FACTS AND PROCEEDINGS BELOW

In reviewing a judgment of dismissal after a demurrer, “we must assume the truth of all facts properly pleaded by the plaintiffs, as well as those that are judicially noticeable.” (Howard Jarvis Taxpayers Assn. v. City of La Habra (2001) 25 Cal.4th 809, 814.) The operative complaint and select information of which we take judicial notice1 provide the following factual background.

1 The Jane Does moved this court to take judicial notice of various documents filed in Doe v. Uber Technologies, Inc. (N.D.Cal. May 1, 2020, No. 19-CV-03310-JSC) 2020 WL 2097599, a federal lawsuit against the Uber entities alleging facts very similar to those alleged here (the federal Uber action). The plaintiff in the federal Uber action, a woman sexually assaulted by a criminal posing as an Uber driver, alleged California law negligence claims against the Uber entities, claiming, as do the Jane Does here, that Uber’s business model created the risk of the fake Uber scheme

3 A. The Uber Business Model The Uber entities operate a technology company that connects individuals looking for transportation with authorized drivers. Users request a ride through the Uber app on their smartphones. The Uber app uses Global Positioning System (GPS) technology available within one’s smartphone device to identify the user’s location, as well as a nearby available driver. The user then meets the driver at an “individually designated pickup location.” The Uber app also has “ ‘safety features’ ” to help users identify their authorized driver. When the rider is matched with a driver, the Uber app provides the rider with the authorized driver’s “name, picture, and license plate,” as well as a description of the car. The GPS technology also allows the rider to track their driver’s progress, so they can see when their authorized driver is nearby.

and that the Uber entities negligently failed to warn or otherwise protect her. The Jane Does’ request for judicial notice further asks that we take judicial notice of two decisions of the Public Utilities Commission of the State of California (the CPUC) regarding the commission’s investigation of sexual assaults potentially associated with “ridesharing and new online-enabled transportation services,” including the Uber app. (Capitalization omitted.) We hereby grant the motion. (See Evid. Code, § 452, subd. (d) [permitting judicial notice of “[r]ecords of . . . any court of this state or . . . any court of record of the United States”] & Taiheiyo Cement U.S.A., Inc. v. Franchise Tax Bd. (2012) 204 Cal.App.4th 254, 267, fn. 5 [“[j]udicial notice may be taken of official acts of the executive department of this state,” including reports of administrative agencies].) We consider these documents as a proffer identifying potential additional allegations the Jane Does could include in a further amended complaint. We also consider the documents from the federal Uber action in our analysis of the parties’ arguments regarding the relevance of that action.

4 Uber drivers distinguish themselves from other cars through the use of an Uber decal. The Uber entities’ “website has a ‘print at home’ feature where anyone with a computer and a printer can print out the identifying emblem to affix to any vehicle.” Uber does not attempt to monitor the use or distribution of decals and does not retrieve Uber decals from drivers deactivated for any reason, including those deactivated based on the driver committing sexual assault. The Uber entities market Uber as a safe alternative to drinking and driving. One of the pages on its website advertises its partnership with Mothers Against Drunk Driving and urges individuals to use Uber’s service instead of attempting to drive home after they have been drinking. Uber advertisements depict young female passengers riding in Uber vehicles alongside slogans referring to safety. Uber’s website also has a general “rider safety webpage,” and includes a paragraph entitled, “Getting a Safe Ride” that reads: “Safe pickups [¶] The Uber app automatically finds your location to provide door-to-door service. That means you stay safe and comfortable wherever you are until your driver arrives.”

B. Uber’s Knowledge of and Reactions to Incidents of Sexual Assault by Third Parties Posing As Uber Drivers The Uber entities “were put on notice as early as November 2014 of the fake uber scheme,” based on reports in numerous American cities and Canada. This scheme “has been known to the Uber [entities] as early as 2016 to be occurring at popular and crowded nightclub/ bar/restaurant locations in and around Los Angeles.” “[T]he Los Angeles Police Department and immediately surrounding jurisdictions have contacted [the] Uber [entities] . . . multiple times to alert [them] of additional victims and

5 the continued perpetration of this fake Uber scheme.” “Uber passengers have reported sexual misconduct including rapes” in the Los Angeles area, nationally, and internationally, “to the Uber [entities’] serious incident unit,” but “the serious incident unit’s agents are forbidden . . . from routing allegations to police or from advising victims to seek legal counsel or make their own police reports.” The Uber entities have been “silencing assault victims with monetary confidential settlements.” The Uber entities have been fined for their refusal to report data on sexual assaults to the

CPUC.

