1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9

IN RE ALPHABET DERIVATIVE

10 Case No. 19-cv-06880-RS

STOCKHOLDER LITIGATION

11

ORDER GRANTING MOTION TO

12 DISMISS 13 14

15 I. INTRODUCTION 16 In this shareholder derivative action, Plaintiffs seek to hold Alphabet, Inc., and its directors 17 liable for breach of fiduciary duties and unjust enrichment predicated on the company’s alleged 18 violation of the Children’s Online Privacy Protection Act (“COPPA”). 16 C.F.R. § 312. Having 19 come up short on their initial attempt to show demand futility, Plaintiffs’ renewed effort fares no 20 better. The essential facts remain unchanged: the Board reasonably thought YouTube was 21 compliant with COPPA because the FTC had labeled it a general audience site, and YouTube had 22 no actual knowledge of any violations. The FTC’s novel interpretation of the law—that individual 23 channels within YouTube could be child-directed—does not render the board’s actions 24 unreasonable, as they had set up and exercised adequate oversight functions. While Plaintiffs point 25 to memos previously unmentioned, they do not move the Complaint across the threshold for 26 demand futility. Thus, for the reasons further set out below, Alphabet’s motion to dismiss is 27 granted and individual Defendants’ motion to dismiss is denied as moot. 1 II. BACKGROUND 2 A. YouTube’s COPPA Compliance 3 Alphabet owns YouTube, the world’s largest video-sharing service. Initially, Alphabet did 4 not believe YouTube was subject to COPPA. The statute prohibits collecting children’s data 5 without parental consent if they are under the age of 13. It applies when a website or online 6 service is “directed to children,” or there is “actual knowledge” that data is being collected from 7 children. Actual knowledge is established only when a site learns an individual user is a child 8 through the entry of a birthdate, birthyear, or current grade in school. 64 Fed. Reg. 59889–92. A 9 site that is not “child-directed” is a “general audience” site. Alphabet did not believe YouTube was 10 such a general audience site for several reasons. Most of its content was not child-directed, and its 11 terms of service prohibit children under 13 from using YouTube’s services without the permission 12 of a parent or guardian. Crucially, its belief was bolstered by the FTC referring to YouTube as a 13 general audience site in a 2013 amendment to COPPA rules. 78 Fed. Reg. 3972, 3982 n.126. In 14 2015, Google launched YouTube Kids as a child-directed mobile application intended for children 15 ages 2 to 12. 16 The FTC later began investigating YouTube’s COPPA compliance, and eventually filed a 17 complaint against Alphabet. The case was based on a novel theory whereby individual YouTube 18 channels directed towards children counted as child-directed sites within YouTube. Upon the 19 filing of the complaint, the parties settled for $170 million. The settlement did not include an 20 admission of liability. Google later released a web-based version of YouTube Kids, started 21 requiring YouTube channel owners to identify their child-directed content on the platform, and 22 limited data collection of YouTube channels aimed at children. 23 B. Previous Complaint 24 In the Verified Consolidated Amended Complaint (“the previous Complaint”), Plaintiffs 25 averred that Alphabet violated COPPA and its Board of Directors knew the company was 26 noncompliant. Plaintiffs asserted Defendants breached their fiduciary duties of care and loyalty for 27 two reasons. First, the directors failed to implement a board-level system of monitoring or 1 reporting on child safety. Second, they failed to respond in good faith to red flags, specifically the 2 FTC investigation and consumer complaints concerning alleged violations of COPPA. 3 Plaintiffs argued demand futility by averring the majority of the Board could not conduct 4 an independent and objective investigation into the purported COPPA violation because the 5 directors faced a substantial likelihood of liability for their alleged misconduct. Plaintiffs relied on 6 the fact that Defendants knew of the magnitude of child-directed content on YouTube combined 7 with the absence of COPPA compliance policies and internal controls. Plaintiffs pointed to a 8 supposed lack of Board minutes and materials discussing COPPA compliance. They emphasized 9 this was the case even after Defendants were repeatedly informed of the FTC investigation. 10 Plaintiffs accused the Audit Committee and Board of not adopting a COPPA compliance policy 11 despite their knowledge of the investigation. The alleged motivation behind the Board’s conduct 12 was to increase Alphabet’s profits. 