1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 8 M.K., a minor by and through his guardian Case No. 21-cv-08465-VKD ad litem Melanie Kirksey, 9 Plaintiff, ORDER GRANTING GOOGLE LLC’S 10 MOTION TO DISMISS THE v. COMPLAINT 11 GOOGLE LLC and FREMONT UNIFIED Re: Dkt. No. 33 12 SCHOOL DISTRICT, Defendants. 13 14 Plaintiff M.K., through his mother as guardian ad litem, sues Google, LLC (“Google”) and 15 the Fremont Unified School District (“District”), alleging that defendants violated his right to 16 privacy through a Google platform used for remote learning during the COVID-19 pandemic. 17 Google moves pursuant to Rule 12(b)(6) to dismiss the complaint. M.K. opposes the motion. 18 Upon consideration of the moving and responding papers, as well as the oral arguments presented, 19 the Court grants Google’s motion to dismiss the complaint, with leave to amend.1 20 I. BACKGROUND 21 The following background facts are based on the allegations of the complaint. 22 M.K. is a minor who attends a public elementary school in the District. Dkt. No. 1 ¶ 1. In 23 March 2020, due to the COVID-19 pandemic, M.K. began attending school remotely through a 24 Google platform that allowed schools and students to transition to “online and internet based 25 systems to access their education.” Id. ¶¶ 1-3. According to the complaint, “[p]arents were not 26

27 1 All parties have expressly consented that all proceedings in this matter may be heard and finally 1 given an option to opt out or an alternative to receive education if they did not wish to risk their 2 child’s privacy.” Id. ¶ 3. The complaint further alleges that “[w]ithout notice to parents Google 3 has collected troves of personal information, including: M.K.’s physical locations, websites 4 visited, every search term used in Google’s search engine and links clicked on, the videos 5 watched, voice recordings, saved passwords, biometrics and other behavioral information.” Id. 6 ¶ 6. 7 M.K. alleges, on information and belief, that his “device was hacked in January 2021 and 8 the hacker sent sexually explicit content to [his] classroom teacher.” Id. ¶ 7. The content 9 reportedly sent by the hacker “was linked to M.K.,” and M.K. was both exposed to, and 10 disciplined for, that content. Id. The complaint further alleges, on information and belief, that 11 “Google will log the hacker’s explicit conduct as conduct of M.K.” and that M.K. “has no means 12 of clearing his reputation and ensuring that data associated with him and [sic] is his data.” Id. ¶ 8. 13 According to M.K., “Google and [the District] failed to inform teachers, school staff and 14 parents of the risk of stalking or hacking into the classroom.” Id. ¶ 7. Google allegedly failed to 15 “provide the school with full notice of its collection, use, and disclosure practices” and did not 16 “enable [learning education agencies] to review and have deleted the personal information 17 collected from its students.” Id. ¶¶ 11, 14. As such, the District reportedly “could not consent to 18 Google’s collection of data[.]” Id. ¶ 14. M.K. states that the District failed “to inform parent[s] of 19 what Google would collect and use” and of “the security risks” presented by “predators and 20 hackers while in online classrooms,” and “failed to obtain parental consent.” Id. ¶¶ 11, 14, 15. 21 Reportedly, neither defendant informed parents that M.K.’s “biometric data would be collected 22 and stored[.]” Id. ¶ 14. 23 The complaint asserts five claims for relief for alleged violation of the federal Video 24 Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710 (claim 1); violation of the California Student 25 Online Personal Information Protection Act (“SOPIPA”), Cal. Bus. & Prof. Code § 22584 (claim 26 2); violation of California’s unfair competition law (“UCL”), Cal. Bus. & Prof. Code § 17200, et 27 seq. (claim 3); “Failure to Protect” (claim 4); and violation of the California constitutional right to 1 privacy (claim 5).2 The complaint seeks damages, as well as injunctive relief, including “an order 2 requiring Google to permanently destroy the biometric identifiers and biometric information it has 3 collected from [M.K.].” Id. at 14. 4 Google moves pursuant to Rule 12(b)(6) to dismiss each of M.K.’s claims for relief. With 5 respect to the VPPA claim, Google argues that the complaint fails to state sufficient facts 6 establishing a plausible claim for relief. As for the remaining claims, Google contends that they 7 are preempted by the federal Children’s Online Privacy Protection Act of 1998 (“COPPA”), and 8 that the complaint fails, in any event, to state sufficient facts supporting plausible claims for relief. 