WILLIAM H. ORRICK, United States District Judge.
Plaintiffs filed this putative class action against defendants Ford Motor Company, General Motors LLC ("GM"), Toyota Motor Corporation and Toyota Motor Sales, U.S.A., Inc. (the latter two collectively as "Toyota"), alleging that defendants have equipped their vehicles with computer technology that is susceptible to being hacked by third parties. They also assert that defendants improperly collect and transmit information about vehicle performance and the geographical location of the cars they sell in violation of plaintiffs' right to privacy.
Plaintiffs have not established specific or general jurisdiction against Ford. Additionally, given the lack of injury flowing from the asserted potential hacking issue, they lack standing to sue the defendants. Their privacy claims are conclusorily pleaded and need more specificity. For these reasons, I GRANT defendants' motions to dismiss with leave to amend.
Plaintiffs' First Amended Complaint ("FAC") identifies three classes of plaintiffs: (1) the "California Class," consisting of plaintiffs who bring California state law and California constitutional law claims against GM and Toyota in connection with vehicles purchased in California; (2) the "Oregon Class," consisting of plaintiffs who bring Oregon state law claims against Ford in connection with vehicles purchased in Oregon; and (3) the "Washington Class," consisting of plaintiffs who bring Washington state law claims against Ford in connection with vehicles purchased in Washington. FAC [Dkt. No. 37]. The central problem alleged is that because the cars' computer systems lack security, basic vehicle functions can be controlled by individuals outside the car, endangering the safety of vehicle occupants. FAC ¶ 2. For example, hacking can result in the loss of driver control over the throttle, brakes, and steering wheel. FAC ¶ 1.
Defendants' vehicles utilize dozens of electronic control units ("ECUs"), which are small computers that control various vehicle operations. FAC ¶ 3. Vehicle safety depends on "near real time" communication between the ECUs. FAC ¶ 28. The ECUs communicate through a controller area network, or "CAN bus," by sending each other digital messages called "CAN packets." FAC ¶¶ 3-4. Because "there is no ECU source or authentication, nor any encryption, built into CAN packets," anyone with physical access to a vehicle can utilize the CAN bus to send malicious CAN packets to the ECUs. FAC ¶ 30. Additionally, defendants' vehicles are equipped with wireless Bluetooth and cell
Plaintiffs assert that defendants have known for a long time that their vehicles can be hacked, and cite numerous research studies and media articles dating back to 2011 that document the electronic security vulnerabilities of defendants' vehicles. FAC ¶¶ 36-40. In one article, for example, a journalist wrote,
FAC ¶ 35.
Plaintiffs also allege that despite defendants' knowledge of significant security vulnerabilities, they market their vehicles as safe. FAC ¶¶ 41-48. Toyota's promotional materials claim, for example, that "Toyota's Integrated Safety Management Concept sets the direction for safety technology development and vehicle development, and covers all aspects of driving by integrating individual vehicle safety technologies and systems rather than viewing them as independently functioning units." FAC ¶ 42. Toyota also claims to be developing "advanced driving support systems where the driver maintains control and the fun-to-drive aspect of controlling a vehicle is not compromised." FAC ¶ 44. Ford makes similar safety claims, such as, "When you look over the impressive list of collision avoidance and occupant protection features, you'll know how well-equipped Fusion is when it comes to you and your passengers' safety." FAC ¶ 46. Ford makes the same claim about the Focus, stating, "You don't have to pick and choose when it comes to safety. Focus is well equipped with an impressive list of safety features." Id. GM says "Quality and safety are at the top of the agenda at GM, as we work on technology improvements in crash avoidance and crashworthiness to augment the post-event benefits of OnStar, like advanced automatic crash notification." FAC ¶ 47. GM also touts the "vast test capabilities" of its new "Active Safety Testing Area," which will "increase GM's ability to bring the best new safety technologies to the customer." FAC ¶ 48.
Plaintiffs further contend that defendants collect owner data, specifically geographic location, driving history, and vehicle performance, from the vehicle computers and then share that data with third parties without securing the transmission. FAC ¶¶ 49-50, 135. Defendants disclose their data collection practices in owners' manuals, online privacy statements, and the terms and conditions of specific feature activations, but drivers cannot opt-out of data collection without disabling the relevant feature. FAC ¶ 50.
