Plaintiffs' third amended complaint alleges that Defendant Facebook, Inc. violated its contractual obligations by tracking logged-out Facebook users on third-party websites. Facebook now moves to dismiss for the third time. Facebook's motion will be granted.

*918 I. BACKGROUND

In this putative class action, Plaintiffs allege that Facebook improperly tracked the web browsing activity of logged-out Facebook users on third-party websites. 1 Third Am. Compl. ("TAC"), Dkt. No. 157. Plaintiffs previously asserted a variety of common law claims and claims for violations of federal and state statutes. After two rounds of motions to dismiss, this Court dismissed the majority of Plaintiffs' claims with prejudice for lack of standing and for failure to state a claim. Order Granting Def.'s Mot. to Dismiss ("MTD Order"), Dkt. No. 148. This Court granted leave to amend only as to Plaintiffs' claims for breach of contract and breach of the duty of good faith and fair dealing. Id. Plaintiffs timely filed their third amended complaint. Facebook now moves to dismiss under Fed. R. Civ. P. 12(b)(6) and 15(c). Def.'s Mot. to Dismiss ("MTD"), Dkt. No. 162.

II. LEGAL STANDARD

A motion to dismiss under Fed. R. Civ. P. 12(b)(6) tests the legal sufficiency of claims alleged in the complaint. Parks Sch. of Bus., Inc. v. Symington , 51 F.3d 1480 , 1484 (9th Cir. 1995). Dismissal "is proper only where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory." Navarro v. Block , 250 F.3d 729 , 732 (9th Cir. 2001). The complaint "must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.' " Ashcroft v. Iqbal , 556 U.S. 662 , 678, 129 S.Ct. 1937 , 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544 , 570, 127 S.Ct. 1955 , 167 L.Ed.2d 929 (2007) ).

III. DISCUSSION

Plaintiffs' TAC asserts causes of action for (1) breach of contract (TAC ¶¶ 139-48) and (2) breach of the duty of good faith and fair dealing (TAC ¶¶ 149-61). Plaintiffs also seek to enlarge the scope of the proposed class.

A. Breach of Contract

Plaintiffs allege that each of them entered into a contract with Facebook that consisted of (1) Facebook's Statement of Rights and Responsibilities ("SRR"), (2) Facebook's Privacy Policy, and (3) relevant pages from Facebook's Help Center. TAC ¶ 140. According to Plaintiffs, Facebook promised in the contract that it would not track the web browsing activity of logged-out Facebook users on third-party websites. Id. ¶ 142. Plaintiffs allege that Facebook broke that promise by collecting data about logged-out users' browsing activity and using cookies to connect that activity to users' identities. Id.

To state a claim for breach of contract, Plaintiffs must allege that (1) they entered into a contract with Facebook, (2) Plaintiffs performed or were excused from performance under the contract, (3) Facebook breached the contract, and (4) Plaintiffs suffered damages from the breach. Oasis W. Realty, LLC. v. Goldman , 51 Cal.4th 811 , 821, 124 Cal.Rptr.3d 256 , 250 P.3d 1115 (2011) (citing Reichert v. General Ins. Co. , 68 Cal.2d 822 , 830, 69 Cal.Rptr. 321 , 442 P.2d 377 (1968) ). "In an action for breach of a written contract, a plaintiff must allege the specific provisions in the contract creating the obligation the defendant is said to have breached."

*919 Woods v. Google Inc. , No. 05:11-cv-1263-JF, 2011 WL 3501403 , at *3 (N.D. Cal. Aug. 10, 2011).

The parties agree that the SRR constitutes a contract. MTD 8; Pls.' Opp'n to Def.'s Mot. to Dismiss ("Opp'n"), Dkt. No. 163. However, the SRR itself does not contain a promise to not track logged-out users. Rather, Plaintiffs argue that the operative contract is a combination of provisions from Facebook's SRR, Facebook's Privacy Policy, 2 and Facebook's Help Center pages. 3

i. The Data Use Policy was not incorporated by reference into the Statement of Rights and Responsibilities.

Plaintiffs cite the following language from Facebook's Data Use Policy (dated September 7, 2011):

TAC ¶ 60 (emphasis added). Plaintiffs argue that this language "implicitly promises to the average user that Facebook will not receive [a user-identifying] cookie when the user is not logged in." Id.

