REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Ann Marie Mortimer (SBN 169077)

amortimer@hunton.com 

Jason J. Kim (SBN 221476) 

kimj@hunton.com 

Kirk A. Hornbeck (SBN 241708) 

khornbeck@hunton.com 

HUNTON & WILLIAMS LLP

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Telephone: (213) 532-2000 

Facsimile: (213) 532-2020 

Samuel A. Danon (admitted pro hac vice) 

sdanon@hunton.com 

John J. Delionado (admitted pro hac vice) 

jdelionado@hunton.com

HUNTON & WILLIAMS LLP 

1111 Brickell Avenue, Suite 2500 

Miami, Florida 33143 

Telephone: (305) 810-2500 

Facsimile: (305) 810-2460 

Attorneys for Defendants 

Yahoo! Inc. and 

Aabaco Small Business, LLC

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA – SAN JOSE DIVISION

IN RE: YAHOO CUSTOMER DATA 

SECURITY BREACH LITIGATION 

CASE NO.: 16-MD-02752 LHK 

REPLY IN SUPPORT OF DEFENDANTS 

YAHOO! INC. AND AABACO SMALL 

BUSINESS, LLC’S MOTION TO DISMISS 

Date: August 24, 2017 

Time: 1:30 p.m. 

Courtroom: 8, 4th Floor 

Judge: Hon. Lucy H. Koh

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 1 of 21
i

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

TABLE OF CONTENTS 

Page 

I. INTRODUCTION ................................................................................................................ 1

II. ARGUMENT ....................................................................................................................... 2

A. Plaintiffs Fail To Allege Facts That Support Article III Standing ............................... 2

B. Plaintiffs Fail To State UCL Claims .......................................................................... 3

1. Plaintiffs have not pled harm caused by a UCL violation. .............................. 3

2. Unlawful, unfair, or fraudulent conduct cannot be inferred............................. 4

3. Plaintiffs fail to allege actionable fraud on which they relied.......................... 4

4. Plaintiffs fail to demonstrate eligibility for injunctive relief. .......................... 5

C. Plaintiffs Fail To State A CLRA Claim ..................................................................... 6

D. Plaintiffs Fail To State A CRA Claim ........................................................................ 6

1. Non-Californians cannot bring CRA claims. .................................................. 6

2. The CRA did not mandate notice for the 2013 or Forged Cookie 

Breaches. ....................................................................................................... 7

3. Plaintiffs do not allege appropriate CRA delay damages. ............................... 8

E. Plaintiffs Fail To State An SCA Claim ...................................................................... 8

F. Plaintiffs Fail To State An OPPA Claim .................................................................... 9

G. Plaintiffs Fail To State An Express Contract Claim ................................................... 9

H. Plaintiffs Fail To State An Implied Contract Claim.................................................. 11

I. Plaintiffs Fail To State An Implied Covenant Claim ................................................ 12

J. Plaintiff Neff Fails To State A Fraudulent Inducement Claim .................................. 12

K. The Foreign Plaintiffs Cannot Bring A Negligence Claim ....................................... 13

L. Plaintiffs Cannot Pursue Declaratory Relief............................................................. 14

III. CONCLUSION .................................................................................................................. 15

 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 2 of 21
ii

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

TABLE OF AUTHORITIES 

Page(s) 

Cases 

Aas v. Sup. Ct., 

24 Cal. 4th 627 (2000) .............................................................................................................. 14 

Attias, et al. v. CareFirst, Inc., et al., 

2017 WL 3254941 (D.C. Cir. Aug. 1, 2017) ............................................................................... 1 

In re Adobe Sys., Inc. Privacy Litig., 

66 F. Supp. 3d 1197 (N.D. Cal. 2014) ..................................................................................1, 2, 6 

Agape Family Worship Ctr., Inc. v. Gridiron, 

2016 WL 633864 (C.D. Cal. Feb. 16, 2016) .............................................................................. 14 

Am. Title Ins. Co. v. Lacelaw Corp., 

861 F.2d 224 (9th Cir. 1988) ....................................................................................................... 7 

In re Anthem, Inc. Data Breach Litig. (“Anthem I”), 

162 F. Supp. 3d 953 (N.D. Cal. 2016) ................................................................................ passim

Anthony v. Kelsey-Hayes Co., 

25 Cal. App. 3d 442 (1972)....................................................................................................... 14 

Antman v. Uber Techs., Inc., 

2015 WL 6123054 (N.D. Cal. Oct. 19, 2015) .............................................................................. 3 

Avidity Partners, LLC v. State, 

221 Cal. App. 4th 1180 (2013) .................................................................................................. 12 

In re Barnes & Noble Pin Pad Litig., 

2016 WL 5720370 (N.D. Ill. Oct. 3, 2016).................................................................................. 8 

Beck v. McDonald, 

848 F.3d 262 (4th Cir. 2017) ....................................................................................................... 6 

Berry v. Am. Exp. Publ’g, Inc., 

147 Cal. App. 4th 224 (2007)...................................................................................................... 6 