C. The Abductions of and Assaults on the Jane Does As noted, each of the Jane Does was sexually assaulted after using the Uber app between June 2017 and February 2018.2 On the nights in question, each Jane Doe used the Uber app to arrange for a ride home after a night out socializing and “consum[ing] alcohol” at “popular Los Angeles night spots,” specifically dance clubs in West Hollywood and downtown Los Angeles. After doing so, each received confirmation that their authorized Uber driver was on the way, and the name, picture, and license plate number of their authorized driver, along with a description of the driver’s car. Before the authorized Uber drivers arrived, however, other cars bearing Uber decals pulled up, the drivers of which held themselves out to be the ride home each Jane Doe had requested via the Uber app. Two of the Jane Does did not attempt to verify

2 Jane Doe No. 1’s assault occurred on June 18, 2017, Jane Doe No. 2’s assault occurred on December 30, 2017, and Jane Doe No. 3’s assault occurred on February 16, 2018. Jane Doe No. 1 and Jane Doe No. 3 were raped by the same serial rapist. According to the parties’ briefing, both rapists have since been apprehended.

6 this before getting into the imposter’s car by checking the picture, license plate number, or car description provided in the Uber app. One Jane Doe “noticed the license plate did not match” the license plate number shown in the Uber app, but the imposter driver convinced her that he had recently crashed his car and “hadn’t had time to update the app.” Ultimately, each Jane Doe entered a car driven by a rapist posing as an Uber driver, who abducted and raped her. None of the sexual predators committing these assaults was an authorized Uber driver. In the months before each Jane Doe was assaulted, the “Los Angeles Police Department and/or the Los Angeles Sheriff’s Department” contacted the Uber entities and “put [them] on notice of sexual predators who were posing as, or actual, rideshare drivers . . . specifically seeking out young[,] inebriated women who have engaged the Uber [a]pp . . . and were waiting for pick[-]up within a five-mile radius located in Los Angeles County.” All three of the Jane Does were abducted in this area, which “includes a concentrated three block area in West Hollywood” and “downtown Los Angeles.” The Uber entities “did not immediately cooperate with law enforcement in the investigation [of Jane Doe No. 3’s rape,] taking more than seven weeks to respond to search warrants . . . , which the detective [indicated] . . . was consistent with the Uber [entities’] . . . prior conduct with the policing agency.”

D. The Jane Does’ Lawsuit The Jane Does sued the Uber entities. The trial court sustained the Uber entities’ demurrer to the Jane Does’ first amended complaint with leave to amend. The Jane Does filed a second amended complaint (the SAC), the operative complaint in the action, which alleges negligence and strict product liability causes of action.

7 Through the SAC, the Jane Does seek to hold Uber liable for failing to warn them about or implement other measures to protect them against rapists employing the fake Uber scheme in the portions of West Hollywood and Los Angeles where the Uber entities knew rapists had repeatedly implemented the scheme. The SAC alleges the Uber entities “have not taken . . . any affirmative precautions to warn Uber users in” these or any other areas “of the continuous fake Uber sexual assault scheme” (capitalization omitted), and have not implemented additional safety features to help Uber app users assure they are entering the car of their authorized Uber driver. The SAC presents a theory of liability under which the Uber entities are negligent not just for failing to properly react to and protect against incidents of the fake Uber scheme, but also for affirmatively creating the risk of third parties employing the fake Uber scheme. Specifically, the SAC alleges that the Uber business model, when combined with Uber’s safety-focused marketing and concealment of assaults associated with use of the Uber app, created this risk. According to the SAC, by continuing to advertise Uber as safe for young, inebriated women, while at the same time “hiding” and failing to warn their customers about numerous reports of fake Uber scheme assaults, the Uber entities have “lulled” the “public, and in particular women looking for a safe ride home, . . . into believing that . . . the Uber [a]pp . . . summons a safe means of transportation,” when in fact using the Uber app can lead to abduction and rape.

E. The Uber Entities’ Successful Demurrer to the SAC The Uber entities demurred to the SAC, and the trial court sustained the demurrer without leave to amend. As to the negligence cause of action, the court concluded that the SAC

8 does not allege facts sufficient to establish a special relationship or misfeasance creating the risk that the Jane Does would be assaulted as they were, and thus could not establish the Uber entities owed a duty to protect the Jane Does from such an assault. As to the strict liability cause of action, the court concluded the Uber app was not a product, and thus a products liability theory of recovery was not legally viable. The court ultimately entered judgment dismissing the entire SAC with prejudice. The Jane Does timely appealed the judgment, challenging only the court’s ruling as to the negligence cause of action.

