NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Ann Marie Mortimer (SBN 169077) 

amortimer@hunton.com 

Jason J. Kim (SBN 221476) 

kimj@hunton.com 

Kirk A. Hornbeck (SBN 241708) 

khornbeck@hunton.com 

HUNTON & WILLIAMS LLP

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Telephone: (213) 532-2000 

Facsimile: (213) 532-2020 

Samuel A. Danon (admitted pro hac vice) 

sdanon@hunton.com 

John J. Delionado (admitted pro hac vice) 

jdelionado@hunton.com

HUNTON & WILLIAMS LLP 

1111 Brickell Avenue, Suite 2500 

Miami, Florida 33143 

Telephone: (305) 810-2500 

Facsimile: (305) 810-2460 

Attorneys for Defendant 

Yahoo! Inc. and Aabaco Small 

Business, LLC

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA – SAN JOSE DIVISION

IN RE: YAHOO! CUSTOMER DATA 

SECURITY BREACH LITIGATION 

CASE NO.: 16-MD-02752-LHK

DEFENDANTS YAHOO! INC. AND 

AABACO SMALL BUSINESS, LLC’S:

(1) NOTICE OF MOTION AND 

MOTION TO DISMISS FIRST 

AMENDED CONSOLIDATED 

CLASS ACTION COMPLAINT 

(2) MEMORANDUM OF POINTS 

AND AUTHORITIES IN SUPPORT 

THEREOF 

Date: March 8, 2018 

Time: 1:30 p.m. 

Courtroom: 8, 4th Floor 

Judge: Hon. Lucy H. Koh 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 1 of 40
1 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

TO ALL PARTIES AND THEIR COUNSEL OF RECORD: 

PLEASE TAKE NOTICE that, on March 8, 2018, at 1:30 p.m., or as soon 

thereafter as this matter may be heard before the Honorable Lucy H. Koh, in 

Courtroom 8 of the above-captioned Court, located at 280 South First Street, 4th 

Floor, San Jose, California 95113, Defendants Yahoo! Inc. (“Yahoo”) and Aabaco 

Small Business, LLC (“Aabaco”) (together, “Defendants”) will and hereby do move 

this Court for an order dismissing Counts 1 through 8 and 11 through 13 of Plaintiffs’ 

First Amended Consolidated Class Action Complaint (“FAC”). Defendants further 

move the Court for an order dismissing Plaintiffs’ request for punitive damages. 

This Motion is made on multiple grounds under Rule 12(b)(6) of the Federal 

Rules of Civil Procedure: 

First, Plaintiffs Rivlin, Granot, and Mortensen have not adequately pled lost 

money or property sufficient to establish statutory standing under California’s unfair 

competition laws; 

Second, Plaintiffs have not pled reliance and/or damages adequately, both of 

which are prima facie elements of their fraudulent concealment claim; 

Third, Plaintiffs’ negligence and fraudulent concealment claims are barred by 

the economic loss rule; 

Fourth, Plaintiffs have not pled facts sufficient to invalidate the limitation-ofliability provisions in the TOS to which they agreed and which bar all but direct 

damages for their contract and negligence claims; 

Fifth, Plaintiffs’ declaratory relief claim is improperly redundant of their 

contract claims; 

Sixth, Plaintiff Mortensen has not adequately pled reliance or the existence of a 

covered “good” or “service” sufficient to state a claim under California’s Consumer 

Legal Remedies Act; 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 2 of 40
2 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Seventh, Plaintiffs Heines and Dugas lack standing to assert a Forged Cookie 

Breach claim under California’s Customer Records Act because neither claims to have 

been affected by that Breach; 

Eighth, Plaintiffs have not cured their deficient allegations that Defendants 

unreasonably delayed notification of the 2013 Breach; 

Ninth, the Customer Records Act’s provision regarding “reasonable security” 

does not apply to the 2013 and 2014 Breaches because that provision did not cover 

“online” account information prior to January 1, 2016; and 

Tenth, Plaintiffs cannot recover punitive damages in connection with any of 

their claims. 

The Motion will be based upon this Notice of Motion and Motion, the 

accompanying Memorandum of Points and Authorities, the Request for Judicial 

Notice filed concurrently herewith, the pleadings and papers on file, and upon such 

oral argument as may be made at the hearing. 

Dated: January 19, 2018 HUNTON & WILLIAMS LLP

By: /s/ Ann Marie Mortimer 

Ann Marie Mortimer 

Attorneys for Defendants Yahoo! Inc. and 

Aabaco Small Business, LLC 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 3 of 40
i 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

TABLE OF CONTENTS 

Page 

I. INTRODUCTION ............................................................................................. 1

II. STATEMENT OF ISSUES TO BE DECIDED ................................................. 4

III. LEGAL ARGUMENT ....................................................................................... 5

A. Plaintiffs Fail To Cure The Pleading Deficiencies In Previously 

Dismissed Claims. ................................................................................... 5

1. The Israel And Paid Users Class Representatives Fail To 

Plead Lost Money Or Property Sufficient To Demonstrate 

Standing Under The UCL (Counts 1 & 2). ..................................... 5

2. The Paid Users Class Representative Also Lacks Standing 

Under The UCL (Counts 1 & 2). .................................................... 6

3. Plaintiffs Fail To Allege Facts Sufficient To Overcome The 

Limitation-Of-Liability Provision In The TOS (Counts 5 

Through 8). .................................................................................... 6

a. Plaintiffs Cannot Show Sufficient “Surprise” Or 

“Oppression.” ...................................................................... 7

b. Plaintiffs’ Substantive Unconscionability Allegations 

Fail....................................................................................... 9

4. The Free Users Fail To Plead Recoverable Contract 

Damages (Counts 5 Through 8). .................................................. 13

5. Plaintiffs Are Limited To Direct Damages, If Any, In 

Connection With Their Implied Covenant Claim (Count 7). ........ 14

6. Declaratory Relief Is Derivatively Deficient And Redundant 

(Count 8)...................................................................................... 14

7. Plaintiffs’ CLRA Claim Remains Deficient (Count 11). .............. 16

8. Plaintiffs Have Not Cured The Defects In Their CRA 

Claims (Counts 12 & 13). ............................................................ 17

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 4 of 40
ii 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

a. No Named Plaintiff Claims Injury From The Forged 

Cookie Breach. .................................................................. 17

b. Plaintiffs Fail To Plead Sufficient Delay Allegations 

For The 2013 Breach. ........................................................ 18

B. Plaintiffs’ “New” Claims Are Deficient. ................................................ 19

1. Plaintiffs Cannot Show Reliance Or Damages For Their 

Fraudulent Concealment Claim (Count 3). ................................... 19

a. Plaintiffs Cannot Show Reliance. ....................................... 19

b. Plaintiffs Cannot Show Damages. ...................................... 20

2. Plaintiffs’ Fraudulent Concealment And Negligence Claims 

Fail Under The Economic Loss Rule (Counts 3 & 4). .................. 22

3. No Retroactive Application Of “Online Account” 

Information For New “Reasonable Security” CRA Claim

(Count 13). ................................................................................... 24

4. Plaintiffs Cannot Recover Punitive Damages (Counts 3, 4, 7, 

10, 11, 12 & 13). .......................................................................... 26

IV. CONCLUSION ............................................................................................... 29

 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 5 of 40
iii 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

TABLE OF AUTHORITIES 

 Page(s) 

Cases 

In re Adobe Sys., Inc. Privacy Litig., 

66 F. Supp. 3d 1197 (N.D. Cal. 2014) ............................................................. 17, 24 

Alcaraz v. Wachovia Mortg., FSB, 

2009 WL 160308 (E.D. Cal. Jan. 21, 2009) .............................................. 26, 27, 28 

Alliance Mortg. Co. v. Rothwell, 

10 Cal. 4th 1226 (1995) ........................................................................................ 20 

Andre v. Bank of Am., NA, 

2016 WL 69914 (N.D. Cal. Jan. 6, 2016) .............................................................. 20 

Armendariz v. Found. Health Psychcare Servs., Inc., 

24 Cal. 4th 83 (2000) ............................................................................................ 10 

Audigier Brand Mgmt. v. Perez, 

2012 WL 5470888 (C.D. Cal. Nov. 5, 2012) ......................................................... 23 

Belton v. Comcast Cable Holdings, LLC, 

151 Cal. App. 4th 1224 (2007) ................................................................................ 9 

Bickley v. Schneider Nat’l, Inc., 

2009 WL 5841196 (N.D. Cal. Feb. 11, 2009) ....................................................... 27 

Body Jewelz, Inc. v. Valley Forge Ins. Co., 

241 F. Supp. 3d 1084 (C.D. Cal. 2017) ........................................................... 22, 23 

Circuit City Stores, Inc. v. Adams, 

279 F.3d 889 (9th Cir. 2002) ................................................................................. 15 

Circuit City Stores, Inc. v. Mantor, 

335 F.3d 1101 (9th Cir. 2003) ............................................................................... 10 

City & Cty. of S.F. v. Tutor-Saliba Corp., 

2005 WL 645389 (N.D. Cal. Mar. 17, 2005) ......................................................... 14 

Copesky v. Super. Ct., 

229 Cal. App. 3d 678 (1991) ................................................................................. 14 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 6 of 40
iv 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Cruz v. HomeBase, 

