ORDER GRANTING MOTION TO DISMISS

Re: ECF No. 14

JON S. TIGAR, District Judge.

Before the Court is Defendant Facebook, Inc.'s motion to dismiss. ECF No. 14. The Court will grant the motion in full.

I. BACKGROUND

Plaintiffs Ibrahim Hassan, Anjeza Hassan, Kosta Hysa, and Mirela Hysa are Facebook users who created accounts between 2007 and 2009. ECF No. 1 ("Compl.") ¶¶ 3-6. Plaintiffs used the Facebook Messenger application to communicate with others via calls and instant messages. Id. They shared "personal, intimate, secure information" via Messenger including "current addresses, social security numbers, birthdays, driver licenses, personal and intimate pictures, personal and intimate conversations, and life-making decisions." Id. ¶ 12. They assert that Facebook, "without authorization, exposed all the above data collected from all four Plaintiffs for its own financial gain." Id. ¶ 10.

Plaintiffs now bring suit against Facebook asserting three causes of action. First, Plaintiffs plead that Facebook violated the Federal Trade Commission Act ("FTC Act") by falsely representing that their "personal data were secured and private" and by "failing to implement reasonable and appropriate security measures or follow industry standards for data security, and failing to comply with its own posted privacy policies." Compl. ¶¶ 16-17. Specifically, Plaintiffs complain of the harvesting and selling of data to Cambridge Analytica, as well as Facebook "allow[ing] over 150 companies to access and use [their] personal data for its own monetary profits, without [their] permission and consent." Id. ¶ 18. Second, Plaintiffs allege public disclosure of private facts based on Facebook giving companies such as Netflix, Spotify, and the Royal Bank of Canada access to "read, write, and delete" their private messages without consent. Id. ¶¶ 22-23. Third, Plaintiffs allege breach of contract based on Facebook's "fail[ure] to comply with its own user agreement knowing that it is misusing our personal information." Id. ¶ 26. Plaintiffs seek damages in the amount of $5,000,000. Id. ¶ 32.

Facebook now moves to dismiss for failure to state a claim. ECF No. 14. Plaintiffs oppose. ECF No. 29. Facebook has filed a reply. ECF No. 30.

II. LEGAL STANDARD

A complaint must contain a short and plain statement of the claim showing that the pleader is entitled to relief in order to give the defendant fair notice of what the claim is and the grounds upon which it rests. Fed. R. Civ. P. 8(a)(2); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). To survive a Rule 12(b)(6) motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. In determining whether a plaintiff has met this plausibility standard, the Court accepts all factual allegations as true and construes the pleadings in the light most favorable to the plaintiff. Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005).

III. DISCUSSION

For the reasons below, the Court will dismiss Plaintiffs' complaint with leave to amend.

A. Claim One

Facebook contends that "Plaintiffs' first cause of action must be dismissed because the FTC Act does not create a private right of action." ECF No. 14 at 6. Facebook is correct. "The [FTC] Act nowhere purports to confer upon private individuals, either consumers or business competitors, a right of action to enjoin the practices prohibited by the Act or to obtain damages following the commission of such acts." Holloway v. Bristol-Myers Corp., 485 F.2d 986, 988-89 (D.C. Cir. 1973). Courts have consistently held "that consumers and members of the public at large may not maintain a private action to enforce the FTCA." Gajo v. Chicago Brand, Case No. 17-cv-00380-EMC, 2017 WL 2473142, at *1 (N.D. Cal. June 8, 2017). Accordingly, "private litigants may not invoke the jurisdiction of the federal district courts by alleging that defendants engaged in business practices proscribed by" the Act. Dreisbach v. Murphy, 658 F.2d 720, 730 (9th Cir. 1981).

For this reason, Plaintiffs' first claim fails as a matter of law. When granting a motion to dismiss, the court should grant leave to amend "unless it determines that the pleading could not possibly be cured by the allegation of other facts." Doe v. United States, 58 F.3d 494, 497 (9th Cir. 1995) (internal quotation marks and citation omitted). Because there are no facts that can cure Plaintiffs' legally defective claim under the FTC Act, that claim is dismissed with prejudice.

B. Claim Two

To state a claim for public disclosure of private facts under California law, a plaintiff must allege "(1) public disclosure, (2) of a private fact, (3) which would be offensive and objectionable to the reasonable person, and (4) which is not of legitimate public concern." Taus v. Loftus, 40 Cal.4th 683, 717 (2007). Facebook argues that "Plaintiffs fail to allege what specific facts were disclosed by Facebook, when, to whom, and how." ECF No. 14 at 7. First, Facebook points out that Plaintiffs do not identify what part of their personal information was exposed or why that information is private. Id. Relatedly, Plaintiffs do not explain how that exposure would be offensive or objectionable to a reasonable person. Id. at 8. Second, Facebook emphasizes that Plaintiffs do not allege that Facebook publicized their private information to the public at large. Id. at 9. Finally, Facebook notes that Plaintiffs fail to plead that Facebook acted with knowledge or reckless disregard of the fact that a reasonable person would consider the publicity at issue highly offensive. Id. at 10.