This class action has five named plaintiffs. Helene Cahen resides in Berkeley, California. She purchased a Lexus RX 400 H in September 2008 from a Lexus dealer in San Rafael, California. FAC ¶ 12. Lexus vehicles are manufactured and sold by Toyota. FAC ¶ 8. Merrill Nisam lives in Mill Valley, California, and purchased a Chevrolet Volt in March 2013 from a Chevrolet dealer in Novato, California. FAC ¶ 14. Chevrolet vehicles are manufactured and sold by GM. FAC ¶ 8. Kerry Tompulis lives in Beaverton, Oregon, and
Plaintiffs bring multiple causes of action which differ for each sub-class. The "California Class," led by plaintiffs Cahen and Nisam, brings eight causes of action against GM and Toyota: (1) violation of the California's Unfair Competition Law ("UCL"), Cal. Bus. Prof. Code § 17200, et seq.; (2) violation of California's Consumers Legal Remedies Act ("CLRA"), Cal. Civ. Cod § 1250, et seq.; (3) violation of California's False Advertising Law ("FAL"), Cal. Bus. Prof. Code § 17500, et seq.; (4) breach of California's Implied Warranty of Merchantability, Cal. Com. Code § 2314; (5) breach of contract at California common law; (6) fraud by concealment at California common law; (7) violation of California's Song-Beverly Consumer Warranty Act, Cal. Civ. Code §§ 1791.1 & 1792; and (8) invasion of privacy under the California Constitution, Cal. Const. art. I, § 1. FAC ¶¶ 62-138.
The "Oregon Class," led by plaintiff Tompulis, brings three causes of action against Ford: (1) violation of Oregon's Unlawful Trade Practices Act, Or. Rev. Stat. § 646.605, et seq.; (2) breach of Oregon's Implied Warranty of Merchantability, Or. Rev. Stat. § 72.3140; and (3) fraudulent concealment at Oregon common law. FAC ¶¶ 139-167.
Finally, the "Washington Class," led by plaintiffs Gibbs and Langdon, brings four causes of action against Ford: (1) violation of Washington's Consumer Protection Act, Rev. Code Wash. Ann. § 19.86.010, et seq.; (2) breach of Washington's Implied Warranty of Merchantability, Rev. Code Wash. § 62A.2-614; (3) breach of contract at Washington common law; and (4) fraudulent concealment at Washington common law. FAC ¶¶ 168-200.
Plaintiffs seek relief in the form of an injunction that enjoins defendants from continuing to market their cars as safe and requires them to establish a recall program and provide free repairs, such as the addition of Trusted Platform Modules. FAC at p. 34-35. They also request costs, fees, and damages, including punitive damages and disgorgement. Id. After the parties briefed defendants' motions to dismiss, I heard argument on November 3, 2015.
Federal Rule of Civil Procedure 8(a)(2) requires a complaint to contain "a short and plain statement of the claim showing that the pleader is entitled to relief," Fed. R. Civ. P. 8(a)(2), in order to "give the defendant fair notice of what the claim is and the grounds upon which it rests," Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (internal quotation marks and alterations omitted).
A motion to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of a complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir.2001). "Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory." Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). While a complaint "need not contain detailed factual allegations" to survive a
In considering whether a claim satisfies this standard, the court must "accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party." Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir.2008). However, "conclusory allegations of law and unwarranted inferences are insufficient to avoid a Rule 12(b)(6) dismissal." Cousins, 568 F.3d at 1067 (internal quotation marks omitted). "[I]t is within [the court's] wheelhouse to reject, as implausible, allegations that are too speculative to warrant further factual development." Dahlia v. Rodriguez, 735 F.3d 1060, 1076 (9th Cir.2013).
Defendants moved to dismiss on various grounds, including: (1) lack of personal jurisdiction against Ford; (2) failure to establish Article III standing; (3) failure to state a claim under the applicable state laws and the California constitution; and (4) preemption of plaintiffs' claims by state and federal law. Because I find that personal jurisdiction against Ford is lacking and that the plaintiffs have failed to establish standing for their claims, I do not discuss the other arguments.
Federal Rule of Civil Procedure 12(b)(2) authorizes a defendant to seek dismissal of an action for lack of personal jurisdiction. Fed. R. Civ. P. 12(b)(2). When a defendant challenges a court's personal jurisdiction over it, the plaintiff bears the burden of establishing that jurisdiction is proper. Ranza v. Nike, Inc., 793 F.3d 1059, 1068 (9th Cir.2015). "Where, as here, the defendant's motion is based on written materials rather than an evidentiary hearing, the plaintiff need only make a prima facie showing of jurisdictional facts to withstand the motion to dismiss." Id. (internal quotation marks and citation omitted). Yet, "the plaintiff cannot simply rest on the bare allegations of its complaint." Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir.2004) (internal quotation marks and citation omitted). Uncontroverted allegations in the complaint are accepted as true, and factual disputes created by conflicting affidavits are resolved in the plaintiff's favor. Id.