Brunette v. Humane Soc’y of Ventura Cty., 

40 F. App’x 594 (9th Cir. 2002)................................................................................................ 15 

Buena Vista, LLC v. New Res. Bank, 

2010 WL 3448561 (N.D. Cal. Aug. 31, 2010) ............................................................................. 4 

Bugna v. Fike, 

80 Cal. App. 4th 229 (2000) ..................................................................................................... 13 

Carma Developers (Cal.), Inc. v. Marathon Dev. Cal., Inc., 

2 Cal. 4th 342 (1992) ................................................................................................................ 12 

Castillo v. Seagate Tech., LLC, 

2016 U.S. Dist. LEXIS 187428 (N.D. Cal. Sep. 14, 2016) ........................................................ 11 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 3 of 21
iii

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Cement & Concrete Workers Dist. Council Pension Fund v. Hewlett Packard Co., 

964 F. Supp. 2d 1128 (N.D. Cal. 2013) ....................................................................................... 4 

Cisco Sys., Inc. v. STMicroelectronics, Inc., 

77 F. Supp. 3d 887 (N.D. Cal. 2014) ......................................................................................... 14 

Claridge v. RockYou, Inc., 

785 F. Supp. 2d 855 (N.D. Cal. 2011) ......................................................................................... 6 

Columbus Univ. v. Tummala, 

2014 WL 12675010 (C.D. Cal. July 15, 2014) .......................................................................... 13 

Cook, Perkiss & Liehe, Inc. v. N. Cal. Collection Serv. Inc., 

911 F.2d 242 (9th Cir. 1990) ....................................................................................................... 4 

Corona v. Sony Pictures Entm’t, Inc., 

2015 WL 3916744 (C.D. Cal. June 15, 2015) ............................................................................. 8 

Cotter v. Lyft, Inc., 

60 F. Supp. 3d 1059 (N.D. Cal. 2014) ......................................................................................... 7 

Davidson v. Apple, Inc., 

2017 WL 976048 (N.D. Cal. Mar. 14, 2017) ............................................................................. 10 

Doe I v. AOL LLC, 

719 F. Supp. 2d 1102 (N.D. Cal. 2010) ....................................................................................... 6 

Doe v. John F Kennedy Univ., 

2013 WL 4565061 (N.D. Cal. Aug. 27, 2013) ........................................................................... 11 

Doe v. Schwarzenegger, 

2007 WL 601977 (N.D. Cal. Feb. 22, 2007) ............................................................................... 7 

Dubbs v. Glenmark Generics Ltd., 

2014 WL 1878906 (C.D. Cal. May 9, 2014) ............................................................................. 14 

Dugas v. Starwood Hotels & Resorts Worldwide, Inc., 

2016 WL 6523428 (S.D. Cal. Nov. 3, 2016) ........................................................................... 5, 6 

Fabozzi v. StubHub, Inc., 

2012 WL 506330 (N.D. Cal. Feb. 15, 2012) ............................................................................... 9 

Fred Briggs Distrib. Co. v. Cal. Cooler, Inc., 

2 F.3d 1156 (9th Cir. 1993)......................................................................................................... 6 

Frezza v. Google Inc., 

2012 WL 5877587 (N.D. Cal. Nov. 20, 2012) ........................................................................... 11 

Giroux v. Essex Prop. Trust, Inc., 

2017 WL 1549477 (N.D. Cal. May 1, 2017) ............................................................................... 2 

Gravquick A/S v. Trimble Navigation Int’l Ltd., 

323 F.3d 1219 (9th Cir. 2003) ..................................................................................................... 6 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 4 of 21
iv

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Greystone Homes, Inc. v. Midtec, Inc., 

168 Cal. App. 4th 1194 (2008) .................................................................................................. 14 

Herskowitz v. Apple Inc., 

940 F. Supp. 2d 1131 (N.D. Cal. 2013) ..................................................................................... 10 

Holland Am. Line Inc. v. Wartsila N. Am., Inc., 

485 F.3d 450 (9th Cir. 2007) ..................................................................................................... 13 

Interworld Network Int’l, Inc. v. VWR Int’l, Inc., 

2012 WL 78738 (N.D. Cal. Jan. 10, 2012) ................................................................................ 14 

In re iPhone Application Litig., 

6 F. Supp. 3d 1004 (N.D. Cal. 2013) ........................................................................................... 5 

J’Aire Corp. v. Gregory, 

24 Cal. 3d 799 (1979) ............................................................................................................... 14 

Long v. Insight Commc’ns of Cent. Ohio, LLC, 

804 F.3d 791 (6th Cir. 2015) ....................................................................................................... 8 

Lovell v. P.F. Chang’s China Bistro, Inc., 

2015 WL 4940371 (W.D. Wash. Mar. 27, 2015) ....................................................................... 11 

Low v. LinkedIn Corp., 

2011 WL 5509848 (N.D. Cal. Nov. 11, 2011) ............................................................................. 3 