Plaintiffs argue that this version of the Data Use Policy is part of the contract because it was incorporated by reference into the SRR. Opp'n 4-5. Under California law, for the terms of another document to be incorporated by reference into an executed document, "the reference must be (1) clear and unequivocal, the (2) reference must be called to the attention of the other party and he must consent thereto, and (3) the terms of the incorporated document must be known or easily available to the contracting parties." Woods , 2011 WL 3501403 , at *3 (quoting Troyk v. Farmers Grp., Inc. , 171 Cal.App.4th 1305 , 1331, 90 Cal.Rptr.3d 589 (2009) ).

Here, Plaintiffs argue that the Privacy Policy was incorporated by reference into the SRR because of the following language in the SRR:

TAC ¶¶ 24, 57. 4 According to Plaintiffs, this language means that the Privacy Policy is incorporated by reference into the SRR because the "SRR expressly refers to the Privacy Policy, says that the Policy is important, links to that Policy and tells users to read it to make important decisions about their privacy." Opp'n 5.

Plaintiffs' complaint cites four versions of Facebook's SRR, dated April 22, 2010 *920 (TAC Ex. A), August 25, 2010 (TAC Ex. B), October 4, 2010 (TAC Ex. C), and April 26, 2011 (TAC Ex. D). TAC ¶¶ 19-20. The excerpt quoted above appears in all four versions of the SRR.

As discussed above, Plaintiffs argue that Facebook's Data Use Policy promised that Facebook would not track logged-out users. However, the version of the Data Use Policy that contains this language was not published until September 7, 2011-more than four months after the latest version of the SRR (dated April 26, 2011) that Plaintiffs attach to their complaint. See TAC Ex. D (attaching the April 26, 2011, version of the SRR), Ex. H (attaching the September 7, 2011, version of the Data Use Policy). Earlier versions of the Privacy Policy did not contain the language that Plaintiffs allege constitutes a promise not to track logged-out users. Compare id. Ex. H (attaching the September 7, 2011, version of the Data Use Policy, which states that Facebook "receive[s] data whenever you visit a ... site with a Facebook feature (such as a social plugin) .... [including], if you are logged in to Facebook , your User ID") (emphasis added), with id. Ex. E (attaching the April 22, 2010, version of the Privacy Policy), Ex. F (attaching the October 5, 2010, version of the Privacy Policy), and Ex. G (attaching the December 22, 2010, version of the Privacy Policy).

As Facebook points out, the SRR does not use the term "Data Use Policy" and does not contain any other references to the Data Use Policy. MTD 11-12. Nor could it, since the Data Use Policy Plaintiffs cite and rely on did not exist until several months after Facebook published the most recent version of its SRR that Plaintiffs attach to their complaint. Plaintiffs do not address this deficiency in their opposition brief. Compare MTD 11-12 (noting that the Data Use Policy "was active starting on September 7, 2011," and that the policy "was not incorporated into any of the SRR versions attached to the TAC, and was therefore not a part of the contract"), with Opp'n 4-5 (arguing that the SRR "expressly refers to the Privacy Policy," but offering no response to Facebook's point that the Data Use Policy was not operative at the time the cited SRR was published). In addition, Plaintiffs do not allege that earlier versions of the Privacy Policy contained similar promises to not track logged-out users. 5

As such, the Court finds that the Data Use Policy was not incorporated by reference into the SRR because the SRR did not "clearly and unequivocally" reference it. See Troyk , 171 Cal.App.4th at 1331 , 90 Cal.Rptr.3d 589 .

ii. The relevant Help Center pages were not incorporated by reference into the Statement of Rights and Responsibilities.

Plaintiffs also argue that various Help Center pages were incorporated by reference into the SRR. Opp'n 5-8. Facebook notes, and Plaintiffs do not dispute, *921 that the SRR contains no direct references to any Help Center pages. See MTD 8-9 ("the SRR does not reference-or even hint at-a single one of the Help Center pages Plaintiffs quote from"); Opp'n 6 ("the Help Center pages are the third link in the contractual chain.... the Privacy Policy linked to the Help Center pages and directed users to them"). Rather, Plaintiffs' theory is that certain Help Center pages were incorporated by reference into the Privacy Policy, and that the Privacy Policy was in turn incorporated into the SRR. Opp'n 7 ("the SRR incorporates the Privacy Policy, and, in turn, the Help Center pages"); TAC ¶¶ 61 ("The Help Center pages are incorporated by reference into the Privacy Policy and are a part of the contract."), 135 (stating that two questions common to all members of the proposed class are "whether the SRR incorporates by reference the Privacy Policy" and "whether the Privacy Policy incorporates by reference the Help Center pages").

