Filed 4/2/24 (unmodified opn. attached)

CERTIFIED FOR PUBLICATION

IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA

SIXTH APPELLATE DISTRICT

STEVE WOZNIAK et al., H050042 (Santa Clara County Plaintiffs and Appellants, Super. Ct. No. 20CV370338)

v. ORDER MODIFYING OPINION,

DENYING PETITION FOR

YOUTUBE, LLC, et al., REHEARING;

NO CHANGE IN JUDGMENT

Defendants and Respondents.

BY THE COURT:

It is ordered that the opinion filed herein on March 15, 2024, be modified as follows: On page 1, the second full paragraph shall now read: “Plaintiffs are Steve Wozniak—whose name and likeness were used in the fake videos—and 17 individuals who fell victim to the scam and lost varying amounts of cryptocurrency. They sued YouTube and Google (defendants), asserting nine causes of action alleging that defendants have been knowingly hosting, promoting, and profiting from the scam for years.” On page 17, the first full paragraph shall now read: “The allegations in the SAC do not support that characterization, though. Plaintiffs have not alleged that the mere hijacking of channels, without more, caused them harm. Nor have they alleged that defendants owed them a duty to prevent the hijacking of channels, regardless of whether any harmful content follows.” On page 17, the last full paragraph shall now read: “Lastly, we recognize that the individual plaintiffs in this action do not make identical allegations. For instance, only the bitcoin plaintiffs allege they were scammed into transferring their cryptocurrency, and only Wozniak alleges that his name and likeness were misappropriated, thereby causing reputational damage. However, the allegations in the negligence cause of action do not distinguish between Wozniak and the bitcoin plaintiffs. Nor have plaintiffs argued in their briefs that any individual plaintiffs made different allegations in support of their negligent security claim.”

There is no change in the judgment. The petition for rehearing is denied.

2 ___________________________________ Wilson, J.

WE CONCUR:

__________________________________________ Danner, Acting P.J.

______________________________________ Bromberg, J.

Wozniak et al. v. Youtube, LLC et al.

H050042

Filed 3/15/24 (unmodified opinion)

CERTIFIED FOR PUBLICATION

IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA

SIXTH APPELLATE DISTRICT

STEVE WOZNIAK et al., H050042 (Santa Clara County Plaintiffs and Appellants, Super. Ct. No. 20CV370338)

v.

YOUTUBE, LLC et al.,

Defendants and Respondents.

This lawsuit stems from a common cryptocurrency scam perpetrated on YouTube: popular channels are hijacked to show fake videos depicting a tech celebrity hosting a live event, during which anyone who sends cryptocurrency to a specified account will receive twice as much in return. Users who send their cryptocurrency in response actually receive nothing in return. Plaintiffs are Steve Wozniak—whose YouTube channel was among those hijacked—and 17 individuals who fell victim to the scam and lost varying amounts of cryptocurrency. They sued YouTube and Google (defendants), asserting nine causes of action alleging that defendants have been knowingly hosting, promoting, and profiting from the scam for years. The trial court sustained defendants’ demurrer on the ground that plaintiffs’ claims are barred by the Communications Decency Act of 1996, 47 U.S.C. § 230 (section 230), which generally provides immunity to interactive computer services that a plaintiff seeks to treat as a publisher or speaker of information provided by another content provider. On appeal, plaintiffs argue their claims are not subject to section 230 immunity because they do not seek to treat defendants as a publisher or speaker of third-party content, but instead seek to hold them liable for engaging in actions they knew would further criminal activity, thereby materially contributing to its illegality. We hold that most of plaintiffs’ claims seek to treat defendants as a publisher or speaker of third-party content and are therefore precluded by section 230. However, we also conclude that one of plaintiffs’ claims—that defendants created their own content and materially contributed to the unlawfulness of the scam by providing verification badges to hijacked YouTube channels—includes allegations which potentially could fall outside the scope of section 230 immunity. As currently pleaded, though, we are unable to conclude that those allegations save any of plaintiffs’ causes of action. Nevertheless, because there is a reasonable possibility plaintiffs could cure the defects, we also conclude the trial court abused its discretion in not granting leave to amend the claims related to verification badges. Accordingly, we reverse and remand for further proceedings.

I. FACTUAL AND PROCEDURAL BACKGROUND1

A. YouTube cryptocurrency scams YouTube, LLC (YouTube) is a video-sharing service that enables its users to view, post, and comment on video content hosted on its platform.2 Users can create their own YouTube channels, thereby making it easy for other users to find a creator’s content in one place and be notified when new content is uploaded. The most popular YouTube channels have millions of subscribers. 1 “We derive our facts from those properly pleaded in the complaint and matters properly judicially noticed. [Citations.] We take as true properly pleaded material facts alleged in the pleadings, disregarding contentions, deductions, and conclusions of fact or law. [Citation.]” (County of Santa Clara v. Superior Court (2023) 87 Cal.App.5th 347, 355, fn. 2.) 2 YouTube is a wholly owned and controlled subsidiary of defendant Google, LLC (Google).

2 User-personalized video recommendations appear when a user first opens the YouTube website or mobile app, and then automatically play after a video ends. YouTube utilizes an algorithm that recommends videos to users based on their personal information and data that YouTube and Google have collected, including clicks, watch time, likes and dislikes, comments, and upload frequency. According to plaintiffs, YouTube’s lax security practices over the years have led to a steady stream of security breaches through which popular YouTube channels are hijacked and taken over by criminals who then use the channels to perpetrate a scam that has defrauded YouTube users of millions of dollars. YouTube has not only knowingly allowed the security breaches and scams, it has also affirmatively promoted and profited from them. The scam generally operates as follows. First, scammers will breach YouTube’s security to unlawfully gain access to verified and popular YouTube channels with tens or hundreds of thousands of subscribers. The scammers then transfer ownership or control of the channel to themselves or a co-conspirator, rename the channel to impersonate tech celebrities or companies, and delete the channel’s pre-existing content. Next, they upload and play scam videos they have created using pre-existing images and videos of famous tech entrepreneurs such as plaintiff Wozniak, Bill Gates or Elon Musk speaking at a cryptocurrency or technology conference, which is intended to deceive YouTube users into believing that the celebrity is hosting a live “bitcoin giveaway” event.3 Plaintiffs allege that Wozniak, who co-founded Apple Computer in the 1970s, is a “Silicon Valley icon,” who has “engaged in many entrepreneurial and philanthropic ventures” and is a “widely known, recognized, and beloved public figure.”

3 “Bitcoin is among the world’s most well-known digital currencies….” (Archer v. Coinbase, Inc. (2020) 53 Cal.App.5th 266, 269.) “A digital currency (also known as ‘cryptocurrency’) is a type of currency maintained by a decentralized network of participants’ computers, rather than a centralized government or organization.” (Ibid.)

3 The scam video is surrounded with images and text stating that, for a limited time, anyone who sends bitcoin to a specified account, via a QR code included in the video, will receive twice as much in return. The images and text often include trademarks, such as the Apple logo, and a link to a fraudulent web address that incorporates the particular tech entrepreneur’s name. However, after the users transfer their cryptocurrency in an irreversible transaction, they receive nothing in return and the scam is complete. The scam has existed on YouTube since at least October 2018 and has been replicated many times in substantially the same form. In the process, millions of people have viewed the scam videos, resulting in the loss of millions of dollars of bitcoin and other cryptocurrencies. Specific to this lawsuit, unnamed third parties have perpetrated the scam since at least May 8, 2020, using Wozniak’s name and likeness and thereby stealing hundreds of thousands of dollars worth of bitcoin and similar cryptocurrencies from the 17 other named plaintiffs. The scam has continued through the date plaintiffs filed the initial complaint in this action. According to plaintiffs, defendants have known about the scam, yet have allowed it to continue. In many instances, YouTube knew specific channels had been hijacked but failed to remove or suspend the pre-existing verification badges appearing on those channels. In at least one instance, YouTube issued a verification badge to a channel while it was perpetrating the scam. YouTube has allowed the scam to continue, despite its own stated policies that it does not allow scams or other deceptive practices that take advantage of the YouTube community. Defendants have both the human and technological capabilities to implement reasonable security measures that would prevent hijacking of popular channels and quickly detect and remove scam videos. Despite having the means to stop or limit the proliferation of the scam, defendants have declined to do so. According to plaintiffs, beyond merely allowing it to continue, defendants have actively promoted and profited from the scam. For instance, YouTube has promoted the