13 C. Order Dismissing Previous Complaint 14 Defendants moved to dismiss the previous Complaint on the grounds that Plaintiffs failed 15 to plead demand futility. Alphabet’s motion was granted because Plaintiffs failed to satisfy the 16 Rales demand futility standard, as the facts provided were not sufficient to create a reasonable 17 doubt that a majority of the Board was disinterested or independent. Rales v. Blasband, 634 A.2d 18 927 (Del. 1993). Further, Plaintiffs did not show the board acted with scienter, as required by the 19 exculpatory provision in Alphabet’s charter. See Wood v. Baum, 953 A.2d 136, 141 (Del. 2008); 20 see also In re Paypal Holdings, Inc. Shareholder Derivative Litigation, 2018 WL 466527, at *3 21 (N.D. Cal. Jan. 18, 2018). (The individual Defendants’ motion was denied as moot.) 22 Plaintiffs did not adequately aver interestedness, because they did not show a substantial 23 likelihood of liability, or that individual directors acted with knowledge of wrongdoing. The 24 Board’s knowledge of the FTC investigation, even coupled with a lack of increased compliance 25 measures, did not establish the board was acting in an interested manner because of a fear of 26 liability. Instead, its conduct evidenced their good-faith belief that it was in compliance, which 27 was supported by the FTC’s previous reference to YouTube as a general audience site. The Board 1 monitored the FTC’s investigation; that the Audit Committee did much of this work was evidence 2 of reasonable delegation, not abdication by the full Board. Ultimately, Plaintiffs’ conclusory 3 allegations and the FTC’s no-liability settlement did not show demand futility. Thus, Plaintiffs 4 failed to satisfy the first Rales prong. The Complaint was dismissed in its entirety, with leave to 5 amend. 6 D. Additions in the Operative Complaint 7 In the current Complaint, Plaintiffs repeat most of the arguments and facts laid out in the 8 previous Complaint, but offer several additional facts. Only the two most important additions will 9 be discussed in detail, as they are representative, and even considering all the other changes, 10 Plaintiffs do not establish demand futility. First, Plaintiffs describe how in early 2015, the FTC 11 sent educational letters to businesses appearing to collect personal information from children 12 under 13 to alert them of amendments to COPPA, reminding them that they needed to be in 13 compliance. It is not confirmed, however, whether YouTube or Google were recipients of the 14 letter. 15 Second, Plaintiffs point to a confidential memorandum received by the Board stating “[i]n 16 the U.S., we mitigated “privacy regulatory swirl” around the YouTube Kids launch.” Plaintiffs 17 claim the “privacy regulatory swirl” was brought to the Board’s attention as a result of a complaint 18 filed with the FTC on behalf of consumer watchdog groups about Alphabet’s COPPA compliance. 19 Plaintiffs accuse Defendants of making no effort to investigate or modify YouTube to ensure 20 compliance with COPPA in response to this complaint. 21 Defendants move for judicial notice and incorporation by reference of various documents. 22 Plaintiffs do not oppose these requests. Opp’n at 4 n.2. In any case, these requests are immaterial 23 to this disposition. 24 III. LEGAL STANDARD 25 A basic principle of corporate law is that a corporation is run by its management and the 26 corporation itself has the right to make claims. See Potter v. Hughes, 546 F.3d 1051, 1058 (9th 27 Cir. 2008). Because a shareholder derivative suit is an extraordinary action that allows a 1 shareholder to step into the shoes of a corporation and make claims on behalf of the corporation, 2 Federal Rule of Civil Procedure 23.1 “establishes stringent conditions for bringing such a suit.” 3 Quinn v. Anvil Corp., 620 F.3d 1005, 1012 (9th Cir. 2010). Rule 23.1 requires a shareholder either 4 to demand action from the corporation’s directors before suing or plead with factual particularity 5 the reasons why such a demand would have been futile. Fed. R. Civ. P. 23.1(b)(1). 6 Traditionally, Rales and Aronson were the two tests used to determine whether demand 7 was futile. Rales, 634 A.2d at 927; Aronson v. Lewis, 473 A.2d 805 (Del. 1984). The Delaware 8 Supreme Court recently affirmed a three-part test, the Zuckerberg test, that essentially combines 9 Aronson and Rales and is used to assess whether a derivative plaintiff has met their pleading burden to show that a pre-suit demand would have been futile. See United Food & Com. Workers 10 Union & Participating Food Indus. Empls. Tri-State Pension Fund v. Zuckerberg, 262 A.3d 1034, 11 1059 (Del. 2021). This new test requires the court to determine, on a director-by-director basis, 12 “(i) whether the director received a material personal benefit from the alleged misconduct that is 13 the subject of the litigation demand; (ii) whether the director faces a substantial likelihood of 14 liability on any of the claims that would be the subject of the litigation demand; and (iii) whether 15 the director lacks independence from someone who received a material personal benefit from the 16 alleged misconduct that would be the subject of the litigation demand or who would face a 17 substantial likelihood of liability on any of the claims that are the subject of the litigation 18 demand.” Id. at 1058–59. If any of these conditions are met for at least half the members on the 19 board, then demand is excused as futile. Id. Cases decided under Rales and Aronson are still good 20 law. Id. 21

