1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 ALI AL-AHMED, Case No. 21-cv-08017-EMC

8 Plaintiff,

ORDER GRANTING DEFENDANT’S

9 v. MOTION TO DISMISS

10 TWITTER, INC., et al., Docket No. 30 11 Defendants.

12 13 14 I. INTRODUCTION 15 Plaintiff Al-Ahmed is a critic of the Kingdom of Saudi Arabia (“KSA”) and has been 16 granted asylum in the United States. Between 2013–2015, two of Twitter’s (now former) 17 employees, Defendants Ahmad Abouammo and Ali Hamad A. Alzabarah, accessed user 18 information on Al-Ahmed without authorization and provided it to KSA government officials. Al- 19 Ahmed filed this lawsuit against Abouammo, Alzabarah, and Twitter for violating the Electronics 20 Communications Privacy Act (“EPCA”), violating the Computer Fraud and Abuse Act (“CFAA”), 21 violating the Stored Communications Act (“SCA”), violating California’s Unfair Competition 22 Law (“UCL”), breach of contract, intrusion upon seclusion, unjust enrichment, promissory 23 estoppel, negligence, negligent hiring, supervision, and retention, civil conspiracy, and replevin. 24 Al-Ahmed alleges that his Twitter account was hacked, which led to the KSA targeting him and 25 those around him. Furthermore, he alleges that Twitter’s suspension of his account in 2018 26 punishes him—the victim—and ratifies its former employees’ conduct. Pending in this Court is 27 Twitter’s motion to dismiss Al-Ahmed’s Complaint. The Court GRANTS Twitter’s motion for 1 II. BACKGROUND 2 Al-Ahmed alleges as follows in the Complaint: 3 Al-Ahmed is one of the leading critics of the KSA who resides and has been granted 4 asylum in the United States. Docket No. 1 (“Complaint”) at 2. Between August 2013 and 5 December 2015, Twitter user information was accessed without authorization and provided to 6 KSA government officials, which Twitter failed to detect for a period of time spanning over a 7 year. Id. at 4, 7. Al-Ahmed’s Arabic Twitter account, which has over 36,000 followers 8 worldwide, was one of the accounts breached during this time. Id. at 6. Al-Ahmed contends that 9 his private information, including his personal phone number and email address, which he never 10 made publicly available, was compromised due to Twitter’s conduct. Id. at 16. His account also 11 had confidential information provided by his followers and journalistic sources. Id. at 3. Al- 12 Ahmed alleges his private information was used by the KSA to silence him by stripping him of his 13 Saudi nationality, keeping him under surveillance, and attempting to kidnap and kill him on 14 multiple occasions. Id. at 6–7. His followers on Twitter, or those who otherwise contacted him 15 using Twitter, have disappeared, been arrested, or have been executed. Id. at 8. According to him, 16 “the KSA managed to fully silence [him] when they . . . suspend[ed his] Arabic Twitter account, 17 without explanation, warning, or justification.” Id. at 8. 18 On November 19, 2019, Abouammo and Alzabarah were indicted for acting as agents for 19 the government of Saudi Arabia while employed at Twitter. Id. at 4. Abouammo was the Media 20 Partnerships Manager responsible for the Middle East and North Africa region at Twitter. Id. at 3. 21 Alzabarah was a Site Reliability Engineer whose responsibility was maintaining Twitter’s 22 hardware and software to ensure uninterrupted service. Id. 23 A. Twitter’s Notice 24 On or about December 11, 2015, Twitter sent the following notice to a small group of its 25 users:

26 Dear @{{screen_name}}, As a precaution, we are alerting you that your Twitter account is one of a small group of accounts that 27 may have been targeted by state-sponsored actors. We believe IP addresses, and/or phone numbers. 1 At this time, we have no evidence they obtained your account 2 information, but we’re actively investigating this matter. We wish we had more we could share, but we don’t have any additional 3 information we can provide at this time.