DISCUSSION

In an appeal from a judgment following an order sustaining a demurrer without leave to amend, we first review de novo “whether the complaint states facts sufficient to constitute a cause of action.” (Blank v. Kirwan (1985) 39 Cal.3d 311, 318 (Blank).) If not, we then apply an abuse of discretion standard of review to “decide whether there is a reasonable possibility that the defect can be cured by amendment: if it can be, the trial court has abused its discretion and we reverse; if not, there has been no abuse of discretion and we affirm.” (Ibid.) Thus, we independently analyze whether the trial court correctly concluded that the SAC failed to state a negligence cause of action. The Jane Does argue the court erred in so concluding because the SAC establishes (1) the Uber entities were in a common carrier special relationship with the Jane Does, which creates a duty to protect, (2) the Uber entities were in a contract-based special relationship with the Jane Does, which creates a duty to protect, and, (3) even absent a special relationship, the Uber entities engaged in misfeasance that created a foreseeable risk of the harm that ultimately befell the Jane Does, and thus the Uber

9 entities can be held liable for failing to protect against such harm. We address each of these arguments in turn below.

A. The SAC Does Not Allege Facts Supporting a Duty to Protect the Jane Does From Third Parties Employing the Fake Uber Scheme California courts “have uniformly held” that a “defendant owes no legal duty to the plaintiff ” if “the defendant has neither performed an act that increases the risk of injury to the plaintiff nor sits in a relation to the parties that creates an affirmative duty to protect the plaintiff from harm.” (Brown v. USA Taekwondo (2021) 11 Cal.5th 204, 216 (Brown).) Thus, “as a general matter, there is no duty to act to protect others from the conduct of third parties.” (Delgado v. Trax Bar & Grill (2005) 36 Cal.4th 224, 235; see ibid. [referring to this as the “no-duty-to-protect rule”].) The California Supreme Court recently reaffirmed this “ ‘general rule’ ” (Brown, supra, at p. 213), while also recognizing that it is subject to well- established exceptions. (Id. at pp. 213−214.) The high court also set forth a “two-step inquiry” for determining when such exceptions apply and trigger a duty to protect. (Brown, supra, 11 Cal.5th at p. 209.) The first step assesses whether there is “a special relationship between the parties or some other set of circumstances giving rise to an affirmative duty to protect.” (Ibid.) If either exists, the court moves on to the second step and considers “whether relevant policy considerations counsel limiting that duty” (ibid.), looking to the policy factors identified in Rowland v. Christian (1968) 69 Cal.2d 108, 112–113 for guidance. (Brown, supra, at p. 209.) A court thus only reaches the Rowland factors once it finds a special relationship or other circumstances giving rise to a duty to protect are present;

10 the factors are not “a freestanding means of establishing duty.” (Id. at p. 217.) The first step in the Brown analysis is dispositive in this case, in the manner we discuss below.

1. The Uber entities do not have a duty to protect based on a common carrier-passenger relationship with the Jane Does Relying on an unpublished federal memorandum decision, Brasseur v. Empire Travel Service, Inc. (9th Cir. Dec. 15, 1995, No. 94-15905) 1995 WL 746181 (Brasseur), the Jane Does argue that they had a common carrier-passenger special relationship with the Uber entities at the time they were abducted, which created a duty to “ ‘warn[ ] [the Jane Does] of reasonably foreseeable risks that may be encountered during transportation or at the terminus.’ ”3 (See Brasseur, supra, 1995 WL 746181 at p. *1.) Specifically, the Jane Does argue that, at the time they were abducted, they already had been “accepted as passengers by Uber” and were waiting for their ride at a designated meeting point. According to the Jane Does, this, combined with the Uber entities’ “specialized knowledge” about “the [f]ake Uber [s]cheme being perpetrated in the five-mile radius” of where the Jane Does were waiting, triggered a common carrier’s duty to protect them. Both California and federal cases consistently hold that, under California

3 We note that ample California authority regarding common carrier liability under California law exists to guide us, and that federal authority is not binding on this court. In any event, as discussed below, the federal authority the Jane Does cite, like California case law regarding common carrier liability, does not support a common carrier relationship or duty to protect on the facts alleged in the SAC.

11 law, a common carrier relationship exists and a corresponding “heightened standard [of care] applies to a passenger [while] in transit” with a common carrier (Churchman v. Bay Area Rapid Transit Dist. (2019) 39 Cal.App.5th 246, 250 (Churchman)), and, under certain circumstances, for brief windows of time immediately before and/or after the passenger is in transit with the carrier. (Id. at pp. 250–251; accord, Rookard v. Mexicoach (9th Cir. 1982) 680 F.2d 1257, 1260 (Rookard).) This heightened duty of care a common carrier owes its passenger is a function of the fact that “ ‘[t]he passenger while in actual progress upon his journey is exposed to countless hazards, [and] gives himself wholly in charge of the carrier.’ ” (Falls v. San Francisco etc. R. R. Co. (1893) 97 Cal. 114, 119 (Falls); Brasseur, supra, 1995 WL 746181 at p. *1 [“[t]he rationale for this heightened standard of care is that during travel a passenger is exposed to numerous hazards while his or her freedom of movement is entirely under the control of the carrier”].) This “rule properly ceases with the reason for it.” (Falls, supra, 97 Cal. at p. 119.) Thus, although this heightened “duty of care does not end absolutely when the passenger alights from carriage” in all instances, once “ ‘the passenger reaches a place outside the sphere of any activity of the carrier which might reasonably constitute a mobile or animated hazard to the passenger” (Brasseur, supra, 1995 WL 746181 at p. *1) and the passenger is “discharged into a relatively safe space, the hazards incident to the journey, as well as the carrier’s control over the passenger, cease to exist,” and no heightened duty of care is owed. (Ibid.; accord, McGettigan v. Bay Area Rapid Transit Dist. (1997) 57 Cal.App.4th 1011, 1017–1018.) Therefore, the precise duration of the common carrier-passenger relationship (and corresponding heightened duty of care) is a function of how long the common carrier has control over the passenger in a manner associated with