4 scam videos in plaintiffs’ and other users’ home page video recommendations, in their “up-next” videos which often begin playing automatically upon the conclusion of the previous video, and in the list of recommended videos shown while one video is playing. YouTube’s algorithm targets the scam videos directly at plaintiffs because the personal information and data that defendants have collected about them—such as clicks, watch time, likes and dislikes, comments, upload frequency, emails sent and received, saved photos and videos, documents and spreadsheets created, YouTube video comments, and other behavior through their apps, browsers, and devices—indicated they were interested in cryptocurrency. YouTube also issues verification badges to certify to its users that a verified channel has been vetted and is trustworthy. According to plaintiffs, in issuing a verification badge, YouTube is communicating that an account is “the official channel of a creator, artist, company or public figure” and therefore can be trusted. YouTube has maintained verification badges on channels it knew had been hijacked. Plaintiffs allege YouTube has also negligently designed its video metrics and other public-facing features of its platform to permit the scammers to falsely represent that large numbers of viewers have “liked” and viewed the videos when they have not. The scammers use bots and other tools to falsely inflate the number of likes, views, and those currently watching, to make the videos appear authentic and more legitimate. Similarly, YouTube enables the scammers to falsely represent that an event is live when it is not. Lastly, defendants sold the scammers paid advertising space that targeted users based on their browsing history and other personal information defendants have collected and analyzed, which indicates an interest in cryptocurrency. According to plaintiffs, despite knowing about the cryptocurrency scams, defendants have continued to sell scammers “all the targeted scam ads that they are willing to buy,” and have delivered those ads directly to plaintiffs and other users likely to be interested in the scam video

5 content. YouTube has continued selling these targeted advertisements to the scammers, notwithstanding its own stated polices that it verifies the identity of its advertisers. B. Initial complaints and first demurrer Plaintiffs filed the initial complaint in this action in San Mateo County Superior Court on July 21, 2020, naming YouTube and Google as defendants.4 The matter was transferred to Santa Clara County Superior Court, which issued an order deeming the case complex and staying all discovery. On February 16, 2021, plaintiffs filed the first amended complaint (FAC). The FAC alleged causes of action for misappropriation of likeness—brought by Wozniak only—fraud and misrepresentation, aiding and abetting fraud, unfair business practices, negligence, negligent failure to warn, and injunctive relief. Defendants filed a demurrer to the FAC on April 5, 2021. They argued that plaintiffs’ claims are precluded by section 230, which was enacted to protect websites against liability for the failure to remove offensive content. According to defendants, plaintiffs were not contending that YouTube actually perpetrated the scam or created any of its content; instead, they sought to hold YouTube liable for not acting more aggressively to monitor, block and remove the material the third parties posted, or for providing neutral tools to its users that the third parties used to perpetrate the scam. Under section 230, they argued, lawsuits “ ‘ “seeking to hold a service provider liable for its exercise of a publisher’s traditional editorial functions—such as deciding whether to publish, withdraw, postpone or alter content—are barred,” ’ ” citing Murphy v. Twitter (2021) 60 Cal.App.5th 12, 26 (Murphy). 4 Plaintiffs include Wozniak, and the following individuals who claim to have been harmed by the cryptocurrency scam on YouTube: Alex Naray, James Denitto, Bernardo Garcia, Alexander Geisler, Asa Jacques, Zhenyu Li, Jin Liu, Anthony Martinez, Harivarmah Nagalinggam, Paul Newman, Myrielle Philistin, Dario Lopez Portilla, Eric Restrepo, Raul Moreño Romero, David Schrader, Luke Thomas and Lung Hung Yang. In this opinion, the term “plaintiffs” refers to all 18 plaintiffs; we refer to the non- Wozniak plaintiffs as the “bitcoin plaintiffs” where necessary to distinguish.

6 They also argued that, even apart from section 230 immunity, plaintiffs had failed to state a viable cause of action. According to defendants, the law does not recognize a theory of secondary liability for misappropriation of likeness and there is no plausible allegation that YouTube itself actually used Wozniak’s likeness. In addition, they argued, plaintiffs cannot establish that YouTube owed them a special duty of care because they did not allege YouTube itself engaged in the allegedly unlawful conduct necessary for each claim. The trial court sustained the demurrer on section 230 immunity grounds but granted plaintiffs leave to amend. C. Discovery stay Prior to filing their second amended complaint, plaintiffs moved to lift the discovery stay. They argued that the critical factual dispute in the case is the extent of defendants’ involvement in creating and contributing to the scam videos and advertisements driving the scams. According to plaintiffs, they were entitled to obtain critical facts in defendants’ sole possession to more fully support their allegations, and “[p]laintiffs’ inability to do so in this case has and continues to severely prejudice their ability to have their grievance fairly and fully heard by the Superior Court.” Defendants opposed the motion, arguing that section 230 provides broad immunity that warrants staying discovery. They contended that courts have consistently stayed discovery when defendants have brought a case-dispositive section 230 defense, and that plaintiffs have not cited any authority involving a section 230 case where a discovery stay has been lifted to allow a party “to conduct intrusive discovery in the face of a broad immunity that the court has already held bars the claims at issue.” The trial court denied plaintiffs’ motion. It relied on the “significant public interest” in section 230 to protect websites from ultimate liability and from having to fight costly and protracted legal battles, and on the importance of resolving immunity questions at the earliest possible stage in litigation to avoid unnecessary discovery and

7 other burdens. The court noted that “federal courts routinely stay discovery in cases apparently subject to Section 230 until the complaint is deemed adequate to avoid [section 230] immunity.” According to the court, plaintiffs’ “vague contentions” that discovery is necessary fail to explain sufficiently “what sort of facts they believe discovery would reveal that would change the section 230 analysis….” The court added that plaintiffs “might be able to do that in the future, but haven’t done that yet.” D. Second amended complaint, demurrer, and motion to lift discovery stay Plaintiffs filed the operative second amended complaint on September 9, 2021 (SAC). The SAC sets forth the allegations summarized above in the factual background, and asserts nine causes of action: (1) misappropriation of likeness, brought by Wozniak only; (2) fraud and misrepresentation; (3) aiding and abetting fraud; (4) unfair business practices; (5) negligence; (6) negligent design; (7) negligent failure to warn; (8) breach of implied contract; and (9) promissory estoppel. At the same time they filed the SAC, plaintiffs submitted a renewed motion to lift the discovery stay. They restated their previous arguments that they were entitled to discovery on their initial causes of action, and argued they were also entitled to discovery on their new theories of liability because they did not implicate section 230 immunity. According to plaintiffs, those new theories included: (1) negligent security resulting in the regular hijacking of YouTube channels; (2) negligent design of YouTube video metrics, channel information, and security features; (3) wrongful disclosure of plaintiffs’ personal information to scammers, including information indicating plaintiffs’ interest in cryptocurrency; (4) promissory estoppel arising from defendants’ promises about providing excellent security, scam protection, accurate video metrics and channel information, and responsible use of its users’ personal information; and (5) negligent failure to warn plaintiffs about each of the foregoing. Plaintiffs contended that section 230 does not apply to those claims because they do not seek to impose liability on

8 defendants for their conduct as a publisher or speaker, so the discovery stay should be lifted. Defendants demurred to the SAC as well, presenting the same general arguments set forth in the initial demurrer, including as to the new causes of action. Defendants also opposed the renewed motion to lift the discovery stay on the same grounds. E. Trial court ruling The trial court sustained the demurrer to the SAC and denied the renewed motion to lift the discovery stay. It first addressed plaintiffs’ allegations, re-stated from the FAC, that defendants had materially contributed to the illegal scam by actively promoting the videos, selling targeted ads, falsely verifying the channels, and providing false and misleading information to promote the videos. The court held that these actions constituted “neutral tools” and, under existing precedent, plaintiffs cannot plead around section 230 immunity by framing such neutral website features as content. “In sum,” the court stated, “all of Plaintiffs’ claims seek to hold Defendants liable as the publisher of content created by others, and not for Defendants’ own content that ‘contributes materially to the alleged illegality of’ the scams at issue here.” The court then addressed the new facts and theories alleged in the SAC, specifically security- or design-related claims and contract-related causes of action. With respect to the former, the court concluded that the theories of liability still depend on third-party content, without which no liability could exist. With respect to the latter, the court held that, while styled as claims for breach of contract and negligent misrepresentation, in reality they treat defendants as publishers and seek to hold them liable for third-party conduct, thereby coming within the scope of section 230 immunity. The court did not address defendants’ alternative arguments that, independent of section 230, the causes of action failed to state sufficient claims for relief. The court sustained the demurrer without leave to amend because plaintiffs had not explained how they could amend the SAC to avoid section 230 immunity, and the

9 court could not discern any such reasonable possibility. The order was entered on January 26, 2022. A judgment of dismissal (judgment) was entered on May 4, 2022. Plaintiffs timely appealed.