9 For the reasons discussed below, the Court dismisses M.K.’s claims for failure to state a claim for 10 relief. 11 II. LEGAL STANDARD 12 A motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) tests the legal 13 sufficiency of the claims in the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). 14 Dismissal is appropriate where there is no cognizable legal theory or an absence of sufficient facts 15 alleged to support a cognizable legal theory. Id. (citing Balistreri v. Pacifica Police Dep’t, 901 16 F.2d 696, 699 (9th Cir. 1990)). In such a motion, all material allegations in the complaint must be 17 taken as true and construed in the light most favorable to the claimant. Id. 18 However, “[t]hreadbare recitals of the elements of a cause of action, supported by mere 19 conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Moreover, 20 “the court is not required to accept legal conclusions cast in the form of factual allegations if those 21 conclusions cannot reasonably be drawn from the facts alleged.” Clegg v. Cult Awareness 22 Network, 18 F.3d 752, 754-55 (9th Cir. 1994). 23 Rule 8(a)(2) requires only “a short and plain statement of the claim showing that the 24 pleader is entitled to relief.” This means that the “[f]actual allegations must be enough to raise a 25 right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 26 2 Although the complaint did not clearly indicate which claims are asserted against each 27 defendant, M.K. subsequently confirmed that the VPPA and UCL claims are asserted only against 1 (2007) (citations omitted). However, only plausible claims for relief will survive a motion to 2 dismiss. Iqbal, 556 U.S. at 679. A claim is plausible if its factual content permits the court to 3 draw a reasonable inference that the defendant is liable for the alleged misconduct. Id. A plaintiff 4 does not have to provide detailed facts, but the pleading must include “more than an unadorned, 5 the-defendant-unlawfully-harmed-me accusation.” Id. at 678. 6 Documents appended to or incorporated into the complaint or which properly are the 7 subject of judicial notice may be considered along with the complaint when deciding a Rule 8 12(b)(6) motion. Khoja v. Orexigen Therapeutics, 899 F.3d 988, 998 (9th Cir. 2018); Coto 9 Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010).3 10 III. DISCUSSION 11 A. Claim 1: VPPA, 18 U.S.C. § 2710 12 The VPPA prohibits “[a] video tape service provider” from “knowingly disclos[ing], to 13 any person, personally identifiable information concerning any consumer of such provider[.]” 14 18 U.S.C. § 2710(b)(1). That provision “protects generally a consumer’s substantive privacy 15 interest in his or her video-viewing history.” Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th 16 Cir. 2017). In relevant part, the statute defines the term “video tape service provider” to mean 17 “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, 18 sale, or delivery of prerecorded video cassette tapes or similar audio visual materials[.]” 18 U.S.C. 19 § 2710(a)(4). The VPPA defines the term “consumer” as “any renter, purchaser, or subscriber of 20 goods or services from a video tape service provider.” Id. § 2710(a)(1). The VPPA defines 21 “personally identifiable information” to “include[] information which identifies a person as having 22 requested or obtained specific video materials or services from a video tape service provider.” Id. 23 § 2710(a)(3). To plead a plausible claim under section 2710(b)(1), M.K. must allege that 24 (1) Google is a “video service provider,” (2) M.K. is a “consumer,” (3) Google knowingly 25 disclosed his “personally identifiable information” to “any person,” and (4) the disclosure was not 26

27 3 The Court does not find it necessary or appropriate to consider materials submitted by Google 1 authorized by section 2710(b)(2). See Mollett v. Netflix, Inc., 795 F.3d 1062, 1066 (9th Cir. 2 2015); Stark v. Patreon, Inc., — F. Supp. 3d —, No. 22-cv-03131-JCS, 2022 WL 7652166, at *5 3 (N.D. Cal. Oct. 13, 2022). 4 Even under liberal pleading standards, M.K.’s complaint fails to state facts plausibly 5 establishing the elements of a VPPA claim. The complaint does not allege any facts that M.K. 6 watched videos, or the circumstances under which that occurred, except for highly generalized 7 allegations that Google collected various pieces of information about him, including “videos 8 watched.” See Dkt. No. 1 ¶ 6; see also id. ¶¶ 25, 52, 58. There are no facts alleged about the 9 platform, application, or website M.K. reportedly used to watch videos, or any facts from which 10 the Court plausibly could infer that M.K. is a “consumer” and Google is a “video tape service 11 provider” within the meaning of the VPPA. Instead, M.K. alleges, in formulaic