The Court agrees that Plaintiffs have failed to plead sufficient facts to survive a motion to dismiss their claim for public disclosure of private facts. While Plaintiffs assert that "Facebook exposed [their] privacy, personal information, personal messages, and personal activities to known and unknown companies without consent," Compl. ¶ 23, they do not identify the content of the messages that were exposed or what makes the exposed information personal or private. As in another case in this district alleging invasion of privacy claims, "[t]he problem for Plaintiffs . . . is that to the extent Plaintiffs intend to allege that they have a privacy interest in the specific content of their emails" — or in this case, instant messages — "their allegations are fatally conclusory. The Complaint merely alleges that Plaintiffs' [messages] were `private' without alleging any facts related to what particular [messages Defendant] intercepted, or the content within particular [messages]." In re Yahoo Mail Litig., 7 F.Supp.3d 1016, 1041 (N.D. Cal. 2014). As in Yahoo, Plaintiffs' conclusory allegations of exposure of their "private messages" fail to state a claim.

Plaintiffs also fail to allege that Facebook publicized their information. "Liability for the common-law tort [of public disclosure of private facts] requires publicity; disclosure to a few people in limited circumstances does not violate the right." Ignat v. Yum! Brands, Inc., 214 Cal.App.4th 808, 820 (2013). Publicity "means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge." Opperman v. Path, Inc., 87 F.Supp.3d 1018, 1062 (N.D. Cal. 2014). Here, Plaintiffs assert broadly that Facebook allowed "known and unknown companies" to access their private messages. Compl. ¶ 23. Without more, the Court cannot conclude that Facebook communicated the information at issue to so many persons that the information was substantially certain to become public knowledge. Thus, Plaintiffs have failed to plead the publicity element of their claim, another deficiency demanding dismissal.

For the reasons above, Claim Two, pleading public disclosure of private facts, is dismissed. However, because Plaintiffs could potentially cure their claim by alleging additional facts, dismissal of Claim Two is with leave to amend.

C. Claim Three

"Under California law, to state a claim for breach of contract a plaintiff must plead the contract, plaintiffs' performance (or excuse for nonperformance), defendant's breach, and damage to plaintiff therefrom." Low v. LinkedIn Corp., 900 F.Supp.2d 1010, 1028 (N.D. Cal. 2012). Facebook argues that Plaintiffs' breach of contract claim fails because Plaintiffs do not identify the contract provision Facebook allegedly breached. ECF No. 14 at 10. The Court agrees, and will dismiss the claim on this basis. Without identifying, in the complaint, the specific contractual provisions alleged to have been breached, Plaintiffs have not adequately pleaded the contract. See, e.g., In re Anthem, Inc. Data Breach Litig., 162 F.Supp.3d 953, 979 (N.D. Cal. 2016) (Without "refer[ring] to any contractual language or any contractual provisions that [Defendant] allegedly breached . . . Plaintiffs' conclusory statements . . . are insufficient to survive a motion to dismiss."); Young v. Facebook, Inc., 790 F.Supp.2d 1110, 1117 (N.D. Cal. 2011) ("In an action for breach of a written contract, a plaintiff must allege the specific provisions in the contract creating the obligation the defendant is said to have breached.").

Facebook also argues, again correctly, that that Plaintiffs have failed to make out a legally cognizable claim for damages. ECF No. 14 at 11. The complaint alleges that Facebook's exposure of data "brings us the Plaintiffs at a high risk of our lives and security. Knowing that more than 150 companies and their employees have all of our private information keeps us under harm and fear not just for our lives but our children." Compl. ¶ 13. To the extent that Plaintiffs' damages claims are based on emotional distress, the claims are not cognizable under California law. See Low, 900 F. Supp. 2d at 1028 ("Emotional and physical distress damages are not recoverable on a California contract claim."); Svenson v. Google Inc., 65 F.Supp.3d 717, 725 (N.D. Cal. 2014) (Increased risk of identity theft is "too speculative to satisfy the pleading requirement of contract damages."); Ruiz v. Gap, Inc., 622 F.Supp.2d 908, 917 (N.D. Cal. 2009), aff'd, 380 F. App'x 689 (9th Cir. 2010) (Under California contract law, a Plaintiff "cannot show he was actually damaged by pointing to his fear of future identity theft."). Plaintiffs must plead legally cognizable contract damages to state a contract claim. Because they have not done so, Claim Three is dismissed on this additional basis.

Because the Court concludes that the allegation of additional facts may cure Plaintiffs' breach of contract claim, dismissal of Claim Three is without prejudice.

CONCLUSION

For the reasons above, Facebook's motion to dismiss is granted, and the Court dismisses the complaint in full. Dismissal of Claim One is with prejudice. Claims Two and Three are dismissed with leave to amend within thirty days of the date of this order.

IT IS SO ORDERED.