12 being a common carrier—specifically, control by virtue of the passenger being aboard the common carrier, or control over the passenger’s exposure to “mobile hazards peculiar to the transportation service, such as cable cars passing through a boarding area [citation], or jet blasts from an airplane [citation].” (Churchman, supra, 39 Cal.App.5th at p. 251.) Accordingly, “cases . . . [holding] that a carrier does have a duty to warn a passenger of reasonably foreseeable risks [citation] . . . [citation] . . . deal with carriers whose passengers were still in their care and control.” (Rookard, supra, 680 F.2d at p. 1260 [summarizing and applying California law]; see Brasseur, supra, 1995 WL 746181 at p. *2 [“[b]ecause the hurricane did not present a risk to [the airplane passenger’s] safety either during her flight, or when she disembarked, [the defendant airline] had no duty to warn her that a hurricane might hit Cancun the following day”].) Here, when the Jane Does were waiting for their respective summoned Uber drivers, the Uber entities had no control over the Jane Does’ movements, nor over the environment in which the Jane Does were waiting.4 The Jane Does disagree, pointing to the Uber app’s use of a GPS pin that locates an Uber app user who has summoned a ride and directs the user to a designated location for pick-up. The Jane Does argue this gives Uber unique knowledge of and influence over the customer’s movements that justifies imposing a common carrier heightened duty of care. This stretches

4 The Jane Does do not (and, on the facts alleged, could not) argue a common carrier heightened duty of care applies on the basis that the injury alleged derives from “mobile hazards peculiar to the transportation service.” (Churchman, supra, 39 Cal.App.5th at p. 251.) We thus focus our analysis on the Uber entities’ level of control over the Jane Does and their safety at the time of the abductions.

13 the reasoning underlying the common carrier-passenger special relationship too far. The ability to direct the Jane Does to a pick-up location and knowledge about their whereabouts—even when combined with additional knowledge that the Jane Does were near a place where other women waiting for an Uber had recently been abducted—is not akin to passengers “submit[ting] themselves completely to the carrier’s charge” while riding on a train or bus. (Orr v. Pacific Southwest Airlines (1989) 208 Cal.App.3d 1467, 1472 (Orr).) Nor is there any allegation that such movement subjected them to any risk. Nor does likening the Jane Does to passengers in a train station or airport waiting to board a common carrier assist the Jane Does’ common carrier theory of duty. First, on the facts alleged in the SAC, the Uber entities had less control over the Jane Does’ safety than a common carrier has over individuals in a station waiting to board or recently alighted passengers “at the terminus.” (Brasseur, supra, 1995 WL 746181 at p. *1.) More importantly, even if the Uber entities had that level of control, the common carrier’s special duty of care “generally does not apply to a passenger waiting in, or passing through, a station or terminal.” (Churchman, supra, 39 Cal.App.5th at p. 250; see Orr, supra, 208 Cal.App.3d at pp. 1472−1474 [no heightened duty where the plaintiff was injured in a security screening area of airport terminal]; Robson v. Union Pacific R. R. Co. (1945) 70 Cal.App.2d 759, 761 [“railroad is not an insurer of the safety of its station premises, but is required to exercise only ordinary care as to invitees”].) “[B]ecause the passengers’ entry into the carrier’s station is not characterized by any of such hazards incident to the journey itself, the carrier at such time and place” does not owe a heightened common carrier duty of care. (Orr, supra, at p. 1472.)

14 Thus, no federal or California case supports the Jane Does’ contentions that, absent the unique level of control over a plaintiff ’s safety associated with traveling on a common carrier and/or the physical hazards of common carrier transportation—neither of which have been alleged here—a common carrier and a potential passenger have a special relationship justifying a heightened duty of care.5

2. The Uber entities do not have a duty to protect based on a contractual relationship with the Jane Does Generally, “a special relationship arises by contract only if the contract itself imposes a duty” to protect. (McHenry v. Asylum Entertainment Delaware, LLC (2020) 46 Cal.App.5th 469, 485−486.) Such a special relationship requires “ ‘a specific promise’ ” in the contract to “ ‘provide specific protection.’ ” (Bom v. Superior Court (2020) 44 Cal.App.5th 1, 16.) The Jane Does do not argue that their contract with the Uber entities contains any express promise to protect. Rather, they argue that a statement on the Uber website— namely, that the Uber app offers “[s]afe pickups [¶] . . . you stay safe and comfortable wherever you are until your driver arrives”— created an implied contractual obligation to protect the Jane Does while waiting for their Uber driver.