IV. DISCUSSION

22 A. Material Personal Benefit 23 Once more, Plaintiffs have not established demand futility. First, Plaintiffs have not 24 demonstrated that any of the directors stood to gain a material personal benefit from the alleged 25 COPPA violation. A personal benefit is one not equally shared by the stockholders. Zuckerberg, 26 262 A.3d at 1055. Plaintiffs argue the directors ignored COPPA compliance for the sake of profit 27 1 through YouTube’s child-directed content and targeted behavioral advertising. Plaintiffs’ claims 2 are vague, e.g., they do not aver a specific amount of revenue Alphabet derived from its 3 supposedly offensive conduct, nor how much the directors gained from ignoring it. Beyond that, 4 Plaintiffs’ theory is not that any of the directors personally benefited from the alleged violation; 5 rather, Plaintiffs argue the directors indirectly benefitted from increased revenue. Yet the 6 stockholders would have benefitted just as much. This is exactly the type of common benefit that 7 Zuckerberg held to be insufficient to show demand futility. 262 A.3d at 1055. 8 B. Substantial Likelihood of Liability 9 Second, Plaintiffs have not shown that the directors faced a substantial likelihood of 10 liability. To establish substantial likelihood of liability, Plaintiffs must make a threshold showing, 11 based on particularized facts, that their claims have some merit. Rales, 634 A.2d at 934, 936 12 (plaintiffs must show “the potential for a director’s liability is not a ‘mere threat’ but instead rises 13 to a ‘substantial likelihood’”). As addressed in the order dismissing the previous complaint, 14 Google’s charter exculpates directors for breaches of fiduciary duties, as authorized by Del. Code 15 8 § 102(b)(7) (2006). Thus, Plaintiffs must show the majority of the Board acted with scienter or 16 bad faith. Zuckerberg, 262 A.3d at 1042 n.18. 17 1. Caremark 18 A claim for breach of fiduciary duty challenging a board’s oversight failure is 19 characterized as a Caremark action. In re Caremark Int'l, 698 A.2d 959 (Del. Ch. 1996). Plaintiffs 20 must allege particularized facts that (1) “the directors utterly failed to implement any reporting or 21 information system or controls”; or (2) “having implemented such a system or controls, [the 22 directors] consciously failed to monitor or oversee its operations.” Stone ex rel. AmSouth 23 Bancorporation v. Ritter, 911 A.2d 362, 369 (Del. 2006). This is “possibly the most difficult 24 theory in corporation law upon which a plaintiff might hope to win a judgment.” Caremark, 698 25 A.2d at 967. Plaintiffs provide no basis to conclude that the Board could have possibly committed 26 a Caremark violation. 27 1 a. Adequate Reporting Systems 2 The Complaint provides no particularized facts to demonstrate Alphabet’s Board lacked 3 adequate reporting and monitoring of legal, regulatory and privacy risks. Alphabet’s Audit 4 Committee was responsible for oversight of legal risk, including regulatory compliance, and 5 provided regular reports to the Board of Directors. The Audit Committee held special meetings to 6 discuss the government investigation involving COPPA, cooperated with the FTC during its 7 investigation, and provided reports to the Board. This suffices to show good faith efforts to 8 implement a board-level monitoring and reporting system. See, e.g., Rojas v. Ellison, No. 2018- 9 0755-AGB, 2019 WL 3408812, at *8–9 (Del. Ch. July 29, 2019); see also Riley v. Chopra, No. 10 21-55518, 2022 WL 614450, at *1 (9th Cir. Mar. 2, 2022) (audit committee’s efforts and updates 11 were enough). Plaintiffs have not satisfied prong one of Caremark, particularly in light of the need 12 to show scienter or bad faith. Zuckerberg, 262 A.3d at 1042 n.18. 