language that 12 largely parrots the language of the VPPA, that that “[a]s users [sic] of the App, [M.K.] is a 13 consumers [sic] within the definition of 18 U.S.C. § 2710(a)(1) of the VPPA,” and that Google 14 “delivers pre-recorded audio visual materials as described in 18 U.S.C. § 2710(a)(4) and is 15 engaged in the business, or affecting interstate or foreign commerce, of rental, sale, or delivery of 16 prerecorded video cassette tapes or similar audio-visual materials delivering videos to consumers 17 through its applications and platforms.” Id. ¶¶ 35, 36. The complaint does not identify what 18 “App” is being referred to, and other allegations that M.K. highlights in his opposition brief 19 simply state that he used a Google platform for remote learning during the COVID-19 pandemic; 20 his account was hacked; and “his teacher received sexually inappropriate messages which were 21 attributed to [him][.]” See id. ¶¶ 1-3, 48-50. The complaint alleges, in equally conclusory fashion, 22 that Google “collected consumers[’] personally identifiable information (‘PII’) within 18 U.S.C. 23 § 2710(a)(3),” and “upon information and belief,” Google disclosed such information to 24 unidentified “third-parties, including data brokers and advertisers[.]” Id. ¶¶ 37, 38. There are no 25 facts linking these allegations to M.K., much less identifying what “personally identifiable 26 information” Google allegedly disclosed, or to whom such information was disclosed. In sum, 27 M.K.’s complaint fails to plead facts establishing the foundational requirements for a VPPA claim. 1 For the first time in his opposition, M.K. asserts that he “was given a Google based 2 account through [the District] and he accessed videos through Google on that account.” Dkt. No. 3 45 at 9. He further states that “Google delivered videos to [him], student’s [G]oogle chrome book 4 and account connect him to videos watched[,] and his teacher and district staff were given access 5 to what [he] watched and when it was being watched.” Id. No such facts are alleged in the 6 complaint. M.K. also requests leave to amend “to clarify that [his] school reviewed his online 7 activity and informed parents of that review.” Id. at 10. Google maintains that such allegations, 8 even if credited, would not state a plausible VPPA claim, or would be subject to a statutory 9 exception to liability. See Dkt. No. 47 at 8. While it remains unclear precisely what facts M.K. 10 believes he can assert on amendment to correct the identified pleading deficiencies, on this record 11 the Court cannot conclude that amendment will be futile. Accordingly, M.K. is given leave to 12 amend his VPPA claim. 13 B. COPPA Preemption 14 Google moves to dismiss M.K.’s state and common law claims for relief on the ground that 15 they are all expressly preempted by COPPA. See Dkt. No. 33 at 12-14; Dkt. No. 47 at 3-16. 16 Google’s preemption argument is based on the premise that M.K. cannot sue under state or 17 common law claims to privately enforce violations of COPPA. The current rule in the Ninth 18 Circuit is that “COPPA’s preemption clause does not bar state-law causes of action that are 19 parallel to, or proscribe the same conduct forbidden by, COPPA.” Jones v. Google LLC, 56 F.4th 20 735, 741 (9th Cir. 2022).4 Accordingly, Google’s motion to dismiss M.K.’s state and common 21 law claims for relief based on express preemption under COPPA is denied. 22 C. Failure to State a Claim for Relief 23 Google maintains that even if they are not preempted by COPPA, each of M.K.’s state law 24 and common law claims must be dismissed because the complaint fails to adequately allege facts 25 supporting a plausible claim for relief. For the reasons discussed below, the Court agrees. 26

27 4 The Court understands that there is a pending request before the Ninth Circuit for a rehearing in 1 1. SOPIPA, Cal. Bus. & Prof. Code § 22584 2 SOPIPA prohibits an “operator”5 from engaging in certain activities, and also imposes 3 certain duties, with respect to students in kindergarten through the twelfth grade. For example, the 4 statute prohibits an operator from “[u]s[ing] information, including persistent unique identifiers, 5 created or gathered by the operator’s site, service, or application, to amass a profile about a K-12 6 student except in furtherance of K-12 school purposes”; “[s]ell[ing] a student’s information”; or 7 disclosing certain information about the student. See Cal. Bus. & Prof. Code § 22584(b)(1)(A)(2), 8 (3), (4). SOPIPA also requires an operator to, among other things, “[i]mplement and maintain 9 reasonable security procedures and practices appropriate to the nature of the covered information, 10 and protect that information from unauthorized access, destruction, use, modification, or 11 disclosure,” and to “[d]elete a student’s covered information if the school or district requests 12 deletion of data under the control of the school or district.” Id. § 22584(d)(1), (2). 