Oeste

I. BACKGROUND2

Defendant Zynga is a San Francisco, California-based developer of games for mobile devices and social networking platforms. (Compl. ¶¶ 1, 2, ECF No. 1). In order to download Zynga’s games, users must either create an account with Zynga and provide certain personally identifying information (“PII”), such as their full name, email address,

phone number, gender, and password, or link their Zynga account to their personal Facebook account. (Id. ¶ 16). Zynga routinely collects and retains users’ PII and Facebook log-in information. (Id. ¶ 17). On or before September 12, 2019, Zynga suffered a data breach that affected as many as 173 million user accounts. (Id. ¶ 21). Zynga did not notify its users of the breach

by email or through a notification on their gaming apps; rather, Zynga posted a “Player Security Announcement” to its website stating that “certain player account information may have been illegally accessed by outside hackers.” (Id. ¶ 24). Thus, “[t]he only way for a user to know that his or her PII has been unlawfully accessed is if that user were to access Zynga’s website on a web browser, or notice instances of fraud or identity theft.” (Id. ¶…