Hadona Diep v. Apple, Inc.

FILED NOT FOR PUBLICATION MAR 27 2024 UNITED STATES COURT OF APPEALS MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT HADONA DIEP; RYUMEI NAGAO, No. 22-16514 Plaintiffs-Appellants, D.C. No. 4:21-cv-10063-PJH v. MEMORANDUM* APPLE, INC., Defendant-Appellee. Appeal from the United States District Court for the Northern District of California Phyllis J. Hamilton, District Judge, Presiding Argued and Submitted February 14, 2024 San Francisco, California Before: S.R. THOMAS, HAMILTON,** and CHRISTEN, Circuit Judges. Plaintiffs Hadona Diep and Ryumei Nagao appeal the district court’s order dismissing with prejudice their complaint against Apple for injuries caused by a * This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. ** The Honorable David F. Hamilton, United States Circuit Judge for the U.S. Court of Appeals for the Seventh Circuit, sitting by designation. malicious application called “Toast Plus” that they downloaded from Apple’s App Store. We have jurisdiction pursuant to 28 U.S.C. § 1291, and “review[] de novo the district court's grant of a motion to dismiss under Rule 12(b)(6), accepting all factual allegations in the complaint as true and construing them in the light most favorable to the nonmoving party.” McGinity v. Procter & Gamble Co., 69 F.4th 1093, 1096 (9th Cir. 2023). We review the district court’s denial of leave to amend the complaint for abuse of discretion. Davidson v. Kimberly-Clark Corp., 889 F.3d 956, 963 (9th Cir. 2018). Because the parties are familiar with the factual and procedural history of the case, we need not recount it here. We affirm in part and remand in part. I The district court properly dismissed counts I (violation of the Computer Fraud and Abuse Act), II (violation of the Electronic Communications Privacy Act), III (violation of California’s Consumer Privacy Act), VI (violation of Maryland’s Wiretapping and Electronic Surveillance Act), VII (additional violation of Maryland’s Wiretapping and Electronic Surveillance Act), VIII (violation of Maryland’s Personal Information Protection Act), and X (negligence) of the complaint. 2  The district court correctly concluded that these counts were barred by section 230(c)(1) of the Communications Decency Act (“CDA”), which instructs that “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” 47 U.S.C. §230(c)(1). With respect to the Apple’s App Store, Apple is a provider of “interactive computer services” within the meaning of the CDA. The Toast Plus application is “information provided by another content provider” within the meaning of the CDA. Therefore, the question is whether Plaintiffs’ claims seek to treat Apple “as the publisher or speaker” of that third-party content. 47 U.S.C. §230(c)(1). In Barnes v. Yahoo!, Inc. 570 F.3d 1096, 1102 (9th Cir. 2009), we explained that the relevant test is “whether the duty that the plaintiff alleges the defendant violated derives from the defendant’s status or conduct as a ‘publisher or speaker.’” Publishing conduct, to which section 230(c)(1) applies, includes “reviewing, editing, and deciding whether to publish or to withdraw from publication third-party content.” Id. (citing Fair Hous. Council of San Fernando Valley v. Roommates.Com, LLC, 521 F.3d 1157, 1170–71 (9th Cir. 2008) (en banc)). By contrast, section 230(c)(1) does not apply to claims that arise from the breach of an independent legal duty, see e.g., Doe v. Internet Brands, Inc., 824 3 F.3d 846, 851–52 (9th Cir. 2016), or claims that assert liability for “content that [the defendant] creates.” Roommates.Com, 521 F.3d at 1161. The district court properly concluded that counts I, II, VI, VII, and X sought to hold Apple liable for “publication decisions.” Barnes, 570 F.3d at 1105. Each of these claims refers, as the basis for culpability, to Apple’s authorization, monitoring, or failure to remove Toast Plus from the App Store. Because these are quintessential “publication decisions” under Barnes, 570 F.3d at 1105, liability is barred by section 230(c)(1). The district court correctly concluded that “the immunity afforded by § 230” renders amendment futile for these five