13 Google argues that the complaint’s allegations are vague and unsupported by sufficiently 14 specific facts. M.K. offers no argument to the contrary. See Dkt. No. 45 at 10-12. Indeed, the 15 complaint alleges “upon information and belief” that “Google has collected personal information 16 including behavioral information and biometric data for purposes that do not further school 17 purposes.” Dkt. No. 1 ¶ 46. While the complaint elsewhere asserts (on information and belief) 18 various ways in which Google might collect a student’s biometric data (Dkt. No. 1 ¶ 58), M.K. 19 alleges no facts explaining how or why he believes that Google collected his biometric 20 information. To the extent M.K.’s claim is based on the alleged hacking incident (see id. ¶ 48), 21 the complaint contains no facts explaining what role, if any, Google played in that event. The 22 complaint contains no allegations that would permit a plausible inference that Google failed to 23 implement and maintain reasonable security procedures and practices. Accordingly, M.K.’s 24 SOPIPA claim is dismissed. 25 Arguing that there is no private right of action under SOPIPA, Google contends that this 26 5 SOPIPA defines the term “operator” to mean “the operator of an Internet Web site, online 27 service, online application, or mobile application with actual knowledge that the site, service, or 1 claim must be dismissed without leave to amend. The parties have not cited, and the Court has not 2 found, any authority discussing SOPIPA § 22584. And neither M.K. nor Google has engaged in 3 the kind of analysis that would allow the Court to make an informed decision about whether there 4 is a private right of action under the statute, or whether any such right properly could be implied. 5 Accordingly, and assuming (without deciding) that M.K. can privately enforce alleged violations 6 of SOPIPA, the Court will give him leave to amend. To the extent M.K. contends that he can, in 7 any event, enforce SOPIPA violations through California’s UCL, his UCL claim is discussed 8 below. 9 2. UCL, Cal. Bus. & Prof. Code § 17200, et seq. 10 California’s UCL broadly defines “unfair competition” to “include any unlawful, unfair or 11 fraudulent business act or practice . . ..” Cal. Bus. & Prof. Code § 17200. “Its purpose is to protect 12 both consumers and competitors by promoting fair competition in commercial markets for goods 13 and services.” Kwikset v. Super. Ct., 51 Cal. 4th 310, 320 (2011) (internal quotations and citation 14 omitted). “Because Business and Professions Code section 17200 is written in the disjunctive, it 15 establishes three varieties of unfair competition—acts or practices which are unlawful, or unfair, 16 or fraudulent. In other words, a practice is prohibited as unfair or deceptive even if not unlawful 17 and vice versa.” Cel-Tech Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 20 Cal. 4th 163, 180 18 (1999) (internal quotations and citations omitted). 19 Although M.K.’s complaint makes passing reference to “deceptive” conduct (see Dkt. No. 20 1 ¶¶ 66, 70), M.K.’s allegations and arguments focus on the “unlawful” and “unfair” prongs of the 21 UCL. His overall thesis appears to be that Google unlawfully collected and stored his personal 22 information. See, e.g., Dkt. No. 1 ¶¶ 52, 58, 62, 67, 72. 23 The Court agrees with Google that, as a threshold matter, M.K.’s UCL claim fails because 24 he has not alleged facts establishing his standing to bring such a claim. “While the substantive 25 reach of [the UCL] remains expansive,” to establish standing to enforce the UCL’s provisions, a 26 plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as 27 injury in fact, i.e., economic injury, and (2) show that that economic injury was the result of, i.e., 1 Kwikset Corp., 51 Cal. 4th at 322; see also Cal. Bus. & Prof. Code § 17204 (“Actions for relief 2 pursuant to this chapter shall be prosecuted exclusively in a court of competent jurisdiction . . . by 3 a person who has suffered an injury in fact and has lost money or property as a result of the unfair 4 competition.”). Standing to bring a UCL claim therefore is “substantially narrower than federal 5 standing under article III, section 2 of the United States Constitution, which may be predicated on 6 a broader range of injuries.” Kwikset Corp., 51 Cal. 4th at 324. 