13 Plaintiffs try to draw parallels between this case, Marchand, and Boeing to show the Board 14 failed to implement the necessary system of monitoring or reporting. Marchand v. Barnhill, 212 15 A.3d 805, 822 (Del. 2019) (no board committee oversaw food safety, even though it was critical 16 for a food company); In re Boeing Company Derivative Litigation, No. 2019-0907-MTZ, 2021 17 WL 4059934, *5–7 (Del. Ch. Sep. 7, 2021) (none of Boeing’s committees was chartered to 18 oversee plane safety). However, these cases are distinguishable. In both cases the relevant 19 committees failed to oversee an issue, and the full board’s oversight was also lacking to the point 20 that there was an utter failure to monitor critical compliance risks. By contrast, here, the Audit 21 Committee Charter specifically tasks the committee with monitoring a bevy of specific risks, 22 including privacy, legal, and regulatory risks. Second Amended Complaint ¶¶ 166–67. 23 b. Satisfactory Monitoring 24 Plaintiffs also fall short of pleading a claim under Caremark’s second prong, that the 25 directors failed to monitor or oversee the information reporting operations they had implemented. 26 Plaintiffs’ do not support their averment regarding YouTube’s violation of COPPA through actual 27 knowledge of the collection of children’s data. The FTC has provided guidance to assess when a 1 general audience site has actual knowledge of children accessing and providing personal 2 information. See 64 Fed. Reg. 59889–92; 78 Fed. Reg. 3972. Unless users input their age or a 3 proxy for age when registering, or a concerned parent reports to the site that the particular user is a 4 child, then the operator has no actual knowledge. Plaintiffs aver that YouTube was aware of child- 5 directed channels, but neither this nor their other averments amount to a viable claim that 6 YouTube was actually aware of underage users, let alone that the Board failed to monitor any 7 information. 8 Plaintiffs continue to assert Defendant’s reaction to the FTC’s investigation constitutes a 9 failure to monitor. As stated in the previous order, however, the mere existence of regulatory 10 investigations or litigation “do not necessarily demonstrate that a corporation’s directors knew or 11 should have known that the corporation was violating the law.” Order on MTD, at 7 (relying on 12 Rojas, 2019 WL 3408812, at *11). Defendants had a reasonable belief YouTube was not in 13 violation of COPPA. Yet they still undertook the sensible course of monitoring and complying 14 with the FTC’s investigation. That it was not the entire Board’s most pressing concern does not 15 mean the Board failed to monitor the investigation. The Board believed it was a general audience 16 site, as the FTC had referred to it as such before. The Board’s actions must be judged with the 17 information it had at the time, not with the benefit of hindsight, knowing that the FTC would 18 introduce a novel interpretation of the law. Neither the educational letters, which YouTube may or 19 may not have even received, nor the references to a “privacy regulatory swirl,” change this 20 analysis. Again, this conclusion is bolstered by the fact that Plaintiffs would also need to show 21 scienter or bad faith, a bar they have not approached. Plaintiffs have not established a substantial 22 likelihood of liability, so they cannot show demand futility. 23 C. Independence and Unjust Enrichment 24 Because Plaintiffs cannot establish any director’s interestedness, there is no need to 25 evaluate independence. Zuckerberg, 262 A.3d at 1059; see also In re Oracle Corp. Derivative 26 Litigation, 2011 WL 5444262, at *6 (N.D. Cal. Nov. 9, 2011). Because Plaintiffs’ breach of 27 fiduciary duty claim is dismissed, their unjust enrichment claim must be dismissed as well. In re 1 PayPal Holdings, Inc. S’holder Derivative Litig., No. 17-cv-00162-RS, 2018 WL 466527, at *6, 2 || n.10. 3 CONCLUSION 4 For the reasons set forth above, Alphabet’s motion to dismiss is granted. As Plaintiffs have 5 already amended their Complaint once and further amendment would appear to be futile, dismissal 6 is without leave to amend. See AmerisourceBergen Corp. v. Dialysist W., Inc., 465 F.3d 946, 951 7 (9th Cir. 2006). The individual Defendants’ motion is denied as moot, without prejudice. 8 9 || ITISSO ORDERED. 10 11 || Dated: April 7, 2022 a (12

RICHARD SEEBORG

13 Chief United States District Judge

15 16

it

Z 18

19 20 21 22 23 24 25 26 27 28 ORDER GRANTING MOTION TO DISMISS CASE No. 19-cv-06880-RS