83 Cal. App. 4th 160 (2000) .................................................................................. 28 

Crystal Springs Upland Sch. v. Fieldturf USA, Inc., 

219 F. Supp. 3d 962 (N.D. Cal. 2016) ................................................................... 22 

Daly v. Viacom, Inc., 

238 F. Supp. 2d 1118 (N.D. Cal. 2002) ................................................................. 20 

Danielson v. Wells Fargo Bank, 

2011 WL 4480849 (C.D. Cal. Sept. 26, 2011) ...................................................... 27 

Darnaa, LLC v. Google, Inc., 

2015 WL 7753406 (N.D. Cal. Dec. 2, 2015) ............................................. 11, 12, 24 

Darnaa, LLC v. Google, Inc.,

236 F. Supp. 3d 1116 (N.D. Cal. 2017) ................................................................. 14 

Doe v. Schwarzenegger, 

2007 WL 601977 (N.D. Cal. Feb. 22, 2007) ................................................... 25, 26 

Elsayed v. Maserati N. Am., Inc., 

215 F. Supp. 3d 949 (C.D. Cal. 2016) ................................................................... 23 

Faulkner v. Cal. Toll Bridge Auth., 

40 Cal. 2d 317 (1953) ........................................................................................... 27 

Ferrington v. McAfee, Inc., 

2010 WL 3910169 (N.D. Cal. Oct. 5, 2010) ......................................................... 16 

Fladeboe v. Am. Isuzu Motors Inc., 

150 Cal. App. 4th 42 (2007) .................................................................................. 20 

Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 

209 Cal. App. 4th 1118 (2012) .............................................................................. 11 

Gallo Glass Co. v. Special Shapes Refractory Co., Inc., 

2017 WL 387247 (E.D. Cal. Jan. 26, 2017) .......................................................... 22

Hammond Enters. Inc. v. ZPS Am. LLC, 

2013 WL 5814505 (N.D. Cal. Oct. 29, 2013)........................................................ 23 

Han v. Mobil Oil Corp., 

73 F.3d 872 (9th Cir. 1995) ................................................................................... 15 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 7 of 40
v 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

In re Heartland Payment Sys., Inc. Customer Data Sec. Breach Litig., 

834 F. Supp. 2d 566 (S.D. Tex. 2011) ................................................................... 13 

Henderson v. Sec. Pac. Nat’l Bank, 

72 Cal. App. 3d 764 (1977) ................................................................................... 26 

In re iPhone Application Litig., 

2011 WL 4403963 (N.D. Cal. Sept. 20, 2011) ........................................................ 9 

In re iPhone Application Litig., 

844 F. Supp. 2d 1040 (N.D. Cal. 2012) ................................................................. 16 

J’Aire Corp. v. Gregory, 

24 Cal. 3d 799 (1979) ........................................................................................... 23 

Jimenez v. Super. Ct., 

29 Cal. 4th 473 (2002) .......................................................................................... 23 

Kilgore v. KeyBank, Nat’l Ass’n, 

718 F.3d 1052 (9th Cir. 2013) ............................................................................. 7, 8 

In re LinkedIn User Privacy Litig., 

932 F. Supp. 2d 1089 (N.D. Cal. 2013) ................................................................. 22 

Lone Star Nat. Bank, N.A. v. Heartland Payment Sys., Inc., 

729 F.3d 421 (5th Cir. 2013) ................................................................................. 13 

Markborough Cal. Inc. v. Super. Ct., 

227 Cal. App. 3d 705 (1991) ................................................................................. 11 

McQuirk v. Donnelley, 

189 F.3d 793 (9th Cir. 1999) ................................................................................. 12 

Michael v. Honest Co., Inc., 

2016 WL 8902574 (C.D. Cal. Dec. 6, 2016) ......................................................... 24 

Molina v. J.C. Penney Co., Inc., 

2015 WL 183899 (N.D. Cal. Jan. 14, 2015) .......................................................... 27

Monaco v. Bear Stearns Residential Mortg. Corp., 

554 F. Supp. 2d 1034 (C.D. Cal. 2008) ................................................................. 14 

Morris v. Redwood Empire Bancorp, 

128 Cal. App. 4th 1305 (2005) .............................................................................. 10 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 8 of 40
vi 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Moule v. United Parcel Serv. Co., 

2016 WL 3648961 (E.D. Cal. July 7, 2016) ............................................................ 7 

Multifamily Captive Grp., LLC v. Assurance Risk Managers, Inc., 

629 F. Supp. 2d 1135 (E.D. Cal. 2009) ................................................................. 23 

Nguyen v. Barnes & Noble, Inc., 

763 F.3d 1171 (9th Cir. 2014) ................................................................................. 8 

Ruiz v. Gap, Inc., 

540 F. Supp. 2d 1121 (N.D. Cal. 2008) ................................................................. 15 

S. Cal. Gas Leak Cases, 

2017 WL 6398546 (Cal. Ct. App. Dec. 15, 2017) ................................................. 23

Savetsky v. Pre-Paid Legal Servs., Inc., 

2015 WL 4593744 (N.D. Cal. July 30, 2015) .......................................................... 8

Simmons v. S. Pac. Transp. Co., 

62 Cal. App. 3d 341 (1972) ................................................................................... 27 

Solarcity Corp. v. Sunpower Corp., 

2017 WL 1739169 (N.D. Cal. May 4, 2017) ......................................................... 16 

Song Fi, Inc. v. Google, Inc., 

2016 WL 1298999 (N.D. Cal. Apr. 4, 2016) ................................................... 20, 21 

Song Fi, Inc. v. Google, Inc., 

2016 WL 3479078 (N.D. Cal. June 27, 2016) ....................................................... 21 

In re Sony Gaming Networks and Customer Data Sec. Breach Litig., 

903 F. Supp. 2d 942 (S.D. Cal. 2012) ................................................................... 22 

Stearns v. Select Comfort Retail Corp., 

2009 WL 1635931 (N.D. Cal. June 5, 2009) ......................................................... 22 

Stewart v. Electrolux Home Products, Inc., 

2018 WL 339059 (E.D. Cal. Jan. 9, 2018) ............................................................ 22 

Taiwan Semiconductor Mfg. Co. v. Tela Innovations, Inc., 

2014 WL 3705350 (N.D. Cal. July 24, 2014) ........................................................ 28 

Tapia v. Super. Ct., 

53 Cal. 3d 282 (1991) ........................................................................................... 25 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 9 of 40
vii 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Taylor v. Super. Ct., 

24 Cal. 3d 890 (1979) ........................................................................................... 27 

Traynor v. Lexington Ins. Co., 

420 F. App’x 674 (9th Cir. 2011) ............................................................................ 7 

Turnbull & Turnbull v. ARA Transp., Inc., 

219 Cal. App. 3d 811 (1990) ................................................................................. 27 

In re Wal-Mart Stores, Inc. Wage & Hour Litig., 

505 F. Supp. 2d 609 (N.D. Cal. 2007) ................................................................... 27 

Walnut Producers of Cal. v. Diamond Foods, Inc., 

187 Cal. App. 4th 634 (2010) ................................................................................ 10 

Warth v. Seldin, 

422 U.S. 490 (1975) .............................................................................................. 17 

WeBoost Media S.R.L. v. LookSmart Ltd., 

2014 WL 2621465 (N.D. Cal. June 12, 2014) ....................................................... 22 

Weiss v. NNN Capital Fund I, LLC, 

2015 WL 11990929 (S.D. Cal. Apr. 3, 2015) ........................................................ 17 

Wiseley v. Amazon.com, Inc., 

2017 WL 4150341 (9th Cir. Sept. 19, 2017) ........................................................... 9 

Woodside Homes of Cal., Inc. v. Super. Ct., 

107 Cal. App. 4th 723 (2003) .................................................................................. 9 

Woolstrum v. Mailloux, 

141 Cal. App. 3d Supp. 1 (1983) ........................................................................... 27 

In re Yahoo Mail Litig., 

7 F. Supp. 3d 1016 (N.D. Cal. 2014) ....................................................................... 8 

In re Yahoo! Inc. Customer Data Sec. Breach Litig., 

2017 WL 3727318 (N.D. Cal. Aug. 30, 2017) ............................................... passim

In re Zappos.com, Inc., 

2013 WL 4830497 (D. Nev. Sept. 9, 2013) ........................................................... 15

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 10 of 40
viii 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Statutes 

15 U.S.C. § 45 ........................................................................................................... 12 

Cal. Bus. & Prof. Code § 17204 ................................................................................... 5 

Cal. Civ. Code § 1668 ................................................................................................ 12 

Cal. Civ. Code § 1761 ................................................................................................ 16 

Cal. Civ. Code § 1798.81.5 ........................................................................................ 24 

Cal. Civ. Code § 3294 .......................................................................................... 27, 28 

Rules 

Fed. R. Civ. P. 9 ......................................................................................................... 14 

 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 11 of 40
1 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

MEMORANDUM OF POINTS AND AUTHORITIES 

I. INTRODUCTION 

Few, if any, security intrusions have received the level of detailed scrutiny as 

the Yahoo Data Breaches. In drafting the First Amended Consolidated Class Action 

Complaint (“FAC”), Plaintiffs stood in the favorable position of not only having the 

benefit of this Court’s rigorous 93-page Motion to Dismiss Order considering and 

outlining the relevant legal issues and providing clear directives on what was required 

to cure the prior pleading deficiencies, but also having access to mountains of relevant 

documentary evidence and a Yahoo corporate representative. In addition to the more 

than 1.5 million pages of documents produced by Defendants concerning all three 

Breaches at issue in this litigation and two full days of corporate representative 

testimony (including extensive documents and testimony concerning Defendants’ 

cybersecurity practices, the October 3, 2017 disclosure regarding the 2013 Breach, 

and Verizon’s acquisition of Defendants’ operating assets), Plaintiffs have been able 

to review: the findings of an intensive independent committee investigation that were 

publicly reported in Yahoo’s 2016 10-K; other detailed securities filings related to 

data security; a DOJ indictment of the perpetrators responsible for the 2014 Breach, 

which include Russian intelligence officers; a putative stockholder class action and 

various stockholder derivative actions; investigations by various government agencies, 

including the SEC; and abundant press coverage and industry expert opinions. Yet, 

despite all of this, Plaintiffs’ sweeping 300-plus paragraph FAC is rife with legal 

defects and still fails to cure the basic pleading deficiencies previously identified by 

this Court. And once again, Plaintiffs’ FAC defaults to broad generalizations, legal 

conclusions, and threadbare assertions in place of well-pled facts specifically linking 

the injuries claimed in this case to the facts alleged. 