When no federal statute governs personal jurisdiction, a district court applies the long-arm statute of the state in which it sits. Id. California's long-arm statute permits a court to exercise personal jurisdiction consistent with constitutional due process. Cal. Code Civ. P. § 410.10. Due process requires that a non-resident defendant have "certain minimum contacts" with the forum "such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice." Int'l Shoe Co. v. Washington, 326 U.S. 310, 316, 66 S.Ct. 154, 90 L.Ed. 95 (1945) (internal quotation marks and citation omitted).
The "minimum contacts" requirement can be satisfied in two ways: general jurisdiction or specific jurisdiction. General jurisdiction applies where a nonresident defendant's "affiliations with the State are so `continuous and systematic' as to render it essentially at home in the forum state." Daimler AG v. Bauman, ___ U.S. ___, 134 S.Ct. 746, 761, 187 L.Ed.2d 624 (2014)
Ford moves to dismiss the claims brought by Tompulis, Gibbs, and Langdon (the "Ford plaintiffs") on the basis of lack of personal jurisdiction over Ford in California. Ford makes two primary arguments: (1) because none of the Ford plaintiffs' claims arise out of Ford's California related activities, there is no specific jurisdiction; and (2) general jurisdiction is lacking because Ford it is neither headquartered nor incorporated in California and does not have the sufficient "minimum contacts" with California in order for general jurisdiction to be appropriate. Ford Mot. at 3-9 [Dkt. No. 47]. Ford is correct on both counts.
The Ford plaintiffs do not address or oppose Ford's contention that specific jurisdiction does not lie here. This is apt.
A three-prong test is used to determine whether specific jurisdiction exists:
Schwarzenegger, 374 F.3d at 802. The Ford plaintiffs bear the burden of satisfying the first two prongs of the test. Id. Personal jurisdiction cannot be established if they fail to do so. Id.
The Ford plaintiffs purchased or leased their vehicles in Oregon and Washington. FAC ¶¶ 13, 15. Their claims arise from the allegedly defective CAN bus units in their vehicles and deficiencies in Ford's disclosures to consumers in Oregon and Washington regarding the sale, marketing, and warranties of those cars. However, none of those claims is tied to Ford's activities in California. The 2014 Ford Escape Tompulis leased was manufactured in Louisville, Kentucky and then sold to her in Oregon. Dwyer Dec. ¶ 4 [Dkt. No. 47-1]; FAC ¶ 13. The 2013 Ford Fusion Gibbs and Langdon purchased was manufactured in Sonora, Mexico and sold in Washington. Dwyer Dec. ¶ 5; FAC ¶ 15. The CAN bus systems in both cars were neither manufactured nor designed in California. Pappas Decl. ¶¶ 4-5 [Dkt. No. 47-2]. The warranties at issue were disseminated with the new vehicles at the point of sale and are also available on the website (which is administered from Michigan). Ford Mot. at 8. Notably, the Ford plaintiffs, who at the time of the filing of the FAC were all non-California residents, bring no causes of action against the other defendants, Toyota and GM. See FAC ¶¶ 139-200.
In short, the Ford plaintiffs bring solely Oregon and Washington causes of action stemming from transactions that occurred in those states. They have failed to demonstrate that specific jurisdiction over Ford is appropriate in California.
The Ford plaintiffs argue that general jurisdiction exists over Ford because
Plaintiffs' argument rests on the notion that a company's "continuous and systematic" contacts can confer general jurisdiction. See Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 416, 104 S.Ct. 1868, 80 L.Ed.2d 404 (1984) (finding no general jurisdiction because defendant lacked continuous and systematic contacts with forum state); Bancroft & Masters, Inc. v. Augusta Nat. Inc., 223 F.3d 1082, 1086 (9th Cir.2000) (same). However, their analysis is undercut by Daimler.
The Court in Daimler held that Daimler AG, the German manufacturer of Mercedes-Benz automobiles, was not subject to general jurisdiction in California "despite its multiple offices, continuous operations, and billions of dollars' worth of sales there." Id. at 772 (Sotomayor, J., concurring). "[O]nly a limited set of affiliations with a forum will render a defendant amenable to all-purpose jurisdiction there." Daimler, 134 S.Ct. at 760. "With respect to a corporation, the place of incorporation and principal place of business are paradigm... bases for general jurisdiction." Id. (internal quotation marks, citations, and modifications omitted). "Those affiliations have the virtue of being unique — that is, each ordinarily indicates only one place — as well as easily ascertainable." Id.