Even if the Court assumes that the Privacy Policy was incorporated into the SRR, Plaintiffs' argument fails because the Help Center pages were not incorporated into the Privacy Policy. In the TAC, Plaintiffs cite several Help Center pages that, according to Plaintiffs, contained promises not to track logged-out users. See TAC ¶¶ 62-67. Some Help Center pages contain explicit promises to that effect-for instance, one page states: "When you log out of Facebook, we remove the cookies that identify your particular account." Id. ¶ 62, Ex. I. However, none of those Help Center are referenced in the Privacy Policy. The Privacy Policy does not link to them, mention them, or otherwise reference them directly.

Instead, Plaintiffs appear to argue that the individual Help Center pages are subparts of a single "broader document." Opp'n 5-6 ("a mainstay of Internet contract law teaches that customers are often contractually bound to individual provisions ... even when the hyperlink only links to the broader document"). This argument finds little factual support. The Help Center pages exist independently at different URLs, as underscored by the fact that Plaintiffs attached Help Center pages as separate exhibits to their TAC. See TAC ¶¶ 62-67 (citing, in order, TAC Exs. I, J, M, L, MM, NN, OO, PP, R, S). No evidence suggests that a Facebook user who reads one Help Center page has also read, or is even aware of, any of the others.

Plaintiffs also argue that the Help Center in its entirety is incorporated into the Privacy Policy because the Privacy Policy links to some of its pages. Opp'n 6 ("Here, the TAC demonstrates clearly how that the Help Center generally (not just specific pages) are incorporated into the SRR.... [T]he Privacy Policy linked to the Help Center pages and directed users to them, without exclusion.") (emphasis added). Plaintiffs' argument that the Privacy Policy "directed" users to Help Center pages "without exclusion" is at odds with TAC, which alleges that the Privacy Policy linked to some Help Center pages, but not to the Help Center pages containing Facebook's promises to not track logged-out users. TAC ¶¶ 62-67. This relationship is too attenuated to support Plaintiffs' position that the entire Help Center is incorporated into the Privacy Policy. See Woods , 2011 WL 3501403 , at *3-4 (finding that pages within Google's Help Center were not incorporated by reference into another document, even when that document contained direct hyperlinks to the Help Center pages at issue).

As such, the Court finds that the Help Center pages cited in the TAC were not incorporated into the Privacy Policy because they were not "known or easily available to the contracting parties." Id.

*922 (quoting Troyk , 171 Cal.App.4th at 1331 , 90 Cal.Rptr.3d 589 ).

B. Breach of the Duty of Good Faith and Fair Dealing

As Plaintiffs note, a claim for a violation of the duty of good faith and fair dealing must rest "upon the existence of some specific contractual obligation." Opp'n 15 (quoting Avidity Partners, LLC v. State , 221 Cal.App.4th 1180 , 1204, 165 Cal.Rptr.3d 299 (2013) ); see also Rosenfeld v. JPMorgan Chase Bank, N.A. , 732 F.Supp.2d 952 , 968 (N.D. Cal. 2010) ("[T]he implied covenant of good faith and fair dealing 'cannot impose substantive duties or limits on the contracting parties beyond those incorporated in the specific terms of their agreement.' ") (quoting Agosta v. Astor , 120 Cal.App.4th 596 , 607, 15 Cal.Rptr.3d 565 (2004) ).

As discussed in the previous section, Plaintiffs have not identified contractual provisions that prohibited Facebook from tracking logged-out users in the manner Plaintiffs allege. Plaintiffs' claim for breach of the duty of good faith and fair dealing must therefore be dismissed.

C. Expanded Class Period

Plaintiffs' second amended complaint alleged a class period that began on May 27, 2010, and ended on September 26, 2011. Second Am. Compl. ("SAC") ¶ 172, Dkt. No. 93. In the order granting Facebook's motion to dismiss Plaintiff's SAC, this Court dismissed the majority of Plaintiffs' claims without leave to amend. MTD Order 14. This Court granted leave to amend only as to Plaintiffs' claims for breach of contract and breach of the duty of good faith and fair dealing, and only "[b]ecause Plaintiffs [did] not identif[y] the specific contractual provisions they allege were breached." Id. at 13-14.