Armed with 20/20 hindsight and a variety of cherry-picked statements, 

Plaintiffs claim—yet again—that Defendants should have known something sooner, 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 12 of 40
2 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

done something better, or acted faster. But Yahoo, which has a vast security border 

covering a massive network system to patrol and protect, has been the target of 

relentless criminal attacks. And, of course, Yahoo has abundantly tested its own 

systems against internal and external simulated attacks, discovered vulnerabilities, and 

improved its systems over time in an unending cycle of learning, adapting, and 

responding to constantly evolving security threats. Plaintiffs’ selective excerpts from 

the abundant discovery available to them cannot substitute for or otherwise fulfill the 

requirements laid out by this Court and the operative law. 

In its order on Defendants’ first motion to dismiss, the Court painstakingly 

pared down this sprawling litigation—it limited the pleadings to Plaintiffs’ contract 

claims (express, implied, and implied covenant), unfair competition (“UCL”) claims 

(under the “unfair” and “unlawful” prongs for all Classes, as well as the “fraudulent” 

prong for the Small Business Users Class insofar as the claim related to alleged 

omissions in Defendants’ Small Business advertisements), and Customer Records Act 

(“CRA”) claim insofar as it related to allegedly delayed notification in connection 

with the 2014 and Forged Cookie Breaches. Although the Court granted Plaintiffs 

leave with respect to certain of the deficiencies identified in its order, as detailed 

herein, Plaintiffs failed to cure them. And the “new” claims asserted by Plaintiffs—

which are largely variations on theories already rejected by the Court—likewise fail 

for similar reasons. At this point, Plaintiffs have had every opportunity to meet their 

pleading burden and cure the deficiencies identified by the Court, but again fall short. 

Plaintiffs Rivlin and Granot once again have not adequately pled lost money or 

property sufficient to establish statutory standing under the UCL, and newly added 

Plaintiff Mortensen fails to make that showing as well. As to their contract theories, 

Plaintiffs rely on threadbare recitals and conclusory allegations in place of facts 

demonstrating either procedural or substantive unconscionability. Limitation-ofliability provisions contained in standardized, online agreements like Defendants’ 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 13 of 40
3 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Terms of Service (the “TOS”) are routinely enforced in free and low-cost provider 

situations where users choose among multiple service alternatives, and Plaintiffs pled 

no facts taking this case outside the norm. They fail to establish “surprise” or 

“oppression” sufficient to invalidate the TOS on procedural unconscionability 

grounds; indeed, Plaintiffs admit the TOS forms a binding contract between 

themselves and Defendants as part of their contract claim. FAC ¶ 225. And nothing 

about the TOS “shocks the conscience” in a manner sufficient to invalidate the TOS 

on substantive unconscionability grounds—particularly given the magnitude of risks 

Yahoo would be forced to assume for providing Plaintiffs with a free to low-cost 

service in the absence of some limitation on liability. The declaratory relief claim is 

redundant and fails for the same reasons. By operation of the limitation-of-liability 

provision, Plaintiffs are limited to “direct” contract, implied covenant, and negligence 

damages, if any—and Plaintiffs have pled “out-of-pocket” mitigation costs, which 

they concede are consequential. Plaintiffs’ CLRA claim still fails for lack of reliance 

and the inability to plead a covered “good” or “service.” 

None of the Plaintiffs has standing to bring any type of claim related to the 

Forged Cookie Breach, as none claims to have been impacted by it. Plaintiffs Heines 

and Dugas—the only California Plaintiffs—have failed again to allege facts 

establishing a legally cognizable delay in notification (as opposed to discovery) under 

the CRA (and do not claim to be impacted by the Forged Cookie Breach). Moreover 

the newly invoked “reasonable security” provision of the CRA upon which Heines 

and Dugas rely did not cover “online account” information until 2016, long after the 

2013 and 2014 Breaches—and nothing therein permits retroactive application. 

Plaintiffs’ other new claims fare no better. None of the Plaintiffs who purport 

to represent the free and Paid Users Classes claims even to have read the Privacy 

Policy, so they cannot plead reliance—justifiable or otherwise—to anchor their 

fraudulent concealment claim. Even still, Plaintiffs’ damages allegations fail under 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 14 of 40
4 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

the “out-of-pocket” loss rule, as they pled no facts showing they received less than 

they paid for using Yahoo’s free or low-cost services. Plaintiffs’ fraudulent 

concealment and negligence claims also are barred by the economic loss rule, and 

Plaintiffs cannot recover punitive damages in any event. 

Specifics matter, and Plaintiffs—despite this Court’s clear instructions and their 

incredible access to documents and testimony—still have not remedied their pleading 

deficiencies by replacing bald conclusions with well-pled facts. Plaintiffs’ insufficient 

claims should be dismissed, and this litigation should move on. 

II. STATEMENT OF ISSUES TO BE DECIDED 

1. Whether Plaintiffs Rivlin, Granot, and Mortensen have adequately pled 

lost money or property sufficient to establish statutory standing under California’s 

unfair competition laws; 

2. Whether Plaintiffs have adequately pled reliance and/or damages, both of 

which are prima facie elements of their fraudulent concealment claim; 

3. Whether Plaintiffs’ negligence and fraudulent concealment claims are 

barred by the economic loss rule; 

4. Whether Plaintiffs have adequately pled facts sufficient to invalidate the 

limitation-of-liability provisions in the TOS to which they agreed and which bar all 

but direct damages for their contract and negligence claims; 

5. Whether Plaintiffs’ derivative declaratory relief claim is improperly 

redundant of their deficient contract claims; 

6. Whether Plaintiff Mortensen has adequately pled reliance or the existence 

of a covered “good” or “service” sufficient to state a claim under California’s 

Consumer Legal Remedies Act; 

7. Whether Plaintiffs Heines and Dugas have standing to assert claims 

based on the Forged Cookie Breach under California’s Customer Records Act where 

neither claims to been affected by that Breach; 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 15 of 40
5 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

8. Whether Plaintiffs cured their deficient allegations that Defendants 

unreasonably delayed notification of the 2013 Breach; 

9. Whether Plaintiffs’ new California’s Customer Records Act claim 

regarding “reasonable security,” upon which Plaintiffs Heines and Dugas now rely, 

retroactively applies to the 2013 and 2014 Breaches when it was not amended until 

January 1, 2016 to include “online account” information; 

10. Whether Plaintiffs can recover punitive damages in connection with any 

of their claims. 

III. LEGAL ARGUMENT 

A. Plaintiffs Fail To Cure The Pleading Deficiencies In Previously 

Dismissed Claims. 

1. The Israel And Paid Users Class Representatives Fail To Plead 

Lost Money Or Property Sufficient To Demonstrate Standing 

Under The UCL (Counts 1 & 2). 

This Court previously dismissed UCL claims made by Plaintiffs Rivlin and 

Granot because they did “not sufficiently allege[] standing under the UCL.” In re 

Yahoo! Inc. Customer Data Sec. Breach Litig., 2017 WL 3727318, at *22 (N.D. Cal. 

Aug. 30, 2017). Specifically, the Court found that instead of alleging ascertainable 

and existing loss in the form of lost money or property, Rivlin and Granot alleged 

“imminent risk of future costs as a result of the Data Breaches,” which is “not 

sufficient to allege ‘lost money or property’ under the UCL.” Id. 

Rivlin and Granot’s allegations still fail to make the UCL’s threshold standing 

showing. Cal. Bus. & Prof. Code § 17204. As before, Rivlin and Granot have not 

pled current out-of-pocket damages or already-incurred loss of property or money. 

Rather, they rely on the possibility of future harm to anchor their claim. Compare 

CAC ¶¶ 15, 16 with FAC ¶¶ 23, 24 (“In addition, the Yahoo Data Breaches have 

caused Plaintiff [Rivlin/Granot] to be at substantial risk for identity theft, if in fact 

[his/her] identity has not already been stolen.”). The Court previously rejected the 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 16 of 40
6 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

hypothetical possibility of future or currently unknown harm as a basis for UCL 

standing. In re Yahoo, 2017 WL 3727318, at *22 (“imminent risk of future costs” 

does not establish UCL standing). Rivlin and Granot’s UCL claim should be 

dismissed—this time with prejudice. 

2. The Paid Users Class Representative Also Lacks Standing 

Under The UCL (Counts 1 & 2).

Newly added Plaintiff Mortensen similarly lacks statutory standing to bring 

UCL claims. Like Plaintiffs Rivlin and Granot, Mortensen does not claim he “lost 

money or property” in the form of mitigation expenses or other lost property or 

money. FAC ¶ 28. To the extent Mortensen claims a “greater risk of identity theft 

and other fraud” (id.), that does not constitute “lost money or property,” as the Court 

previously held. In re Yahoo, 2017 WL 3727318, at *22. Nor does Mortensen 

adequately allege “benefit-of-the-bargain” losses. Although he claims he “paid 

$19.95 per year for Yahoo’s premium email service” (FAC ¶ 28), he fails to describe 

the “premium” features for which he paid—e.g., ad-free mail, mail forwarding—much 

less plead facts showing how Yahoo’s allegedly “unlawful” and “unfair” conduct 

deprived him of such features. Indeed, there is no difference between Mortensen’s 

allegations and the similarly vague allegations by Plaintiff Rivlin, which this Court 

held fell short of adequately alleging “lost benefit of the bargain.” In re Yahoo, 2017 

WL 3727318, at *20, 22 n.4 & 5. Like Rivlin, Mortensen’s bare allegation that he 

paid fees associated with his account is not sufficient to demonstrate UCL standing. 