5 The United States District Court for the District of Northern California reached the same conclusion in the federal Uber action. Specifically, it “dismissed [the] [p]laintiff ’s common carrier negligence claim because [p]laintiff had not plausibly alleged facts that supported an inference that Uber had a common carrier / passenger relationship with [p]laintiff at the time of the assault which warranted a heightened duty of care.” (Doe v. Uber Technologies, Inc., supra, 2020 WL 2097599 at p. *2.)

15 It is possible for contractual terms to be implied based on extra-contractual representations under certain circumstances, depending upon the specificity of the representation at issue, as well as other factors. (See, e.g., Vallejo Police Officers Assn. v. City of Vallejo (2017) 15 Cal.App.5th 601, 620 [where there was “no evidence of any specific promise” in extra-contractual representations, those representations did not imply terms in written contract].) The facts alleged are not sufficiently definite or explicit to constitute a “specific promise” that the Uber entities would undertake a legal duty to protect from third party misconduct. (Ibid.) Therefore, the language on the Uber website on which the Jane Does rely is not an enforceable promise to protect against third parties while waiting for an Uber driver on a public street.6 The Jane Does also analogize to premises liability cases involving quasi-contractual relationships that recognize a business’s duty to protect potential customers from third party crime. But such cases involve a plaintiff physically on the defendant’s property, creating at least an invitee-invitor special relationship. (See, e.g., Morris v. De La Torre (2005) 36 Cal.4th

6 Because a promise to protect passengers from third party criminal conduct cannot be implied into the contract between the Uber entities and the Jane Does, the Jane Does’ reliance on case law establishing that a contractual relationship continues “until both parties have waived or fully performed their mutual obligations” is of no assistance in arguing for a contract-based duty to protect. (Dayton v. Yellow Cab Co. (1948) 85 Cal.App.2d 740, 744 (Dayton) [because a carrier-passenger contract requires taxi passengers “to pay their fare,” the carrier-passenger special relationship was still in place after passengers exited taxi before paying and affected the duty of care the taxi driver owed during the altercation that immediately ensued].)

16 260, 271–272 [defendant had a special relationship with noncustomer plaintiff giving rise to duty to protect plaintiff against third party attack while in defendant’s business, because “a special relationship exists between a business proprietor and . . . its invitees,” italics omitted].) The duty at issue in such cases thus does not derive from an implied contractual obligation in the absence of any other special relationship. The Jane Does also cite to what they characterize as “privity of contract” cases, which are distinguishable for similar reasons. (See C.A. v. William S. Hart Union High School Dist. (2012) 53 Cal.4th 861, 878 [discussing extent of school’s responsibility to protect students against foreseeable harm from third parties, based on special relationship between school district and its pupils]; Dayton, supra, 85 Cal.App.2d at pp. 743–744 [involving duration of common carrier special relationship between taxi driver and customer].) On the facts alleged in the SAC, there is no contract-based special relationship between the Jane Does and the Uber entities that could give rise to a duty to protect the Jane Does from third parties.

3. The SAC does not allege misfeasance based on which the Uber entities could be held liable for failure to protect against the acts of the Jane Does’ assailants a. Misfeasance as a basis for duty to protect The general rule that one has no duty, absent a special relationship, to protect others against harm at the hands of third parties is rooted in the idea that, “[g]enerally, the ‘person who has not created a peril is not liable in tort merely for failure to take affirmative action to assist or protect another’ from that peril.” (Brown, supra, 11 Cal.5th at p. 214, italics added, quoting Williams v. State of California (1983) 34 Cal.3d 18, 23.) A necessary corollary to this is that when a defendant has

