greer’s death. Rather, it was Greer, himself, who posted “where can i [sic] score heroin in jacksonville, fl” on Experience Project. And it was the drug dealer, Margenat-Castro, who posted in response to Greer’s post.

It is true that Ultimate Software used features and functions, including algorithms, to analyze user posts on Experience Project and recommended other user groups. This includes the heroin-related discussion group to which Greer posted and (through its emails and push notifications) to the drug dealer who sold him the fentanyl-laced heroin. Plaintiff, however, cannot plead around Section 230 immunity by framing these website features as content. We have held that what matters is whether the claims “inherently require[] the court to treat the defendant as the ‘publisher or speaker’ of content provided by another.” Barnes, 570 F.3d at 1102. If they do, then Section 230(c)(1) provides immunity from liability. Id.

By recommending user groups and sending email notifications, Ultimate Software, through its Experience Project website, was acting as a publisher of others’ content. These functions—recommendations and notifications—are tools meant to facilitate the communication and content of others. They are not content in and of themselves.

Our recent decision, HomeAway.com, Inc. v. City of Santa Monica, 918 F.3d 676 (9th Cir. 2019) is of no help to Plaintiff. There, the City of Santa Monica required short- term vacation rentals to be licensed and imposed liability on vacation rental hosting platforms—HomeAway.com and Airbnb—that facilitated unlicensed short-term vacation rentals. Id. at 680. The platforms sued, alleging, among other things, that Section 230 immunized them from liability. Id. We found that HomeAway.com and Airbnb did not meet the second prong of the Barnes test because the Santa Monica ordinance did not “proscribe, mandate, or even discuss the content of the [website] listings” and required only that the website’s transactions involve licensed properties. Id. at 683. In other words, the vacation rental platforms did not face liability for the content of their listings; rather liability arose from facilitating unlicensed booking transactions.

Ultimate Software, therefore, satisfies the second prong of the Barnes test.

3. Ultimate Software Published Information/Content Provided by Another Information Content Provider

The third prong is also met because, as stated previously and as detailed in Plaintiff’s complaint, the content at issue was created and developed by Greer and his drug dealer. Plaintiff’s content “manipulation” theory is without support in the statute and case law. First, Plaintiff misreads Roommates.com when she argues it holds that a website

DYROFF V. THE ULTIMATE SOFTWARE GROUP 13

develops content if it manipulates the content in a unique way through content-neutral tools.

The question in Roommates.com was whether Section 230 immunized a website, which matched people renting rooms with people looking for somewhere to live, from claims that it violated federal and state housing anti- discrimination laws by requiring subscribers to disclose, using dropdown menus and checkboxes, their sex, sexual orientation, and family status. See Roommates.com, 521 F.3d at 1161–2, 1165.

We answered “no” to this question. We rested our decision, however, on the fact that Roommates.com affirmatively required users to disclose information related to protected classes through discriminatory questions and answer choices. As a result, this information, especially information related to a user’s protected class, served as the focus of the registration process and, ultimately, became the cornerstone of each user’s online profile. Moreover, the website designed its search function to guide users through the required discriminatory criteria. Id. at 1164, 1167. Under these set of facts, the website in Roommates.com was clearly the developer of the discriminatory content at issue. Id. at 1170.

In Roommates.com, we also identified the type of conduct that does not constitute the “development” of content under Section 230. Id. at 1169. For example, a housing website that lets users create their own criteria for identifying and choosing potential roommates (including criteria based on protected classes like race or sex) in a blank text box, does not become a developer of content if it does not require the use of that discriminatory criteria. Id. In other words, a website does not become a developer of content when it provides neutral tools that a user exploits to create a profile or perform a search using criteria that constitutes a protected class. Id. We, furthermore, concluded that “[w]here it is very clear that the website directly participates in developing the alleged illegality—as it is clear here with respect to [Roommates.com’s] questions, answers and the resulting profile pages—immunity will be lost.” However, “in cases of enhancement by… inference—such as with respect to the ‘Additional Comments’ [on Rommates.com]—[S]ection 230 must be interpreted to protect websites not merely from ultimate liability, but from having to fight costly and protracted legal battles.” Id. at 1174–75.

Here, Ultimate Software’s functions on Experience Project most resemble the “Additional Comments” features in Roommates.com in that Experience Project users, including Wesley Greer, were not required to disclose that they were looking for heroin or other illegal drugs. Rather, users were given something along the lines of blank text boxes in which they could post and share experiences, questions, and answers. The recommendation and notification functions helped facilitate this user-to-user communication, but it did not materially contribute, as Plaintiff argues, to the alleged unlawfulness of the content. Roommates.com, 521 F.3d at 1175; see also Kimzey, 836 F.3d at 1269 n.4 (the material contribution test makes a “‘crucial distinction between, on the one hand, taking actions (traditional to publishers) that are necessary to the display of unwelcome and actionable content and, on the other hand, responsibility for what makes the displayed content illegal or actionable.’”).