3. Plaintiffs Fail To Allege Facts Sufficient To Overcome The 

Limitation-Of-Liability Provision In The TOS (Counts 5 

Through 8).

As this Court held, Defendants’ TOS limits their liability to Plaintiffs absent 

plausible allegations that those provisions are “unconscionable.” In re Yahoo, 2017 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 17 of 40
7 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

WL 3727318, at *52.1 To overcome those presumptively enforceable limitation-ofliability provisions, the Court ordered Plaintiffs to adequately plead facts evidencing 

both procedural and substantive unconscionability. Id. at *53. Just as this Court 

previously rejected Plaintiffs’ “threadbare recitals” of unconscionability last time, it 

should do so again now. Plaintiffs added more words to the FAC, but no new or 

significant facts to plausibly demonstrate unconscionability. Id. at 46 n.13 

(“Plaintiffs’ claim ... merely lists various provisions of Yahoo’s Terms and Service 

and alleges that these provisions are ‘unconscionable and unenforceable, or precluded 

by federal and state law.’ ... These ‘threadbare recitals’ ... are insufficient to state a 

claim.”) (citation omitted); see also FAC ¶¶ 232-242. Because Plaintiffs have failed 

to plead sufficient facts alleging why the agreed-to limitation-of-liability provisions 

are procedurally unconscionable in terms of “oppression” and “surprise,” or that the 

terms of the provisions are so manifestly unfair as to “shock the conscience,” their 

claims must be dismissed. See Traynor v. Lexington Ins. Co., 420 F. App’x 674 (9th 

Cir. 2011). 

a. Plaintiffs Cannot Show Sufficient “Surprise” Or 

“Oppression.” 

The hallmarks of procedural unconscionability are “surprise” and “oppression.” 

In re Yahoo, 2017 WL 3727318, at *52 (citation omitted). Plaintiffs have pled neither 

sufficiently. Plaintiffs admit the TOS constitutes a contract between themselves and 

Defendants as part of their contract claim. FAC ¶ 225. Plaintiffs, therefore, are bound 

by all of the terms therein, not simply those that presently suit their litigation 

objectives. In any event, Plaintiffs assert that the limitation-of-liability provision is a 

“surprise” because it appeared on pages 8 and 9 of the online TOS, not on the first or 

last page. FAC ¶ 236. This solitary allegation is not enough. Moule v. United Parcel 

Serv. Co., 2016 WL 3648961, at *7 (E.D. Cal. July 7, 2016) (“Plaintiff fails to show 

 

1

 The Court set forth the limitation-of-liability language in both Defendants’ TOS in 

its last order. In re Yahoo, 2017 WL 3727318, at *46. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 18 of 40
8 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

‘surprise’ because the terms were not hidden from view or drafted in ‘fine-print 

terms.’”); Kilgore v. KeyBank, Nat’l Ass’n, 718 F.3d 1052, 1059 (9th Cir. 2013) 

(finding that a contract provision was not procedurally unconscionable under 

California law when the provision was not “buried in fine print in the [contract], but 

was instead in its own section, clearly labeled, in boldface”). First, the only Plaintiffs 

who even claimed to have read the TOS at all are Essar and Neff. Because none of 

the other Plaintiffs has read the TOS, none can plausibly claim “surprise” as to the 

limitation-of-liability provisions, or any other provision. In any event, even as to 

Plaintiffs Essar and Neff, the FAC altogether ignores that the limitation-of-liability 

provisions are clear, conspicuous, and prominently displayed in bold typeface, and 

presented entirely in capitalized letters—they are not obscured or printed in small 

typeface in a footnote. This undercuts any claim of procedural unconscionability. 

Compare FAC ¶ 232 (citing Exhs. 1-6, 16-23) with Kilgore, 718 F.3d at 1059. 

Plaintiffs’ “oppression” allegations also are fatally scant: “On the question of 

oppression, the Terms of Service themselves are contained in an adhesion contract 

that allows for no form of negotiation or modification. All of Defendants’ customers 

must accept the Terms on a take it or leave it basis.” FAC ¶ 237. The fact that a 

limitation-of-liability provision is contained in a standardized agreement is not 

sufficient to demonstrate unconscionability. Standardized contracts, like Defendants’ 

TOS, are routinely enforced within California and throughout the United States. In 

fact, this Court previously has enforced provisions in Yahoo’s TOS, and it should do 

so again here. In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1028-29 (N.D. Cal. 2014) 

(enforcing mail scanning consent provision contained in Yahoo TOS); see also 

Savetsky v. Pre-Paid Legal Servs., Inc., 2015 WL 4593744, at *4, 10 (N.D. Cal. July 

30, 2015) (holding click-wrap characteristic of agreement was neither procedurally 

nor substantively unconscionable). The fact that users are required to affirmatively

accept the TOS further undercuts any argument of unconscionability. Nguyen v. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 19 of 40
9 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Barnes & Noble, Inc., 763 F.3d 1171, 1176 (9th Cir. 2014) (noting that courts 

frequently uphold contracts “where the user is required to affirmatively acknowledge 

the agreement before proceeding with use of the website”).2 

Even accepted as true, Plaintiffs’ allegations that the TOS are included in the 

middle pages of a standardized agreement do not establish procedural 

unconscionability. These already thin allegations are weakened further still by the 

fact that Plaintiffs willingly chose to accept Defendants’ service, including the TOS, 

from a field of alternative mail service providers, eliminating any claim of oppression. 

This choice, and the “availability of alternative sources from which to obtain the 

desired service defeats any claim of oppression.” In re iPhone Application Litig.,

2011 WL 4403963, at *8 (N.D. Cal. Sept. 20, 2011) (quoting Belton v. Comcast Cable 

Holdings, LLC, 151 Cal. App. 4th 1224, 1245 (2007)) (internal quotations omitted). 

b. Plaintiffs’ Substantive Unconscionability Allegations Fail. 

Plaintiffs’ weak showing on procedural unconscionability requires that they 

make a “compelling” case of substantive unconscionability. Woodside Homes of Cal., 

Inc. v. Super. Ct., 107 Cal. App. 4th 723, 730 (2003) (requiring a more robust showing 

of substantive unconscionability where procedural unconscionability is low). 

Plaintiffs do not come close. Although Plaintiffs invoke the conclusory labels that the 

TOS are “unconscionable” and “harsh,” they plead no facts demonstrating substantive 

unconscionability. Having failed to do so, Plaintiffs’ allegations again fail as 

“threadbare recitals” and bald “legal conclusions.” In re Yahoo, 2017 WL 3727318, at 

*52 (“The CCAC does not even mention these requirements, let alone plead facts to 

 

2

See also Wiseley v. Amazon.com, Inc., 2017 WL 4150341, at *1 (9th Cir. Sept. 19, 

2017) (“The notices on Amazon’s checkout and account registration pages, which 

alerted Wiseley that clicking the corresponding action button constituted agreement to 

the hyperlinked COU, were in sufficient proximity to give him a ‘reasonable 

opportunity to understand’ that he would be bound by additional terms.”) (citations 

omitted). 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 20 of 40
10 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

show that they are met. Instead, the CCAC only offers ‘threadbare recitals’ that 

various provisions are unconscionable.”) (citation omitted). 

Substantive unconscionability is evaluated as of the time the contract was made 

and consists of an allocation of risks in an objectively unreasonable manner. 

Armendariz v. Found. Health Psychcare Servs., Inc., 24 Cal. 4th 83, 113-14 (2000). 

“[I]t is important that courts not be thrust in the paternalistic role of intervening to 

change contractual terms that the parties have agreed to merely because the court 

believes the terms are unreasonable. The terms must shock the conscience.” Morris 

v. Redwood Empire Bancorp, 128 Cal. App. 4th 1305, 1322-23 (2005) (citations

omitted) (internal quotations omitted). What shocks the conscience is not measured 

simply by the results of applying the challenged provision. Instead, the provision 

must truly be objectively unreasonable or unexpected—indicating a high level of 

oppression at the time it was entered into. See, e.g., Circuit City Stores, Inc. v. 

Mantor, 335 F.3d 1101, 1106 (9th Cir. 2003) (defendant employer “even resorted to 

threatening [plaintiff’s] job outright should [plaintiff] exercise his putative ‘right’ to 

opt out” of contract). Unconscionability turns not only on a “‘one-sided’ result, but 

also on an absence of ‘justification’ for it ... a contract is largely an allocation of risks 

between the parties, and therefore ... a contractual term is substantively suspect if it 

reallocates the risks of the bargain in an objectively unreasonable or unexpected 

manner.” Walnut Producers of Cal. v. Diamond Foods, Inc., 187 Cal. App. 4th 634, 

647 (2010) (citation omitted) (internal quotations omitted). 

Plaintiffs fail to plead a single fact to plausibly allege the terms of the TOS, and 

the limitation-of-liability provision in particular, were so unfair as to “shock the 

conscience” at the time of contracting. Rather, Plaintiffs resort to conclusory labels, 

alleging that the TOS are “one[-]sided,” presented on an “as[-]is” basis, with “no 

reasonable commercial justification” for a limitation-of-liability provision, since the 

possibility of “consequential damages” is a foreseeable result of a breach and that 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 21 of 40
11 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Plaintiffs “were harmed as a result of Defendants’ breach of contract terms.” FAC 

¶¶ 238-240, 243. These allegations, alone or in combination, fall far short of the mark 

to show substantive unconscionability. 

It is well established under California law that limitation-of-liability provisions 

are fully enforceable, including those in standardized “as-is” contracts. See Food 

Safety Net Servs. v. Eco Safe Sys. USA, Inc., 209 Cal. App. 4th 1118, 1126 (2012).