Munning v. Gap, Inc., 

2017 WL 733104 (N.D. Cal. Feb. 24, 2017) ............................................................................... 3 

Muskovich v. Crowell, 

1996 WL 707008 (S.D. Iowa Aug. 30, 1996) .............................................................................. 8 

New Image Labs., Inc. v. Stephan Co., 

34 F. App’x 338 (9th Cir. 2002).................................................................................................. 7 

O’Connor v. Uber Techs., Inc., 

2013 WL 6354534 (N.D. Cal. Dec. 5, 2013) ............................................................................. 11 

Ott v. Alfa-Laval Agri, Inc., 

31 Cal. App. 4th 1439 (1995).................................................................................................... 14 

Perkins v. LinkedIn Corp., 

53 F. Supp. 3d 1190 (N.D. Cal. 2014) ......................................................................................... 5 

Phillips v. Apple Inc., 

2016 WL 1579693 (N.D. Cal. Apr. 19, 2016) ............................................................................. 5 

Poublon v. C.H. Robinson Co., 

846 F.3d 1251 (9th Cir. 2017) ................................................................................................... 15 

Principal Life Ins. Co. v. Robinson, 

394 F.3d 665 (9th Cir. 2005) ..................................................................................................... 15 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 5 of 21
v

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

R Power Biofuels, LLC v. Chemex LLC, 

2016 WL 6663002 (N.D. Cal. Nov. 11, 2016) ......................................................................10, 14 

Ramos v. Citimortgage, Inc., 

2009 WL 86744 (E.D. Cal. Jan. 8, 2009) .................................................................................. 10 

Rhynes v. Stryker Corp., 

2011 WL 2149095 (N.D. Cal. May 31, 2011) ............................................................................. 5 

Seely v. White Motor Co., 

63 Cal. 2d 9 (1965) ................................................................................................................... 14 

In re Sony Gaming Networks & Customer Data Sec. Breach Litig. (“Sony I”), 

903 F. Supp. 2d 942 (S.D. Cal. 2012) ................................................................................... 5, 12 

In re Sony Gaming Networks & Customer Data Sec. Breach Litig. (“Sony II”), 

996 F. Supp. 2d 942 (S.D. Cal. 2014) ......................................................................................... 8 

State Farm Mut. Auto. Ins. Co. v. James M. Liguori, M.D., P.C., 

589 F. Supp. 2d 221 (E.D.N.Y. 2008) ....................................................................................... 15 

Strougo v. Barclays PLC, 

105 F. Supp. 3d 330 (S.D.N.Y. 2015) ......................................................................................... 4 

Strumlauf v. Starbucks Corp., 

192 F. Supp. 3d 1025 (N.D. Cal. 2016) ..................................................................................... 13 

In re Target Corp. Data Sec. Breach Litig., 

66 F. Supp. 3d 1154 (D. Minn. 2014)........................................................................................ 11 

Walters v. Kimpton Hotel & Rest. Grp., LLC, 

2017 WL 1398660 (N.D. Cal. Apr. 13, 2017) ........................................................................... 11 

Welborn v. IRS, 

2016 WL 6495399 (D.D.C. Nov. 2, 2016) .................................................................................. 3 

Willingham v. Glob. Payments, Inc., 

2013 WL 440702 (N.D. Ga. Feb. 5, 2013) ................................................................................ 11 

Statutes 

18 U.S.C. § 2702 .......................................................................................................................... 8, 9 

Cal. Bus. & Prof. Code § 17204 ....................................................................................................... 3 

Cal. Bus. & Prof. Code § 22577 ....................................................................................................... 9

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 6 of 21
1

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

MEMORANDUM OF POINTS AND AUTHORITIES 

I. INTRODUCTION 

In colorful language and sweepingly broad statements, Plaintiffs equate Yahoo’s inability to 

achieve an impenetrable security system—something Yahoo never promised and expressly 

disclaimed—with an automatic breach of legal duty and resulting legal harm. But the size and fact 

of the breaches are not proof that Yahoo’s security measures were inadequate, or even if they were, 

that Plaintiffs suffered actual and compensable injury traceable to the breaches. A causal connection

between the purported data stolen and the injuries alleged is the lynchpin of standing. Here it is 

missing. Although Plaintiffs attempt to camouflage their inferential logical leaps and pleading holes

with frequent references to Anthem and Adobe,

1

this case is starkly different. In those cases, it was 

undisputed that the Social Security numbers and credit card information necessary to perpetrate the 

claimed identity theft and financial injuries were actually stolen in the breach. By contrast, all of 

the harms alleged here—from fraudulent tax returns, to purloined disability checks and unauthorized 

credit card purchases—require access to specific data elements that were never collected or stored by

Yahoo or allegedly disclosed over Yahoo email by or to Plaintiffs. 