Ford is not incorporated in California, nor does it have its principal place of business here. FAC ¶ 22 (noting that Ford is a Delaware corporation with its principal place of business in Michigan). These facts, alone, are strong evidence that Ford is not at home in California. Daimler, 134 S.Ct. at 760; see also Goodyear, 131 S.Ct. at 2853-54 (noting that "the paradigm forum for the exercise of general jurisdiction... [is the corporation's] domicile, place of incorporation, and principal place of business" (citation omitted)). "A corporation that operates in many places can scarcely be deemed at home in all of them, [o]therwise, `at home' would be synonymous with `doing business.'" Daimler, 134 S.Ct. at 762 n. 20.
The Ford plaintiffs' reliance on pre-Daimler cases that use a "continuous and systematic" analysis must be reconsidered in light of this relatively recent precedent. Even if Ford's business contacts with California are continuous and systematic, approving the exercise of general jurisdiction in every state in which a corporation does business would be "unacceptably grasping." Id. at 761; see also Google Inc. v. Rockstar Consortium U.S. LP., No. 13-cv-5933-CW, 2014 WL 1571807, at *5 (N.D.Cal. Apr. 17, 2014) (declining to exercise general jurisdiction over a patent licensing entity, incorporated in Delaware and headquartered in Texas, that had engaged in continuous and systematic business in the forum state by targeting a significant part of its business to Silicon Valley in California). The general jurisdiction inquiry does not "focus solely on the magnitude of the defendant's in-state contacts" but must take into account a "corporation's activities in their entirety, nationwide and worldwide." Daimler, 134 S.Ct. at 762 n. 20 (internal citations, modifications and quotation marks omitted).
In Daimler, the Court denied the exercise of general jurisdiction even though Daimler's subsidiary, whose contacts were imputed for the purposes of the Court's analysis, "ha[d] multiple California-based facilities," was the "largest supplier of luxury vehicles to the California market," and its "California sales account[ed] for 2.4% of Daimler's worldwide sales." 134 S.Ct. at 752. These facts surpass the type of contacts at issue here. Out of approximately 75,000 employees in the United States and 187,000 worldwide, Ford only has 302 employees in California. Pappas Decl. ¶¶ 7-8 [Dkt. No. 71]. Even if the volume of business the Ford plaintiffs attribute to Ford is true, it would not be enough to render Ford "essentially at home in the forum State." Daimler, 134 S.Ct. at 761; see also Ranza, 793 F.3d at 1069 (declining to exercise general jurisdiction over a foreign company when the defendant's contacts with the forum states consisted of: (1) 20 to 27 employees working in forum state on expatriate assignments at any one time
The Court noted that in an "exceptional case," "a corporation's operations in a forum other than its formal place of incorporation or principal place of business may be so substantial and of such a nature as to render the corporation at home in that State." Daimler, 134 S.Ct. at 761 n. 19. It did not define what an "exceptional case" is, but its discussion of Perkins v. Benguet Consolidated Mining Co., 342 U.S. 437, 72 S.Ct. 413, 96 L.Ed. 485 (1952), indicates that the bar for such a finding is very high. In Perkins, the Court held that the defendant, a mining company based in the Philippines, was subject to general jurisdiction in Ohio because the defendant's president directed all of the company's activities from Ohio. 342 U.S. at 448, 72 S.Ct. 413. The Daimler Court noted that Perkins was an "exceptional case" because the defendant's mining operations in the Philippines were halted by Japanese wartime occupation of the Philippines. Id. at 761 n. 19. As a result, the Court found that Ohio could be considered the defendant's "surrogate for the place of incorporation or head office" and principal, if temporary, place of business. Id. at 756 n. 8 (citations omitted). Here, the Ford plaintiffs allege no similar facts to support the proposition that California can be considered Ford's surrogate place of incorporation or temporary place of business. See Xilinx, Inc. v. Papst Licensing GMBH & Co.KG, No. 14-cv-4794-LHK, 113 F.Supp.3d 1027, 1036, 2015 WL 4149166, at *5 (N.D.Cal. July 9, 2015) ("Merely conducting business in California from a home base in Germany is not "exceptional," even when such business generates substantial revenue."). In sum, the Ford plaintiffs have failed to establish general personal jurisdiction over Ford in California.
Defendants assert that plaintiffs lack standing for all of their claims. "[T]he irreducible constitutional minimum of standing contains three elements." Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). First, the plaintiff must show an "injury in fact" that is "actual or imminent, not conjectural or hypothetical." Id. (citations and internal quotation marks omitted). Second, the injury must be "traceable to the challenged action of the defendant, and not the result of the independent action of some third party." Id. (citations and internal quotation marks omitted). Finally, the injury
Plaintiffs claim that they have been injured as a result of defendants' alleged misrepresentation. They assert that "they would not have purchased their [vehicles] or would not have paid as much as they did to purchase them." FAC ¶ 66. Similarly, they contend that "they paid an inflated purchase or lease price for the [vehicles]." FAC ¶ 78.