II. DISCUSSION

Plaintiffs argue on appeal that (1) section 230 does not apply to the conduct alleged in this case, which seeks to hold defendants liable for choosing to engage in actions they knew would further entirely criminal activity, and (2) the trial court abused its discretion in imposing a blanket stay of all discovery and repeatedly refusing to lift the stay. Defendants argue that (1) plaintiffs’ claims seek to impose liability for harm caused by third-party videos hosted on YouTube, which section 230 precludes; (2) even if section 230 does not apply, plaintiffs have still failed to state viable claims because they improperly attempt to impose vicarious liability for harms caused by unrelated third parties; and (3) the trial court properly exercised its discretion in imposing limits on discovery. We address these arguments in turn below. A. Section 230 immunity 1. Applicable law and standard of review “When reviewing a ruling on a demurrer, we examine de novo whether the complaint alleges facts sufficient to state a cause of action.” (Liapes v. Facebook (2023) 95 Cal.App.5th 910, 919 (Liapes), citing Regents of University of California v. Superior Court (2013) 220 Cal.App.4th 549, 558 (Regents).) “ ‘We assume the truth of the properly pleaded factual allegations, [and] facts that reasonably can be inferred from those expressly pleaded.’ [Citation.] But we do not assume the truth of ‘contentions, deductions, or conclusions of law.’ ” (Liapes, supra, at p. 919, quoting Stearn v. County of San Bernardino (2009) 170 Cal.App.4th 434, 440.)

10 “We liberally construe the complaint ‘with a view to substantial justice between the parties,’ drawing ‘all reasonable inferences in favor of the asserted claims.’ ” (Liapes, supra, 95 Cal.App.5th at p. 919, quoting Regents, supra, 220 Cal.App.4th at p. 558.) “The plaintiff must demonstrate the court erroneously sustained the demurrer and ‘must show the complaint alleges facts sufficient to establish every element of each cause of action.’ ” (Liapes, supra, at p. 919, quoting Rakestraw v. California Physicians’ Service (2000) 81 Cal.App.4th 39, 43.) When a demurrer is sustained without leave to amend, “we decide whether there is a reasonable possibility that the defect can be cured by amendment: if it can be, the trial court has abused its discretion and we reverse; if not, there has been no abuse of discretion and we affirm. [Citations.] The burden of proving such reasonable possibility is squarely on the plaintiff.” (Blank v. Kirwan (1985) 39 Cal.3d 311, 318 (Blank).) In the context of a demurrer on section 230 grounds, “when a plaintiff cannot allege enough facts to overcome Section 230 immunity, a plaintiff’s claims should be dismissed.” (Dyroff v. Ultimate Software Group, Inc. (9th Cir. 2019) 934 F.3d 1093, 1097 (Dyroff).)5 Section 230 “ ‘immunizes providers of interactive computer services against liability arising from content created by third parties.’ ” (Liapes, supra, 95 Cal.App.5th at p. 928, quoting Fair Housing Council of San Fernando Valley v. Roommates.com, LLC (9th Cir. 2008) 521 F.3d 1157, 1162, fn. omitted (Roommates).) “Congress enacted section 230 ‘for two basic policy reasons: to promote the free exchange of information and ideas over the internet and to encourage voluntary monitoring for offensive and

5 Although federal precedents interpreting section 230 are not binding upon this court, “where the decisions of the federal courts on a federal question are ‘ “ ‘both numerous and consistent,’ ” ’ we should hesitate to reject their authority [citation].” (Doe II v. MySpace, Inc. (2009) 175 Cal.App.4th 561, 571, quoting Barrett v. Rosenthal (2006) 40 Cal.4th 33, 58 (Barrett); Etcheverry v. Tri–Ag Service, Inc. (2000) 22 Cal.4th 316, 320–321 [“While we are not bound by decisions of the lower federal courts, even on federal questions, they are persuasive and entitled to great weight.”].)

11 obscene material.’ ” (Hassell v. Bird (2018) 5 Cal.5th 522, 534 (Hassell), quoting Carafano v. Metrosplash.com, Inc. (9th Cir. 2003) 339 F.3d 1119, 1122.) Section 230, subdivision (c)(1) states: “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” Section 230, subdivision (e)(3) provides: “No cause of action may be brought, and no liability may be imposed under any State or local law that is inconsistent with this section.” An “interactive computer service” is defined in the statute as “any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions.” (§ 230, subd. (f)(2).) The statute also defines “information content provider” as “any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.” (§ 230, subd. (f)(3).) Read together, these two provisions “ ‘protect from liability (1) a provider or user of an interactive computer service (2) whom a plaintiff seeks to treat, under a state law cause of action, as a publisher or speaker (3) of information provided by another information content provider.’ ” (Murphy, supra, 60 Cal.App.5th at p. 24, quoting Barnes v. Yahoo!, Inc. (9th Cir. 2009) 570 F.3d 1096, 1100–1101, fn. omitted (Barnes).)6 The California Supreme Court has explained that these provisions “convey[] an intent to shield Internet intermediaries from the burdens associated with defending against state law claims that treat them as the publisher or speaker of third party content.” (Hassell, supra, 5 Cal.5th at p. 544; see also Barrett, supra, 40 Cal.4th 33, 39 [section 230, subdivisions (c)(1) and (e)(3) “have been widely and consistently interpreted to

6 The parties agree that YouTube is an interactive computer service—accordingly, our discussion below focuses only on the second and third elements.

12 confer broad immunity against defamation liability for those who use the Internet to publish information that originated from another source”].) “Accordingly, section 230 protects an interactive computer service provider’s curation of content on its platform from ‘ “ ‘claims that would place a computer service provider in a publisher’s role. Thus, lawsuits seeking to hold a service provider liable for its exercise of a publisher’s traditional editorial functions—such as deciding whether to publish, withdraw, postpone or alter content—are barred.’ ” ’ (Prager University v. Google, LLC (2022) 85 Cal.App.5th 1022, 1032 (Prager), quoting Barrett, supra, 40 Cal.4th at p. 43.) Notwithstanding that broad construction of section 230, “an interactive computer service provider only has immunity if it is not also the information content provider — that is, someone ‘responsible, in whole or in part, for the creation or development’ of the content at issue.” (Liapes, supra, 95 Cal.App.5th at p. 928, citing § 230, subd. (f)(3), Roommates, supra, 521 F.3d at p. 1162.) “Passively displaying content ‘created entirely by third parties’ renders the operator only a service provider ‘with respect to that content.’ (Roommates, at p. 1162.) ‘But as to content that it creates itself, or is “responsible, in whole or in part” for creating or developing, the website is also a content provider.’ [Citation.] ‘Thus, a website may be immune from liability for some of the content it displays to the public but be subject to liability for other content.’ ” (Liapes, supra, 95 Cal.App.5th at p. 928.) A website creates or develops content “by making a material contribution to [its] creation or development.” (Kimzey v. Yelp, Inc. (9th Cir. 2016) 836 F.3d 1263, 1269 (Kimzey).) A “material contribution” does not refer to “merely . . . augmenting the content generally, but to materially contributing to its alleged unlawfulness.” (Roommates, supra, 521 F.3d at pp. 1167-1168.)