Each of Plaintiffs’ claims fails for other, independent reasons. Plaintiffs abandoned their 

UCL restitution claim for non-paying users, injunctive relief is not warranted for a past breach, and 

Plaintiffs have not pled sufficient facts that satisfy the required showing of “unlawful,” “unfair,” or 

“fraudulent” conduct resulting in causally-related harm. Further, Plaintiffs’ CLRA claim fails 

because business users and free subscribers are not “purchasers,” and “services” is a statutory term 

of art that does not apply to the Yahoo email platform. Additionally, nonresidents do not have 

 

1

 In their “Statement of Recent Decision” (ECF No. 120), Plaintiffs seek to align their case with 

Attias, et al. v. CareFirst, Inc., et al., 2017 WL 3254941 (D.C. Cir. Aug. 1, 2017). Rather than prop 

up Plaintiffs’ deficient Complaint, however, Attias serves only to highlight the deficiencies therein. 

Distinguishing Clapper v. Amnesty International USA, 568 U.S. 398 (2013), the Attias court noted 

the plaintiffs in that case failed to establish standing because their claimed injuries turned on a 

“series of contingent events, none of which was alleged to have occurred by the time of the lawsuit.” 

Id. at *6. Like Anthem and Adobe, the Attias plaintiffs overcame Clapper by making “specific 

allegations in the complaint that [the defendant] collected and stored ... credit card and social 

security numbers” and “subscriber ID numbers” that indisputably could be used to commit 

“identity theft.” Id. None of those data elements are alleged to have been stolen in the Yahoo data 

breaches. Like Anthem and Adobe, Attias does not aid Plaintiffs’ cause. 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 7 of 21
2

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

statutory standing under the CRA even where a California choice-of-law provision exists, Plaintiffs 

concede they are not entitled to statutory damages (Opp. at n.27), and no damages can be attributed 

to any delay in notification. Lastly, Yahoo’s expressed goals about privacy and security do not 

create an enforceable legal promise, and Plaintiffs waived all consequential damages even if proven. 

II. ARGUMENT 

A. Plaintiffs Fail To Allege Facts That Support Article III Standing 

Plaintiffs’ theories fall short of the constitutional minimum necessary for standing because 

certain of the alleged harms do not qualify as injury-in-fact, and no facts are pled to causally tether 

any alleged harms to actual data potentially exposed in these breaches. The user information 

potentially exposed in the Yahoo data breaches that allegedly affects Plaintiffs was limited to 

“names, email addresses, telephone numbers, dates of birth, hashed passwords, and some encrypted 

and unencrypted security questions and answers.” Yet, Plaintiffs attempt to morph this into a 

different breach by broadening their definition of PII to include general, non-Plaintiff-specific 

allegations of “private information contained in user’s emails such as financial communications ... 

credit card [records], retail accounts, banking account passwords, IRS documents, and social security 

numbers.” Compl. ¶ 1. But sweeping these items into the definition of PII cannot create standing if 

the data stolen was not the cause of the harms alleged. Here, no Plaintiff alleges his or her email 

account contained this data or any other data necessary to commit the specific alleged injuries. 

“[T]o prove that a data breach caused identity theft, the pleadings must include allegations of 

a nexus between the two instances beyond allegations of time and sequence.” In re Anthem, Inc. 

Data Breach Litig. (“Anthem I”), 162 F. Supp. 3d 953, 987 (N.D. Cal. 2016). Plaintiffs fall short. 

In Anthem, as in Adobe, the nexus was the undisputed fact that the information hacked was the same 

information used to perpetrate the complained-of financial harm, including “Social Security 

[n]umbers” (Anthem) and “credit and debit cards, [and] expiration dates” (Adobe). Anthem I, 162 F. 

Supp. 3d at 987 (acknowledging Plaintiffs alleged “specific aspects of [p]laintiff’s PII” were stolen 

and used to cause complained-of harm) (emphasis added). Instead, Plaintiffs here make general 

allegations regarding various types of information that hypothetically may have been in some 

unnamed, absent class members’ emails, without once alleging that information such as a Social 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 8 of 21
3

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Security number or payment card (or other account information) of any particular named Plaintiff 

was actually transmitted in any of their emails. Opp. at 9 (citing Compl. ¶¶ 1, 37-44, 58, 60, 68, 90-

95). Plaintiffs cannot borrow potential (or even actual) injuries from absent putative class members 

to establish standing. See, e.g., Giroux v. Essex Prop. Trust, Inc., 2017 WL 1549477, at *2 (N.D. 

Cal. May 1, 2017) (finding no standing when data breach plaintiff “combined allegations describing 

the harm she has suffered with the harm the larger putative class has suffered”). 

Plaintiffs fail to plead facts showing that the data elements stolen from them were the same 

ones necessary to cause the complained-of harm to them. That failure negates any potential showing 

of traceability—and with it, Article III standing. Low v. LinkedIn Corp., 2011 WL 5509848, at *6 

(N.D. Cal. Nov. 11, 2011) (no standing where the information necessary to cause the financial 

injuries, including credit card and Social Security data was not alleged to have been stolen); see also

Antman v. Uber Techs., Inc., 2015 WL 6123054, at *11 (N.D. Cal. Oct. 19, 2015) (no standing when 

harm alleged did not align with specific data exposed); Welborn v. IRS, 2016 WL 6495399, at *9 

(D.D.C. Nov. 2, 2016) (plaintiffs “must allege facts that indicate that the information stolen ... is the 

same type of information used to commit their injuries”). 