7 To the extent M.K.’s complaint appears to base his standing on the alleged collection and 8 storage of his personal information (see Dkt. No. 1 ¶¶ 52, 58, 62, 67, 72), courts have held that 9 “[a] plaintiff’s ‘personal information’ does not constitute property under the UCL.” In re 10 Facebook Priv. Litig., 791 F. Supp. 2d 705, 714 (N.D. Cal. 2011), aff’d, 572 F. App’x 494 (9th 11 Cir. 2014); see also Archer v. United Rentals, Inc., 195 Cal. App. 4th 807, 816 (2011) (dismissing 12 UCL invasion of privacy claim based on “the unlawful collection and recordation of [plaintiffs’] 13 personal identification information” because plaintiffs “failed to demonstrate how such privacy 14 violation translates into a loss of money or property.”). M.K. offers no argument or authority to 15 the contrary. 16 Instead, M.K. argues that he “has a property interest in education,” and that the alleged 17 “damage to his reputation resulted in loss of actual education and class time.” See Dkt. No. 45 at 18 12 (citing Goss v. Lopez, 419 U.S. 565, 574 (1975)). Goss held that students have a property 19 interest in public education protected by the Due Process Clause of the Fourteenth Amendment. 20 Goss, 419 U.S. at 574. M.K. has not presented any argument or authority recognizing that the 21 alleged harms to that interest or to his reputation constitute “a loss of money or property” required 22 to establish standing to enforce the UCL. For the first time in his opposition brief, M.K. argues 23 that his parents were “required to fund tutors for [him] after he was removed by his teacher for 24 online conduct associated to his account” and “to escape the tracking and collection of data[.]” 25 Dkt. No. 45 at 12. M.K. acknowledges, however, that these allegations are not in his complaint. 26 Moreover, it remains unclear whether he might be able to plead sufficient facts demonstrating that 27 such economic injury properly may be attributed to him, or that it necessarily was caused by 1 amendment will be futile. According, M.K. is given leave to amend this claim to assert facts 2 establishing his standing. Pending an amended complaint that establishes M.K.’s standing, the 3 Court does not address Google’s remaining arguments that M.K. fails to plead facts establishing a 4 plausible UCL violation. 5 3. Failure to Protect 6 M.K. claims that Google was “negligent when it failed to train . . . teachers on the risk of 7 hackers and predators infiltrating the online platform and how to respond and identify individuals 8 who hacked into the online class programs and protect student safety.” Dkt. No. 1 ¶ 77. He 9 further alleges that he was “forced to use Google’s service in order to participate in school,” and 10 that Google “secretly and unlawfully monitor[ed] and profile[d] children . . . without the 11 knowledge or consent of those children’s parents,” and to M.K.’s detriment, “causing him to have 12 his account infiltrated with inappropriate language of a hacker.” Id. ¶ 78. M.K.’s claim sounds in 13 negligence, which requires him to allege facts establishing “(1) a legal duty of due care; (2) a 14 breach of that duty; (3) causation; and (4) damages.” In re Google Android Consumer Privacy 15 Litig., No. 11-MD-02264 JSW, 2013 WL 1283236, at *12 (N.D. Cal. Mar. 26, 2013). 16 Google argues, persuasively, that the complaint fails to plausibly allege facts supporting 17 the breach of any duty Google owed to M.K. The complaint alleges that Google “had a duty to 18 protect [him] from predators while he was participating in his online school” and that Google 19 “assumed this responsibility when it made entered [sic] schools for the purpose of data collection.” 20 Dkt. No. 1 ¶ 82. In essence, M.K.’s complaint concerns a situation where Google offers an 21 educational platform that the District chose to use. While M.K. contends that in doing so, Google 22 “created a special relationship” with him and essentially owed a duty of care under the “Good 23 Samaritan Rule” (see Dkt. No. 45 at 13), he cites no authority to that effect.6 As discussed above, 24 M.K.’s allegations concerning Google’s alleged monitoring and collection of data about him, and 25 its role (if any) in the alleged hacking incident, are conclusory and inadequately pled. 26 6 Additionally, M.K.’s arguments that “Google has not been neutral” (Dkt. No. 45 at 14) appear to 27 be based on a misapprehension of the court’s discussion of “content-neutral liability” for purposes 1 Accordingly, M.K.’s claim based on a negligent failure to protect is dismissed. Because 2 the Court cannot conclude that amendment would be futile, M.K. is given leave to amend. 