13 2. Analysis In their briefs on appeal, plaintiffs group their claims into six general categories, rather than addressing each of the nine causes of action individually. Our discussion below tracks those six categories. a. Negligent security claim Plaintiffs characterize their “negligent security claim” as an allegation that defendants “failed to implement reasonable security measures to protect verified and popular YouTube channels from being regularly hijacked and transformed to broadcast the scam videos.” Plaintiffs contend this claim does not treat defendants as the publisher or speaker of third-party content, and section 230 does not immunize failures to secure software from intrusion. They argue that the negligent-security claim is “not concerned with whether YouTube engaged in traditional editorial functions immunized by Section 230, such as blocking or removing user content.” Instead, they argue, the claim is concerned with the failure to employ reasonable security measures to protect channels from hijacking. Applying the standards summarized above, we conclude plaintiffs’ negligent security claim is subject to section 230 immunity because it seeks to treat defendants as a publisher and speaker of information provided by another information content provider. (Murphy, supra, 60 Cal.App.5th at p. 24.) In their briefs, plaintiffs do not identify which causes of action include their “negligent security” claim, and there is no claim in the SAC with that label. Instead, plaintiffs cite various allegations from the SAC which are found within the “negligence” cause of action. We construe this as a concession that the other causes of action do not purport to allege liability for these “security-related” claims, and we limit our analysis here to the negligence cause of action. In the negligence cause of action, plaintiffs allege, among other things, that: defendants had knowledge of all relevant aspects of the scam before plaintiffs were harmed by it; defendants owed plaintiffs a duty to use reasonable care to prevent harm to

14 others, including to prevent or mitigate the foreseeable risk that plaintiffs and other users would be victimized by the scam; defendants breached that duty by failing to implement reasonable security protocols to prevent or shut down the scam on their platforms; and, plaintiffs were harmed by those breaches. Ultimately, this claim seeks to hold YouTube liable for allowing the scam videos to be shown on the hijacked channels. YouTube’s actions allowing the scam videos to be shown on hijacked channels amount to a publishing decision not to prevent or alter the videos—that is, “ ‘deciding whether to exclude material that third parties seek to post online.’ ” (Murphy, supra, 60 Cal.App.5th at p. 24, quoting Roommates, supra, 521 F.3d at pp. 1170-1171.) Plaintiffs insist their claim is not concerned with whether YouTube engaged in traditional editorial functions such as blocking or removing user content; instead, they allege defendants failed to implement “common-sense security measures to prevent rampant hijacking and unfettered repurposing of YouTube channels and the resulting harm to users, including Plaintiffs.” In other words, they argue their claim is content-neutral because it is not predicated on the harmful content that flowed from the security failures. Plaintiffs rely solely on a recent case from the northern district of California—In re Zoom Video Communications Inc. Privacy Litigation (N.D. Cal. 2021) 525 F.Supp.3d 1017 (In re Zoom). In that case, the plaintiffs were Zoom users who alleged that Zoom had made harmful misrepresentations and failed to secure Zoom meetings from intruders known as “Zoombombers.” (Id. at p. 1023.) The plaintiffs argued that they sought to hold Zoom accountable not for its actions as a content provider, publisher or speaker, but rather for its failure to provide promised security and privacy. (Id. at p. 1030.) Zoom moved to dismiss, arguing that section 230 immunized them from all such claims. (Ibid.) The court analyzed section 230’s text, legislative history and case law, and explained that the immunity does not apply to claims that are either (1) content neutral, or (2) do not derive from the defendant’s status or conduct as a publisher or speaker. (Id. at

15 p. 1032, citing HomeAway.com v. City of Santa Monica (9th Cir. 2019) 918 F.3d 676, 680 [section 230, subdivision (c)(1) immunity does not apply to content-neutral liability); Nunes v. Twitter (N.D. Cal. 2016) 194 F.Supp.3d 959, 968 [where statute imposes liability regardless of content, section 230, subdivision (c)(1) immunity does not apply]; Barnes, supra, 570 F.3d at p. 1107 [section 230, subdivision (c)(1) did not preclude plaintiff’s contract-based liability claims, where contract generated legal duty distinct from Yahoo’s status as publisher].) Under that framework, the court held that the bulk of the plaintiffs’ claims were immunized by section 230, because they challenged the harmfulness of specific content provided by the third party Zoombombers and alleged Zoom should have done more to moderate or block that content. (In re Zoom, supra, 525 F.Supp.3d at p. 1035.) However, the plaintiffs’ contract-based claims were not subject to section 230 immunity because they did not derive from Zoom’s status or conduct as a publisher or speaker. (Ibid.) The court also denied the motion to dismiss the plaintiffs’ claims “to the extent they are content-neutral.” (Ibid.) We agree with the general proposition described in Zoom that section 230 immunity may not apply when a plaintiff alleges harm resulting solely from a security failure or statutory violation, independent of any harmful third-party content resulting from the violation. (In re Zoom, supra, 525 F.Supp.3d at p. 1032.) However, that is not what plaintiffs alleged here. As we have explained, the negligence cause of action is predicated on YouTube allowing the scam videos to be shown on the hijacked channels. Plaintiffs argue that “[w]hile the content of the scam videos were [sic] themselves also undoubtedly harmful to Plaintiffs, that is separate and distinct from the harm caused by Defendants in failing to remedy known security flaws that Defendants knew criminals were actively exploiting to harm YouTube’s users.” In other words, plaintiffs seek to characterize their claim as alleging both that (1) the security failure itself caused harm, and (2) the resulting bitcoin scam caused further independent harm.

16 The allegations in the SAC do not support that characterization, though. Plaintiffs have not alleged that the mere hijacking of Wozniak’s and other users’ channels, without more, caused them harm. Nor have they alleged that defendants owed them a duty to prevent the hijacking of Wozniak’s or other users’ channels, regardless of whether any harmful content follows. The negligence cause of action does include an allegation that defendants owed plaintiffs a duty to take reasonable steps “to design, maintain, implement, monitor, test, and comply with reliable security systems, protocols, and practices to ensure that its website, including YOUTUBE channels, were adequately secured from unauthorized access.” Yet, even liberally construing the SAC, we do not read that as an allegation that defendants owed plaintiffs such a duty independent of any resulting harmful content. At bottom, the negligence cause of action and the SAC as a whole demonstrate that plaintiffs’ security-based claim is predicated on the harmful content of the scam videos, without which there would likely be no lawsuit. (See, e.g., Murphy, supra, 60 Cal.App.5th at p. 30, fn. 6 [gravamen of each cause of action “concern[ed] Twitter’s editorial decisions not to publish content—as reflected by the fact that [plaintiff] alleges no specific injury from the alleged notice and retroactivity violations but complains instead of the harm caused by Twitter’s ban on her and others’ free speech rights”].) Lastly, we recognize that the individual plaintiffs in this action do not make identical allegations. For instance, only the bitcoin plaintiffs allege they were scammed into transferring their cryptocurrency, and only Wozniak alleges that his YouTube channel was hijacked, thereby causing reputational damage. However, the allegations in the negligence cause of action do not distinguish between Wozniak and the bitcoin plaintiffs. Nor have plaintiffs argued in their briefs that any individual plaintiffs made different allegations in support of their negligent security claim.

17 b. Negligent design claim Plaintiffs’ characterization of their negligent design claim is similar to that of their negligent security claim. They argue that the duty defendants violated springs from their distinct capacity as product designers rather than as publishers or speakers, and that plaintiffs allege design flaws that do not derive from the content of third-party videos or posts. For the same reasons set forth above regarding the negligent-security claim, we conclude this claim seeks to treat defendants as a publisher and speaker of information provided by another information content provider. (Murphy, supra, 60 Cal.App.5th at p. 24.) In support of their arguments, plaintiffs cite allegations in their negligence and negligent design causes of action. The negligent design claim makes similar allegations as the negligence claim. For instance, it alleges that YouTube negligently designed its security protocols and video metrics such as likes, dislikes, views, “currently watching” count, livestream indicator, and verification badges. As a result, YouTube’s platform is “easily exploitable by bad actors” and “allow[s] scammers free reign to modify hijacked channels to perpetrate the scam—all while assuring its users these issues do not exist.” They further allege that those video and channel metrics “did not perform as safely as an ordinary consumer would have expected them to perform when used in an intended or reasonably foreseeable way, such as occurred when Plaintiffs used YOUTUBE to watch videos and were scammed out of cryptocurrency due in significant part to the false and misleading video metrics and other information displayed about the scam videos, and which were a significant factor and cause in Plaintiffs believing the scam videos were legitimate and in transferring their cryptocurrency to the scammers.” Ultimately, this claim seeks to hold YouTube liable for allowing the scam videos to be shown on the hijacked channels and is predicated on that third-party content. YouTube’s actions amount to a publishing decision not to prevent or alter the videos— that is, “ ‘deciding whether to exclude material that third parties seek to post online.’ ”

18 (Murphy, supra, 60 Cal.App.5th at p. 24, quoting Roommates, supra, 521 F.3d at pp. 1170-1171.) Plaintiffs rely on Lemmon v. Snap, Inc. (9th Cir. 2021) 995 F.3d 1085 (Lemmon). In that case, a 20-year-old man and two 17-year-old boys died after driving their car over 100 miles per hour and crashing into a tree. (Id. at p. 1089.) Shortly before the crash, one of the boys had opened the Snapchat application on his smartphone to document how fast they were driving. (Ibid.) The boys’ parents sued Snap, the social media provider that owns the Snapchat application, alleging it encouraged their sons to drive at dangerous speed and thus caused their death through the negligent design of its application. (Id. at p. 1090-1091.) Specifically, they alleged that the application uses a “speed filter”—which allows users to record and share their real-life speed—and a reward system with trophies and social recognitions, combining to create an incentive for users to reach 100 miles per hour and document it on the application. (Id. at p. 1089.) The court held that the negligent design claim was not barred by section 230. The parents’ claim rested on the premise that manufacturers have a duty to exercise due care in supplying products that do not present an unreasonable risk of injury or harm to the public. (Lemmon, supra, 995 F.3d at p. 1091-1092.) As the court explained, “[t]he duty underlying such a claim differs markedly from the duties of publishers as defined in the CDA. Manufacturers have a specific duty to refrain from designing a product that poses an unreasonable risk of injury or harm to consumers. [Citation.] Meanwhile, entities acting solely as publishers—i.e., those that ‘review[ ] material submitted for publication, perhaps edit[ ] it for style or technical fluency, and then decide[ ] whether to publish it,’ [citation]—generally have no similar duty.” (Id. at p. 1092.) The duty that Snap allegedly violated “ ‘springs from’ its distinct capacity as a product designer,” as “evidenced by the fact that Snap could have satisfied its ‘alleged obligation’… without altering the content that Snapchat’s users generate.” (Id. at p. 1092, quoting Barnes, supra, 570 F.3d at p. 1107.)