B. Plaintiffs Fail To State UCL Claims 

1. Plaintiffs have not pled harm caused by a UCL violation. 

Plaintiffs’ UCL claims are rife with generalizations, thin on supporting facts, and deficient all 

around. Plaintiffs’ UCL claims fail out of the gate because pleading a causally related “injury-infact” (i.e., “lost money or property”) is an essential element of the claim. Cal. Bus. & Prof. Code § 

17204. For the reasons described above, Plaintiffs’ failure to plead facts plausibly showing that the

harm alleged flowed from the breaches not only defeats standing, but also defeats the UCL claims in 

their entirety. Moreover, Plaintiffs effectively acknowledge that free email users are foreclosed from 

seeking restitution because they paid nothing for Yahoo’s services. Opp. at 16:20-22 (limiting 

restitution claim to “consumer[s] who paid to use Yahoo’s services”). And Plaintiffs acknowledge 

that paying customers like Plaintiff Neff have adequate legal remedies—i.e., contract damages—thus 

foreclosing the equitable remedy of restitution. See, e.g., Munning v. Gap, Inc., 2017 WL 733104, at 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 9 of 21
4

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

*6 (N.D. Cal. Feb. 24, 2017) (dismissing UCL claim seeking restitution and injunction because 

plaintiff had adequate legal remedy under contract theory). 

2. Unlawful, unfair, or fraudulent conduct cannot be inferred. 

Even if Plaintiffs could get over the “harm” hurdle, they fail to meet the threshold 

requirement of showing “unlawful,”2 “unfair,” or “fraudulent” conduct, and the Opposition 

substitutes bare legal conclusions of UCL liability and assertions of resulting harm in place of these

facts. With respect to “unfair” conduct, Plaintiffs cite this Court’s Anthem I decision and proclaim 

victory. But once again, Plaintiffs’ reliance on Anthem is misplaced. Anthem dealt with a health 

insurance company subject to an entirely different regulatory scheme governing sensitive medical 

information (e.g., HIPAA, HITECH Act, etc.). Accordingly, and unlike here, the Anthem plaintiffs 

alleged facts (1) “demonstrating that Defendants’ conduct violated an established public policy” or 

(2) showing the claim is “tethered to specific constitutional, statutory, or regulatory provisions.” 

Anthem I, 162 F. Supp. 3d at 990. Here, Plaintiffs do neither, and generalized assertions that Yahoo 

did not provide adequate security—without identifying a specific breach of established public policy 

or specific constitutional, statutory, or regulatory provisions—is not enough. See Buena Vista, LLC 

v. New Res. Bank, 2010 WL 3448561, at *5 (N.D. Cal. Aug. 31, 2010) (“[C]onclusory allegations do 

not support a claim that Defendants’ actions offend[] an established public policy or that they are 

immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers.”). 

3. Plaintiffs fail to allege actionable fraud on which they relied.

Plaintiffs’ attempt to plead “fraudulent” conduct fares not better. First, Plaintiffs attempt to 

convert Yahoo’s aspirational statements about user privacy and a “pledge that they would implement 

proper safeguards to maintain the confidentiality and security of Plaintiffs’ PII” into an actionable 

statement of fact. Opp. at 15:13-14. Plaintiffs’ attempt, however, fails as puffery.3

 See, e.g., 

 

2

Plaintiffs’ claim that Yahoo’s conduct qualifies as “illegal” rises and falls with the merits of their

nonviable CLRA, CRA and OPPA claims. For the reasons discussed below, Plaintiffs have failed to 

adequately plead statutory violations sufficient to meet the “illegal” prong of the UCL. 

3

The Ninth Circuit has rejected Plaintiffs’ suggestion that the Court sideline the puffery issue as a 

“question of fact.” Opp. at 15:9-11; Cook, Perkiss & Liehe, Inc. v. N. Cal. Collection Serv. Inc., 911 

F.2d 242, 245 (9th Cir. 1990) (stating there is no “sound reason” for that approach). 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 10 of 21
5

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

Cement & Concrete Workers Dist. Council Pension Fund v. Hewlett Packard Co., 964 F. Supp. 2d 

1128, 1135 (N.D. Cal. 2013) (CEO’s “pledge[] to make the company’s code of business conduct 

stronger” constituted puffery); Strougo v. Barclays PLC, 105 F. Supp. 3d 330, 343 (S.D.N.Y. 2015) 

(“pledge[] to increase transparency and conduct ... business in the right way” constituted puffery). 