4 It’s possible your account may not have been an intended target of the suspected activity, but we wanted to alert you as soon as 5 possible. We recognize that this may be of particular concern if you choose to Tweet using a pseudonym. For tips on protecting your 6 identity online, you may want to visit the Tor Project or EFF’s Protecting Yourself on Social Networks. 7 8 Id. at 14. Al-Ahmed alleges that this notice was insufficient because it failed to indicate that these 9 state-sponsored actors committed these data breaches while they were located on Twitter’s 10 premises, employed by Twitter, using Twitter’s resources, at the direction of Twitter. Id. at 15. 11 B. Twitter’s Actions in Aid of the KSA 12 Al-Ahmed alleges that Twitter provided the two employees with access to Twitter’s 13 resources with the full knowledge that they were improperly accessing user data, helped them 14 provide the information to the KSA, and helped them cover up their tracks by purging its internal 15 database of incriminating evidence. Id. at 7. Al-Ahmed also alleges that Twitter’s Privacy Policy 16 suggests that Tweets may be protected by opting to allow only Twitter followers to see them 17 through account settings, which created an illusion of security and safety. Id. at 10. Al-Ahmed 18 lastly alleges that Twitter failed to safeguard user data, evidenced by its disclosure to the 19 Securities and Exchange Commission in 2020. The disclosure stated that Twitter received a draft 20 complaint from the Federal Trade Commission alleging “violations…[r]elate[d] to the Company’s 21 use of phone number and/or email address data provided for safety and security purposes 22 [ostensibly for targeted advertising] during periods between 2013 and 2019.” Id. at 12. Thus, 23 Twitter negligently failed to implement policies, practices, and safeguards that would have 24 prevented the acts of its former employees. Id. at 37. 25 C. Twitter’s Relationship with the KSA 26 In 2011, Saudi Prince Alwaleed Bin Talal purchased $300 million worth of stock in 27 Twitter. Id. In 2015, Bin Talal made an additional investment, owning 5.2% of the company, 1 Crown Prince Bin Salman. Id. Thus, Al-Ahmed alleges that Twitter’s acts were designed to 2 appease Bin Salman, a significant investor. Id. According to Al-Ahmed, Bader al-Asaker is the 3 head of Bin Salman’s affairs and the “Saudi mastermind” behind the Twitter spy scandal. Id. at 4 13. He claims that Asaker is “Foreign Official-1” in the United States Attorneys Offices’ 5 indictment against Abouammo and Alzabarah. Id. Al-Ahmed alleges that Asaker provided 6 Abouammo and Alzabarah with “gifts, cash payments, and promises of future employment in 7 exchange for nonpublic information about Twitter uses, which constituted valuable property…” 8 Id. Furthermore, Twitter CEO Jack Dorsey met with both Asaker and Bin Salman at Twitter’s 9 headquarters on June 25, 2016, and at least one additional time in Riyadh thereafter. Id. at 13. 10 Dorsey and Asaker follow each other on Twitter. Id. 11 D. Twitter’s Suspension of Al-Ahmed’s Account 12 In 2018, Al-Ahmed’s Twitter account was suspended, preventing access to his followers. 13 Id. at 8. Al-Ahmed alleges that, as a result, he lost significant revenue and earning potential 14 related to his work as a journalist, as much of his work was contingent on his online presence. Id. 15 at 16. Al-Ahmed further alleges that his appeal of the suspension failed despite Alzabarah and 16 Abouammo’s indictment. Id. at 8. According to Al-Ahmed, preventing access to his account and 17 the list of his followers, punishes the victim and “ratifie[s] the actions of its supposedly errant 18 employees and show[s] [Twitter’s] continuing allegiance to the KSA.” Id. 19 III. LEGAL STANDARD 20 A. Motion to Dismiss 21 Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include “a short and plain 22 statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A 23 complaint that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). See Fed. R. 24 Civ. P. 12(b)(6). To overcome a Fed. R. Civ. P. 12(b)(6) motion to dismiss after the Supreme 25 Court’s decisions in Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corporation v. 26 Twombly, 550 U.S. 544 (2007), a plaintiff’s “factual allegations [in the complaint] ‘must . . . 27 suggest that the claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d 1 construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. 2 Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). But “allegations in a 3 complaint . . . may not simply recite the elements of a cause of action [and] must contain sufficient 4 allegations of underlying facts to give fair notice and to enable the opposing party to defend itself 5 effectively.” Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap 6 Co., 751 F.3d 990, 996 (9th Cir. 2014)). “A claim has facial plausibility when the Plaintiff pleads 7 factual content that allows the court to draw the reasonable inference that the Defendant is liable 8 for the misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a 9 ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted 10 unlawfully.” Id. (quoting Twombly, 550 U.S. at 556). 11 B. Judicial Notice 12 Under Federal Rule of Evidence 201, “[a] judicially noticed fact must be one not subject to 13 reasonable dispute in that it is either (1) generally known within the territorial jurisdiction of the 14 trial court or (2) capable of accurate and ready determination by resort to sources whose accuracy 15 cannot reasonably be questioned.” Fed. R. Evid. 201. Courts may take judicial notice of 16 “undisputed matters of public record,” but generally may not take judicial notice of “disputed facts 17 stated in public records.” Lee v. City of Los Angeles, 250 F.3d 668, 690 (9th Cir. 2001). Facts 18 subject to judicial notice may be considered on a motion to dismiss. Mullis v. U.S. Bankr. Ct., 828 19 F.2d 1385, 1388 (9th Cir. 1987). “Proper subjects of judicial notice when ruling on a motion to 20 dismiss include . . . publically accessible websites[.]” Perkins v. LinkedIn Corp., 53 F. Supp. 3d 21 1190, 1204 (N.D. Cal. 2014) (citing Caldwell v. Caldwell, No. 05–4166, 2006 WL 618511, at *4 22 (N.D. Cal. Mar. 13, 2006); Wible v. Aetna Life Ins. Co., 375 F.Supp.2d 956, 965–66 (C.D. 23 Cal.2005). 24 The doctrine of incorporation by reference is distinct from judicial notice. The doctrine 25 “permits a district court to consider documents ‘whose contents are alleged in a complaint and 26 whose authenticity no party questions, but which are not physically attached to the . . . 27 pleadings.’” In re Silicon Graphics Sec. Litig., 183 F.3d 970, 986 (9th Cir. 1999) (quoting Branch 1 plaintiff refers extensively to the document or the document forms the basis of the plaintiff’s 2 claim.” United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003). The Ninth Circuit in Knievel 3 extended this doctrine to apply in some circumstances where the plaintiff does not explicitly allege 4 the contents of the document in the complaint, but the defendant was allowed to attach the 5 document in its motion to dismiss. In order for this extension to apply, the plaintiff’s claim must 6 depend on the contents of the document and the parties must not dispute the authenticity of the 7 document. Knievel v. ESPN, 393 F.3d 1068 (9th Cir. 2005) (allowing the introduction of a 8 website’s contents that were seen alongside the disputed contents in a defamation suit that were 9 not disputed for authenticity). 10 Therefore, the requirements for the documents that are relied on by the complaint to be 11 incorporated is that: “(1) the complaint refers to the document; (2) the document is central to the 12 plaintiff’s claim; and (3) no party questions the authenticity of the copy attached to the 12(b)(6) 13 motion.” Marder v. Lopez, 450 F.3d 445, 448 (9th Cir. 2006) (internal citations omitted). Such 14 documents may be considered as “part of the complaint,” without converting the Rule 12(b)(6) 15 motion into one for summary judgment. Ritchie, 342 F.3d at 908. The contents of such 16 documents may be assumed to be true for purposes of deciding a Rule 12(b)(6) motion. Id. 17 IV. DISCUSSION 18 A. Twitter’s Request for Incorporation by Reference/Judicial Notice 19 Twitter requests the Court to incorporate by reference or judicially notice the following 20 documents: 21 a. Twitter’s December 11, 2015 email and in-app notices. Docket No. 29-5 22 (“Srinivasan Declaration”), Ex. A (“Twitter Employee Declaration”), Ex. 1–2. 23 b. Twitter’s records reflecting that the December 11, 2015 email notice and in-app 24 notice were sent to Al-Ahmed. Twitter Employee Declaration, Ex. 3–4. 25 c. A Twitter message sent by Al-Ahmed through his Twitter account, and a certified 26 English translation of that message. Twitter Employee Declaration, Ex. 5. 27 d. A screenshot of Al-Ahmed’s active Twitter account. Srinivasan Declaration, Ex. 1 e. A publicly available Twitter post made by Ali Al-Ahmed that lists his phone 2 number. Srinivasan Declaration, Ex. C. 3 f. A publicly available press release listing Al-Ahmed’s phone number and email 4 address. Srinivasan Declaration, Ex. D. 5 g. Twitter’s current and prior terms of service. Srinivasan Declaration, Ex. E; Twitter 6 Employee Declaration, Ex. 6A–6N. 7 Al-Ahmed does not directly respond to Twitter’s request for incorporation by reference 8 and judicial notice. 9 1. Incorporation by Reference 10 Twitter seeks to incorporate by reference five exhibits. See Docket No. 31. Exhibits 1 and 11 2 are notifications Twitter sent to potentially affected Twitter users regarding the unauthorized 12 access of Twitter accounts. Id. at 4. Exhibits 1 and 2 may be incorporated by reference because 13 they are referenced extensively in the Complaint and are integral to Al-Ahmed’s claims. Ritchie, 14 342 F.3d at 908 (“Even if a document is not attached to a complaint, it may be incorporated by 15 reference into a complaint if the plaintiff refers extensively to the document or the document 16 forms the basis of the plaintiff’s claim.”). The Complaint directly quotes the contents of these 17 notifications and argues their sufficiency. Docket No. 31 at 5. See, e.g., Complaint at 14, 15; 18 Daniels-Hall v. National Educ. Ass’n, 629 F.3d 992, 998 (9th Cir. 2010) (“Plaintiff directly quoted 19 the material . . . thereby incorporating [the material] into the Complaint.”). 20 Exhibits 3 and 4 are files maintained in Twitter’s records that identify the user accounts 21 that received the notifications. Docket No. 31 at 5. The Complaint does not discuss Al-Ahmed’s 22 dispute that he received notice in the Complaint. However, the issue is somewhat hinted at, as Al- 23 Ahmed alleges that “Twitter purportedly sent a notice[.]” Complaint at 14. Al-Ahmed does not 24 dispute that Twitter sent these notices to some people, but disputes that he received notice from 25 Twitter in his Opposition. Opp’n at 4–5, Ex. A at 2. Twitter argues that “where a plaintiff claims 26 he or she never received a notification, and the defendant provides evidence that the defendant did 27 in fact notify the plaintiff, defendant’s evidence may be incorporated by reference to prevent the 1 information.” See Docket No. 38 (“Reply”) at 4–5. These notification lists may be incorporated 2 by reference because “the notifications submitted by [Twitter] are crucial to [Al-Ahmed’s] claims 3 that [he] never received notifications . . . [Al-Ahmed], again, do not raise in [his] Opposition any 4 dispute as to the authenticity of these notifications.” Starks v. Geico Indem. Co., No. CV-15- 5 5771-MWF (PJW), 2015 WL 12942282, at *2 (C.D. Cal. Nov. 10, 2015) (incorporating by 6 reference the notifications allegedly not received by the plaintiff). Accordingly, these exhibits 7 may be treated as part of the Complaint under the incorporation by reference doctrine. 8 Exhibit 5 consists of an Arabic message transmitted by Al-Ahmed from his Twitter 9 account as well as an English translation of the message. Id. at 16. Twitter claims that this 10 message contained hateful and abusive language. Id. at 6–7. Twitter argues that this message led 11 to the suspension of Al-Ahmed’s Twitter account and is thus integral to his Complaint. Id. 12 However, the Complaint makes no reference to this message and Al-Ahmed’s claims are not 13 dependent on the existence of this message. Although Twitter cites two cases for the proposition 14 that Al-Ahmed is not allowed to plead around the very message he wrote that led to his 15 suspension, these cases are distinguishable. 16 Twitter first cites Chyba v. Green Tree Servicing, LLC., in which the plaintiff alleged that a 17 loan service provider failed to provide her with written notices related to her loan. No. 12-CV- 18 2530-H (WMC), 2012 WL 12874929, at *1–*2 (S.D. Cal. Dec. 12, 2012). The defendant 19 submitted written correspondences regarding the validation and collection of the debt. Id. The 20 court incorporated the letter because “[a]lthough not specifically referenced in her complaint, 21 Plaintiff’s claims depend on this written correspondence.” Id. at *2–*3. Here, Al-Ahmed’s 22 claims do not depend on Exhibit 5. This allegedly hateful message is integral not to Al-Ahmed’s 23 allegations but to Twitter’s defense of them. See Jones v. Raymer Metals, Inc., No. CV-17-00546- 24 BROMRWX, 2017 WL 10560488, at *4 (C.D. Cal. May 31, 2017) (distinguishing Chyba because 25 while “[w]ritten correspondence between parties” may be considered under the incorporation by 26 reference doctrine . . . Plaintiff does not appear to rely on Defendant’s letter as a basis for her 27 claims.”). 1 incorporated by reference. Id. (citing Knievel, 393 F.3d at 1076). In Knievel, the plaintiffs alleged 2 that a photograph and associated caption published on the defendant’s website were defamatory. 3 Knievel, 393 F.3d at 1070. The plaintiff attached a photograph of the webpage to the complaint 4 but omitted surrounding web pages that gave context to the photograph. Id. at 1076. The Ninth 5 Circuit incorporated by reference the surrounding pages because “a viewer accessing the Knievel 6 photograph must also access the surrounding pages” and a court must also take into account “all 7 parts of the communication that are ordinarily heard or read with [a statement].” Id. Here, there is 8 no issue with the completeness of an otherwise admissible document. It is a new document 9 altogether. 10 In addition, Exhibit 5’s authenticity seems to be disputed by Al-Ahmed. Al-Ahmed states 11 in his declaration that he does not recognize this statement in Exhibit 5 and that it is not his 12 statement. Docket No. 32 (“Opp’n”), Exhibit A, at 3. Al-Ahmed also states that its translation is 13 “entirely inaccurate.” Id. Documents under dispute cannot be incorporated by reference. See 14 Knievel, 393 F.3d at 1068. Accordingly, Exhibit 5 may not be incorporated by reference. 15 For the foregoing reasons, the Court GRANTS Twitter’s motion to incorporate by 16 reference Exhibit 1 and 2 but DENIES the motion for Exhibits 3–5. 17 2. Judicial Notice of Public Documents 18 Twitter also asks the Court to judicially notice publicly available documents. Exhibits B, 19 C, and D to the Srinivasan Declaration are copies of the landing page of Al-Ahmed’s Twitter 20 account, a public post on the account, and a press release page, which are all available publicly. 21 “Because the exhibits Plaintiff seeks to have judicially noticed are publicly accessible webpages 22 and Defendant does not oppose authentication of the websites[,]” these exhibits are properly 23 subject to judicial notice. Lindora, LLC v. Limitless Longevity LLC, No. 15-CV-2847-JAH 24 (KSC), 2016 WL 6804443, at *3 (S.D. Cal. Sept. 29, 2016); Perkins v. LinkedIn Corp., 53 F. 25 Supp. 3d 1190, 1204 (N.D. Cal. 2014) (noting that publicly accessible websites are subject to 26 judicial notice). 27 Similarly, Exhibit E to the Srinivasan Declaration and Exhibits 6A–6N to the Twitter 1 the present, and also publicly available on Twitter’s webpage. Accordingly, they also are properly 2 subject to judicial notice. See Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1068-1069 n.3 (N.D. 3 Cal. 2016) (taking judicial notice of Yelp’s privacy policies); Datel Holdings Ltd. v. Microsoft 4 Corp., 712 F. Supp. 2d 974, 983–84 (N.D. Cal. 2010) (taking judicial notice of Xbox software 5 license and terms of service). Accordingly, the Court GRANTS Twitter’s motion to judicially 6 notice Exhibits B, C, D, and 6A–6N.1 7 B. The Abdulaziz Case 8 Throughout the motion, Twitter cites a case with substantially similar facts and allegations 9 that was filed in this district and dismissed three times. See generally Abdulaziz v. Twitter, Inc., 10 2020 WL 6947929 (Aug. 12, 2020) (“Abdulaziz I”); Abdulaziz v. Twitter, Inc., No. 19-CV-06694- 11 LB, 2021 WL 633812, at *7 (N.D. Cal. Feb. 18, 2021) (“Abdulaziz II”); Abdulaziz v. Twitter, Inc., 12 No. 19-CV-06694-LB, 2021 WL 2986400, at *1 (N.D. Cal. July 15, 2021) (“Abdulaziz III”). This 13 case was brought by another Saudi dissenter and pertains to the same 2013–2015 hacking of the 14 Twitter accounts by the same employees. The plaintiff had alleged that after his Twitter data was 15 hacked, Saudi agents used malware to hack his phone and then targeted his family. Id. The 16 plaintiff similarly alleged violations of the SCA, California’s UCL, invasion of privacy, 17 misrepresentation, negligence, and negligent hiring, supervision, or retention of employees. See 18 Abdulaziz I, 2020 WL 6947929, *1. Abdulaziz I found that the plaintiff lacked Article III standing 19 because he failed to show how the compromise of the Twitter data caused the harm to his family 20 and friends, especially when he was already an outspoken dissident who suffered persecution prior 21 to the hacking of his Twitter account. Id. at *6. The court also found that Twitter’s December 22 2015 notice barred the plaintiff’s claims due to the statute of limitations and defeated any claim 23 that Twitter ratified its employee’s conduct. Id. at *7. 24 In Abdulaziz II, the plaintiff alleged negligent supervision and retention of its employees 25 and negligence. The court again held that the plaintiff lacked standing due to lack of causation 26