19 We find the case distinct for the same general reasons set forth above with respect to In re Zoom. While the negligent design claim in Snap was not predicated on any third- party content—indeed, the alleged harm flowed directly and solely from the negligent design and occurred without any third-party content—the same is not true here. Instead, the negligent design claim and the SAC as a whole are predicated on the scam videos, without which there would likely be no lawsuit. While a plaintiff may avoid application of section 230 immunity by alleging a negligent design claim that is independent of third- party content, that is not what plaintiffs alleged in the SAC here. c. Negligent failure to warn claim Plaintiffs argue that their negligent failure to warn cause of action is not immunized by section 230. According to plaintiffs, section 230 does not apply because (1) they allege defendants knew about the scam without having to monitor any third-party content, and (2) there is no exception to the duty of care defendants owed plaintiffs. With respect to the first of those arguments, plaintiffs rely on Doe v. Internet Brands, Inc. (9th Cir. 2016) 824 F.3d 846. In that case, two men used a networking website for models to lure women to fake photo shoots, where they drugged and raped them. (Id. at pp. 848-849.) The plaintiff, one of the victimized women, sued the website for negligent failure to warn, alleging it knew of the ongoing scheme but breached its duty to warn her and other users. (Ibid.) The Ninth Circuit held that section 230 did not bar the plaintiff’s claim because she did not seek to hold the defendant liable as a publisher or speaker of any third-party content. (Id. at p. 851.) Instead, she sought to hold it liable for failing to warn about information it had obtained from an outside source about the scheme. (Ibid.) Again, we find the case inapposite. Here, plaintiffs’ claim is predicated on the third-party content, of which they assert defendants had a duty to warn. Plaintiffs thus seek to impose liability on defendants resulting from the third-party information they publish on their platform. In Internet Brands, by contrast, the alleged duty to warn

20 existed independent of any third-party content on the defendant’s platform. The plaintiff there alleged a duty to warn of the possibility of being drugged and raped at a fake photo shoot—in so doing, she was not treating the defendant as a publisher or speaker of third- party information. With respect to plaintiffs’ second argument, they contend defendants owed them a tort duty to warn pursuant to the basic principle in Civil Code section 1714, subdivision (a) that “[e]veryone is responsible, not only for the result of his or her willful acts, but also for an injury occasioned to another by his or her want of ordinary care or skill in the management of his or her property or person,” and that no exception exists. However, section 230 is an exception. (Prager, supra, 85 Cal.App.5th at p. 1043 [“Section 230(c)(1) and (e)(3) reflect the unambiguous exercise of Congress’s constitutional power to preempt state laws”].) It provides immunity from certain causes of action that seek to treat defendants as a publisher or speaker of information provided by another information content provider. (Murphy, supra, 60 Cal.App.5th at p. 24.) Plaintiffs’ argument would allow essentially every state cause of action otherwise immunized by section 230 to be pleaded as a failure to warn of such information published by a defendant. That construction of the law runs counter to the authority we have summarized above.

d. Claims based on knowingly selling and delivering scam ads and scam video recommendations to vulnerable users Plaintiffs argue section 230 does not immunize from claims that defendants (1) knowingly sold and delivered scam advertisements, or (2) recommended scam videos to vulnerable users. Plaintiffs’ theory is that defendants are “knowingly selling criminals the ads necessary to fuel their criminal activity, and the ads are being purchased with the proceeds of their criminal activity,” constituting “financial entanglement” that falls outside the scope of section 230 immunity. In addition, they are “recommending scam

21 videos or other activity involving algorithms to knowingly help criminals target vulnerable users.” Plaintiffs characterize these as independent theories of liability “underlying most of [their] claims.” They specifically cite allegations in the SAC found in the negligence, negligent failure to warn, and breach of implied contract causes of action. First, we address plaintiffs’ arguments regarding the sale of advertisements. As with their previous claims, this, too, is ultimately predicated on the third-party content of the scam videos. Plaintiffs do not object to the mere act of defendants selling advertisements to third parties. Instead, they object to the content of the advertisements themselves, which promote the scam. For instance, in the negligence cause of action, they allege that defendants breached their duties by, among other things, “selling ads for, and otherwise promoting, materially contributing to, and profiting from the scam.” There is no allegation that selling advertisements, by itself and independent of their content, constituted the breach. Nor is there any allegation that defendants themselves created the advertisements or any of their content. Instead, the claims treat defendants as the publisher of those advertisements. (Murphy, supra, 60 Cal.App.5th at p. 24.) Plaintiffs argue that defendants’ “financial entanglement” and “revenue sharing” with the third-party criminals takes them outside the scope of section 230 immunity. They rely on a recent case from the Ninth Circuit Court of Appeals—Gonzalez v. Google, LLC (9th Cir. 2021) 2 F.4th 871 (Gonzalez), reversed on other grounds by Twitter, Inc. v. Taamneh (2023) 598 U.S. 471. In Gonzalez, the plaintiffs were the families of victims of attacks by the terror group ISIS. They sued Google, Twitter and Facebook, alleging that the social media platforms allowed ISIS to post videos and other content to communicate their message, radicalize new recruits, and further its mission. (Gonzalez, supra, 2 F.4th at p. 880.) They also claimed that Google placed paid advertisements in proximity to ISIS-created content and shared the resulting ad revenue with ISIS. (Ibid.) Accordingly, they alleged, the defendants were directly liable for committing acts of international

22 terrorism pursuant to the Anti-Terrorism Act, 18 U.S.C. § 2333, and secondarily liable for conspiring with, and aiding and abetting, acts of international terrorism. (Ibid.) The Ninth Circuit held that the plaintiffs’ revenue-sharing theory was distinct from the other theories of liability, as it was “not directed to the publication of third-party information,” but instead was “premised on Google providing ISIS with material support by giving ISIS money.” (Gonzalez, supra, 2 F.4th at 898.) The court explained that the revenue-sharing theory did not depend on “the particular content ISIS places on YouTube; this theory is solely directed to Google’s unlawful payments of money to ISIS.” (Ibid.) For that reason, section 230 immunity did not apply to the revenue-sharing claims. (Id. at pp. 898-99.) We find the case distinct. Here, plaintiffs do not allege that defendants gave money directly to the third-party scammers. There is no allegation of wrongdoing that is not dependent on the content of the third-party information. While plaintiffs allege that defendants knowingly profited from the advertisements and the associated criminal scheme, Gonzalez did not hold that profiting from third-party advertisements is beyond the scope of section 230 immunity. Instead, it distinguished between activity that depended on the particular content placed on YouTube, and activity that did not, such as directly providing material support to ISIS by giving them money. Plaintiffs’ second theory is that section 230 does not immunize from claims that defendants are “recommending scam videos or other activity involving algorithms to knowingly help criminals target vulnerable users.” They argue courts have interpreted Gonzalez as holding that the products of purportedly neutral website algorithms—such as targeted ads and recommendations—are outside the bounds of Section 230 “if the site owner is alleged to have knowingly assisted wrongdoers who harness those algorithms to inflict harm.” They rely on a case from the southern district of New York—National Coalition on Black Civic Participation v. Wohl (S.D.N.Y., Sept. 17, 2021, 20 Civ. 8668 (VM)) 2021 U.S. Dist. Lexis 177589* (Wohl). In Wohl, the defendants allegedly sent