17 affirmatively “created a peril” that foreseeably leads to the plaintiff ’s harm (Williams, supra, at p. 23), the defendant can, even absent a special relationship, be held liable for failing to also protect the plaintiff from that peril. This scenario does not represent a true exception to the general rule that there is no duty to protect. Rather, it involves more than a mere failure to protect (nonfeasance), and instead involves both misfeasance— the defendant has “ma[de] the plaintiff ’s position worse, i.e., defendant has created a risk”—and the nonfeasance of failing to protect against that risk once created. (Weirum v. RKP General, Inc. (1975) 15 Cal.3d 40, 49 (Weirum).) A seminal case exploring such a situation is Weirum, supra, 15 Cal.3d 40. In Weirum, a “rock radio station with an extensive teenage audience conducted a contest which rewarded the first contestant to locate a peripatetic disc jockey. Two minors driving in separate automobiles attempted to follow the disc jockey’s automobile to its next stop. In the course of their pursuit, one of the minors negligently forced a car off the highway, killing its sole occupant.” (Id. at p. 43.) The court rejected the defendant radio station’s argument that it was accused of nonfeasance—that is, of a failure to protect the decedent against the teenagers, something for which, absent a special relationship, the law does not permit liability. (Id. at pp. 47−49.) The court explained “this rule has no application if the plaintiff ’s complaint . . . is grounded upon an affirmative act of defendant which created an undue risk of harm”—i.e., misfeasance. (Id. at p. 48.) The court viewed the radio station’s broadcast as an affirmative act that had “stimulated” the “reckless conduct by youthful contestants” which “constituted the hazard to which decedent was exposed.” (Id. at p. 47). Under those circumstances, the defendant was liable for “creat[ing] . . . an unreasonable risk of harm” to the decedent, and the court affirmed

18 a jury verdict for plaintiff. (Id. at p. 49.) The Weirum court also found significant that this reckless conduct was a foreseeable result of the broadcast, in that “[m]oney and a small measure of momentary notoriety awaited the swiftest response. It was foreseeable that defendant’s youthful listeners, finding the prize had eluded them at one location, would race to arrive first at the next site and in their haste would disregard the demands of highway safety.” (Id. at p. 47.) A key fact in Weirum is that the plaintiff was injured by third parties doing exactly what the defendant’s conduct encouraged them to do: speed to the next location of the disc jockey, whatever the cost. Courts have repeatedly identified this as a defining feature of Weirum misfeasance. (See Olivia N. v. National Broadcasting Co., Inc. (1981) 126 Cal.App.3d 488, 496 [Weirum misfeasance occurs only where the defendant actively “urg[es]” the third party “to act in [the] inherently dangerous manner” that injured the plaintiff]; accord, Melton v. Boustred (2010) 183 Cal.App.4th 521, 535 (Melton); Sakiyama, supra, 110 Cal.App.4th at p. 408; McCollum v. CBS, Inc. (1988) 202 Cal.App.3d 989, 1005.) Sakiyama, supra, 110 Cal.App.4th 398 provides a helpful counterpoint in understanding the limits of Weirum misfeasance. In Sakiyama, the plaintiffs were teenagers who had been injured and the parents of two other teenagers who had been killed in a single-car crash after leaving an all-night rave party hosted on the defendant’s premises. (Id. at p. 402.) The record supported that drug use at such an event was common and was to be anticipated. Nevertheless, the court noted that “the teenagers did not need to use drugs to attend the party. [The defendant] did not promote drug use; in fact, it took numerous steps to discourage and prevent drug use. And, although the party lasted all night, the attendees

19 were not required to stay until they were too tired to drive home.” (Id. at p. 408.) Thus, unlike in Weirum, the conduct that led to the teenagers’ injuries and deaths was neither encouraged by the defendant nor a necessary result of the defendant’s conduct, and could not constitute misfeasance. (Compare ibid. with Weirum, supra, 15 Cal.3d at p. 48.) The all-night rave party provided an opportunity for the teenagers to use drugs and/or stay up all night before attempting to drive home, but it did not create the risk that they would do so. Thus, the court found the defendant venue owed no duty to protect attendees from that risk.

b. The Jane Does’ theory of misfeasance The Jane Does argue that they have alleged sufficient Weirum misfeasance by the Uber entities to establish a duty to protect. They argue the Uber entities did not just fail to protect or warn the Jane Does, but rather: actively concealed the fake Uber scheme and instances of sexual assault reported to Uber; created a rideshare platform that encourages unsafe behavior, but marketed it as safe; offered a deficient matching system on the Uber app; and made Uber decals easy to obtain without keeping track of their use. To assess the Jane Does’ misfeasance argument, we must determine whether the SAC alleges actions by the Uber entities that “ ‘created a “peril,” that is, an unreasonable risk of harm to others’ ” in the manner present in Weirum, but not present in Sakiyama. (Melton, supra, 183 Cal.App.4th at p. 533.) The Jane Does argue that they do, because the Uber business model, as supported by Uber’s safety-focused marketing and concealment of sexual assaults, created an opportunity for rapists to stalk their prey that otherwise would not have existed. Specifically, they argue, “Uber reshaped the transportation industry to give the