3 4. California Constitutional Right to Privacy 4 “The California Constitution creates a privacy right that protects individuals from the 5 invasion of their privacy by private parties.” In re Yahoo! Mail Litig., 7 F. Supp. 3d 1016, 1037 6 (N.D. Cal. 2014); Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 20 (1994) (The right to 7 privacy embodied in article I, section 1 of the California Constitution “creates a right of action 8 against private as sell as government entities.”). To state a claim for invasion of privacy under the 9 California Constitution, M.K. must plead facts establishing “(1) a legally protected privacy 10 interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by 11 defendant constituting a serious invasion of privacy.” Hill, 7 Cal. 4th at 39-40. “Actionable 12 invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential 13 impact to constitute an egregious breach of the social norms underlying the privacy right. Thus, 14 the extent and gravity of the invasion is an indispensable consideration in assessing an alleged 15 invasion of privacy.” Id. at 37. 16 As discussed above, M.K.’s complaint is highly conclusory and does not plausibly allege 17 facts to support Google’s alleged monitoring and collection of data about him. Here, M.K. alleges 18 that Google monitored his “privately owned personal computer and his Chrome Book during 19 non[- ]school hours,” and “design[ed] the App to secretly obtain, and improperly gain knowledge 20 of, review, and[/]or retain [M.K.]’s activities through the technologies and activities described 21 herein.” Dkt. No. 1 ¶¶ 88, 89. M.K. further alleges that “the nature of privacy invasion involves 22 sharing [M.K]’s personally identifiable information and/or viewing data with potentially countless 23 third-parties, known and unknown, for undisclosed and potentially unknowable purposes, in 24 perpetuity.” Id. ¶ 90. There are no facts identifying what “App” is referred to or the “technologies 25 and activities” purportedly set out in the complaint. Nor does the complaint allege any facts 26 describing the purported sharing of M.K.’s data, what data was shared, and with whom it was 27 shared. In sum, M.K. fails to allege sufficient facts to plausibly establish that Google violated his 1 Accordingly, M.K.’s claim for invasion of privacy under the California Constitution is 2 dismissed. Because the Court cannot conclude that amendment would be futile, M.K. is given 3 leave to amend this claim. 4 IV. LEAVE TO AMEND 5 Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely 6 given when justice so requires,” because “the court must remain guided by the underlying purpose 7 of Rule 15 . . . to facilitate decisions on the merits, rather than on the pleadings or technicalities.” 8 Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (internal quotation marks and 9 citation omitted). “The decision of whether to grant leave to amend nevertheless remains within 10 the discretion of the district court,” which may deny leave to amend if allowing amendment would 11 unduly prejudice the opposing party, cause undue delay, or be futile, or if the party seeking 12 amendment has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512 F.3d 522, 532 (9th 13 Cir. 2008) (citing Foman v. Davis, 371 U.S. 178, 182 (1962)). 14 Although M.K. has articulated some additional facts that he believes could be alleged on 15 an amendment, the Court harbors some uncertainty whether those additional facts will correct all 16 of the pleading deficiencies identified in Google’s present motion. Nevertheless, as the law 17 generally favors resolving matters on the merits, the Court will permit M.K. to amend his claims. 18 Amendment is limited to the claims asserted in his complaint.7 19 V. CONCLUSION 20 Based on the foregoing, Google’s motion to dismiss is granted with leave to amend, 21 consistent with the rulings in this order. M.K.’s amended complaint shall be filed by April 10, 22 2023. Google’s response to the amended complaint shall be filed April 24, 2023. 23 The initial case management conference is re-set for May 30, 2023, 1:30 p.m. The 24 parties’ joint case management statement is due by May 23, 2023. All other related deadlines in 25 7 In his opposition, M.K. argues, in passing, that claims for security breaches are allowed under 26 the California Consumer Privacy Act (“CCPA”). Dkt. No. 45 at 7. No such claim is alleged in his complaint. Indeed, in the proceedings concerning Google’s present motion to dismiss, as well as 27 the separate motion to dismiss filed by the District, M.K. has alluded to potential other claims he 1 the Court’s Order Setting Initial Case Management Conference and ADR Deadlines (Dkt. No. 4) 2 are adjusted accordingly. 3 IT IS SO ORDERED. 4 Dated: March 27, 2023 5 6 Varga win K, Marcle:

VIRGINIA K. DEMARCHI

7 United States Magistrate Judge 8 9 10 11 a 12

15 16

= 17

Z 18

19 20 21 22 23 24 25 26 27 28