This is particularly so where, as here, the service is offered for free or at a low cost to 

the subscriber. See Markborough Cal. Inc. v. Super. Ct., 227 Cal. App. 3d 705, 714 

(1991). California courts routinely find limitations of liability to be appropriate where 

it is commercially reasonable to “retain broad discretion over those services and to 

minimize its exposure to monetary damages.” Darnaa, LLC v. Google, Inc., 2015 WL 

7753406, at *3 (N.D. Cal. Dec. 2, 2015), reconsidered in part on other grounds, 2016 

WL 6540452 (N.D. Cal. Nov. 2, 2016). 

Further, the reasonableness of the limitation-of-liability provision is manifest 

here, given that users accepted the provision when they chose Yahoo from other 

alternatives. It would be manifestly unjust to rewrite that agreement and impose 

unlimited liability on Defendants for their free and low-cost services: “Because 

YouTube offers its hosting services at no charge, it is reasonable for YouTube to 

retain broad discretion over those services and to minimize its exposure to monetary 

damages. Plaintiff has not pointed to any shocking unfairness in these provisions of 

the Terms of Service.” Darnaa, 2015 WL 7753406, at *3. Significantly, in Darnaa, 

YouTube’s limitation-of-liability provision was even broader and extended to all 

types of damages, including direct damages. Id. at *4. 

Plaintiffs claim there can be no reasonable commercial justification for the 

inclusion of a limitation-of-liability provision in the data breach context because of 

“state and federal” requirements to maintain “acceptable levels of data security.” 

FAC ¶ 239. These arguments, including Plaintiffs’ attempt to cure their prior pleading 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 22 of 40
12 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

deficiencies with oblique references to the FTC Act, the CRA, or the CLRA (FAC 

¶ 242) are red herrings and no substitutes for well-pled facts. This Court rejected this 

very tactic before, and it should do so again. In re Yahoo, 2017 WL 3727318, at *52. 

Moreover, Defendants are not “seeking to invoke the disclaimers or limitations 

on liability” in connection with those laws. FAC ¶ 242. Further, Defendants have not 

asserted the limitation-of-liability provision as a defense to Plaintiffs’ CRA or CLRA 

claims, and Plaintiffs have not even asserted a claim under the FTC Act, nor could 

they.3 Section 5 of that Act authorizes the FTC to prevent “unfair or deceptive acts or 

practices in or affecting commerce.” 15 U.S.C. § 45(a)(1). However, it does not 

create a private right of action for Plaintiffs. 15 U.S.C. § 45(m)(1)(A). As to the 

CRA, to the extent any violation occurred, it would apply only to California residents 

(here only free users Heines and Dugas). And, again, Defendants have not asserted 

the limitation-of-liability provision as a defense to their CRA claims. In re Yahoo, 

2017 WL 3727318, at *35 (dismissing CRA claims of all non-California citizens).4 

As to the CLRA, Plaintiffs’ claim independently fails for the reasons set forth below 

(and, again, Defendants have not asserted the limitation-of-liability provision as a 

defense to the CLRA claim). Because Plaintiffs have failed yet again to demonstrate 

unconscionability, their contract claims should be limited to any well-pled direct 

damages by paid users only. 

 

3

 This too favors enforcement of the limitation-of-liability provision, since it would 

not have the effect of depriving Plaintiffs of all possible remedies. 

4

 Plaintiffs claim the limitation-of-liability provision cannot be enforced under 

California Civil Code § 1668. FAC ¶ 241. However, Section 1668 extends only to a 

“total release of future liability” for intentional wrongs. McQuirk v. Donnelley, 189 

F.3d 793, 796–97 (9th Cir. 1999) (emphasis added); Darnaa, 2015 WL 7753406, at 

*5. The limitation here is not a total release and therefore does not violate Section 

1668. Also, for the other reasons set forth in this motion, there have been no 

“statutory violations” that would implicate Section 1668. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 23 of 40
13 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

4. The Free Users Fail To Plead Recoverable Contract Damages 

(Counts 5 Through 8).

Plaintiffs agreed that they “cannot seek consequential damages” under the TOS. 

In re Yahoo, 2017 WL 3727318, at *46. And based on Plaintiffs’ concession that 

‘“out-of-pocket mitigation costs’ are consequential damages,” the Court dismissed 

their claims to such damages with leave to amend should Plaintiffs sufficiently allege 

unconscionability. Id.5 As described above, the TOS is neither procedurally nor 

substantively unconscionable. Because Yahoo users are limited to recovery of direct 

damages for contract claims specifically, users who paid nothing can claim nothing—

the only damages they can allege are “consequential” and therefore barred. 

Indeed, in a data breach case involving the exposure of payment card 

information, another district court specifically held: “[w]hen a contract limits 

recovery to direct damages, a plaintiff may recover only the difference between the 

amount paid and the value received.” In re Heartland Payment Sys., Inc. Customer 

Data Sec. Breach Litig., 834 F. Supp. 2d 566, 580 (S.D. Tex. 2011), rev’d in part on 

other grounds sub nom. Lone Star Nat. Bank, N.A. v. Heartland Payment Sys., Inc., 

729 F.3d 421 (5th Cir. 2013). According to the court, the “damages the [plaintiffs] 

seek are not the difference between the contract price and the value of the paymentcard services. Instead, the [plaintiffs] seek the costs they incurred in covering 

fraudulent transactions and replacing payment cards after the hacker intrusion into the 

Heartland computer systems.” Id. The same result should follow here. Plaintiffs 

admit any out-of-pocket mitigation costs are barred as consequential damages if the 

limitation-of-liability provision applies, and they fail to adequately plead any 

compensable direct damages for free users. 

 

5

 The FAC further elaborates that such “consequential out[-]of[-]pocket losses” 

include alleged damages “for procuring credit freeze or protection services, identity 

theft monitoring, and other expenses relating to identity theft losses or protective 

measures.” FAC ¶ 186. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 24 of 40
14 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Moreover, Federal Rule of Civil Procedure 9(g) provides that “when items of 

special damages are claimed, they shall be specifically stated.” City & Cty. of S.F. v. 

Tutor-Saliba Corp., 2005 WL 645389, at *17 (N.D. Cal. Mar. 17, 2005) (“A specific 

statement of special damages requires not just the total lump sum, but a statement of 

the specific items which make up the lump sum.”). Plaintiffs have failed to abide by 

this rule, and should the Court determine that any of the damages are special (i.e., 

consequential), such damages may “be denied.” Id.

5. Plaintiffs Are Limited To Direct Damages, If Any, In 

Connection With Their Implied Covenant Claim (Count 7).

As with Plaintiffs’ other contract theories, they cannot overcome the limitationof-liability provisions in Defendants’ TOS limiting them to direct damages. See, e.g., 

Darnaa, LLC v. Google, Inc., 236 F. Supp. 3d 1116, 1125 (N. D. Cal. 2017)

(limitation-of-liability provision barred implied covenant claim). Thus, Plaintiffs’ 

requests for consequential and punitive damages (FAC ¶ 255) are barred by the TOS. 

Even without the TOS, punitive damages are “not recoverable for breach of the 

implied covenant of good faith and fair dealing outside the insurance context.” 

Monaco v. Bear Stearns Residential Mortg. Corp., 554 F. Supp. 2d 1034, 1043 (C.D. 

Cal. 2008) (citing Copesky v. Super. Ct., 229 Cal. App. 3d 678 (1991)). Thus, even if 

the limitation-of-liability provision were stricken, Plaintiffs’ associated prayers for 

punitive damages should be rejected.

6. Declaratory Relief Is Derivatively Deficient And Redundant 

(Count 8).

Plaintiffs’ declaratory relief claim is very narrow. It requests a single 

declaration from this Court: that certain provisions of the TOS are unconscionable 

and therefore unenforceable. FAC ¶¶ 257-258. These arguments fail again for the 

same reasons the Court previously dismissed the declaratory relief claim without 

prejudice: Plaintiffs’ unconscionability allegations remain deficient. In re Yahoo, 

2017 WL 3727318, at *52-53. Because of these insufficient allegations, the Court 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 25 of 40
15 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

previously could not determine if the claim was redundant. Id. at *52 n.18. The new 

unconscionability allegations, however, only reinforce that declaratory relief here is 

necessarily bound up with, and duplicative of, Plaintiffs’ contract-based claims. In re 

Zappos.com, Inc., 2013 WL 4830497, at *5 (D. Nev. Sept. 9, 2013) (“The Court 

dismisses this claim, as it is on its face duplicative of the causes of action elsewhere 

directly asserted.”); Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121, 1124 (N.D. Cal. 2008) 

(dismissing declaratory relief counterclaim as “completely superfluous to [the] 

lawsuit”). They should be dismissed on that basis.

Here, the declaratory relief claim―which Plaintiffs have not alleged in the 

alternative―is duplicative, as Plaintiffs already made the same deficient 

unconscionability contentions in their contract claim. See FAC ¶¶ 232-42. Indeed, 

the declaratory relief claim specifically incorporates these exact allegations. Id. ¶ 258 

(“The grounds for unconscionability of the disclaimers and limitations on liability 

mentioned above are alleged in paragraphs 232-242, infra, and are specifically 

incorporated herein by reference.”). Plaintiffs allege no additional facts or otherwise 

meaningfully differentiate the contract and declaratory relief claims.6 The declaratory 

relief claim is wholly redundant and would not “serve a useful purpose in clarifying 

and settling the legal relations in issue.” In re Yahoo, 2017 WL 3727318, at *52 n.18 

(citation omitted) (internal quotation omitted). Further, Plaintiffs have had every 

opportunity to meet their pleading burden and have failed. The claim should be 

 

6

 The only additional basis of unconscionability is the one-year limitations period in 

the TOS. FAC ¶ 258. Plaintiffs cite Circuit City Stores, Inc. v. Adams, 279 F.3d 889, 

894 (9th Cir. 2002). FAC ¶ 258. But this case is inapposite, as it addressed an 

arbitration provision made as a condition of employment. Circuit City, 279 F.3d at 

893-94. Moreover, California courts have afforded contracting parties considerable 

freedom to modify the length of a statute of limitations. See, e.g., Han v. Mobil Oil 

Corp., 73 F.3d 872, 877 (9th Cir. 1995) (“A contractual limitation period requiring a 

plaintiff to commence an action within 12 months following the event giving rise to a 

claim is a reasonable limitation which generally manifests no undue advantage and no 

unfairness.”). Plaintiffs plead no facts to suggest that a one-year limit is unreasonable. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 26 of 40
16 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

dismissed with prejudice. Solarcity Corp. v. Sunpower Corp., 2017 WL 1739169, at 

*5 (N.D. Cal. May 4, 2017) (dismissing redundant declaratory relief claim with 

prejudice).