Nor have Plaintiffs pled an actionable falsity. They cite the statement that Yahoo “had physical, 

electronic, and procedural safeguards that comply with federal regulations to protect personal 

information about you.” Compl. ¶ 128. But beyond this bare assertion, Plaintiffs plead nothing to 

suggest it is false, such as the specific “safeguards” Yahoo promised to use but did not or the 

“federal regulations” with which Yahoo failed to comply and how. Moreover, Plaintiffs ignore 

Defendants’ disclaimers regarding limitations in their security measures, which defeat any claim of 

purported misrepresentations or omissions concerning the same. In re Sony Gaming Networks & 

Customer Data Sec. Breach Litig. (“Sony I”), 903 F. Supp. 2d 942, 969-70 (S.D. Cal. 2012). 

Plaintiffs’ claims also fail for lack of reliance. Plaintiffs make no claim that they actually 

read and relied on Defendants’ TOS or Privacy Policy, much less when or which provisions. See,

e.g., Opp. at 14:18-19 (citing Compl. ¶¶ 100, 116, 119).

4

 The fact that Plaintiffs had to accept the 

TOS as a condition of use does not excuse them from pleading reliance—i.e., that they actually read 

the TOS and Privacy Policy. This failure is fatal. See, e.g., Perkins v. LinkedIn Corp., 53 F. Supp. 

3d 1190, 1220 (N.D. Cal. 2014); In re iPhone Application Litig., 6 F. Supp. 3d 1004, 1015, 1022 

(N.D. Cal. 2013); Phillips v. Apple Inc., 2016 WL 1579693, at *7 (N.D. Cal. Apr. 19, 2016).

4. Plaintiffs fail to demonstrate eligibility for injunctive relief.

Plaintiffs’ UCL injunction claim should be dismissed. Plaintiffs not only concede the 

availability of adequate legal remedies,5 but also fail to address that injunctive relief does not remedy 

past breaches. For example, in Dugas v. Starwood Hotels & Resorts Worldwide, Inc., 2016 WL 

 

4 At most, Plaintiff Neff claims he saw “advertisements and explanations” at an indeterminate point 

in time. Opp. at 14:19-20:1. But even as to him, the Complaint identifies only one allegedly 

contemporaneous “advertisement,” which merely states: “It’s easy to create a professional looking 

website. Reassure customers with the VeriSign VerifiedTM Seal.” Compl. ¶ 98. Neff pleads no 

facts showing those statements were false when made. Nor can he. 

5

 Plaintiffs concede injunctive relief is improper, as they seek money damages under other claims. 

Opp. at 5-9; Rhynes v. Stryker Corp., 2011 WL 2149095, at *4 (N.D. Cal. May 31, 2011). 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 11 of 21
6

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

6523428 (S.D. Cal. Nov. 3, 2016), the court dismissed a claim for an injunction requiring 

“Defendants to enhance their cybersecurity in the future” because it would “not provide any relief 

for past injuries or injuries incurred in the future” in connection with a breach that has already 

occurred. Id. at *8; Beck v. McDonald, 848 F.3d 262, 277-78 (4th Cir. 2017) (no inference of future 

harm from past data breaches).6

C. Plaintiffs Fail To State A CLRA Claim 

Plaintiffs’ CLRA arguments ignore existing precedent and expand the statutory definition of 

“consumers” to include individuals who did not “purchase or lease” qualifying “services.” This 

invitation to rewrite the CLRA should be rejected. First, Plaintiffs cite no case law to justify 

defining “consumers” to include individuals who did not “purchase or lease.” Generalized “policy 

arguments” are no basis to do so. Berry v. Am. Exp. Publ’g, Inc., 147 Cal. App. 4th 224, 232 (2007) 

(rejecting attempt to “rewrite a statute under the guise of a liberal interpretation”). Further, 

Plaintiffs’ argument that the provision of PII alone constitutes a “purchase” with “currency” has 

been flatly rejected. Claridge v. RockYou, Inc., 785 F. Supp. 2d 855, 864 (N.D. Cal. 2011) (rejecting 

argument that PII is “currency,” and its transfer “in exchange for free applications, constitutes a 

‘purchase’ or ‘lease’ under the CLRA”). Second, Plaintiffs argue that “internet providers” can be an 

“exception to the rule” that “software” is not a “good or service.” Even if Yahoo were an “internet 

provider” (and it is not), the case Plaintiffs cite concerned paying customers and did not even 

analyze whether the CLRA should cover the online service at issue—it certainly did not create an 

“exception to the rule.” Doe I v. AOL LLC, 719 F. Supp. 2d 1102 (N.D. Cal. 2010); Opp. at 17:8-9. 

D. Plaintiffs Fail To State A CRA Claim 

1. Non-Californians cannot bring CRA claims. 

Statutory standing and contractual choice of law are separate concepts, which cannot be 

conflated to expand the universe of CRA plaintiffs. Mot. at 18 (citing authority); Fred Briggs 

Distrib. Co. v. Cal. Cooler, Inc., 2 F.3d 1156 (9th Cir. 1993). On this point, there can be no 

 

6

 Plaintiffs’ reliance on Adobe does not alter this analysis. The injunctive relief in that case was 

limited to plaintiffs who overspent on Adobe products. In re Adobe Sys., Inc. Privacy Litig., 66 F. 