claims. Therefore, the claims were properly dismissed. We also agree that the district court properly dismissed Count III under California's Consumer Privacy Act and Count VIII under Maryland’s Personal Information Privacy Act. Those counts alleged that Apple violated statutory duties to “implement reasonable security procedures and practices” to protect the personal information of App Store users. Cal. Civ. Code § 1798.100(e); see also Md. Comm. Code § 14-3503(a) (imposing similar duty). We need not decide whether violations of such duties can be boiled down to publication activities in every instance or whether implementation of reasonable security policies and practices would always “necessarily require an internet company to monitor third-party 4 content.” See HomeAway.com, Inc. v. City of Santa Monica, 918 F.3d 676, 682 (9th Cir. 2019). In this case, at least, plaintiffs failed to plead adequately a theory of injury under these state data privacy statutes that is “fully independent of [Apple’s] role in monitoring or publishing third-party content.” Lemmon v. Snap, Inc., 995 F.3d 1085, 1093 (9th Cir. 2021). Plaintiffs also did not explain in opposition to Apple’s motion to dismiss or on appeal how amendment of the pleadings could cure this defect. We therefore affirm dismissal of Counts III and VIII under section 230(c)(1) without leave to amend. II A The claims asserted in counts IV (violation of California’s Unfair Competition Law (“UCL”)), V (violation of California’s Legal Remedies Act (“CLRA”)), and IX (liability under Maryland’s Consumer Protection Act (“MCPA”)) are not barred by the CDA. These state law consumer protection claims do not arise from Apple’s publication decisions as to whether to authorize Toast Plus. Rather, these claims seek to hold Apple liable for its own representations concerning the App Store and Apple’s process for reviewing the applications available there. Because Apple is the primary “information content 5 provider” with respect to those statements, section 230(c)(1) does not apply. See Carafano v. Metrosplash.com, Inc., 339 F.3d 1119, 1124–25 (9th Cir. 2003) (examining which party “provide[d] the essential published content”). B These state law consumer protection claims are also not foreclosed by the warranty disclaimer or “Limitation of Liability” provision contained in Apple’s Media Services Terms and Conditions (“Terms”). Because the consumer protection claims arise under California and Maryland law, we consider the enforceability of exculpatory provisions under the law of those states. In general, limitation of liability provisions are enforceable against claims for breach of warranty, breach of contract, negligence, and liability for third-party conduct. See Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 209 Cal. App. 4th 1118, 1126–27 (2012); Wolf v. Ford, 644 A.2d 522, 525 (Md. 1994). However, both California and Maryland limit the enforcement of exculpatory provisions that purport to excuse a party from the party’s own fraud or misconduct. See Cal. Civ. Code § 1668; Wolf, 644 A.2d at 525–26. Similarly, waivers of certain statutory claims are unenforceable as a matter of public policy. See, e.g., Cal. Civ. Code § 1751 (“Any waiver by a consumer of the provision of the [the CLRA] is . . . 6 unenforceable.”); Cal. Civil Code § 3513 (“[A] law established for a public reason cannot be contravened by private agreement.”). Here, the App Store Terms may effectively limit Apple’s liability for breach of warranty, breach of contract, and certain third-party torts. But Apple cannot disclaim liability for its own false, misleading, or fraudulent statements. The district court’s conclusion that the Terms are enforceable against claims arising under the UCL, CLRA, and MCPA was in error. C Because neither section 230(c) nor the Terms would bar a well-pleaded consumer protection claim, the question is whether the operative complaint satisfies the heightened pleading requirements for claims sounding in fraud. The CLRA, the MCPA, and the fraud “prong” of the UCL all prohibit material misrepresentations and omissions that have the effect of misleading a reasonable consumer. Cal. Civ. Code § 1770(a); Cal. Bus. & Prof. Code § 17200; Md. Code, Com. Law § 13-301. To state a claim under these statutes, a private plaintiff must clearly identify “what is false or misleading” about the defendant’s statement. Becerra v. Dr Pepper/Seven Up, Inc., 945 F.3d 1225, 1229 (9th Cir. 2019); Wheeling v. Selene Fin. LP, 250 A.3d 197, 215–19 (Md. 2021). A plaintiff 7 must also plead reliance upon the defendant’s statement and allege an actual injury or loss caused by that reliance. Daniel v. Ford Motor Co., 806 F.3d 1217, 1225 (9th Cir. 2015); Bank of Am., N.A. v. Jill P. Mitchell Living Tr., 822 F. Supp. 2d 505, 531–35 (D. Md. 2011); Wheeling, 250 A.3d at 218. Because allegations of misrepresentation sound in fraud, they are subject to the heightened pleading standard of Federal Rule of Civil Procedure 9(b). Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir. 2009). The district court concluded that the operative complaint failed to satisfy the heightened pleading standard. There is support in the record for the district court’s conclusion. Although Plaintiffs do identify a number of Apple’s statements they allege to be “misleading,” they do not explain why those statements would be misleading to a reasonable consumer, whether and how those statements induced reliance, or why reliance was reasonable. Plaintiffs also fail to explain why they should have statutory standing as “consumers” under the CLRA. As to its UCL claim, Plaintiffs did not show under the UCL how, as to the “unfair” prong, Apple’s conduct offends “public policy” or is “substantially injurious to consumers,” Davis v. HSBC Bank Nevada, N.A., 691 F.3d 1152, 1169 (9th Cir. 2012), nor, under the “unlawful” what constituted a predicate violation of some other law, Farmers Ins. Exch. v. Super. Ct., 826 P.2d 730, 734 (Cal. 1992). 8  Although the district court’s dismissal of these claims for failure to meet a heightened pleading standard has a sound basis in the record, the question is whether the district court should have dismissed these claims with prejudice and without leave to amend. Because Plaintiffs could conceivably cure the pleading deficiencies in the consumer protection claims, Plaintiffs should have been afforded the opportunity to amend their complaint. Federal Rule of Procedure 15(a)(2) instructs that federal courts should “freely give leave [to amend] when justice so requires.” Although a district court has “discretion to deny leave to amend when the amendment would be futile,” V.V.V. & Sons Edible Oils Ltd. v. Meenakshi Overseas, LLC, 946 F.3d 542, 547 (9th Cir. 2019), “[d]ismissal of a complaint without leave to amend is improper unless it is clear, on de novo review, that the complaint could not be saved by any amendment.” Parents for Priv. v. Barr, 949 F.3d 1210, 1221 (9th Cir. 2020). Where denial of leave to amend is based on “an inaccurate view of the law,” we must reverse. Smith v. P. Properties and Dev. Corp., 358 F.3d 1097, 1100 (9th Cir. 2004). Here, the district court denied leave to amend based on the conclusion that “all of plaintiffs' claims were premised on Apple’s role as a publisher of the Toast Plus app” such that “any amendment would be futile given Apple's immunity 9 afforded by § 230.” However, Plaintiffs’ consumer protection claims are not barred by section 230. The court did not mention any other rationale, such as “undue delay, bad faith or dilatory motive . . . repeated failure to cure deficiencies by amendments previously allowed . . . [or] undue prejudice to the opposing party . . . .” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1034 (9th Cir. 2008). In the absence of an alternative reason, we must assume that futility is the basis for denial. Smith, 258 F.3d at 1100-01. Because the district court’s denial of leave to amend claims IV, V, and IX was premised on legal error, we vacate the judgment of the district court as to those claims, and remand with instructions to grant Plaintiffs leave to amend their complaint as to those claims. We express no opinion as to the merits of Plaintiffs’ claims. AFFIRMED in part; VACATED and REMANDED in part. Each party shall bear its own costs. 10