7. Plaintiffs’ CLRA Claim Remains Deficient (Count 11). 

After the Court dismissed Plaintiffs’ CLRA claim, Plaintiffs brought in a new 

plaintiff, Mortensen, to allege the same claim on behalf of a newly alleged “Paid User 

Class.” But the claim fails again for two simple reasons: 

First, Mortensen does not claim he “actually read” the alleged 

misrepresentations that form the basis of the CLRA claim—accordingly, he cannot 

show the requisite reliance. In re Yahoo, 2017 WL 3727318, at *27 (“[T]his Court 

has consistently held that plaintiffs in misrepresentation cases must allege that they 

actually read the challenged representations . . . to state a claim.”) (citations omitted) 

(internal quotations omitted). This alone requires dismissal. 

Second, even if Mortensen had “actually read” and claimed to have relied on 

the alleged misrepresentations, the CLRA claim still fails. Yahoo Mail, a web-based 

email platform, is “software.” As this Court has held repeatedly, “software” is not a 

“good” or a “service” under the CLRA. In re iPhone Application Litig., 844 F. Supp. 

2d 1040, 1070 (N.D. Cal. 2012). By definition, “goods” are statutorily limited to 

“tangible chattels,” and “services” are specifically defined as “work, labor, and 

services ... furnished in connection with the sale or repair of [tangible chattels].” Cal. 

Civ. Code § 1761(a)-(b). Yahoo Mail is neither. Email accounts are not “tangible 

chattel,” and Yahoo does not provide any work or services in support of any “tangible 

chattel.” Ferrington v. McAfee, Inc., 2010 WL 3910169, at *19 (N.D. Cal. Oct. 5, 

2010) (“[S]oftware [is] ... not a service for purposes of the CLRA.”). This flaw is 

both fatal and incurable. Accordingly, the CLRA claim now should be dismissed with 

prejudice. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 27 of 40
17 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

8. Plaintiffs Have Not Cured The Defects In Their CRA Claims 

(Counts 12 & 13). 

a. No Named Plaintiff Claims Injury From The Forged 

Cookie Breach. 

Only the two named plaintiffs who are California citizens (Heines and Dugas) 

can assert CRA claims. See In re Yahoo, 2017 WL 3727318, at *35 (dismissing CRA 

claims of all non-California citizens). However, neither Heines nor Dugas claims to 

have been a user potentially or actually affected by the Forged Cookie Breach.7 

Specifically, the FAC admits that certain Yahoo users were notified of the Forged 

Cookie Breach, yet Heines and Dugas do not plead they are part of that population. 

Compare FAC ¶¶ 6, 142 (alleging that Yahoo notified affected users of the Forged 

Cookie Breach) with id. ¶¶ 18 (Heines), 20 (Dugas) (alleging no Forged Cookie 

Breach notice facts). The FAC nevertheless underscores that the Forged Cookie 

Breach was a separate and different kind of breach (id. ¶¶ 117-118), affecting a 

different―and much smaller―set of users (id. ¶ 6), and occurring at a different time 

(id.). Heines and Dugas thus do not have standing to assert claims based on the 

Forged Cookie Breach. Weiss v. NNN Capital Fund I, LLC, 2015 WL 11990929, at 

*3 (S.D. Cal. Apr. 3, 2015) (“If no class representative has standing to raise a 

particular claim, that claim must be dismissed.”). And they cannot rely on the fact 

that absent class members may have standing. “In a class action, named plaintiffs 

representing a class ‘must allege and show that they personally have been injured, not 

that injury has been suffered by other, unidentified members of the class to which they 

belong and which they purport to represent.’” In re Adobe Sys., Inc. Privacy Litig., 66 

F. Supp. 3d 1197, 1211 (N.D. Cal. 2014) (quoting Warth v. Seldin, 422 U.S. 490, 502 

(1975)). These two Plaintiffs have not and cannot plead injury from the Forged 

 

7

 Although the Court previously decided the issue of standing, it did not address 

Yahoo’s argument that “no California-resident Plaintiff specifically claims to have 

been affected by the Forged Cookie Breach.” ECF No. 94 at 21 n.26. The FAC did 

nothing to change this specific pleading deficiency. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 28 of 40
18 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Cookie Breach. Accordingly, the claim that Yahoo violated the CRA with respect to 

that Breach must be dismissed. 

b. Plaintiffs Fail To Plead Sufficient Delay Allegations For 

The 2013 Breach. 

The Court previously dismissed the CRA notice-delay claim for the 2013 

Breach because Plaintiffs failed to allege “when Defendants learned of the 2013 

breach[.]” In re Yahoo, 2017 WL 3727318, at *38. Plaintiffs’ failure to do so 

prevented the Court from determining “which version of the CRA was in effect 

[when] Defendants allegedly violated the CRA” for purposes of Defendants’ 

retroactivity argument.8 Id. at *38. Notwithstanding that Plaintiffs had ample

opportunity to obtain pre-amendment discovery, including documents and deposition 

testimony related to the 2013 Breach and the October announcement with respect to 

the scope of that breach, the FAC still lacks facts establishing an unreasonable delay 

by Defendants in notifying affected users of the 2013 Breach. The same fatal 

omission therefore remains. 

Plaintiffs provide no details regarding the actual discovery date of the 2013 

Breach, despite having examined Defendants’ corporate representative abundantly on 

this topic and receiving written discovery on this very issue. At most, Plaintiffs 

complain of a delay in discovery, but plead no facts evidencing an unreasonable delay 

in notification. As this Court held, the CRA’s notification requirement governs delays 

in notification—not delays in discovery. In re Yahoo, 2017 WL 3727318, at *37, 38 

(dismissing CRA notification-delay claim based on Plaintiffs’ failure to include “any 

allegations ... suggesting when Defendants learned of the 2013 breach.”) (emphasis 

added). Consequently, Plaintiffs have not adequately alleged that Defendants 

“‘unreasonably delay[ed]’ in notifying Plaintiffs of the 2013 Breach.” Id. Because 

 

8

 The Court summarized that argument, which addressed the addition of “personal 

account” information to the CRA’s notification provisions, made effective by a 

January 1, 2014 amendment. In re Yahoo, 2017 WL 3727318, at *36-37. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 29 of 40
19 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Plaintiffs have failed once again to cure the deficiencies highlighted by the Court, 

Plaintiffs’ notification-delay claim regarding the 2013 Breach should be dismissed 

with prejudice. 

B. Plaintiffs’ “New” Claims Are Deficient. 

1. Plaintiffs Cannot Show Reliance Or Damages For Their 

Fraudulent Concealment Claim (Count 3). 

In the FAC, Plaintiffs have recast their failed UCL fraud claim as a fraudulent 

concealment claim, and it fails for the same reasons, as well as others. In both 

instances, Plaintiffs claim Defendants did not disclose that their security systems 

allegedly were substandard and did not timely notify them of the 2014 Breach.9 

Compare CAC ¶ 132 with FAC ¶¶ 201, 203. Nothing is truly “new,” and the pleading 

deficiencies identified by the Court in the prior complaint have not been cured. 

a. Plaintiffs Cannot Show Reliance. 

The last time the Court dismissed Plaintiffs’ UCL claim under a fraudulent 

omissions theory,10 it stated: “Plaintiffs have not alleged that, had Defendants 

disclosed in their Privacy Policy that Defendants’ security systems were noncompliant and substandard, Plaintiffs ‘would have been aware’ of this disclosure” 

because they did “not allege that they actually read Defendants’ Privacy Policy.” In 

re Yahoo, 2017 WL 3727318, at *30. Plaintiffs’ fraudulent concealment claim suffers 

the same flaw. With the exception of Plaintiff Neff,11 none of the Plaintiffs claims to 

 

9

 Plaintiffs do not claim Yahoo fraudulently concealed the 2013 or Forged Cookie 

Breaches—rather, they limit the claim to the 2014 Breach. FAC ¶¶ 201, 203. 

10 The sole exception is Plaintiff Neff, whom the Court permitted to bring a UCL 

fraud claim on behalf of the Small Business Users Class. 

11 Indeed, only Plaintiff Neff purports to bring a UCL claim under the “fraudulent” 

prong, likely because he is the only Plaintiff who claims exposure to materials that 

allegedly required corrective disclosures. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 30 of 40
20 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

have read Yahoo’s Privacy Policy12 when they signed up for their Yahoo Mail 

accounts. Plaintiffs’ fraudulent concealment claim fails on that basis alone. Id.

(dismissing UCL claim based on allegedly fraudulent omissions because Plaintiffs did 

“not allege that they actually read Defendants’ Privacy Policy”). 

b. Plaintiffs Cannot Show Damages. 