In summary, Plaintiff is unable to allege that Ultimate Software materially contributed to the content posted on Experience Project that led to Greer’s death. Plaintiff cannot

DYROFF V. THE ULTIMATE SOFTWARE GROUP 15

and does not plead that Ultimate Software required users to post specific content, made suggestions regarding the content of potential user posts, or contributed to making unlawful or objectionable user posts. Ultimate Software is entitled to immunity under the plain terms of Section 230 and our case law as a publisher of third-party content.

II. Plaintiff Does Not Plead Sufficient Facts to Show that

Ultimate Software Colluded with Drug Dealers on Experience Project

The complaint’s allegations as it relates to Plaintiff’s “collusion” with bad actors does not establish an independent theory of liability. Rather, Plaintiff tries, again, to circumvent Section 230 immunity by alleging that Ultimate Software knew or should have known that users sold drugs on Experience Project, and it supported and protected these drug dealers through its anonymity policies. The district court characterized this claim well, stating “The idea is that Ultimate Software is less Match.com and more Silk Road (a notorious online platform for criminal activities, including selling illegal drugs).”

To advance this collusion and inducement theory, Plaintiff relies on a Washington Supreme Court decision, J.S. v. Village Voice Media Holdings, LLC, 184 Wash. 2d 95 (2015) (en banc). In Village Voice Media, plaintiffs, minors featured in advertisements for sexual services, sued the operators of the website Backpage.com alleging, among other things, violations of state laws prohibiting the sexual exploitation of children. Id. at 98. The court held that plaintiffs sufficiently alleged that the website operators helped develop the illegal content and therefore were not immune from liability under Section 230. Id. at 103. Specifically, the court pointed to allegations that Backpage.com required users to disclose certain information within its “escorts” section that encouraged the sexual exploitation of children. Id. at 102. One such allegation is that Backpage.com’s “content requirements [were] specifically designed to control the nature and context of [escort] advertisements so that pimps can continue to use Backpage.com to traffic in sex, including the trafficking of children.” Id. at 102–03. In other words, the court found that the plaintiffs alleged enough facts such that it was plausible to infer that Backpage.com’s content requirements—within the website’s escort section—were designed to facilitate the prostitution of children.

Here, Ultimate Software’s anonymity features along with its public statements expressing concern for internet privacy and detailing the burden of law enforcement information requests are not facts whose inferences, viewed in the light most favorable to Plaintiff, plausibly allege collusion with drug dealers or other bad actors. Today, online privacy is a ubiquitous public concern for both users and technology companies. These statements do not establish, on the part of Ultimate Software, antipathy to law enforcement, especially given the corresponding statements about always supporting “proper law enforcement requests.”

Unlike the plaintiffs in Village Voice Media, Plaintiff here did not allege that Experience Project had a section for drug-related experiences on its website with specific content posting requirements that facilitated illegal drug transactions. Plaintiff’s allegation that user anonymity equals promoting drug transactions is not plausible. Iqbal, 556 U.S. at 678. The district court was right to dismiss all claims related to this supposed theory of liability because

DYROFF V. THE ULTIMATE SOFTWARE GROUP 17

Ultimate Software is, as reasoned above, immune under Section 230.

III. Ultimate Software Did Not Owe a Duty to

Plaintiff’s Son

Ultimate Software owed Greer no duty of care because Experience Project’s features amounted to content-neutral functions that did not create a risk of harm. Plaintiff rests her “failure to warn claim” on a misguided premise that misfeasance by Ultimate Software created a duty to Greer.

When analyzing a duty of care in the context of third- party acts, California courts distinguish between “misfeasance” and “nonfeasance.” Melton v. Boustred, 183 Cal. App. 4th 521, 531 (2010). Misfeasance is when a defendant makes the plaintiff’s position worse while nonfeasance is when a defendant does not help a plaintiff. Lugtu v. Cal. Highway Patrol, 26 Cal. 4th 703, 716 (2001). Misfeasance, unlike nonfeasance, creates an ordinary duty of care where none may have existed before. See id.

Ultimate Software did not make Plaintiff’s son, Greer, worse off because the functions Plaintiff references— recommendations and notifications—were used regardless of the groups in which a user participated. No website could function if a duty of care was created when a website facilitates communication, in a content-neutral fashion, of its users’ content. See e.g., Klayman v. Zuckerberg, 753 F.3d 1354, 1359–60 (D.C. Cir. 2014) (no special relationship between Facebook and its users). We decline to create such a relationship. Accordingly, the district was correct to dismiss Plaintiff’s duty to warn claim. For the preceding reasons, we AFFIRM the district court’s order granting Defendant Ultimate Software’s motion to dismiss.