Supp. 3d 1197, 1224 (N.D. Cal. 2014). Only Plaintiff Neff spent money on Defendants’ service, and 

even he does not allege that he “spent more” for a specified set of security measures. Compl. ¶ 222. 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 12 of 21
7

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

reasonable dispute. As the Ninth Circuit has clearly stated: “When a law contains geographical 

limitations on its application, ... courts will not apply it to parties falling outside those limitations, 

even if the parties stipulate that the law should apply.” Gravquick A/S v. Trimble Navigation Int’l 

Ltd., 323 F.3d 1219 (9th Cir. 2003) (cited in Opp. at 21-22). Plaintiffs cannot reasonably interpret 

the law otherwise. Cotter v. Lyft, Inc., 60 F. Supp. 3d 1059, 1065 (N.D. Cal. 2014) (“Even if the 

choice of law provision were intended to confer upon out-of-state drivers a cause of action ..., it 

could not do so. [One] cannot create ... a cause of action that California law does not provide.”).7 

The statutory reach of the CRA cannot be extended beyond California residents by agreement, and 

an agreement on choice of law cannot be construed to do so. 

2. The CRA did not mandate notice for the 2013 or Forged Cookie 

Breaches. 

Plaintiffs have not offered a single case to support their claim that notice was required for the 

2013 Breach simply because it was discovered after the CRA was amended. Absent “express” 

legislative intent, there is no retroactive obligation to provide notice related to the 2013 Breach. See, 

e.g., Doe v. Schwarzenegger, 2007 WL 601977, at *1 (N.D. Cal. Feb. 22, 2007). Even if legislative 

intent were overlooked, and the CRA were somehow retroactive, Plaintiffs’ claim related to the 2013 

Breach still fails. The 2013 Breach was discovered, and notice promptly provided, in 2016. 

Plaintiffs failed to plead delay in notice, and delay in discovery does not trigger a claim. 

Nor have Plaintiffs cited any authority to justify expanding the CRA to cover the Forged 

Cookie Breach. First, Plaintiffs fail to allege that any California resident specifically claims to have 

been affected by the Forged Cookie Breach. Mot. at 21 n.26. Second, Plaintiffs concede that 

hackers “used the forged cookies as a substitute” (Opp. at 20 (emphasis added)) for the 

§ 1798.82(h)(2) online account data elements. As Plaintiffs admit, hackers relied on this “substitute” 

in the absence of the exposure of the data elements themselves. Here, the plain text of 

 

7

The judicial admissions doctrine is not applicable for two reasons. First, Yahoo stipulated only 

that California law would apply, not that California law would provide relief to all users for all 

causes of action. See Compl. ¶ 118. Second, the Ninth Circuit has limited judicial admissions “to 

admissions of fact,” and not “questions of law.” New Image Labs., Inc. v. Stephan Co., 34 F. App’x 

338, 342 (9th Cir. 2002) (citing Am. Title Ins. Co. v. Lacelaw Corp., 861 F.2d 224, 227 (9th Cir. 

1988)). Whether the CRA applies to non-Californians is a question of law, not fact. 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 13 of 21
8

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

§ 1798.82(h)(2) is limited to statutorily-defined data elements, not broader categories of data 

elements Plaintiffs simply assert to be “substitutes” for online accounts. 

3. Plaintiffs do not allege appropriate CRA delay damages. 

Plaintiffs Heines and Dugas (Compl. ¶¶ 10, 12) are the only California residents, so only 

their allegations of harm are relevant to the CRA. Neither has alleged facts indicating that a notice

delay, if any, harmed them in a way distinct from harm they allege due to the breaches themselves.8 

In In re Sony Gaming Networks & Customer Data Sec. Breach Litig. (“Sony II”), as in other data 

breach cases involving CRA claims, damages like those claimed by Plaintiffs—e.g., credit 

monitoring, identity theft protection, loss of the use of PII, risk of future harm, time spent addressing 

the harm and associated anxiety—have not been found to be “delay-related” damages. 996 F. Supp. 

2d 942, 1010 (S.D. Cal. 2014). Rather, “costs relating to credit monitoring, identity theft protection, 

and penalties,” as well as the breach and disclosure of sensitive information by criminal hackers, all

“fail to constitute incremental harm suffered by Plaintiffs as a result of any delay,” and “the only 

reasonable inference is that Plaintiffs suffered the alleged economic injuries as a result of the data

breach itself.” Corona v. Sony Pictures Entm’t, Inc., 2015 WL 3916744, at *5 (C.D. Cal. June 15, 

2015); see also In re Barnes & Noble Pin Pad Litig., 2016 WL 5720370, at *8 (N.D. Ill. Oct. 3, 

2016) (“loss of value of ... PII, the time and expense of mitigating the risk of identity theft, or 

anxiety” failed to show “injuries were caused by the delay between the time she was notified of the 

breach and the time she contends she should have been notified”). The same reasoning applies here. 