Plaintiffs also fail to plead damages under the out-of-pocket loss rule governing 

fraud claims. As the Supreme Court of California has made plain, absent a fiduciary 

relationship (which does not exist here), a “defrauded party is ordinarily limited to 

recovering his out-of-pocket loss.” Alliance Mortg. Co. v. Rothwell, 10 Cal. 4th 1226, 

1240 (1995) (quotations omitted); see also Fladeboe v. Am. Isuzu Motors Inc., 150 

Cal. App. 4th 42, 66 (2007) (“Under California law, a defrauded party is ordinarily 

limited to recovering out-of-pocket damages.”) (citation omitted); Daly v. Viacom, 

Inc., 238 F. Supp. 2d 1118, 1126 (N.D. Cal. 2002) (“As plaintiff must plead 

cognizable ‘out-of-pocket’ damages to state a cause of action for fraud, plaintiff has 

not adequately pleaded a cause of action for fraud.”). 

Out-of-pocket damages, in turn, are measured by the “difference in actual value 

at the time of the transaction between what the plaintiff gave and what he received.” 

Song Fi, Inc. v. Google, Inc., 2016 WL 1298999, at *7 (N.D. Cal. Apr. 4, 2016) 

(emphasis added) (citation omitted); see also Andre v. Bank of Am., NA, 2016 WL 

69914, at *5 (N.D. Cal. Jan. 6, 2016) (out-of-pocket rule ‘“awards the difference in 

actual value at the time of the transaction between what the plaintiff gave and what he 

received”’) (citation omitted). 

 

12 Plaintiff Essar claims only to have read Yahoo’s Terms of Service; he does not 

claim to have read—much less relied upon—the Privacy Policy, which Plaintiffs 

claim gave false assurances as to data security and therefore allegedly required 

corrective disclosures. FAC ¶ 19. As this Court held already, that omission is fatal. 

In re Yahoo, 2017 WL 3727318, at *28 (“Plaintiffs do not allege that they ‘actually 

read’ ... the separate Privacy Policy ... which was accessible ... via an additional 

hyperlink.”). 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 31 of 40
21 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Here, the “damages Plaintiffs describe do not amount to out-of-pocket damages 

because they do not reflect the difference between what Plaintiffs paid [Defendants] 

and what they received.” Song Fi, 2016 WL 1298999, at *8. Plaintiffs Heines, Essar, 

Dugas, the Ridolfos, Rivlin, and Granot did not pay anything to use Yahoo Mail, and 

so cannot meet this standard. For example, in one case that concerned free online 

services, the court found: 

Plaintiffs still do not allege out-of-pocket damages. Their 

allegations include the following proposed damages:

payments to technical personnel to convert, condense and 

upload the LuvYa video and manage comments and 

responses on the Stevie Marco YouTube channel; loss of 

advertising expenses paid to Facebook to promote LuvYa; 

the “views, likes, and favorable public comments that are the 

property of Plaintiffs”; the fair market value of these likes 

and comments; and attorneys’ fees. [Citation.] None of 

these enumerated alleged damages, nor any other 

damages listed in the 3AC, reflect “the difference in 

actual value at the time of the transaction between what 

the plaintiff gave and what he received” due to the

allegedly fraudulent nature of the transaction. 

Song Fi, Inc. v. Google, Inc., 2016 WL 3479078, at *4 (N.D. Cal. June 27, 2016) 

(emphasis added). Plaintiffs Heines, Essar, Dugas, the Ridolfos, Rivlin, and Granot 

suffer the same shortcoming—they paid nothing to Defendants. As a consequence, 

they cannot show damages under the out-of-pocket loss rule. 

Plaintiff Mortensen fares no better. As stated above, although Mortensen 

claims he “paid $19.95 per year for Yahoo’s premium email service” (FAC ¶ 28), he 

does not even describe the “premium” features for which he paid.13 Indeed, Plaintiffs 

 

13 In re Yahoo, 2017 WL 3727318, at *20, 22 n.4 & 5 (allegations of payment for mail 

forwarding features insufficient to establish cognizable out-of-pocket loss stemming 

from Breaches). 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 32 of 40
22 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

pled no distinctions between the TOS and Privacy Policy provided to free versus 

premium users. And there are no facts showing any alleged promise that Yahoo made 

to premium users with respect to security protocols that differs from those allegedly 

made to free users. Quite simply, Mortensen “does not sufficiently demonstrate that 

included in [his] bargain for premium membership was the promise of a particular (or 

greater) level of security that was not part of the free membership.” In re LinkedIn 

User Privacy Litig., 932 F. Supp. 2d 1089, 1093 (N.D. Cal. 2013). 

2. Plaintiffs’ Fraudulent Concealment And Negligence Claims 

Fail Under The Economic Loss Rule (Counts 3 & 4). 

Plaintiffs’ negligence and fraudulent concealment claims also fail under the 

economic loss rule. That rule bars tort claims absent personal injury or property 

damage. Stearns v. Select Comfort Retail Corp., 2009 WL 1635931, at *3 (N.D. Cal. 

June 5, 2009); Crystal Springs Upland Sch. v. Fieldturf USA, Inc., 219 F. Supp. 3d 

962, 968 (N.D. Cal. 2016); Gallo Glass Co. v. Special Shapes Refractory Co., Inc., 

2017 WL 387247, at *5 (E.D. Cal. Jan. 26, 2017). Plaintiffs allege no personal injury 

or property damage here. 

Courts in the Ninth Circuit regularly dismiss negligence and fraudulent 

concealment claims under the economic loss rule, and the Court should do so now. 

See, e.g., Stewart v. Electrolux Home Products, Inc., 2018 WL 339059, at *3 (E.D. 

Cal. Jan. 9, 2018) (“Plaintiffs’ damages from the thermostat failure during the selfcleaning cycle are limited to economic loss, precluding their strict liability and 

fraudulent concealment claims.”); In re Sony Gaming Networks and Customer Data 

Sec. Breach Litig., 903 F. Supp. 2d 942, 961-62 (S.D. Cal. 2012) (dismissing 

negligence claim in data breach case under economic loss rule); Body Jewelz, Inc. v. 

Valley Forge Ins. Co., 241 F. Supp. 3d 1084, 1093-94 (C.D. Cal. 2017) (“As 

Plaintiff’s negligence claim is barred by the economic[-]loss rule, the dismissal is 

without leave to amend.”); WeBoost Media S.R.L. v. LookSmart Ltd., 2014 WL 

2621465, at *6 (N.D. Cal. June 12, 2014) (“The Court finds that Plaintiff’s fraudulent 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 33 of 40
23 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

concealment claims are barred by the economic[-]loss rule.”); Multifamily Captive 

Grp., LLC v. Assurance Risk Managers, Inc., 629 F. Supp. 2d 1135, 1145-46 (E.D. 

Cal. 2009) (dismissing fraud claims pursuant to economic loss rule where plaintiffs 

sought only economic losses); Hammond Enters. Inc. v. ZPS Am. LLC, 2013 WL 

5814505, at *4-5 (N.D. Cal. Oct. 29, 2013) (barring fraudulent concealment claim 

under economic loss rule and finding that “[w]here a purchaser’s expectations in a 

sale are frustrated because the product he bought is not working properly, his remedy 

is said to be in contract alone, for he has suffered only ‘economic losses’”) (citation 

omitted) (internal quotations omitted). Indeed, a California Court of Appeal recently 

held the economic loss rule applies even in the mass tort context. S. Cal. Gas Leak 

Cases, 2017 WL 6398546, at *9 (Cal. Ct. App. Dec. 15, 2017). 

Here, Plaintiffs plead no personal injury or property damage; at best, Plaintiffs 

seek economic losses. Accordingly, Plaintiffs’ negligence and fraudulent 

concealment claims are barred by the economic loss rule and should be dismissed. 

Audigier Brand Mgmt. v. Perez, 2012 WL 5470888, at *6 (C.D. Cal. Nov. 5, 2012) 

(dismissing fraudulent concealment claim where plaintiff failed to allege damages 

beyond its economic losses); Jimenez v. Super. Ct., 29 Cal. 4th 473, 483 (2002). 

As to their negligence claim, Plaintiffs seek to invoke the “special relationship” 

exception to the economic loss rule articulated in J’Aire Corp. v. Gregory, 24 Cal. 3d 

799, 804 (1979). FAC ¶ 215. But no “special relationship” exists. First, the “special 

relationship exception is not applicable here where, unlike in J’Aire, Plaintiff[s] and 

Defendant[s] are in privity of contract.” Body Jewelz, 241 F. Supp. 3d at 1092-93 

(“special relationship” exception to economic loss rule inapplicable where parties had 

contract covering online services and website monitoring). Unlike the plaintiff in 

J’aire, Plaintiffs claim there is a “binding contract between Yahoo and each user.” 

FAC ¶ 225. Second, “[Defendants] did not design [Yahoo Mail] with Plaintiff[s], or 

any particular use, in mind.” Elsayed v. Maserati N. Am., Inc., 215 F. Supp. 3d 949, 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 34 of 40
24 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

964 (C.D. Cal. 2016). To the contrary, as Plaintiffs concede, Defendants provide the 

same Yahoo Mail platform to “hundreds of millions” of users. FAC ¶ 165; Michael v. 

Honest Co., Inc., 2016 WL 8902574, at *24 (C.D. Cal. Dec. 6, 2016) (“The FAC does 

not adequately plead any exception to the economic[-]loss doctrine. It does not allege 

more than a relationship between Plaintiffs and Defendant that is an ‘everyday 

consumer transaction.’”). Defendants plainly do not have a “special relationship” 

with “hundreds of millions” of users, all of whom used the same Yahoo Mail platform 

under the same Terms of Service and Privacy Policy. 

But even if Plaintiffs could overcome the economic loss rule (and they cannot), 

Plaintiffs’ negligence claim fails because the remedies they seek are barred by the 

limitation-of-liability provision in the TOS, which expressly covers 

“UNAUTHORIZED ACCESS TO OR ALTERATION OF YOUR 

TRANSMISSIONS OR DATA.” FAC, Exh. 6 § 20; see also id., Exh. 23 ¶ 13. As 

stated above, that provision is valid and fully enforceable. See, e.g., Darnaa, 2015 

WL 7753406, at *5 (dismissing negligence theory without leave to amend based on 

limitation-of-liability provision in YouTube’s TOS). 