Defendants argue that plaintiffs cannot assert injury in fact based on the risk of future harm from the alleged product defect (that defendants' cars are susceptible to hacking by third parties). The crux of defendants' contention is that the risk of future injury caused by insecure software is not an injury in fact under Article III because such a scenario is too speculative to constitute a "certainly impending" injury. Clapper v. Amnesty Intern. USA, ___ U.S. ___, 133 S.Ct. 1138, 1147-48, 185 L.Ed.2d 264 (2013); GM Mot. at 4 [Dkt. No. 43]; Toyota Mot. at 8 [Dkt. No. 49]; Ford Mot. at 9. Defendants point out that plaintiffs do not allege any hacking incidents that have taken place outside of controlled settings, and that the entire threat rests on the speculative premise that a sophisticated third party cybercriminal may one day successfully hack one of plaintiffs' vehicles. GM Mot. at 5; Toyota Mot. at 8; Ford Mot. at 10.
The Court recently discussed injury in fact in Clapper, where the plaintiffs sought to invalidate a federal law that "allows the Attorney General and the Director of National Intelligence to acquire foreign intelligence information by jointly authorizing the surveillance of individuals who are not `United States persons' and are reasonably believed to be located outside the United States." 133 S.Ct. at 1142. Because the plaintiffs regularly communicated with individuals they believed to be surveillance targets, they claimed injury in fact based on the likelihood that their own communications would be unlawfully acquired by the federal government. Id. at 1143. In finding that plaintiffs failed to establish injury in fact, the Court held that the "theory of future injury [was] too speculative to satisfy the well-established requirement that threatened injury must be `certainly impending.'" Id. (emphasis in original). The court explained that plaintiffs could not establish standing based on the "highly attenuated chain of possibilities" that:
Id. at 1148.
Defendants place great weight on U.S. Hotel and Resort Management, Inc. v.
Plaintiffs respond that Onity is inapposite because the susceptibility to hacking in Onity merely posed the threat of break-in, whereas the potential hacking of plaintiff's vehicles poses the more substantial risk of serious bodily injury or death. GM Opp. at 12 [Dkt. No. 53]; Toyota Opp. at 13 [Dkt. No. 52]; Ford Opp. at 17-18. But plaintiffs conflate the nature of the future risk at stake with the plausibility of the future risk for standing purposes — that a greater risk may be at stake in this case does not speak to whether the risk is any more plausible.
Plaintiffs also note that Onity did not arise in the Ninth Circuit. GM Opp. at 12; Toyota Opp. at 13; Ford Opp. at 17. That is true, but Ninth Circuit precedent is in line with the Onity court's interpretation of Clapper. For example, although Birdsong v. Apple, Inc., 590 F.3d 955 (9th Cir.2009) predates Clapper, it is consistent with the requirement that a risk of future harm be certainly impending. The Birdsong court dismissed claims against Apple alleging that the iPod posed an unreasonable risk of hearing loss to its users. Id. at 960. In dismissing the complaint for lack of standing, the court noted that the plaintiffs failed to plead that they themselves suffered or would likely suffer any hearing loss. Id. Accordingly, it was insufficient for the plaintiffs to plead injury to "unidentified iPod users" without also pleading injury that was "concrete and particularized as to themselves." Id. (emphasis in original). The Birdsong plaintiffs further lacked standing because even the injury as pleaded with regard to "unidentified iPod users" was purely hypothetical — indeed, there had been no claim that anybody suffered reduced hearing loss from iPod use. Id. at 961.
Onity and Birdsong are instructive. As in Onity, which involved a similar risk of future hacking, here plaintiffs allege only that their vehicles are susceptible to future hacking by third parties. FAC ¶¶ 1-2, 30, 34. Plaintiffs therefore fail to allege that any harm is "certainly impending" because while it is possible that a potential hacker would in fact attempt to gain control of a vehicle, "allegations of possible future injury are not sufficient." Onity, 2014 WL 3748639 at *3 (internal modifications, citations and quotation marks omitted) (emphasis in original). Although plaintiffs do allege that "it's just a question of when" until hackers start infiltrating the CAN bus in defendants' vehicles, FAC ¶ 40 (internal citations and quotation marks omitted), plaintiffs do not allege that any future risk of harm is "concrete and particularized as to themselves." Birdsong, 590 F.3d at 960 (emphasis in original). They allege only that car owners in general face a risk of hacking at some point in the future. The risk faced by the individual plaintiffs themselves remains speculative.