27 1 Al-Ahmed refers to Exhibit C as a private message in relation to his Privacy Act claim in the 1 and that the December 2015 notice was sufficient notice to trigger the statute of limitations under 2 California’s discovery rule. 2021 WL 633812, at *7. In Abdulaziz III, the court dismissed the 3 case with prejudice for lack of causation required for Article III standing. 2021 WL 2986400, at 4 *3. Twitter largely relies on this case to argue that Al-Ahmed lacks standing and that the statute 5 of limitations period has passed. 6 C. Article III Standing 7 Under Rule 12(b)(1), a party may move to dismiss for lack of subject matter jurisdiction. 8 “[L]ack of Article III standing requires dismissal for lack of subject matter jurisdiction under 9 [Rule] 12(b)(1).” Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). The “irreducible 10 constitutional minimum” of standing requires that a “plaintiff must have (1) suffered an injury in 11 fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to 12 be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 13 (2016). These three elements are referred to as, respectively, injury in fact, causation, and 14 redressability. Planned Parenthood of Greater Was. & N. Idaho v. U.S. Dep’t of Health & Human 15 Servs., 946 F.3d 1100, 1108 (9th Cir. 2020). The alleged injury in fact must be “concrete, 16 particularized, and actual or imminent.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203, 210 17 L. Ed. 2d 568 (2021). “For an injury to be ‘particularized,’ it must affect the plaintiff in a personal 18 and individual way” and “[o]nly those plaintiffs who have been concretely harmed by a 19 defendant’s statutory violation may sue that private defendant over that violation in federal court.” 20 Spokeo, 136 S. Ct. at 1548 (internal quotation marks omitted); Ramirez, 141 S. Ct. at 2205. “The 21 plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these 22 elements[.]” Spokeo, 136 S. Ct. at 1547 (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). 23 Here, Al-Ahmed’s claims arise from two separate events: (1) the former Twitter 24 employees’ unauthorized access into Twitter accounts at the behest of the KSA between 2013– 25 2015, and (2) the May 2018 suspension of Al-Ahmed’s Arabic Twitter account. Docket No. 30 26 (“Mot.”) at 8. Twitter argues that Al-Ahmed lacks Article III standing relating to the KSA’s 2013 27 to 2015 espionage, and therefore all claims against Twitter except Replevin must be dismissed. 1 Twitter argues that Al-Ahmed’s claims do not have Article III standing for the same reason 2 articulated by the Abdulaziz courts—he fails to establish a causal nexus between Twitter’s actions 3 and the injury, and any such injury is not particularized to Al-Ahmed. Id. at 10. Al-Ahmed 4 argues that: (1) an injury exists solely by virtue of statutes creating legal rights; (2) Twitter’s 5 invasion of his privacy is a harm in itself; and (3) that he has nevertheless alleged a concrete and 6 particularized injury apart from the invasion to his privacy. Opp’n at 3 (citing Havens Realty 7 Corp. v. Coleman, 455 U.S. 363, 373 (1982) (internal quotations omitted)). Al-Ahmed’s first and 8 third arguments fail. However, invasion of privacy is a particularized injury sufficient to establish 9 Article III standing. 10 The first argument fails because this argument was explicitly rejected by the Supreme 11 Court in 2016. Spokeo, 136 S. Ct. at 1543 (“Article III standing requires a concrete injury even in 12 the context of a statutory violation.”). The third argument also fails because Al-Ahmed fails to 13 identify a concrete and personal injury separate from the invasion of privacy itself. Although Al- 14 Ahmed’s affidavit to his Opposition states: “as a freelance journalist and author this has cost me 15 hundreds of thousands of dollars in lost revenue from writing articles and books and through 16 podcasts[,]” this injury is not alleged in his Complaint. Opp’n, Ex. A; Remington v. Mathson, 42 17 F. Supp. 3d 1256, 1278 n.3 (N.D. Cal. 2012), aff’d, 575 F. App’x 808 (9th Cir. 2014) (“A 18 Complaint cannot be amended through allegations made in an opposition to a motion to 19 dismiss.”); Schneider v. California Dep’t of Corr., 151 F.3d 1194, 1197 n.1 (9th Cir. 1998) (“In 20 determining the propriety of a Rule 12(b)(6) dismissal, a court may not look beyond the complaint 21 to a plaintiff’s moving papers, such as a memorandum in opposition to a defendant’s motion to 22 dismiss.”). Even if this statement is taken into consideration, it fails to establish standing because 23 it lacks any causal connection to the alleged KSA-sponsored espionage claims. The preceding 24 paragraph to this sentence makes clear that it was Twitter’s suspension of his account in 2018 that 25 prevented him “from accessing the tens or thousands of KSA and other Arab-language followers 26 and sources [that] curtailed [his] ability to report credibly and in real time on events unfolding in 27 the KSA [and cost him his revenue.]” Docket No. 32-1, Ex. A at 5–6. The hacking of his account 1 Nevertheless, invasion of privacy by itself is sufficiently concrete and particularized to 2 confer Article III standing. Last year, the Supreme Court further clarified the scope of Article III 3 standing that: “Various intangible harms can also be concrete. Chief among them are injuries with 4 a close relationship to harms traditionally recognized as providing a basis for lawsuits in American 5 courts. Those include, for example, reputational harms, disclosure of private information, and 6 intrusion upon seclusion.” Ramirez, 141 S. Ct. at 2204. 7 In the years between Spokeo and Ramirez, the Ninth Circuit found Article III standing in 8 multiple privacy-related claims such as ECPA and SCA claims. See Campbell v. Facebook, Inc., 9 951 F.3d 1106 (9th Cir. 2020). The Ninth Circuit explained:

10 the legislative history and statutory text demonstrate that Congress and the California legislature intended to protect these historical 11 privacy rights when they passed the Wiretap Act, SCA, and CIPA. See S. REP. NO. 99-541, at 2 (1986) (“[The Wiretap Act] is the 12 primary law protecting the security and privacy of business and personal communications in the United States today.”); Id. at 3 13 (“[The SCA] is modeled after the Right to Financial Privacy Act, 12 U.S.C. § 3401 et seq. to protect privacy interests in personal and 14 proprietary information ....”); Cal. Pen. Code § 630 (noting that CIPA was passed “to protect the right of privacy of the people of 15 this state”). Thus, these statutory provisions codify a substantive right to privacy, the violation of which gives rise to a concrete injury 16 sufficient to confer standing. 17 In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 599 (9th Cir. 2020) (finding standing 18 to pursue privacy claims under the Wiretap Act, SCA, and CIPA because Facebook's tracking and 19 collection of personal information would constitute “harm to their interest in controlling their 20 personal information”). Therefore, an invasion of privacy as a harm is sufficient here. See 21 Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017) (“Privacy torts do not always 22 require additional consequences to be actionable . . . the ‘intrusion itself’ makes the defendant 23 liable.” (citing Restatement (Second) of Torts § 652B cmt. b. (Am. Law Inst. 1977)); Lynch v. 24 AML Network Ltd., No. CV 21-3574-GW-RAOX, 2021 WL 4453470, at *3 (C.D. Cal. Sept. 27, 25 2021) (“The Ninth Circuit has expressly held that “a violation of the TCPA is a concrete, de facto 26 injury.”). 27 The disclosure of Al-Ahmed’s private information, including his personal phone number 1 information” and is a violation of a statutory right to privacy. In re Facebook, 956 F.3d at 599; 2 see also Eichenberger, 876 F.3d at 983 (finding that the VPPA identifies a substantive right to 3 privacy against a disclosure of an individual’s personally identifiable information). Accordingly, 4 Al-Ahmed’s injury is sufficiently concrete and particularized. 5 Twitter argues that Al-Ahmed fails to establish that his alleged injury is “fairly traceable to 6 the challenged action of the defendant, and not the result of the independent action of some third 7 party not before the court.” Reply at 2 (citing Lujan, 504 U.S. at 560–61). To the extent that Al- 8 Ahmed alleges that these breaches of privacy caused other harms such as the disappearance, arrest, 9 or execution of his followers, his claims fail because he “does not explain how the compromise of 10 the Twitter data caused the harm[.]” Abdulaziz I, 2020 WL 6947929, at *6. Any harm to Al- 11 Ahmed, if alleged to be a result of the harm or disappearance of his followers, cannot be 12 established due to lack of causation. Al-Ahmed fails to allege that his followers were harmed by 13 the breach of privacy. Merely alleging harm to “several” Twitter users who either followed him 14 on Twitter or have messaged him, out of the 36,000 followers that he had, is insufficient. Indeed, 15 the only specific example Al-Ahmed points to is a follower of his Twitter account who was also a 16 Saudi Dissident. Complaint at 8. The article cited by Al-Ahmed describes him as “one of the 17 kingdom’s most prominent and persistent dissidents” who had “frequent prison terms.” Id. at 8, 18 n.8. As such, Al-Ahmed fails to plead any facts that would suggest that the breach of privacy led 19 to his imprisonment and death. 20 On the other hand, Al-Ahmed alleges unauthorized access of his Twitter account resulted 21 in harm to him described above is traceable to Abouammo and Alzabarah who were Twitter 22 employees. Al-Ahmed’s theory against Twitter is one of vicarious liability for its employees’ 23 conduct. Accordingly, this conduct is “fairly traceable” to Twitter. 24 For the foregoing reasons, Al-Ahmed has Article III standing. 25 D. Statute of Limitations 26 1. Abdulaziz I and II 27 The statute of limitations issue here concerns the same December 2015 notice discussed in 1 plaintiff’s claims, including the negligence and negligent hiring claims. Abdulaziz I, 2020 WL 2 6947929, at *7; Abdulaziz II, 2021 WL 633812, at *7. Under the same reasoning, Twitter argues 3 that Al-Ahmed’s claims accrued when he received the 2015 notices alerting him that his account 4 information had been exposed. Mot. at 12. Since the Complaint was filed on October 13, 2021, 5 more than 5 years have passed since the notice of the unauthorized intrusion of his Twitter 6 account, and more than 3 years have passed since the suspension of his account.2 Therefore, 7 Twitter contends that all of Al-Ahmed’s claims, except his breach of contract and civil conspiracy 8 claims (to the extent they are premised on his account suspension) are time-barred. Id. Al-Ahmed 9 argues that he is saved from the time ban by California’s discovery rule; he contends his claims 10 did not accrue until the Twitter employees’ indictment in 2019. Opp’n at 5. 11 2. Notice and the Discovery Rule 12 a. The Delayed Discovery Rule 13 Pursuant to the “discovery rule,” the accrual of a cause of action is postponed until the 14 “plaintiff discovers, or has reason to discover, the cause of action.” Fox v. Ethicon Endo-Surgery, 15 Inc., 35 Cal. 4th 797, 807, 110 P.3d 914, 920 (2005). “A plaintiff has reason to discover a cause 16 of action when he or she has reason at least to suspect a factual basis for its elements.” Id. 17 Therefore, it is inquiry notice, not actual notice, that is relevant to the discovery rule. Id. For the 18 2 The ECPA, CFAA, SCA, promissory estoppel, intrusion upon seclusion, negligent hiring, and 19 negligence claims each have two-year statutes of limitations. 18 U.S.C. § 2520(e) (two years for ECPA claims); 18 U.S.C. § 1030(g) (two years for CFAA claims); 18 U.S.C. § 2707(f) (two years 20 for SCA claims); Calhoun v. Google LLC, 526 F. Supp. 3d 605, 624 (N.D. Cal. 2021) (two years limitation period for intrusion upon seclusion claims under Cal. Civ. Proc. Code § 335.1); So v. 21 Shin, 212 Cal. App. 4th 652, 662 (2013) (two years for negligence claims under Cal. Civ. Proc. Code § 335.1); McGowan v. Weinstein, 505 F. Supp. 3d 1000, 1025 (C.D. Cal. 2020) (two years 22 for negligent hiring claims under Cal. Civ. Proc. Code § 335.1). UCL and breach of contract claims have four-year statutes of limitations. Cal. Code of Civ. Proc. § 337(a) (four years for 23 claims on written contracts); Cal. Bus. & Prof. Code § 17208 (four years for UCL claims). The statutes of limitations for unjust enrichment, promissory estoppel, and civil conspiracy are based 24 on the underlying wrong. Duke Gerstel Shearer, LLP v. Pursiano, No. D060374, 2012 WL 4712102, at *5 (Cal. Ct. App. Oct. 4, 2012); Newport Harbor Ventures, LLC v. Morris Cerullo 25 World Evangelism, 6 Cal. App. 5th 1207, 1224, n.5 212 Cal. Rptr. 3d 216, 229 (2016), aff'd, 4 Cal. 5th 637, 413 P.3d 650 (2018); Maheu v. CBS, Inc., 201 Cal. App. 3d 662, 673, 247 Cal. Rptr. 304, 26 310 (Ct. App. 1988). If founded on a quasi-contract theory, the claim is two years. Cal. Civ. Proc. Code § 339(1). If founded on conversion, fraud, or mistake, it is three years. Cal. Civ. Code § 27 338(d); Maheu, 201 Cal. App. 3d at 673, 247 Cal. Rptr. 304, 310. If founded on a written 1 discovery rule to apply, the plaintiff “must specifically plead facts to show (1) the time and 2 manner of discovery and (2) the inability to have made earlier discovery despite reasonable 3 diligence.” Id. at 808, 110 P.3d 914 (internal quotation marks omitted); see McGowan v. 4 Weinstein, 505 F. Supp. 3d 1000, 1018–19 (C.D. Cal. 2020) 5 Al-Ahmed argues that November 2019 is the correct time for accrual for two reasons. 6 First, he argues that he never received an email or in-app notice from Twitter in December 2015. 7 Opp’n at 4. Thus, he had not discovered or had reason to discover any cause of action. Id. 8 Second, even if he did receive such a notice, this notice did not include that these “state-sponsored 9 actors” were located on Twitter’s premises, employed by Twitter, used Twitter’s resources, and 10 acted at the direction or tacit permission of Twitter. Id. at 15. Thus, Al-Ahmed had no reason to 11 know or believe that Twitter was complicit in, or, at the very least, negligent in its hiring, training, 12 supervision and retention of the conduct of its employees until Alzabarah and Abouammo’s public 13 indictment on November 19, 2019. Complaint at 15; Opp’n at 5-6. According to Al-Ahmed, this 14 constitutes ignorance of the cause of action, as his causes of action for ECPA, CFAA, SCA, 15 promissory estoppel, intrusion upon seclusion, negligent hiring, and negligence could not have 16 accrued until he learned of Twitter’s involvement by virtue of the Twitter employees’ indictment. 17 Under this construction, less than two years have passed between Al-Ahmed’s alleged discovery 18 and the filing of the Complaint on October 13, 2021. 19 The first argument is unconvincing. In Abdulaziz II, the plaintiff had similarly argued that 20 he did not receive Twitter’s notice and that the notice itself was insufficient. Nevertheless, the 21 court dismissed the claim as time-barred. Although the Court did not explicitly discuss the 22 November 2019 indictment of the two employees, it found that the December 2015 notice was 23 sufficient notice to trigger the statute of limitations for the plaintiff’s negligent supervision and 24 retention of its employees and negligence. The court explained:

25 The plaintiff does not dispute that Twitter sent the [December 2015] notices, but he disputes that he received them, contends they did not 26 in any event warn him sufficiently of the breach, and asserts that he learned of the breach only on October 20, 2018 (rendering his 27 lawsuit timely). compromised the plaintiff’s Twitter account—was sufficient notice 1 to trigger the statute of limitations. At that point, under California’s discovery rule, the plaintiff “discover[ed], or has reason to discover, 2 the cause of action.” 3 Abdulaziz II, 2021 WL 633812, at *7 (internal citations omitted). 4 In Abdulaziz I, the court explained that the plaintiff did not meaningfully dispute that 5 Twitter sent notices by simply asserting that he may not have received the notice when Twitter 6 submitted its notification list. See Abdulaziz I, 2020 WL 6947929, at *7 (“The plaintiff does not 7 meaningfully dispute that Twitter sent notices in December 2015. (Indeed, Twitter submitted its 8 notification lists showing notice to the plaintiff.)”). Al-Ahmed’s position here has similarly 9 deficient. First, Al-Ahmed fails expressly to allege that he did not receive the notice in the 10 Complaint, which only discusses the insufficiencies of the notice. Second, Al-Ahmed merely 11 argues in his Opposition that he did not receive a notice despite carefully checking emails and that 12 he never received an in-app notification -- which he cannot confirm because of his account 13 suspension. Opp’n at 5. In any event, actual notice is not required for the statute of limitations to 14 begin to run. See Fox, 35 Cal. 4th 797, 807 (“A plaintiff has reason to discover a cause of action 15 when he or she has reason at least to suspect a factual basis for its elements.”). As in Abdulaziz I, 16 the fact that Al-Ahmed may not have received the notice does not prove that Twitter did not send 17 notices. Like Abdulaziz I, Al-Ahmed does not dispute Twitter provided a notification list showing 18 notice to Al-Ahmed. 19 Al-Ahmed’s ignorance of the identity of the perpetrators (being Twitter employees) does 20 not affect the statute of limitations, and ignorance of the cause of the action, which tolls the statute 21 of limitations, also fails. As the Court noted in Fox, 35 Cal. 4th 797, 807, “failure to discover, or 22 have reason to discover, the identity of the defendant does not postpone the accrual of a cause of 23 action, whereas a like failure concerning the cause of action itself does.” (Internal quotation marks 24 and citations omitted.) 25 According to Al-Ahmed, the alleged lack of notice resulted in the ignorance of the cause of 26 action, not the identity of the defendant. Opp’n at 5. However, when notified that his Twitter 27 account had been hacked, he had notice that Twitter may have been responsible in some way, e.g., 1 B263468, 2017 WL 432819, at *6 (Cal. Ct. App. Feb. 1, 2017); see also Guerrero v. S. California 2 Kaiser Permanente Med. Grp., No. B225999, 2011 WL 4375093, at *6 (Cal. Ct. App. Sept. 21, 3 2011) (plaintiff knew of the tortious conduct in 2005 even if he did not know the tortfeasor’s 4 employees; ignorance of the identity did not delay the running of the statute of limitations). 5 As the California Supreme Court stated, “the statute of limitations begins to run when the 6 plaintiff suspects or should suspect that her injury was caused by wrongdoing, that someone has 7 done something wrong to her.” Jolly v. Eli Lilly & Co., 44 Cal. 3d 1103, 1110 (1998). “The 8 [a]ggrieved parties generally need not know the exact manner in which their injuries were 9 effected, nor the identities of all parties who may have played a role therein.” Bernson v. 10 Browning-Ferris Industries, 7 Cal. 4th 926, 932 (1994)). The Ninth Circuit, quoting this 11 language, also explained that it is the knowledge of the injury, not the identity of the defendant or 12 the exact legal claim, that is required under California law:

13 [The plaintiff] knew about its injury in 2013 when it discovered the fraudulent accounts. It did not need to know the exact legal claim it 14 could bring against a specific defendant. Rather, it was enough that it had knowledge of the injury that gave rise to the claim. Any 15 liability it now claims against [the defendant] is derived from that injury in 2013. 16 17 Kyko Glob. Inc. v. Bhongir, No. 20-17526, 2021 WL 4958989, at *1 (9th Cir. Oct. 26, 2021). 18 Accordingly, the claims based on the unauthorized access of his account not saved by the 19 discovery rule are barred under the statute of limitations. 20 The parties discuss the delayed discovery rule solely under California law. However, even 21 if the federal discovery rule applies to the federal causes of action, there would be no meaningful 22 difference because “[t]he federal accrual standard is essentially the same as the discovery rule.” 23 Peterson v. Sutter Med. Found., No. 3:21-CV-04908-WHO, 2022 WL 316677, at *12 (N.D. Cal. 24 Feb. 2, 2022) (citing Lukovsky v. City & Cty. of San Francisco, 535 F.3d 1044, 1048 (9th Cir. 25 2008)); see also Mangum v. Action Collection Serv., Inc., 575 F.3d 935, 940 (9th Cir. 2009), 26 abrogated on other grounds by Rotkiske v. Klemm, 140 S. Ct. 355, 205 L. Ed. 2d 291 (2019) (“[A] 27 limitations period begins to run when the plaintiff knows or has reason to know of the injury 1 explained:

2 We pause to acknowledge that the statutes of limitations governing claims under the CFAA and SCA, as we understand them, may have 3 troubling consequences in some situations. Even after a prospective plaintiff discovers that an account has been hacked, the investigation 4 necessary to uncover the hacker’s identity may be substantial. In many cases, we suspect that it might take more than two years. But 5 it would appear that if a plaintiff cannot discover the hacker’s identity within two years of the date she discovers the damage or 6 violation, her claims under the CFAA and SCA will be untimely. 7 Sewell v. Bernardin, 795 F.3d 337, 342 (2d Cir. 2015); see also Radcliff v. Radcliff, No. CV 20- 8 3669, 2020 WL 7090687, at *5–7 (D.N.J. Dec. 4, 2020) (“[F]or statute of limitations purposes, a 9 CFAA claim starts to run when the plaintiff is aware of the alleged damage not when the plaintiff 10 learns exactly what has happened . . . [T]he main inquiry in determining when the statute of 11 limitation starts to accrue is when Plaintiff learned the integrity of her computer had been 12 compromised, even if the identity of the hacker was not known at the time.”). 13 Several cases illustrate why the statute of limitations began to run even if Al-Ahmed was 14 not aware of the precise roles of Twitter’s employees. In McGowan v. Weinstein, the plaintiff was 15 sexually assaulted by Weinstein, who learned that she planned to expose him as her rapist through 16 a memoir in 2016. 505 F. Supp. 3d 1000, 1007 (C.D. Cal. 2020). A private intelligence agency, 17 Black Cube, was hired by Weinsten and Boies, and supervised by Bloom, to put the negative 18 campaign against Weinstein. Id. Although the plaintiff found out Weinstein, Boies, and Black 19 Cubes’ involvement in 2017, she only learned about Bloom’s role in September 2019 through an 20 article. Id. at 1009. Nevertheless, the court found that the applicable statute of limitations for the 21 negligent hiring and supervision claim against both Boies and Bloom began in 2017 despite her 22 late knowledge of Bloom’s role because she failed to “plead facts to show . . . her inability to have 23 discovered the necessary information despite reasonable diligence.” Id. at 1025 (citing Fox, 35 24 Cal. 4th at 815). Like the plaintiff in Weinstein who alleged that she could not have discovered 25 Bloom’s role until the 2019 article, Al-Ahmed similarly argues that he could not have discovered 26 Twitter’s role until its employees’ indictment. If anything, Al-Ahmed had a stronger basis for 27 investigating Twitter compared to the Weinstein plaintiff, as Twitter was not a third party 1 breached. In fact, Al-Ahmed argues in the Opposition that Twitter “negligently supervised nearly 2 everyone who had unneeded access,” not just Abouammo and Alzabarah, because “it was 3 reasonably foreseeable that someone in a company with 3,900 employees might do this.” Opp’n 4 at 21-22. 5 Similarly, in Guerrero v. S. California Kaiser Permanente Med. Grp., a plaintiff sued an 6 employer for negligence and negligent hiring and supervision of their employee, who allegedly 7 stole the appellant's identity. No. B225999, 2011 WL 4375093, at *1 (Cal. Ct. App. Sept. 21, 8 2011). The plaintiff similarly argued that he had no proof of the employee’s identity until the 9 employee was criminally charged in 2006 and convicted in 2007. Id. at *3. Nevertheless, the 10 California Court of Appeals affirmed the trial court’s ruling that the claims were barred by the 11 statute of limitations because he knew of the tortious conduct in 2005 and that ignorance of the 12 identity did not delay the running of the statute of limitations. Id. at *6. The Court found that 13 there were sufficient facts at least for an inquiry notice to suspect Kaiser’s potential involvement. 14 Like Weinstein and Guerrero, Al-Ahmed was required to plead more to show that he was unable 15 to have made earlier discovery despite reasonable diligence. “[Conclusory allegations [do] not 16 withstand [dismissal].” Fox, 35 Cal. 4th 797, 808; see also Hall v. Wal-Mart Stores, Inc., No. CV 17 H-15-3523, 2017 WL 462053, at *1 (S.D. Tex. Feb. 1, 2017) (finding that the lack of knowledge 18 that an unknown perpetrator was a Wal-Mart employee did not save the plaintiff’s claim from the 19 statute of limitations because had knowledge of the harm and “ignorance of the identity of the 20 party responsible for an injury does not affect the running of the limitations period”). 21 b. Fraudulent Concealment 22 Al-Ahmed next argues that Twitter deliberately and fraudulently concealed its involvement 23 to avoid liability, tolling the statute of limitations.3 Id. at 6 (“[T]he doctrine of fraudulent 24 concealment tolls the statute of limitations where a defendant, through deceptive conduct, has 25 caused a claim to grow stale.” (citing Regents of the University of California v. Superior Court, 20 26 Cal.4th 509, 533 (1999))). 27 1 Under California’s fraudulent concealment doctrine, a defendant may be “estopped from 2 profiting from its own misconduct” by asserting a statute of limitations defense “when a diligent 3 plaintiff is unable to discover the defendant’s identity as a result of the defendant’s intentional 4 efforts to conceal the identity of the defendant.” Shively v. Bozanich, 31 Cal. 4th 1230, 1249, 80 5 P.3d 676, 687 (2003); Bernson, 7 Cal.4th at 930, 30 Cal.Rptr.2d 440, 873 P.2d 613. “For a 6 defendant to be equitably estopped from asserting a statute of limitations, the plaintiff must be 7 directly prevented . . . from filing [a] suit on time.” Vaca v. Wachovia Mortg. Corp., 198 Cal. 8 App. 4th 737, 746, 129 Cal. Rptr. 3d 354, 360 (2011) (alteration in original) (quotation marks and 9 citation omitted). Bernson’s standard “emphasiz[es] the burden on the plaintiff to demonstrate 10 reasonable diligence, including the filing of a complaint against known defendants.” Bernson, 7 11 Cal.4th at 937, 30 Cal.Rptr.2d 440, 873 P.2d 613. “One factor which must be considered pertinent 12 to the diligence inquiry is whether the filing of a timely Doe complaint would, as a practical 13 matter, have facilitated the discovery of the defendant’s identity within the [statute of 14 limitations].” Id. at 937, 30 Cal.Rptr.2d 440, 873 P.2d 613. Thus, “[w]here the identity of at least 15 one defendant is known, for example, the plaintiff must avail himself of the opportunity to file a 16 timely complaint naming Doe defendants and take discovery. However, where the facts are such 17 that even discovery cannot pierce a defendant’s intentional efforts to conceal his identity, the 18 plaintiff should not be penalized.” Id. 19 Al-Ahmed fails to allege any deceptive conduct by Twitter beyond the argument that 20 Twitter’s notice did not specify that its own employees were involved. Although Al-Ahmed 21 argues that “Twitter went through great lengths to conceal [its involvement and the identities of 22 the perpetrators,]” this assertion is conclusory and unsupported by facts. Opp’n at 6. On the 23 contrary, the December 2015 email and in-app notification provides sufficient notice of Al- 24 Ahmed’s injury as well as Twitter’s failure to protect his account from data breaches by state- 25 sponsored attacks. Al-Ahmed was aware of Twitter’s possible failure to implement policies and 26 safeguards to prevent data breaches, even if he was unaware of the full extent of Twitter’s conduct 27 via its employees who committed the breaches. He could have sought out the unknown hackers 1 Mgmt. Humanitarian Found. v. Laughrin, 400 F. App’x 250, 252 (9th Cir. 2010) (“Once the 2 plaintiff is aware of ‘a defendant,’ he can file a timely complaint naming Doe defendants and can 3 then utilize the available discovery tools to identify and serve any Doe defendants within the 4 applicable . . . statute of limitations.”). Discovery with Twitter likely would have led to the 5 discovery of the identities of the hackers. Therefore, this is not a case “where the facts are such 6 that even discovery cannot pierce a defendant’s intentional efforts to conceal his identity.” 7 Bernson, 7 Cal.4th at 937, 30 Cal.Rptr.2d 440, 873 P.2d 613. Accordingly, Al-Ahmed fails to 8 show any exercise of reasonable diligence, and the Court finds no fraudulent concealment by 9 Twitter. 10 3. The Continuous Accrual Doctrine 11 “[U]nder the theory of continuous accrual, a series of wrongs or injuries may be viewed as 12 each triggering its own limitations period, such that a suit for relief may be partially time-barred as 13 to older events but timely as to those within the applicable limitations period.” Aryeh v. Canon 14 Bus. Solutions, Inc., 55 Cal. 4th 1185, 1192, 292 P.3d at 876 (2013). Continuous accrual applies 15 when there is a continuing or recurring obligation, such as monthly billing and payments, with 16 each month triggering a new limitations period. Id. at 1199, 292 P.3d at 880 (“When an obligation 17 or liability arises on a recurring basis, a cause of action accrues each time a wrongful act occurs, 18 triggering a new limitations period.”) (citation omitted); see, e.g., Wolf v. Travolta, 167 F. Supp. 19 3d 1077, 1104–05 (C.D. Cal. 2016) (citing Tsemetzin v. Coast Fed. Sav. & Loan Assn., 57 Cal. 20 App. 4th 1334, 1344, 67 Cal. Rptr. 2d 726 (1997)); Armstrong Petroleum Corp. v. Tri-Valley Oil 21 & Gas Co., 116 Cal. App. 4th 1375, 1388–89, 11 Cal. Rptr. 3d 412 (2004). Therefore, the theory 22 of continuous accrual “would permit [the plaintiff] to sue, but only for those discrete acts 23 occurring within the [relevant limitations period] immediately preceding the filing of [the 24 plaintiff’s] suit.” Aryeh, 55 Cal. 4th at 1199–200, 292 P.3d at 881. 25 Al-Ahmed argues that the continuous accrual doctrine makes portions of his claims timely. 26 Opp’n at 6. According to Al-Ahmed, Twitter breached its contractual obligations contained in its 27 TOS (express and implied), including its obligation to preserve Al-Ahmed’s confidential sources 1 he has a reasonable expectation of privacy. Opp’n at 6–7. Al-Ahmed contends that Twitter 2 continues to breach its TOS by keeping Al-Ahmed’s Twitter account suspended, which constitutes 3 ongoing harms and liabilities that are “separate, recurring invasions of the same right [that] can 4 each trigger their own statute of limitations.” Id. at 7–8 (citing Aryeh at 1198). Al-Ahmed lists 5 Twitter’s ongoing wrongdoings as follows: 1) unlawfully accessing and disseminating his 6 confidential sources, list of followers, and other proprietary electronic data and intellectual 7 property, 2) suspending his Twitter account and withholding his sources and list of followers; 3) 8 breaching contractual obligations contained in Twitter’s TOS; 4) deliberately, negligently, or 9 recklessly employing operatives who continue to commit tortious acts against Al-Ahmed; 5) 10 engaging in fraud such as making materially false statements regarding its obligations to and 11 relationship with Al-Ahmed; and 6) violating Al-Ahmed’s First Amendment right to Free Speech 12 and Freedom of Assembly. Id. 13 Al-Ahmed’s attempt to characterize the above acts as continuously recurring invasions 14 fails. Rather, they are two distinct incidents: the unauthorized intrusion in 2015 and the 15 suspension of Al-Ahmed’s Twitter account in 2018. The continued suspension of the account 16 does not constitute a separate act, and “[w]ithout separate wrongful acts to trigger the statute of 17 limitations, continuous accrual does not apply.” Ryan v. Microsoft Corp., 147 F. Supp. 3d 868, 18 896-97 (N.D. Cal. 2015) (declining to apply rule where “alleged recurring injuries during the 19 limitations period arose out of a single transaction that occurred before the limitations period”). 20 Because both incidents are discrete and independent transactions, the continuous accrual doctrine 21 does not apply. The statute of limitations on the suspension is separate and distinct from the 22 limitations applicable to the hack. 23 For the foregoing reasons, all of Al-Ahmed’s claims against Twitter related to the 24 unauthorized intrusion of his Twitter account are barred by the statute of limitations. All claims 25 related to the 2018 account suspension are barred except any claims with a 4-year statute of 26 limitations since this suit was not filed until October 2021. Accordingly, only the breach of 27 contract claim, UCL claim, and the promissory estoppel claim based on the breach of contract, to 1 the extent that they are related to the 2018 account suspension, survive the time bar.4 However, 2 for the reasons stated below, those claims are barred by the CDA Section 230(c)(1). 3 E. CDA Section 230(c)(1) and Al-Ahmed’s Account Suspension-Related Claims 4 Twitter seeks immunity from Al-Ahmed’s account-suspension-related claims under CDA 5 Section 230(c)(1). Mot. at 15. Section 230(c), titled “Protection for “Good Samaritan” blocking 6 and screening of offensive material, provides:

7 (1) Treatment of publisher or speaker No provider or user of an interactive computer service shall be 8 treated as the publisher or speaker of any information provided by another information content provider. 9 (2) Civil liability 10 No provider or user of an interactive computer service shall be held liable on account of— 11 (A) any action voluntarily taken in good faith to restrict access 12 to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively 13 violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or 14 (B) any action taken to enable or make available to information content providers or others the technical means to restrict 15 access to material described in paragraph (1). 16 47 U.S.C.A. § 230. 17 In Section 230(b), Congress laid out the policies underlying this protection:

18 (b) Policy It is the policy of the United States— 19 (1) to promote the continued development of the Internet and other 20 interactive computer services and other interactive media;

21 (2) to preserve the vibrant and competitive free market that presently exists for the Internet and other interactive computer 22 services, unfettered by Federal or State regulation;

23 (3) to encourage the development of technologies which maximize user control over what information is received by individuals, 24 25 4 Civil conspiracy and unjust enrichment claims are similarly based on the underlying wrong but 26 are not premised on the breach of contract. See Complaint at 34–35; Opp’n at 35 (“Plaintiff’s cause of action for restitution [is] based on quasi-contract/unjust enrichment is cognizable under 27 California law as an alternative claim.”). Accordingly, the 4-year statutes of limitations do not families, and schools who use the Internet and other interactive 1 computer services;

2 (4) to remove disincentives for the development and utilization of blocking and filtering technologies that empower parents to 3 restrict their children’s access to objectionable or inappropriate online material; and 4 (5) to ensure vigorous enforcement of Federal criminal laws to deter 5 and punish trafficking in obscenity, stalking, and harassment by means of computer. 6 47 U.S.C. § 230. 7 Section 230 “provides internet companies with immunity from certain claims in order to 8 promote the continued development of the Internet and other interactive computer services.” 9 Lemmon v. Snap, Inc., 995 F.3d 1085, 1090–91 (9th Cir. 2021) (internal quotation marks and 10 citations omitted). This immunity “shields from liability those individuals or entities that operate 11 internet platforms, to the extent their platforms publish third-party content.” Id. 12 The Ninth Circuit explained: 13 Subsection (c)(1), by itself, shields from liability all publication 14 decisions, whether to edit, to remove, or to post, with respect to content generated entirely by third parties. Subsection (c)(2), for its 15 part, provides an additional shield from liability, but only for “any action voluntarily taken in good faith to restrict access to or 16 availability of material that the provider ... considers to be obscene ... or otherwise objectionable.” § 230(c)(2)(A). Crucially, the 17 persons who can take advantage of this liability shield are not merely those whom subsection (c)(1) already protects, but any 18 provider of an interactive computer service. See § 230(c)(2). Thus, even those who cannot take advantage of subsection (c)(1), perhaps 19 because they developed, even in part, the content at issue, see Roommates, 521 F.3d at 1162–63, can take advantage of subsection 20 (c)(2) if they act to restrict access to the content because they consider it obscene or otherwise objectionable. Additionally, 21 subsection (c)(2) also protects internet service providers from liability not for publishing or speaking, but rather for actions taken 22 to restrict access to obscene or otherwise objectionable content. 23 Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009) (finding that a claim alleging defendant’s 24 failure to remove content was barred by Section 230(c)(1). As such, decisions to remove a user’s 25 posting is also considered a publishing decision which “involves reviewing, editing, and deciding 26 whether to publish or to withdraw from publication third-party content.” Id. at 1102. 27 To determine whether § 230(c)(1) applies, the Ninth Circuit set a three-prong test. Id. at 1 of an interactive computer service (2) whom a plaintiff seeks to treat, under a state law cause of 2 action, as a publisher or speaker (3) of information provided by another information content 3 provider.” Lemmon, 995 F.3d at 1090–91. 4 The first prong is satisfied and undisputed by the parties. “Information content provider” 5 is defined to include “any person or entity that is responsible, in whole or in part, for the creation 6 or development of information provided through the Internet or any other interactive computer 7 service.” 47 U.S.C. § 230(f)(3). “Twitter is a social media platform and provides the prototypical 8 service entitling it to protections of [Section 230]” and “[e]very decision the Court has seen to 9 consider the issue has treated Twitter as an interactive computer service provider, even at the 10 motion to dismiss stage.” Morton v. Twitter, Inc., No. CV 20-10434-GW-JEMX, 2021 WL 11 1181753, at *3 (C.D. Cal. Feb. 19, 2021) (internal quotation marks and citation omitted). 12 The second and third prongs are also satisfied. Al-Ahmed’s claims against Twitter are 13 related to the suspension of his account. As discussed above, removal of posts and accounts of a 14 user is generally considered as treating the information content provider as a publisher. See 15 Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1109 (9th Cir. 2009) (finding that the removal of social 16 media content falls under Section 230(c)(1)); see also King v. Facebook, Inc., No. 21-CV-04573- 17 EMC, 2021 WL 5279823, at *1 (N.D. Cal. Nov. 12, 2021) (finding that claims relating to 18 disabling of accounts fall under Section 230(c)(1)). 19 1. The Policies of Section 230 20 Al-Ahmed offers several arguments why Section 230 immunity should not apply. Al- 21 Ahmed’s main argument is that Twitter’s attempt to invoke statutory immunity under Section 22 230(c) runs afoul of the policies and the fundamental purposes of the CDA. Opp’n at 11. First, 23 Al-Ahmed argues that the Ninth Circuit has been dubious of large Internet companies seeking 24 special privileges under the CDA. He quotes Fair Hous. Council of San Fernando Valley v. 25 Roommates.com, LLC, 521 F.3d 1157, 1164, n.15 (9th Cir.2008), stating, “The [CDA] was not 26 meant to create a lawless no-man’s land on the Internet.” However, Roommates is inapposite 27 because it concerned a housing website’s questionnaire that requires disclosure of the subscriber’s 1 The Ninth Circuit found that the posting of the questionnaires was the website’s own act and that 2 the “CDA does not grant immunity for inducing third parties to express illegal preferences.” Id. at 3 1165. The claim here does not involve Twitter posting as its own unlawful content. 4 Al-Ahmed also points to Justice Thomas’s concurrence in Malwarebytes, which expressed 5 concerns that Section 230(c) under the Ninth Circuit’s expansive scope confers sweeping 6 immunity that warrants revisitation in an appropriate case. Opp’n 9-10 (citing Malwarebytes, Inc. 7 v. Enigma Software Grp. USA, LLC, 141 S. Ct. 13, 18, 208 L. Ed. 2d 197 (2020)). As this Court 8 discussed in King, Justice Thomas’s concurrence does not constitute binding authority – it is a 9 nonbinding concurrence. King, 2021 WL 5279823, at *10, *13. 10 Second, Al-Ahmed argues that immunity, applied to this case, would run contrary to the 11 policy of protecting children from exposure to pornographic and obscene material, which he 12 argues is the principal aim of Section 230. Opp’n at 11–12 (citing Section 230(b)(4)). According 13 to Al-Ahmed, the suspension of his Twitter account, which bears no relationship to obscene 14 materials, would render such policies illogical. Id. However, while it is true that Sections (b)(4)– 15 (5) seek to enable filtering obscene materials and ensure their enforcement, the policies underlying 16 Section 230 are not limited to obscene materials. For instance, Sections (b)(1)–(2) states: “[i]t is 17 the policy of the United States – to promote the continued development of the Internet and other 18 interactive computer services and other interactive media” and “preserve the vibrant and 19 competitive free market that presently exists for the Internet . . . unfettered by Federal or State 20 regulation.” 47 U.S.C. § 230(b). 21 In a similar vein, Al-Ahmed argues that because “the statute is intended to immunize an 22 interactive service provider for engaging in tradition editorial functions in a public forum,” it 23 “could never have been contemplated by the legislature to protect against or require the policing of 24 private exchanges that are very much equivalent to private texts, phone calls or emails.” Opp’n at 25 12–13. However, Al-Ahmed fails to cite any authority that limits protected editorial functions to 26 material published in a public forum. Al-Ahmed cites a single Second Circuit case, Force v. 27 Facebook, Inc., 934 F.3d 53 (2d Cir. 2019), which merely notes that the word “publisher” is 1 a California court specifically discussed this issue and came to the opposite conclusion as follows:

2 Plaintiffs' other attempt to evade section 230(c)(1) is based on Twitter's Direct Messaging capabilities, which allow for the sending 3 of private messages through the Twitter platform. Plaintiffs contend that publishing activity under section 230(c)(1) “necessarily 4 involves the dissemination of information to the public” and thus does not encompass the transmission of private messages through 5 Direct Messaging. . . . 6 I am not persuaded that publishing activity under section 230(c)(1) 7 does not extend to Twitter's Direct Messaging capabilities. As noted above, Congress enacted section 230(c)(1) in part to respond to a 8 New York state court decision finding that an internet service provider could be held liable for defamation based on third-party 9 content posted on its message boards. In defamation law, the term “publication” means “communication [of the defamatory matter] 10 intentionally or by a negligent act to one other than the person defamed.” The Fourth Circuit has held that an internet service 11 provider covered by the “traditional definition” of publisher is protected by section 230(c)(1). And while the Ninth Circuit has 12 declined to construe “the reach of section 230(c)(1) [as] fastened ... tightly to the nuances of defamation law,” the court has also 13 indicated that the statute's protections extend at least as far as the “treat[ment] [of] internet service providers as publishers ... for the 14 purposes of defamation.” Under this analysis, the private nature of Direct Messaging does not remove the transmission of such 15 messages from the scope of publishing activity under section 230(c)(1). 16 17 Fields v. Twitter, Inc., 200 F. Supp. 3d 964, 974–75 (N.D. Cal. 2016) (citations omitted). 18 Third, Al-Ahmed argues that Twitter’s suspension of his account suppresses the 19 dissemination of free speech by “terminat[ing]/suspend[ing] the account of a prominent journalist 20 democracy advocate against its most notable shareholders, the KSA[,]” which runs counter to the 21 policy of “remov[ing] disincentives [to filter objectionable content.]” Id. at 13. Although Al- 22 Ahmed’s argument is not entirely clear, the CDA contemplates the ability of services like Twitter 23 to employ filtering processes. 24 2. The Application of Section 230 25 Al-Ahmed next argues that a defendant who assists in the development of what made the 26 content unlawful is not protected under Section 230. Id. (citing Fed. Trade Comm’n v. LeadClick 27 Media, LLC, 838 F.3d 158, 174 (2d Cir. 2016) (“A defendant . . . will not be held responsible 1 Inc., 570 F.3d 1187, 1199 (10th Cir, 2009)); Fair Hous. Council v. Roomates.com, LLC, 521 F.3d 2 1157, 1167–68 (holding the defendant liable when it had questionnaires “not merely… 3 augmenting the content generally, but…materially contributing to its alleged unlawfulness”)). 4 However, the cases cited by Al-Ahmed are inapposite. Roomates.com is inapposite because the 5 defendant, in that case, created and posted the questionnaire in question, thus inducing illegal acts 6 of third parties. Roomates.com, LLC, 521 F.3d at 1165. Likewise, the defendant in LeadClick 7 Media participated in the development of its affiliates’ deceptive websites, “materially 8 contributing to [the content’s] alleged unlawfulness.” LeadClick Media, 838 F.3d at 176. Unlike 9 Roomates.com and LeadClick Media, Twitter has not participated in the development of deceptive 10 websites or required its subscribers to give information that would induce third parties to violate 11 laws. Twitter seeks immunity for claims only in relation to the suspension of accounts of third 12 party speakers. 13 Al-Ahmed next argues that Twitter cannot claim immunity under Section 230(c)(2) 14 because it failed to demonstrate good faith. Opp’n at 14. However, this argument is irrelevant 15 because Twitter seeks immunity under Section 230(c)(1), which does not have a good faith 16 requirement, and does not seek immunity under Section 230(c)(2), which requires good faith. 17 Levitt v. Yelp! Inc., No. C-10-1321 EMC, 2011 WL 5079526, at *7 (N.D. Cal. Oct. 26, 2011), 18 aff’d, 765 F.3d 1123 (9th Cir. 2014) (finding that while Section 230(c)(2) has a good-faith 19 requirement, (c)(1) has no such requirement). 20 Some courts in other districts have declined to extend Section 230(c)(1) to cases in which 21 the user brought claims based on their own content, not a third party’s, on the ground that it would 22 render the good faith requirement of Section 230(c)(2) superfluous. See, e.g., e-ventures 23 Worldwide, LLC v. Google, Inc., No. 2:14-cv-646-FtM-PAM-CM, 2017 WL 2210029, at *3 24 (M.D. Fl. Feb. 8, 2017). However, although a Florida court found the lack of this distinction to be 25 problematic, it also noted that other courts, including those in this district, “have found that CDA 26 immunity attaches when the content involved was created by the plaintiff.” Id. (citing Sikhs for 27 Just., Inc. v. Facebook, Inc., 697 F. App’x 526 (9th Cir. 2017) (affirming dismissal of the 1 230(c)(1)). 2 The California case cited by the Florida court, Sikhs, specifically addressed this issue. The 3 plaintiff had argued that there was no “third-party content” because it was the plaintiff who 4 created allegedly blocked Facebook page. Sikhs for Just. “SFJ”, Inc. v. Facebook, Inc., 144 F. 5 Supp. 3d 1088, 1093 (N.D. Cal. 2015), aff’d sub nom. Sikhs for Just., 697 F. App’x 526. The 6 court disagreed and analyzed the language of § 230(c)(1) as follows:

7 [I]t appears that Plaintiff denies the existence of “third-party content” because there are only two parties in this litigation, Plaintiff 8 and Defendant. . . .

9 However, Plaintiff misunderstands the CDA. By its terms, the CDA precludes publisher liability against an interactive computer service 10 for content created by “another information content provider.” 47 U.S.C. § 230(c)(1). An “information content provider” is defined as 11 “any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the 12 Internet or any other interactive computer service.” Id. § 230(f)(3). . . . 13 [T]he CDA immunizes an interactive computer service provider that 14 “passively displays content that is created entirely by third parties,” but not an interactive computer service provider that acts as an 15 information content provider by creating or developing the content at issue. Roommates, 521 F.3d at 1162. Put another way, “third- 16 party content” is used to refer to content created entirely by individuals or entities other than the interactive computer service 17 provider. See id. By contrast, the number of parties in a given litigation is irrelevant to CDA immunity. 18 In this case, the complaint asserts that the . . . Page was provided by 19 Plaintiff, not Defendant. Compl. at 1, 7. . . . By contrast, the complaint nowhere alleges that Defendant provided, created, or 20 developed any portion or content of the . . . Page. . . Instead, Plaintiff argues that “the content belongs to [Plaintiff] and was put 21 on Defendant's online platform.” Opp. at 3. Accordingly, only Plaintiff, not Defendant, acts as an information content provider in 22 this case. As a result, the . . . Page, which was created entirely by Plaintiff, is “information provided by another information content 23 provider” within the meaning of § 230. See Roommates, 521 F.3d at 1162. 24 25 Id. Other courts in this district and the Ninth Circuit have similarly applied Section 230(c)(1) to 26 claims where a user’s own content was removed. See also Riggs v. MySpace, Inc., 444 F. App’x 27 986, 987 (9th Cir. 2011) (affirming dismissal under Section 230(c)(1) claims based on the removal 1 whether to exclude material that third parties seek to post online is perforce immune under section 2 230” (quoting Roommates, 521 F.3d at 1164, n.15, 1170–71; see also Murphy v. Twitter, Inc., 60 3 Cal. App. 5th 12, 27, 274 Cal. Rptr. 3d 360, 370 (2021). As such, the Court follows the approach 4 taken by others this district and applies Section 230(c)(1) to allegations of removal of a user’s 5 content. Because Section 230(c)(1) applies here, and Twitter is not required to demonstrate good 6 faith. 7 As the California Court of Appeal noted in Murphy, 60 Cal. App. at 27, 274 Cal. Rptr. 3d 8 at 370, “[c]ourts have routinely rejected a wide variety of civil claims like [the plaintiff’s] that 9 seek to hold interactive computer services liable for removing or blocking content or suspending 10 or deleting accounts (or failing to do so) on the grounds they are barred by the CDA.” The court 11 found it was proper to dismiss plaintiff’s claims of breach of contract, promissory estoppel, and 12 violation of the UCL claims as barred under section 230(c)(1)). 13 This Court’s decision in King v. Facebook closely mirrors this case. In King, the plaintiff 14 had a personal account with about 1,000 friends who shared both political and nonpolitical 15 information. King, 2021 WL 5279823, at *1. The account was disabled by Facebook. This Court 16 held that Facebook had CDA immunity under Section 230(c)(1) to the extent his contract and 17 implied covenant claims were based on Facebook’s disabling of the plaintiff’s account. This 18 Court held, however, that CDA immunity did not apply to the extent that the claim was based on 19 Facebook’s failure to provide an explanation for the disabling of the account. Id. at 13. The court 20 reasoned that this specific claim was tied to an implied promise to explain its decision that does 21 not depend on Facebook’s status as a publisher. Id. (the terms of service stated: “[wh]ere we take 22 such action [account suspension or termination] we’ll let you know and explain any options you 23 have to request a review”). Id. at *8. 24 Accordingly, Twitter’s immunity extends to all of Al-Ahmed’s suspension-based claims, 25 but not his breach of contract claim based on Twitter’s failure to provide adequate justification for 26 the suspension and to adequately or meaningfully address and consider his appeal from the 27 suspension of his account. Nevertheless, this claim fails because Al-Ahmed fails to articulate any 1 Unlike Facebook’s terms of service in King, Al-Ahmed’s Complaint does not point to, and 2 Twitter’s TOS does not seem to include or imply a similar provision that would constitute a 3 promise to address any suspensions and appeal them. Therefore, this remaining claim is also 4 dismissed. 5 V. CONCLUSION 6 For the foregoing reasons, the Court GRANTS Twitter’s motion to dismiss in its entirety. 7 Al-Ahmed seeks leave to amend the Complaint to allege a Lanham Act claim that falls within the 8 scope of the CDA’s intellectual property exception. See 47 U.S.C. § 230(e)(2) (“Nothing in [§ 9 230] shall be construed to limit or expand any law pertaining to intellectual property.”); see 10 Enigma Software Grp. USA, LLC v. Malwarebytes, Inc., 946 F.3d 1040, 1053 (9th Cir. 2019) 11 (discussing that § 230(e)(2)’s exception may apply to Lanham claims involving intellectual 12 property).5 The First Amended Complaint, if any, is due within thirty (30) days of the date of this 13 order. 14 This order disposes of Docket No. 30. 15 16 IT IS SO ORDERED. 17 18 Dated: May 20, 2022 19 20 ______________________________________

EDWARD M. CHEN

21 United States District Judge 22 23 24 25 26

27 5 Courts have found that some Lanham Act claims fall within the scope of the CDA’s intellectual