23 robocalls containing false information intended to prevent recipients from voting, in violation of the Voting Rights Act of 1965 and Ku Klux Klan Act of 1870. The court held that section 230 immunity did not apply because the defendants had acted as more than a passive publisher or neutral intermediary. Rather than merely transmitting robocall messages, the defendants allegedly had discussed the content or purpose of the messages, maintained a database of phone numbers that could be targeted for a robocall campaign, and directed the messages to specific communities and zip codes selected by certain defendants, “to maximize the threatening effects the robocall would have on Black voters in New York and other large metropolitan areas.” (Id. at p. 8.) The court acknowledged that “the use of neutral algorithms does not constitute content development.” (Wohl, supra, 2021 U.S. Dist. Lexis 177589* at p. 9.) However, it held that the claims at issue were not based on the mere provision or use of content- neutral tools in a neutral manner. (Ibid.) Instead, they alleged the defendants actively and specifically aided the illegal behavior, including by curating a list of target zip codes. (Ibid.) We do not find the case analogous. Here, plaintiffs have not alleged that defendants undertook any similar acts to actively and specifically aid the illegal behavior. Instead, they allege only that YouTube’s neutral algorithm results in recommending the scam videos to certain targeted users. For instance, the SAC alleges that “YouTube’s state-of-the-art algorithm tailors its recommended videos to its users based on a variety of personal information and data that YOUTUBE and GOOGLE collect about their users, including ‘clicks, watch time, likes/dislikes, comments, freshness, and upload frequency.’ ” There is no allegation that YouTube has done anything more than develop and use a content-neutral algorithm. Courts have consistently held that such neutral tools do not take an interactive computer service outside the scope of section 230 immunity. In Dyroff, for instance, the plaintiff was the family of a man who had died after using fentanyl-laced heroin, which

24 he had acquired following communications on defendant’s online messaging board. (Dyroff, supra, 934 F.3d at p. 1094.) The plaintiff contended the messaging board created content because it “used features and functions, including algorithms, to analyze user posts ... and recommend other user groups.” (Id. at p. 1098.) The Ninth Circuit rejected the argument, holding that “[t]hese functions—recommendations and notifications—[were] tools meant to facilitate the communication and content of others,” and were “not content in and of themselves.” (Ibid.) The online message board employed neutral tools similar to the ones challenged by plaintiffs here, and there is no allegation that the algorithms treat the scam content differently than any other third-party content. (Ibid.; see also, Gonzalez, supra, 2 F.4th at p. 896 [“a website’s use of content-neutral algorithms, without more, does not expose it to liability for content posted by a third-party”]; Roommates, supra, 521 F.3d at p. 1171 [website not transformed into content creator by virtue of supplying neutral tools that deliver content in response to user inputs]; cf. Liapes, supra, 95 Cal.App.5th at p. 929 [Facebook’s tools were not neutral—rather than merely proliferate and disseminate content as a publisher, they created, shaped, and developed content by requiring users to provide information used to contribute to discriminatory unlawfulness].)

e. Claims based on wrongful disclosure and misuse of plaintiffs’ personal information Plaintiffs argue that defendants failed to take reasonable measures to protect their personal information from being disclosed to and exploited by scammers. In support of their arguments, plaintiffs cite allegations in their negligence, unfair business practices, breach of implied contract, and promissory estoppel causes of action. With respect to their breach of implied contract, negligence and unfair business practices causes of action, plaintiffs argue only that, “for reasons similar to those above,” they do not seek to hold defendants liable as the publisher or speaker of third-party content, but rather “for their failure to take reasonable measures to ensure they are not

25 selling targeted scam ads and making recommendations that weaponize Plaintiffs’ [personal information] against them.” For support, they rely again on In re Zoom. For the same reasons set forth above in the sections discussing plaintiffs’ negligence-based claims, we conclude these claims also seek to treat defendants as a publisher and speaker of information provided by another information content provider because they are ultimately predicated on YouTube allowing the scam videos to be shown on the hijacked channels. (Murphy, supra, 60 Cal.App.5th at p. 24.)7 With respect to their promissory estoppel cause of action, plaintiffs argue that it is based on defendants’ “public and widely publicized promises about providing excellent security, protecting against scams, ensuring the accuracy of video metrics and other video and channel information, and using Plaintiffs’ personal non-public information and data in a responsible way.” According to plaintiffs, their “quasi-contractual claims are based on breaches of duties and promises that have nothing to do with content moderation, such as implied duties and promises to protect Plaintiffs from known security flaws and to protect Plaintiffs’ [personal information] from misuse and wrongful disclosure.” Plaintiffs rely chiefly on the Ninth Circuit Court of Appeals’ decision in Barnes for support. In that case, the plaintiff sued Yahoo after her ex-boyfriend posted unauthorized false profiles of her on its website. (Barnes, supra, 570 F.3d at pp. 1098– 1099.) In response to her demand that Yahoo remove the profiles, Yahoo’s director of communications called her and told her he would “ ‘personally walk the statements over to the division responsible for stopping unauthorized profiles and they would take care of

7 Plaintiffs cite to the allegations in their breach of implied contract cause of action, but offer no argument in support beyond their reference to “reasons similar to those above.” To the extent their argument regarding that cause of action is any different than for their negligence and UCL causes of action, they have failed to support it with reasoned argument and we consider it forfeited. (Badie v. Bank of America (1998) 67 Cal.App.4th 779, 784-785 [“When an appellant fails to raise a point, or asserts it but fails to support it with reasoned argument and citations to authority, we treat the point as waived”].)

26 it.’ ” (Id. at pp. 1098–1099.) After Yahoo still failed to remove the content, Barnes sued, alleging negligence and promissory estoppel. (Id.) The Ninth Circuit drew a distinction between the two types of claims. The negligence claim was barred by section 230 because “the duty that Barnes claims Yahoo violated derives from Yahoo’s conduct as a publisher—the steps it allegedly took, but later supposedly abandoned, to de-publish the offensive profiles.” (Barnes, supra, 570 F.3d at p. 1103.) By contrast, the promissory estoppel claim was not barred because “the duty the defendant allegedly violated springs from a contract—an enforceable promise— not from any non-contractual conduct or capacity of the defendant. [Citation.] Barnes does not seek to hold Yahoo liable as a publisher or speaker of third-party content, but rather as the counter-party to a contract, as a promisor who has breached.” (Id. at p. 1107.) Several courts have recently considered the extent to which section 230 bars certain contract-based claims. In Murphy, the First District Court of Appeal noted that Barnes “never suggested… that all contract or promissory estoppel claims survive CDA immunity.” (Murphy, supra, 60 Cal.App.5th at p. 29.) Instead, Barnes had explained that, “as a matter of contract law, the promise must ‘be as clear and well defined as a promise that could serve as an offer, or that otherwise might be sufficient to give rise to a traditional contract supported by consideration,” and that “a general monitoring policy ... does not suffice for contract liability.’ ” (Ibid., quoting Barnes, supra, 570 F.3d at p. 1108.) For that reason, the court held that the plaintiff’s allegations at issue—that Twitter “ ‘enforced its Hateful Conduct Policy in a discriminatory and targeted manner’ ” by removing her tweets and suspending her account—amounted to attacks on Twitter’s “interpretation and enforcement of its own general policies rather than breach of a specific promise.” (Murphy, supra, 60 Cal.App.5th at app. 29-30.) Similarly, in Prager, a different panel of this court acknowledged that section 230 does not necessarily foreclose contractual claims where the defendant “has agreed to limit

27 its exercise of editorial discretion according to bargained-for terms and conditions.” (Prager, supra, 85 Cal.App.5th at p. 1035, citing Murphy, supra, 60 Cal.App.5th at pp. 28-30.) Nevertheless, the court rejected the plaintiff’s various theories of liability that were predicated on the defendants’ terms of service, finding each of them deficient “as a matter of either law or pleading.” (Ibid.) Defendants’ alleged promises here are closer to those in Murphy— more akin to general policies or statements—than those in Barnes—personalized and constituting a clear, well-defined offer. As noted above, plaintiffs rely on defendants’ “public and widely publicized promises.” For instance, they cite allegations that Google states on its website: “When people use our products, they trust us with their information, and it’s our job to do right by them. This means always being thoughtful about what data we use, how we use it, and how we protect it.” Similarly, they allege that Google states it uses “the world’s most advanced security,” and “[t]o keep every Google product and service [which includes youtube.com] secure for our users, we engineer and employ one of the most advanced security infrastructures in the world. This means constantly strengthening our built-in security technologies to detect and protect against evolving online threats, before they ever reach our users.” We view these statements as general policies made by defendants in their capacity as publisher, rather than as specific promises. (Murphy, supra, 60 Cal.App.5th at app. 29-30.). As such, plaintiffs’ claim for promissory estoppel does not survive section 230 immunity.