20 illusion of safety to women like [the Jane Does] so they would get into a stranger’s car on the basis of nothing more than an ‘Uber’ decal on the driver’s window, a small picture, and information on the license plate, make[,] model[,] and color of the supposed Uber vehicle,” then lulled these women into a further false sense of security through their marketing and concealment. They further identify the Uber entities’ alleged “creation of a faulty matching system and negligent endorsement of a driver (via decals) of the subject driver” as “malfeasance.” The Jane Does emphasize that, particularly in the area where they were abducted, it was entirely foreseeable to the Uber entities that use of the Uber app could lead to abduction and rape, and that the Uber app and actions of the Uber entities placed the Jane Does in a worse position in terms of avoiding this fate. The “crux of the difference between” misfeasance and nonfeasance for purposes of assessing a duty to protect is whether the third-party conduct “ ‘was a necessary component’ of the [defendant’s] conduct at issue.” (Melton, supra, 183 Cal.App.4th at p. 534.) That assault and rape by third parties is a foreseeable result of a defendant’s actions, or that this conduct may not have occurred absent the defendant’s actions, is insufficient to establish this. By way of example, it is entirely foreseeable that teenagers at an all-night rave party might use drugs and/or stay up all night, then attempt to drive home. Because doing so is not a “necessary component” of attending such a party, however, Sakiyama concluded the party did not create a risk thereof, and the party venue had no duty to protect against it. (Sakiyama, supra, 110 Cal.App.4th at p. 408.) Similarly, when one publicly posts an unrestricted invitation to an “ ‘out-of-control and dangerously public’ ” party at one’s residence, it is foreseeable that drunken attendees could become physically violent and that party guests

21 might be harmed in a way they would not have been, had the party not taken place and / or been publicly advertised. (Melton, supra, 183 Cal.App.4th at p. 533.) But Melton deemed such foreseeability and causal connection insufficient to require the party host to protect against such violence, because “[t]he violence that harmed plaintiffs [in that case] was not ‘a necessary component’ of [the] defendant[ ] [host’s] party.” (Id. at p. 535; see ibid. [rejecting idea that hosting and advertising party in this way constituted “active conduct that increased the risk of harm to plaintiffs”].) So too here. The fake Uber scheme may be a foreseeable result of the Uber business model, and the Jane Does’ assailants may not have been able to as easily commit their crimes against the Jane Does, were it not for the Uber app and the Uber business model. But these connections cannot establish that the harm the Jane Does suffered is a “necessary component” of the Uber entities’ actions. (Sakiyama, supra, 110 Cal.App.4th at p. 408.) “The violence that harmed [the Jane Does]”—abduction and rape—“[is] not ‘a necessary component’ of ” the Uber business model. (See Melton, supra, 183 Cal.App.4th at p. 535.) Nor does such harm become a necessary component of the Uber business model because the Uber entities marketed the Uber app as safe to use, refused to cooperate with sexual assault investigations, or concealed sexual assaults related to the use of the app. Even accepting such allegations as true, the Uber entities still are not alleged to have “[taken] . . . action to stimulate the criminal conduct” (ibid.), as was the case in Weirum, where defendants encouraged plaintiffs to drive as quickly as possible to the designated location. (See Weirum, supra, 15 Cal.3d at p. 48.) To the contrary, like the defendants in Sakiyama, the Uber entities made efforts to prevent the type of conduct that harmed the plaintiffs—namely, they included matching system features in the Uber app that, if utilized, can

22 thwart efforts like the fake Uber scheme. The conduct based on which the Jane Does seek to impose liability thus does not constitute misfeasance that can give rise to a duty to protect. In arguing to the contrary, the Jane Does read Weirum and its progeny too broadly and focus too much on whether the rapes they suffered were a foreseeable result of using the Uber app. But it is only “[w]here there is a legal basis for imposing a duty—as in [the] cases of misfeasance or when a special relationship exists— [that] the court considers the foreseeability of risk from the third party conduct.” (Melton, supra, 183 Cal.App.4th at p. 532.) Here, the SAC does not allege such misfeasance. The Jane Does also focus on the idea that the Uber entities’ alleged actions “place[d] [the Jane Does] in . . . worse position[s].” Weirum is the source of this language, but that case goes on to explain that the phrase is meant to refer to when the defendant has created the risk that ultimately harms the plaintiff: “[W]hen the defendant is responsible for making the plaintiff ’s position worse, i.e., [the] defendant has created a risk.” (Weirum, supra, 15 Cal.3d at p. 49.) Weirum thus does not stand for the proposition that a defendant worsening the plaintiff ’s position in the simplest, most literal sense is alone sufficient to establish misfeasance triggering a duty to protect. (See Discussion ante, part A.3.a.) Moreover, there are “many commonplace commercial activities” that provide an opportunity for, and thus theoretically increase the risk of, criminal conduct by third parties. (Sakiyama, supra, 110 Cal.App.4th at p. 409.) For example, bars, restaurants, “New Year’s Eve parties,” concerts, and college parties all “provide patrons with the opportunity to drink alcohol, become intoxicated, and then drive.” (Ibid.) Yet these activities are not treated as misfeasance in cases where plaintiffs are harmed by a patron’s criminal act of driving while intoxicated, and California courts have consistently “refused