3. No Retroactive Application Of “Online Account” Information 

For New “Reasonable Security” CRA Claim (Count 13).

Plaintiffs’ new CRA claim under Section 1798.81.5 (regarding “reasonable 

security” measures) fails on retroactivity grounds. This separate CRA claim was not 

in the prior complaint (see generally CAC (ECF No. 80)) and thus has not been 

addressed by the Court. This Court has stated under Section 1798.81.5 that: “A 

business that owns or licenses [or maintains] personal information about a California 

resident shall implement and maintain reasonable security procedures and practices 

appropriate to the nature of the information, to protect the personal information from 

unauthorized access, destruction, use, modification, or disclosure.” In re Adobe, 66 F. 

Supp. 3d at 1210 (citing Cal. Civ. Code § 1798.81.5(b)). 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 35 of 40
25 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Before January 1, 2016, the plain language of the CRA narrowly defined 

“personal information” under Section 1798.81.5(d)―and it did not include “online 

account” information in the context of “reasonable security” measures: 

[A]n individual’s first name or first initial and his or her last name in 

combination with any one or more of the following data elements, 

when either the name or the data elements are not encrypted: 

(A) Social security number. 

(B) Driver’s license number or California identification card number. 

(C) Account number, credit or debit card number, in combination with 

any required security code, access code, or password that would 

permit access to an individual’s financial account.

(D) Medical information. 

That narrow construction is supported by a later amendment to that same 

provision, which changed the definition of “personal information” to include “online 

account” information, such as Defendants’ services here. See RJN, Exh. A. Unlike 

the 2014 “online account” information amendment to the CRA’s separate notification 

provision, the “reasonable security” provision of Section 1798.81.5 did not apply to 

“online account” information until two years later, specifically on January 1, 2016. 

See RJN, Exh. B. This is well after both the 2013 and 2014 Breaches. 

A ‘“new statute is presumed to operate prospectively absent an express 

declaration of retrospectivity or a clear indication that the electorate, or the 

Legislature, intended otherwise.’” See, e.g., Doe v. Schwarzenegger, 2007 WL 

601977, at *1 (N.D. Cal. Feb. 22, 2007) (quoting Tapia v. Super. Ct., 53 Cal. 3d 282, 

287 (1991)). There has been no express declaration of retrospectivity here. Rather, 

this was a change in the law that lacks the requisite legislative declaration for 

retroactive application. And while the CRA’s separate notification obligation is tied 

to discovery of a breach, Section 1798.81.5’s “reasonable security” requirement has 

no such trigger. In other words, although amendments to the CRA’s separate 

notification provision may have created an obligation to notify of a breach discovered 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 36 of 40
26 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

post-amendment, there is no way to go back in time and hold a business liable for 

allegedly failing to have applied a security requirement that it would have had to 

foretell would be in effect years later. 

Here, Plaintiffs allege that “[i]n the 2013 Breach, hackers obtained, among 

other things, class members’ Yahoo login (ID), Country Code, Recovery E-Mail 

(linked with the profile), Date of Birth (DOB), Hash of Password (MD5), and Cell 

phone number and ZIP code if they were provided by the user for password recovery.” 

FAC ¶ 133. For the 2014 Breach, Plaintiffs allege “the account information may have 

included names, email addresses, telephone numbers, dates of birth, hashed passwords 

(the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security 

questions and answers.” Id. ¶ 126.14 Accordingly, the 2013 and 2014 Breaches 

involved the compromise of information regarding “online accounts,” but the 

requirement regarding “reasonable security” measures in Section 1798.81.5 did not 

arise before January 1, 2016. As such, Plaintiffs’ attempt to retroactively apply 

Section 1798.81.5 to the 2013 and 2014 Breaches should be dismissed with prejudice. 

4. Plaintiffs Cannot Recover Punitive Damages (Counts 3, 4, 7, 

10, 11, 12 & 13). 

“Punitive damages are never awarded as a matter of right, are disfavored by the 

law, and should be granted with the greatest of caution and only in the clearest of 

cases.” Alcaraz v. Wachovia Mortg., FSB, 2009 WL 160308, at *12 (E.D. Cal. Jan. 

21, 2009) (citing Henderson v. Sec. Pac. Nat’l Bank, 72 Cal. App. 3d 764, 771 

(1977)). Because punitive damages are so heavily disfavored, Plaintiffs carry a heavy 

pleading burden to overcome dismissal of the same. “Allegations that the acts ... 

were ‘arbitrary, capricious, fraudulent, wrongful and unlawful,’ like other adjectival 

descriptions of such proceedings, constitute mere conclusions of law.” Id. at *12 

 

14 Neither of the two California residents who allege CRA claims specifically alleges 

the necessary data elements that would permit access to an individual’s “financial 

account.” FAC ¶¶ 18, 20. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 37 of 40
27 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

(quoting Faulkner v. Cal. Toll Bridge Auth., 40 Cal. 2d 317, 329 (1953)). Plaintiffs 

do not meet their burden. 

First, Plaintiffs cannot recover punitive damages under a negligence theory 

because “[c]onduct which may be characterized as unreasonable, negligent, grossly 

negligent or reckless does not satisfy the highly culpable state of mind warranting 

punitive damages.” Woolstrum v. Mailloux, 141 Cal. App. 3d Supp. 1, 10 (1983) 

(citation omitted); see also Molina v. J.C. Penney Co., Inc., 2015 WL 183899, at *3 

(N.D. Cal. Jan. 14, 2015) (“Generally, mere or even gross negligence will not support 

an award of punitive damages.”) (citing Simmons v. S. Pac. Transp. Co., 62 Cal. App. 

3d 341, 368 (1972)); Taylor v. Super. Ct., 24 Cal. 3d 890, 899-900 (1979)). 

(“[O]rdinarily, routine negligent or even reckless disobedience of traffic laws would 

not justify an award of punitive damages.”). By definition, negligence is an 

unintentional tort—accordingly, Plaintiffs cannot recover punitive damages under a 

negligence theory.15 

Second, Plaintiffs cannot recover punitive damages for their CRA claims. As a 

matter of law, “[w]here a right is created by statute and the statute does not expressly 

permit punitive damages, punitive damages under California Civil Code section 3294 

are not available.” In re Wal-Mart Stores, Inc. Wage & Hour Litig., 505 F. Supp. 2d 

609, 620 (N.D. Cal. 2007); see also, e.g., Bickley v. Schneider Nat’l, Inc., 2009 WL 

5841196, at *1 (N.D. Cal. Feb. 11, 2009) (same, collecting cases); Turnbull & 

Turnbull v. ARA Transp., Inc., 219 Cal. App. 3d 811, 826-27 (1990) (“[W]hen a new 

right ... is created by statute and a statutory remedy for the infringement thereof is 

provided, such remedy is exclusive of all others”) (citations omitted). Nothing on the 

face of the CRA expressly allows for punitive damages. Accordingly, Plaintiffs 

cannot recover punitive damages based on an alleged violation of the CRA. Cf. 

 

15 As noted above in Section III.A.5, Plaintiffs also cannot recover punitive damages 

for their implied covenant claim (Count 7). 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 38 of 40
28 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Danielson v. Wells Fargo Bank, 2011 WL 4480849, at *3 (C.D. Cal. Sept. 26, 2011)

(“The Ninth Circuit has implicitly authorized the use of a 12(b)(6) motion to challenge 

a prayer for damages precluded by law.”). 

Third, Plaintiffs otherwise fail to allege facts sufficient to warrant an award of 

punitive damages under any other claim. See, e.g., FAC ¶¶ 211, 277, 288. “Under 

California punitive damages law, a company simply cannot commit willful and 

malicious conduct—only an individual can.” Taiwan Semiconductor Mfg. Co. v. Tela 

Innovations, Inc., 2014 WL 3705350, at *6 (N.D. Cal. July 24, 2014); see also Cal. 

Civ. Code § 3294(b) (“With respect to a corporate employer, the advance knowledge 

and conscious disregard, authorization, ratification, or act of oppression, fraud, or 

malice must be on the part of an officer, director, or managing agent of the 

corporation.”) (emphasis added); Alcaraz, 2009 WL 160308, at *12 (“[S]ection 

3294(b) requires proof of wrongful conduct among corporate leaders.”) (citing Cruz 

v. HomeBase, 83 Cal. App. 4th 160, 166 (2000)) (emphasis added). 

Taiwan Semiconductor is instructive. In that case, the court struck the

plaintiff’s punitive damage allegations because it failed to allege specific facts 

showing a managing agent, officer, or director of the corporate defendant actually 

committed any malice, fraud, or oppression. Taiwan Semiconductor, 2014 WL 

3705350, at *7. Just like the plaintiff in Taiwan Semiconductor, Plaintiffs similarly 

fail to allege specific facts showing a specific managing agent, officer, or director of 

Defendants actually committed fraud, malice, or oppression. Plaintiffs’ failure to do 

so is a “fatal defect” and warrants dismissal of their punitive damages requests. Id. 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 39 of 40
29 

NOTICE OF MOTION AND MOTION TO DISMISS 

FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

IV. CONCLUSION 

For these reasons, the Court should dismiss Counts 1 through 8 and 11 through 

13 of the FAC with prejudice. The Court further should dismiss Plaintiffs’ requests 

for punitive damages. 

Dated: January 19, 2018 HUNTON & WILLIAMS LLP

By: /s/ Ann Marie Mortimer 

Ann Marie Mortimer 

Attorneys for Defendants Yahoo! Inc. and 

Aabaco Small Business, LLC 

Case 5:16-md-02752-LHK Document 205 Filed 01/19/18 Page 40 of 40