Judges in this District regularly deny standing in product liability cases where
At the hearing on these motions, plaintiffs' counsel encouraged me to rely on In re MyFord TouchConsumer Litigation to find standing in this case. MyFord Touch is not analogous. The contested defects in MyFord Touch were numerous, had already manifested, and had been experienced by the plaintiffs bringing the case. 46 F.Supp.3d at 949 ("Plaintiffs have identified various problems with the [car component] system, ranging from the entire system freezing up or crashing (in which case no features connected to [car component] are operational, including the navigation technology, the radio, the rearview camera, and the defroster) to isolated problems such as random but frequent screen black outs, nonresponsiveness to touch or voice commands, locking up of the rearview camera, and inaccurate directions on the navigation system."). None of those factors is present in this case. The FAC does not allege that plaintiffs have suffered a hacking attack, nor does it plead any facts that would establish that they face an increased risk of a future hacking attack on their vehicles as opposed to other vehicle owners.
All of this is not to say that a future risk of harm can never satisfy injury in fact analysis. Although a speculative future risk will not suffice, "a credible threat of harm is sufficient to constitute actual injury for standing purposes." Riva v. Pepsico, Inc., 82 F.Supp.3d 1045, 1052 (N.D.Cal.2015) (internal citations and quotation marks omitted). In Riva, the court rejected Pepsi drinkers' claims that they were put at an increased risk of cancer because of carcinogens that were present in Pepsi at levels that exceeded California standards. Id. at 1049-51. Although the Pepsi drinkers cited studies showing an increased risk of cancer in mice exposed to extremely high levels of the carcinogen at issue, they failed to allege that humans experienced the same cancer risk when exposed to the lower levels present in Pepsi. Id. at 1053. The Pepsi drinkers' claims of risk therefore lacked credibility and "effectively invited the Court to engage in an `ingenious academic exercise in the conceivable to explain how defendants' actions
The requirement that a threat of harm be credible is not an empty one, especially in light of Clapper's requirement that the threat be "certainly impending." Just as it was impossible for the Riva court to determine whether the Pepsi drinkers faced an increased risk of cancer, it is difficult for me to conclude whether plaintiffs' vehicles might be hacked at some point in the future, especially in light of the fact that plaintiffs do not allege that anybody outside of a controlled environment has ever been hacked. Plaintiffs have alleged only that their cars are susceptible to hacking but have failed to plead that they consequently face a credible risk of hacking.
Plaintiffs argue that they have Article III standing because of the economic loss that flows from the risk of future injury. GM Opp. at 10; Toyota Opp. at 11; Ford Opp. at 15. They principally rely on Hinojos v. Kohl's Corp., 718 F.3d 1098 (9th Cir.2013) and In re Toyota Motor Corp. Unintended Acceleration Marketing, Sales Practices, & Products Liability Litigation, 754 F.Supp.2d 1145 (C.D.Cal.2010) (hereinafter "In re Toyota I"). However, plaintiffs fail to discuss the specific facts of either Hinojos or In re Toyota I, which are not analogous to the instant case and do not help them.
In Hinojos, plaintiffs alleged they were induced to purchase products that were falsely advertised as on sale but had in reality been "marked down" from fictitiously high "original" prices. Hinojos, 718 F.3d at 1101. The court held that "when, as here, [p]laintiffs contend that class members paid more for a product than they otherwise would have paid, or bought it when they otherwise would not have done so[,] they have suffered an Article III injury in fact." Id. at 1104 n. 3 (internal quotation marks, modifications and citations omitted). Because Hinojos involved plaintiffs who had purchased products that were falsely advertised as on sale but had actually been "marked down" from fictitiously high "original" prices, the economic injury was not speculative but directly ascertainable. Id. at 1101. Plaintiffs here do not assert any demonstrably false misrepresentations of value, but rather make conclusory allegations that their cars are worth less because of the risk of future injury. FAC ¶¶ 66, 78, 81, 156, 198. The asserted economic harm is much more speculative than that in Hinojos.
In re Toyota I involved widespread and well-documented sudden unintended acceleration in Toyota model cars. 754 F.Supp.2d at 1164. The court found that a "manifested defect" was not required to establish standing "[a]s long as plaintiffs allege a legally cognizable loss under the `benefit of the bargain' or some other legal theory." Id. There the economic harm suffered by the plaintiffs was not at all speculative because of the decrease in value caused by the defect. Id. at 1162. The In re Toyota I court found that "[w]hile a statistically significant propensity for [the sudden unintended acceleration] may not be considered `actual' or `imminent,' the market effect of the alleged [sudden unintended acceleration] defect undoubtedly is actual or imminent." Id. (emphasis in original).