f. Claims based on defendants’ creation or development of information materially contributing to scam ads and videos Plaintiffs argue defendants were also active content providers that materially contributed to the alleged illegality of the third-party conduct and therefore fall outside the scope of section 230 immunity. Specifically, they argue that, with respect to the

28 scam, defendants are information content providers under section 230 because they materially contributed to the scam’s illegality by creating scam videos and paid advertising; falsely representing that the scam videos were “live” and that large numbers of users were watching or had “liked” the videos; recommending videos and selling advertisements to lead vulnerable users directly to the scam; and falsely displaying “verification badges,” thereby communicating that the scam videos represented the real individual or entity it claimed to be “and therefore can be trusted.” As summarized above, “an interactive computer service provider only has immunity if it is not also the information content provider — that is, someone ‘responsible, in whole or in part, for the creation or development’ of the content at issue.” (Liapes, supra, 95 Cal.App.5th at p. 928.) A website may qualify as an information content provider and lose immunity under section 230 “by making a material contribution to creation or development” of illegal content. (Kimzey, supra, 836 F.3d at p. 1269.) A “material contribution” to illegal content refers to “materially contributing to its alleged unlawfulness.” (Roommates, supra, 521 F.3d at pp. 1167-1168.) We address plaintiffs’ arguments in turn. First, plaintiffs argue on appeal that defendants are information content providers with respect to the scam because they created scam videos and paid advertisements. While such behavior theoretically could make defendants information content providers under section 230, the SAC does not actually allege that defendants created scam videos or advertisements. Instead, it alleges that the third-party scammers created the videos and the advertisements, and defendants allowed them to be published on their platforms: “Defendants materially contributed to them by promoting the videos to a specific audience identified through its algorithm, by selling targeted ads driving traffic to the videos, by falsely verifying YOUTUBE channels that carry the videos….” Second, the SAC similarly does not allege that defendants falsely represented that the scam videos were live and that large numbers of users were watching and liked the

29 videos. Instead, it alleges that defendants “negligently designed video metrics and other public-facing features of its platform that permit the scammers to falsely represent that the scam videos are ‘live’ when they are not, that large numbers of users who are ‘currently watching’ live scam videos when they are not, that a large number of users have ‘viewed’ the videos when they have not, that large numbers of users have ‘liked’ the videos when they have not, and other similarly false or misleading statements of fact that cause the scam videos and promotions to appear authentic.” (Emphasis added.) In other words, plaintiffs allege that the scammers created that information, not defendants. Third, defendants’ recommendation of videos and sale of advertisements does not make them information content providers because those recommendations did not materially contribute to the illegality of the content underlying the scam. A “material contribution” does not merely refer to “augmenting the content generally, but to materially contributing to its alleged unlawfulness.” (Roommates, supra, 521 F.3d at pp. 1167–68 (emphasis added). “This test ‘draw[s] the line at the “crucial distinction between, on the one hand, taking actions” to display ‘actionable content and, on the other hand, responsibility for what makes the displayed content [itself] illegal or actionable.’ ” (Kimzey, supra, 836 F.3d at p. 1269, fn.4 (internal quotation marks omitted) (quoting Jones v. Dirty World Entertainment Recordings LLC (6th Cir. 2014) 755 F.3d 398, 413– 14). Here, recommending videos and selling advertisements may display and augment the illegal content, but it does not contribute to what makes it illegal. (See, e.g., Dyroff, supra, 934 F.3d at p. 1099 [“The recommendation and notification functions helped facilitate this user-to-user communication, but it did not materially contribute, as Plaintiff argues, to the alleged unlawfulness of the content.”].) Lastly, plaintiffs argue that defendants acted as information content providers in displaying verification badges which falsely identified hijacked channels as vetted and trustworthy. As explained below, we conclude that, while the SAC alleges defendants created the verification badges and materially contributed to the development of the

30 unlawful scam, the allegations are too conclusory to involve them in the creation or development of that content and make them information content providers under section 230. However, because there is a reasonable possibility that this defect could be cured by amendment, plaintiffs must be given leave to amend those particular claims.

i. Responsibility for creation or development of information In certain circumstances, a website operator may be deemed responsible for creating or developing information, in whole or in part, under section 230. (§ 230, subd. (f)(3).) A website operator is not deemed responsible for information merely because it compiled information voluntarily supplied by users. In Gentry v. eBay, Inc. (2002) 99 Cal.App.4th 816, the plaintiffs sued eBay, a website operator, after purchasing sports memorabilia on eBay that proved to be fake. They alleged eBay had violated Civil Code section 1739.7, which requires memorabilia dealers to provide certificates of authenticity to purchasers. (Id. at p. 826.) The court of appeal held that section 230 barred the claims because eBay merely published content provided by third parties who had falsely identified the items as authentic. (Id. at pp. 828-833.) The court concluded eBay was not responsible for that content, based on a declaration from eBay and other documents of which the trial court had taken judicial notice demonstrating how eBay’s website works. (Id. at pp. 831-832.) Because of that information, and concessions made by the plaintiffs, the court held that “the substance of appellants’ allegations reveal [sic] they ultimately seek to hold eBay responsible for … eBay’s dissemination of representations made by the [third parties], or the posting of compilations of information generated by those defendants and other third parties.” (Gentry, 99 Cal.App.4th at p. 831.) Similarly, the court found that eBay was not responsible for the information in its ratings and “Power Sellers” designations for sellers

31 because those ratings and designations reflected “information provided by third party consumers and dealers.” (Id. at p. 834.) By contrast, in certain instances where website operators either create their own information or require users to supply information specified by the website, courts have held the operators responsible. (See Roommates, supra, 521 F.3d 1157; § 230, subd. (f)(3) [treating any person “responsible, in whole or in part, for the creation or development of information” as an “information content provider”].) In Roommates, a roommate-matching website required users to state their gender, sexual orientation, and familial status, and indicate whether they were willing to live with persons of various genders, sexual orientations, and familial status. (Id. at p. 1161.) It then posted this information on the users’ profile pages and used it to determine which postings to show other users. (Id. at pp. 1161–1162, 1165.) Because the website itself required users to provide this information, the Ninth Circuit held the operator was partially responsible for the creation or development of the information, even though the specifics were supplied by third parties. (Id. at pp. 1165-1167.) As the court explained, a website operator “can be both a service provider and a content provider: If it passively displays content that is created entirely by third parties, then it is only a service provider with respect to that content. But as to content that it creates itself, or is ‘responsible, in whole or in part’ for creating or developing, the website is also a content provider.” (Roommates, supra, 521 F.3d at pp. 1162-1163.) The court first held that “Roommate’s own acts—posting the questionnaire and requiring answers to it—are entirely its doing and thus section 230 of the CDA does not apply to them. Roommate is entitled to no immunity.” (Roommates, supra, 521 F.3d at p. 1165.) Further, with respect to the information ultimately provided by the users, the fact that they are “information content providers does not preclude Roommate from also being an information content provider by helping ‘develop’ at least ‘in part’ the information in the profiles.” (Ibid.) Thus, in sharp contrast to websites that merely

32 provide “neutral tools” based on “voluntary inputs,” the court observed, “Roommate’s website is designed to force subscribers to divulge protected characteristics and discriminatory preferences.” (Id. at p. 1172.) Similarly, in Liapes, the First District Court of Appeal held that Facebook was responsible under section 230 for information used in advertisements on its website because the company required users to disclose that information. Much like the website in Roommates, Facebook required users to supply information to describe their age and gender. (Liapes, supra, 95 Cal.App.5th at p. 929.) It also required advertisers to select age and gender parameters, which were used, along with other parameters, to target ads. (Ibid.) Analogizing to Roommates, the court concluded that Facebook’s ad-delivery tools did not “merely proliferate and disseminate content as a publisher”; they created, shaped, or developed that content. (Id. at p. 929, quoting Roommates, supra, 521 F.3d at pp. 1167-1168.) In sum, existing precedent holds that where a website operator either creates its own content or requires users to provide information and then disseminates it, thereby materially contributing to the development of the unlawful information, it may be considered responsible for that information, and thus be an “information content provider.” (§ 230, subd. (f)(3).) The SAC here includes allegations potentially fitting within this category. For instance, it alleges that “YOUTUBE has continued to maintain the verification of channels that have been hijacked to broadcast BITCOIN GIVEAWAY scam videos and, in at least one instance, even issued a verification badge to a channel at the very time it was actively broadcasting scam videos.” It also alleges: “When YOUTUBE verifies a channel, YOUTUBE is communicating to its users that ‘it’s the official channel of a creator, artist, company, or public figure,’ and that the channel ‘represent[s] the real creator, brand, or entity it claims to be’ because YOUTUBE has ‘check[ed] different factors to help verify [the channel