23 to hold business owners and hosts in these situations liable for negligence.” (Ibid. [collecting cases].) Similarly, in cases against youth organizations that negligently provide the opportunity for an adult to molest a child, courts have analyzed the organization’s liability for resulting harm under a paradigm of nonfeasance (failure to protect) and special relationships. (See, e.g., Brown, supra, 11 Cal.5th at p. 210 [liability of organization third party sexual predators “t[aking] advantage of . . . opportunities to sexually abuse the young” participants that would not have existed but for the organizations was premised on nonfeasance and special relationship, not misfeasance]; accord, Doe v. United States Youth Soccer Assn., Inc. (2017) 8 Cal.App.5th 1118, 1122 [youth soccer]; Juarez v. Boy Scouts of America, Inc. (2000) 81 Cal.App.4th 377, 384 [boy scouts], disapproved of on other grounds in Brown, supra, at pp. 212 & 221.) Thus, that a defendant’s organization or business creates an opportunity for criminal conduct against a plaintiff and thereby worsens the plaintiff ’s position does not render such criminal conduct a necessary component of the organization’s actions—even when that conduct is foreseeable. Providing such an opportunity does not constitute misfeasance triggering a duty to protect.7

7 The district court in the federal Uber action accepted the idea that the Uber entities’ business model could constitute misfeasance because it “ ‘made plaintiff ’s position worse’ ” and “ ‘created a foreseeable risk of harm from the third persons.’ ” (Doe v. Uber Technologies, Inc., supra, 2020 WL 2097599 at p. *3.) To the extent the federal Uber action rests on the same alleged conduct presented in the SAC, we disagree that such actions “[made] the plaintiff ’s position worse” or created the risk at issue in the manner necessary to establish a duty to protect under California law. In concluding to the contrary, the district court in

24 In sum, we conclude that no legal duty arose from the actions alleged in the SAC, because those actions establish neither misfeasance, nor a special relationship.

B. The Trial Court Acted Within Its Discretion in Denying Leave to Amend When reviewing a ruling sustaining a demurrer without leave to amend, “we decide whether there is a reasonable possibility that the defect can be cured by amendment,” and “[t]he burden of proving such reasonable possibility is squarely on the plaintiff.” (Blank, supra, 39 Cal.3d at p. 318.) In their opening brief, the Jane Does “request the ability to amend their complaint” “if any deficiencies are perceived” therein, but do not make any effort to explain how they would amend. Only in their reply brief do the Jane Does point to new allegations they might include in a further amended complaint. These derive in part from information “recently . . . declassified in the [f]ederal [Uber] [a]ction” that is “systemic of [the] Uber[ ] [entities’] practices.”8 Specifically, the Jane Does indicate they would add allegations (1) that the Uber entities have known for many years about

the federal Uber action, like the Jane Does here, relied on Lugtu v. California Highway Patrol (2001) 26 Cal.4th 703, 716. But the conduct deemed to be misfeasance in that case is not analogous to the conduct at issue here. Namely, in Lugtu, the “plaintiffs’ cause of action . . . [was] based upon the claim that [a police officer’s] affirmative conduct . . . in directing [the plaintiff] to stop [his car] in the center median of the freeway, placed plaintiffs in a dangerous position and created a serious risk of harm to which they otherwise would not have been exposed.” (Id. at pp. 716–717.) 8 These facts were the subject of the Jane Does’ request for judicial notice to this court, which we granted above, and have taken into account in our foregoing analysis.

25 instances of the fake Uber scheme and sexual assaults otherwise associated with the Uber app; (2) that the Uber entities have been uncooperative with authorities investigating sexual assaults related to the Uber app; (3) that “the serial rapists in question in this case had prior relationships with Uber wherein they obtained the Uber decals emblazoned on the vehicles that abducted each” Jane Doe; (4) “concerning [the Uber entities’] failure to request, retrieve or otherwise cancel said decals, endorsing the decals as safe”; and (5) more specifically identifying “policies and procedures of [the Uber entities] negatively conducting [sic] sexual assault investigations giving rise to serial rapists going undetected by law enforcement.” These proffered facts largely offer more specific examples of the general conduct already alleged in the SAC. None of these additional allegations would change the fundamental contours of the SAC, which does not support that the Uber entities had a legally cognizable duty to protect the Jane Does from the third parties perpetrating the fake Uber scheme. Therefore, the trial court acted well within its discretion in denying leave to amend.

26

DISPOSITION

The judgment is affirmed. The parties shall bear their own costs on appeal.

CERTIFIED FOR PUBLICATION.

ROTHSCHILD, P. J.

We concur:

CHANEY, J.

BENDIX, J.

27