While it was appropriate for that court to infer a market effect from widespread and well-documented acceleration problems, here the market effect is hypothetical. As Ford points out, all vehicles manufactured post-2008 are required to be equipped with some form of the CAN bus
Additionally, in a later order from that very same case, the court found that "[w]hen economic loss is predicated solely on how a product functions, and the product has not malfunctioned, the Court agrees that something more is required than simply alleging an overpayment for a `defective' product." In re Toyota Motor Corp. Unintended Acceleration Litig., 790 F.Supp.2d 1152, 1166 n. 11 (C.D.Cal.2011) (hereinafter "In re Toyota II"). The court found standing because of "specific allegations of diminution in value, and repeated recalls...in millions of vehicles [that] have driven down resale values." Id. at 1162 (internal quotation marks and citations omitted). There, plaintiffs alleged that the Kelley Blue Book, and other car value guides, had "lowered the values of Toyota vehicles subject to recalls." Id. at 1159. Here, plaintiffs make no specific allegations of diminution in value. Instead, the economic loss is "predicated solely on how [the vehicles] function[]," namely, that they are susceptible to hacking, but plaintiffs do not plead the required "something more." Id. at 1165 n. 11.
Cases in this District hold that conclusory allegations of economic loss stemming from a speculative future risk of harm cannot establish Article III standing unless plaintiffs plead "something more." In Boysen, for example, the court found that economic injury could not establish injury in fact where "plaintiffs did not plead a distinct risk of harm from a defect in defendants' products that would make such an economic injury cognizable." 2012 WL 2953069, at *7. In other words, an economic injury that rests on the risk presented by an underlying product defect fails to establish injury in fact if the underlying risk is itself speculative. See Id. The Boysen court found the alleged economic harm speculative because although arsenic and lead were indisputably present in defendant's juice, plaintiff could not plausibly plead a risk of physical injury from consuming the juice that would affect its value. Id.
Similarly, in Contreras, the economic harm stemming from alleged but unmanifested deficiencies in Toyota brakes failed to establish injury in fact. Contreras, 2010 WL 2528844, at *7. First, "[p]laintiffs' allegation that their vehicles are worth substantially less than they would be without the alleged defect is conclusory and unsupported by any facts," and second, plaintiffs failed to allege "that they were forced to replace their vehicles after learning of the alleged defect or that they incurred any out-of-pocket damages." Id.
Here, the California Class plaintiffs allege that had they known about the lack of electronic security in their vehicles, "they would not have purchased their Class Vehicles or would not have paid as much as they did to purchase them." FAC ¶¶ 66, 81. The California plaintiffs also contend that they "suffered injury in fact and actual damages resulting from [d]efendants' material omissions and misrepresentations because they paid an inflated purchase or lease price for the Class Vehicles." FAC ¶ 78. The plaintiffs in the Oregon and Washington classes similarly allege that they have been injured "[a]s a result of their reliance" upon defendants' omissions because of "their lost benefit of the bargain and overpayment at the time of purchase or lease and/or the diminished value of their Class Vehicles." FAC ¶¶ 165, 198.
Finally, Toyota and GM dispute whether the California Class plaintiffs have established injury in fact to bring the invasion of privacy claim under the California Constitution. All of plaintiffs' factual allegations with regard to the privacy claim are contained within just three paragraphs of the FAC, reproduced here in their entirety:
FAC ¶¶ 49, 50, 135.
Despite the California Class plaintiffs' assertion that they "maintain a legally protected privacy interest in their personal data," FAC ¶ 135, "[p]laintiffs have not identified a concrete harm from the alleged collection and tracking of their personal information sufficient to create injury in fact." In re iPhone Application Litig., No. 11-MD-02250-LHK, 2011 WL 4403963, at *5 (N.D.Cal. Sept. 20, 2011). Without showing an "injury in fact" that is "actual or imminent, not conjectural or hypothetical," plaintiffs cannot establish
Plaintiffs string cites to various Ninth Circuit and California district court cases to argue that their allegations are sufficient to establish injury for their privacy claims. GM Opp. at 14; Toyota Opp. at 15. Their cases are inapposite because they fail to establish a comparable credible risk of future harm that would constitute injury in fact. For example, Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir.2010) involved employees who sued their employer after a laptop that contained unencrypted personally identifying information such as names, addresses, and social security numbers was stolen. 628 F.3d at 1143. Though the employees did not allege their identities had actually been stolen, the court found that an individual Starbucks employee did not need to have his identity actually stolen in order to establish that he faced "a credible threat of harm" — the fact that a computer containing his personal information had already been stolen was enough. Id. at 1142-43. The court was careful to note, however, that no credible risk of harm, and thus no injury in fact, would have existed "if no laptop had been stolen, and Plaintiffs had sued based on the risk that it would be stolen at some point in the future." Id. at 1143; see also Low v. LinkedIn Corp., No. 11-cv-01468-LHK, 2011 WL 5509848 at *5-6 (N.D.Cal. Nov. 11, 2011) (noting that in the absence of the "publication or theft" of personally identifying information, the plaintiff failed to establish a "credible threat" of future harm).