33 owner’s] identity.’ YOUTUBE also verifies channels to ‘distinguish official channels from other channels with similar names.’ ” Further, “YOUTUBE’s users, including numerous Plaintiffs here, relied on YOUTUBE’s representations that the verified channels are authentic and that the verification badge means the channel’s owner is who they claim to be.” It can reasonably be inferred from these allegations that YouTube is wholly responsible for creating the information concerning the authenticity of the channel owners in the verification badges. Unlike the scam videos themselves, the third-party scammers did not create or develop the verification badges—defendants allegedly did. Nor is there any suggestion in the SAC that the verification badges contain information voluntarily provided by users and thus merely redirect or highlight third-party content. We therefore conclude the SAC adequately alleges that under section 230, YouTube is responsible for creating the information in the verification badges. ii. Material Contribution Despite these allegations, we cannot conclude that defendants are “information content providers” within the meaning of section 230 because the SAC, as currently pleaded, does not adequately allege that the information for which defendants are responsible gives rise to their asserted liability or materially contributed to the illegality of the conduct at issue. Section 230 defines “information content provider” as a person responsible, in whole or in part, for “the creation or development” of information. (§ 230, subd. (f)(3)). Cases have long interpreted “creation” and “development” to require a “material contribution” to the alleged unlawfulness of the information at issue. (Roommates, supra, 521 F.3d at p. 1167-1168 [“We believe that both the immunity for passive conduits and the exception for co-developers must be given their proper scope and to that end we interpret the term ‘development’ as referring not merely to augmenting content generally, but to materially contributing to its alleged unlawfulness.”]; see also Kimzey,

34 supra, 836 F.3d at p. 1269 [applying the material contribution requirement to “creation”].) “In other words, a website helps to develop unlawful content, and thus falls within the exception to section 230, if it contributes materially to the alleged illegality of the conduct.” (Roommates, supra, 521 F.3d at p. 1168.) The SAC asserts that the verification badges are “materially contributing to the criminally fraudulent enterprise that is the BITCOIN GIVEAWAY scam.” Yet the SAC fails to allege specific facts showing how the badges materially contributed to the illegal conduct by plaintiffs. For instance, the first cause of action for misappropriation of likeness alleges in part that “Defendants’ false or misleading statements include but are not limited to statements that … the scam videos were being aired by ‘verified’ or otherwise legitimate accounts or channels.” However, the gravamen of the misappropriation claim is that the scammers used plaintiff Wozniak’s name, likeness, and identity without his consent. The SAC does not explain how statements concerning verification of the accounts or channels materially contribute to the illegality of using that likeness without his consent. As a consequence, the verification badges provide no basis for treating defendants as the creator or developer of the content misappropriating plaintiff’s Wozniak’s likeness. It is well-settled that “ ‘conclusory allegations will not withstand demurrer.’ ” (Fox v. Ethicon Endo-Surgery, Inc. (2005) 35 Cal.4th 797, 808.) Similarly, the second cause of action for fraud alleges that “Defendants falsely represented to Plaintiffs and their other users who viewed BITCOIN GIVEAWAY scam videos on YOUTUBE’s website that… they were being broadcast by ‘verified’ or otherwise legitimate channels with large numbers of subscribers….” Further, it alleges scammers hijacked popular YouTube channels and falsely represented that the scam videos they were broadcasting were live and viewers were “liking” the videos. However, these allegations do not demonstrate that the verification badges played any significant or meaningful role in conveying false impressions concerning the source or authenticity of the videos. Indeed, only seven of the 17 bitcoin plaintiffs even allege

35 that they relied on false verification of channels.8 Moreover, it is unclear how many times defendants allegedly issued verification badges while a channel was broadcasting a scam video. Although the SAC alleges YouTube did so “in at least one instance,” plaintiffs argue on appeal that “YouTube has also awarded channels that were actively running scam videos its ‘verification badge,’ ” using the plural to suggest there were multiple instances. The SAC also does not specify whether defendants knew the channels had been hijacked, or whether the verifications were issued before or after the hijacking. Nor does it make clear which causes of action and theories of liability are predicated on the allegations regarding the verification badges. (Liapes, supra, 95 Cal.App.5th at p. 919 [to survive demurrer, plaintiff “ ‘must show the complaint alleges facts sufficient to establish every element of each cause of action’ ”].) Accordingly, the SAC fails to provide a basis for concluding that defendants materially contributed to the illegal content and should be treated as the creators or developers of that content. (Roommates, supra, 521 F.3d at p. 1174 [close cases must be resolved in favor of immunity].) 3. Leave to amend Nevertheless, the SAC’s allegations regarding verification badges are sufficient to justify granting plaintiffs leave to amend, because there is a reasonable possibility that the infirmities we have discussed can be cured by amendment. (Blank, supra, 39 Cal.3d at p. 318.) In Murphy, the court explained in a section 230 context that “ ‘[w]here the appellant offers no allegations to support the possibility of amendment and no legal authority showing the viability of new causes of action, there is no basis for finding the trial court abused its discretion when it sustained the demurrer without leave to amend.’ ” (Murphy, supra, 60 Cal.App.5th at p. 42, quoting Total Call International, Inc. v.

8 The SAC alleges that the following bitcoin plaintiffs relied on false verifications: James Denitto, Bernardo Garcia, Jin Liu, Anthony Martinez, Myrielle Philistin, Daria Lopez Portilla, and Eric Restrepo.

36 Peerless Insurance Co. (2010) 181 Cal.App.4th 161, 173.) Here, though, we conclude plaintiffs have adequately alleged that defendants are responsible for the information in the verification badges, and although the SAC fails to allege that this information materially contributed to the illegal conduct or content from third parties, we cannot conclude there is no possibility of plaintiffs amending the complaint to do so. We caution that we express no opinion regarding the viability of any claims in a subsequent amended complaint. We limit our conclusion as to the reasonable possibility of amendment solely to the allegations regarding verification badges. B. Failure to state a claim for relief Because the trial court ruled that section 230 provided immunity for all of plaintiffs’ causes of action, it did not reach defendants’ separate argument that the causes failed to state claims for relief. Defendants argue on appeal that, even if section 230 does not apply, this court should affirm on this alternative ground. Plaintiffs argue this court should instead remand to the trial court to decide the issue in the first instance. Because we reverse and remand for plaintiffs to be given leave to amend as to their allegations regarding the verification badges, we need not reach this issue. C. Discovery stay The trial court based its denial of plaintiffs’ motion to lift the discovery stay on the “significant public interest” of protecting websites from ultimate liability and from having to fight costly and protracted legal battles, and the importance of resolving immunity questions at the earliest possible stage in litigation to avoid unnecessary discovery and other burdens. The court also noted that “federal courts routinely stay discovery in cases apparently subject to Section 230 until the complaint is deemed adequate to avoid [section 230] immunity.” Those grounds have now shifted, and we remand for the trial court and the parties to consider the appropriate scope of discovery in light of our decision and subsequent developments in the trial court.

37

III. DISPOSITION

The judgment is reversed and the matter is remanded with directions to the trial court to enter a new order sustaining the demurrer with leave to amend, consistent with this opinion. In the interests of justice, the parties shall bear their own costs on appeal. (Cal. Rules of Court, rule 8.278(a)(5).)

38 ___________________________________ Wilson, J.

WE CONCUR:

__________________________________________ Danner, Acting P.J.

______________________________________ Bromberg, J.

Wozniak et al. v. Youtube, LLC et al.

H050042

Trial Court: Santa Clara County Superior Court No.: 20CV370338

Trial Judge: The Honorable Sunil R. Kulkarni

Attorneys for Plaintiffs and Appellants Joseph W. Cotchett Steve Wozniak et al.: Brian Danitz Christopher Owen Holleran Julia Qisi Peng Andrew F. Kirtley Gia Jung

Attorneys for Defendants and Respondents David H. Kramer YouTube, LLC et al.: Amit Q. Gressel Carmen Sobczak Mark R Yohalem Ariel C. Green Anaba

Wozniak et al. v. YouTube, LLC et al.

H050042