In their TAC, Plaintiffs allege a new class period that begins on April 22, 2010, and ends on "a later date to be determined upon the completion of discovery." TAC ¶ 132. This expanded class definition exceeds the scope of leave to amend that the Court granted in its order dismissing Plaintiffs' SAC. Fed. R. Civ. P. 15(a)(2) provides that "a party may amend its pleading only with the opposing party's written consent or the court's leave." Plaintiffs did not obtain Facebook's consent or this Court's leave to expand its class allegations. Accordingly, Plaintiffs' expanded class allegations are stricken.

D. Leave to Amend

Courts "should freely give leave [to amend] when justice so requires." Fed. R. Civ. P. 15(a)(2) ; In re Korean Air Lines Co., Ltd. , 642 F.3d 685 , 701 (9th Cir. 2011). Absent a showing of prejudice, delay, bad faith, or futility, there is a strong presumption in favor of granting leave to amend. Eminence Capital, LLC v. Aspeon, Inc. , 316 F.3d 1048 , 1052 (9th Cir. 2003).

However, courts can dismiss without leave to amend in the event of a plaintiff's "repeated failure to cure deficiencies by amendments previously allowed." Foman v. Davis , 371 U.S. 178 , 182, 83 S.Ct. 227 , 9 L.Ed.2d 222 (1962) ; see also Abagninin v. AMVAC Chem. Corp. , 545 F.3d 733 , 742 (9th Cir. 2008) ("Leave to amend may also be denied for repeated failure to cure deficiencies by previous amendment."); Zucco Partners, LLC v. Digimarc Corp. , 552 F.3d 981 , 1007 (9th Cir. 2009), as amended (Feb. 10, 2009) ("where the plaintiff has previously been granted leave to amend and has subsequently failed to add the requisite particularity to its claims, '[t]he district court's discretion to deny leave to amend is particularly broad' ") (quoting In re Vantive Corp. Sec. Litig. , 283 F.3d 1079 , 1097-98 (9th Cir. 2002) ).

Here, the Court previously allowed Plaintiffs to amend their claims for *923 breach of contract and breach of the duty of good faith and fair dealing. Since Plaintiffs' amendments did not cure the defects the Court identified, Plaintiffs' claims will be dismissed without leave to amend.

IV. CONCLUSION

Facebook's motion to dismiss is GRANTED. The Clerk shall close this file.

IT IS SO ORDERED.

For a more detailed discussion of Plaintiffs' factual allegations, see this Court's orders granting Facebook's motion to dismiss Plaintiffs' first amended complaint (Dkt. No. 87 at 2-6) and Facebook's motion to dismiss Plaintiffs' second amended complaint (Dkt. No. 148 at 1-3).

During the alleged class period, Facebook changed the title of this document from "Privacy Policy" to "Data Use Policy." Opp'n 4 n.4. As discussed below, Facebook also changed the substance of the document. In this order, unless otherwise indicated, the term "Privacy Policy" refers to both the Privacy Policy and the Data Use Policy.

Plaintiffs' statement of their cause of action for breach of contract does not identify the specific contractual language that Facebook allegedly breached. TAC ¶¶ 139-48. However, Plaintiffs identify specific contractual language in their brief in opposition to Facebook's motion to dismiss. Opp'n 4 (citing factual allegations in the TAC at ¶¶ 24, 57, 60, and 62-67).

Plaintiffs' opposition brief quotes additional language from the SRR that is not cited in the TAC:

During the hearing on Facebook's motion on November 16, 2017, Plaintiffs' counsel argued that the September 7, 2011, Data Use Policy is incorporated into the April 26, 2011, SRR because Facebook's users continuously agree to the SRR each time they use or access Facebook. Plaintiffs base this argument on the following statement from the SRR: "By using or accessing Facebook, you agree to this Statement." TAC Ex. D. Under this theory, Plaintiffs argue that they agreed to the SRR on or after September 7, 2011, which means that the Data Use Policy would have been incorporated into the contract between the parties as of that date. This argument fails for two reasons: first, the TAC does not identify the dates that Plaintiffs "used or accessed" Facebook; and second, Plaintiffs have not alleged that the April 26, 2011, version of the SRR remained in effect as of September 7, 2011.