Similarly in In re Sony Gaming Networks & Customer Data Security Breach Litigation, 996 F.Supp.2d 942 (S.D.Cal. 2014), the plaintiffs had their "names, mailing addresses, email addresses, birth dates, credit and debit card information (card numbers, expiration dates, and security codes), and login credentials" compromised after malicious hackers broke into Sony's servers. 996 F.Supp.2d at 954. Analogizing to Krottner, the In re Sony court found that a data breach purposefully perpetrated by hackers involving sensitive personal identifying information created a "certainly impending" "credible threat" of future harm. Id. at 962-63; see also Doe 1 v. AOL LLC, 719 F.Supp.2d 1102, 1105 (N.D.Cal.2010) (cited by the California Class) (finding injury in fact because AOL created a credible risk of future injury when it inadvertently published to its website a database containing AOL users' search records, "names, social security numbers, addresses, telephone numbers, credit card numbers, user names, passwords, and financial/bank account information," which was then downloaded and reposted on numerous third party websites around the internet).
The California Class plaintiffs fail to establish a comparable credible risk of future identity theft that would establish an injury in fact. At worst, they allege that GM and Toyota "collect large amounts of data on driving history and vehicle performance, and transmit the data to third-party data centers without effectively securing the data." FAC ¶ 50. Nowhere do plaintiffs allege the kind of theft, malicious breach, or widespread accidental publication of sensitive personally identifying information such as social security numbers or credit card information that the Krottner, In re Sony, and Doe I courts found so dangerous. Instead, the only data plaintiffs specifically identify is "the geographic location of their vehicles at various times." FAC ¶ 135. It is not apparent how the purposeful disclosure of such data to third party data centers would establish any credible risk of future harm. See Low, 2011 WL 5509848 at *4 (finding that to the extent the plaintiff sought to establish future harm, his allegation that sensitive information may be transmitted to third parties without identifying how it would be
Furthermore, plaintiffs do not specifically allege that they themselves have been affected by these alleged behaviors. See LaCourt v. Specific Media, Inc., No. 10-cv-1256, 2011 WL 1661532, at *4 (C.D.Cal. Apr. 28, 2011) (finding that plaintiffs had not shown injury-in-fact in part because they had not alleged that they were personally affected by the complained of practices). Without any evidence of a breach or data compromise, speculative and generalized allegations of geographic tracking and data collection is insufficient to establish Article III standing.
Even if plaintiffs' allegations were sufficient to establish standing, they would not demonstrate a violation of the right to privacy under the California Constitution. In order to establish an invasion of privacy claim under Article I, Section 1 of the California Constitution, a plaintiff must plead "(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy." Hill v. Nat'l Collegiate Athletic Assn., 7 Cal.4th 1, 39-40, 26 Cal.Rptr.2d 834, 865 P.2d 633 (1994).
The California Class plaintiffs fail to adequately identify a protected privacy interest. "Legally recognized privacy interests are generally of two classes: interests in precluding the dissemination or misuse of sensitive and confidential information (informational privacy), and interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (autonomy privacy)." Id. at 35, 26 Cal.Rptr.2d 834, 865 P.2d 633. As pleaded, defendants' tracking of a vehicle's driving history, performance, or location "at various times," is not categorically the type of sensitive and confidential information the constitution aims to protect. FAC ¶¶ 49, 135. Plaintiffs rely on a report by Senator Edward Markey of Massachusetts that discusses concerns about vehicle hacking based on responses to letters sent out and responded to by sixteen automobile manufactures. FAC, Exh. 1 at 12 [Dkt No. 37-3]. However, the report does not fill in the missing gaps in plaintiffs' allegations. For example, it does not identify which car manufactures are collecting data, the frequency of which the data is being tracked, or the type of data is being collected. Id. Without more robust allegations, I am unable to adopt the plaintiffs' view that "[t]he Court can reasonably infer that simply by driving, Cahen is constantly creating data about her personal travel locations, which Toyota collects, aggregates, and disseminates." Toyota Opp. at 22.
For the foregoing reasons, defendants' motions to dismiss are GRANTED. Given the upcoming holidays, plaintiffs shall file an amended complaint, if any, by January 8, 2016.