E. Plaintiffs Fail To State An SCA Claim 

Plaintiffs’ Opposition ignores that an SCA claim requires a knowing and voluntary 

disclosure, and Plaintiffs allege no such thing. 18 U.S.C. § 2702(a)(1)-(2). Mere “negligence,” or 

even “reckless” conduct, is not sufficient. Long v. Insight Commc’ns of Cent. Ohio, LLC, 804 F.3d 

791, 797 (6th Cir. 2015). Knowing and voluntary participation in the breach, not just a failure to act, 

 

8

To the contrary, Plaintiff Heines alleges she was aware of unauthorized Social Security and credit 

account activity as early as February 2015, nearly a year and a half before she received any breach 

notice. Compl. ¶ 10. Similarly, Plaintiff Dugas alleges to have been aware of purported income tax 

fraud since 2013, again, long before even Yahoo was aware of any potential intrusions. Id. ¶ 12. 

Plaintiffs’ actual knowledge close to the time of the breaches gave them an opportunity to take 

prophylactic steps to address the harm each alleged was caused by the breach itself. 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 14 of 21
9

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

is required. See Muskovich v. Crowell, 1996 WL 707008, at *5 (S.D. Iowa Aug. 30, 1996) 

(employer whose failure to implement safeguards had resulted in data breach did not constitute 

“knowing” disclosure). Not surprisingly, Plaintiffs cite no cases in support of their bid to convert 

Defendants’ alleged failure to prevent the breach into a knowing disclosure under the SCA. 

Plaintiffs’ “contents” argument misses the point. Under the plain text of §§ 2702(a)(1)-(2), 

Defendants (as alleged RCS or ECS providers) “shall not knowingly divulge to any person or entity 

the contents of any communication.” Yet Plaintiffs contend that “hackers ‘gained access to the 

email ... and thus any private information contained within those emails.’” Opp. at 23 (bolded 

emphasis added). Criminal hacking by an unauthorized third-party is not a voluntary disclosure by 

even a negligent or reckless RCS or ECS provider, and Plaintiffs cite no authority that allows a 

hacker’s intent to be imputed to a defendant. Even if Plaintiffs found such authority, they still fail to 

allege facts that otherwise explain how cookie information amounts to “contents,” as opposed to 

non-actionable transactional data. Mot. at 24. The SCA was not intended to apply derivatively, and 

does not apply so, as Plaintiffs wish. Their SCA claim should be dismissed with prejudice. 

F. Plaintiffs Fail To State An OPPA Claim 

Plaintiffs abandon their standalone OPPA claim in the Opposition, and have failed to state a 

viable OPPA claim as a predicate for a UCL violation. Plaintiffs cannot bootstrap a UCL claim on 

OPPA because Plaintiffs are not “consumers” under OPPA, and do not qualify for its protections or 

stated policy objectives (i.e., to protect paying “consumers”). Mot. at 24-25 (citing, among other 

things, Cal. Bus. & Prof. Code § 22577(d) requirement that OPPA consumer “purchase or lease” 

goods or services); Fabozzi v. StubHub, Inc., 2012 WL 506330, at *5 (N.D. Cal. Feb. 15, 2012) 

(failure to state a claim under the borrowed law is fatal to an “unlawful” UCL claim). 

G. Plaintiffs Fail To State An Express Contract Claim 

Plaintiffs have failed to identify a contractual promise made and broken by Yahoo. Plaintiffs 

claim Yahoo failed to: (1) “have proper safeguards in accordance with applicable law to protect 

Plaintiffs’ PII;” and (2) “comply with their own policies and applicable laws, regulations, and 

industry standards relating to data security.” Opp. at 24:7-10. But the TOS disclaims all warranties, 

the “promises” Plaintiffs allege cannot be found in the TOS, and thus, those “promises” fall squarely 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 15 of 21
10

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

within the disclaimer.9 Yahoo never promised to provide “hack-free” services and specifically 

informed users that the system was not 100% secure and that users did so “AT [THEIR] SOLE 

RISK.” Compl., Exh.1, at § 19(a) & (b); RJN, Exh. 2. In any event, Plaintiffs fail to show Yahoo 

breached the alleged “promises,” as they fail to “plead the federal law or laws with which 

[Defendants] allegedly did not comply” or how. Anthem I, 162 F. Supp. 3d at 982.10 

Plaintiffs also cannot plead damages—a substantive element of their contract claim—in light 

of the limitation-of-liability provisions in the TOS. Those provisions expressly bar “PUNITIVE, 

INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES ...” 

Compl., Exh. 1, at 91. Plaintiffs attempt an end run around the limitation-of-liability provision by 

claiming that “not all of the damages Plaintiffs seek are consequential,” but the only “nonconsequential” damages they identify are hypothetical “benefit of the bargain damages suffered by 

Plaintiff Neff and other users that paid for Yahoo services” (which are never adequately pled). Opp. 

at 25:12-18. Plaintiffs thus concede that any remaining damages—including all damages sought by 

the consumer classes—fall within the scope of the limitation-of-liability provisions. Unable to 

attack those provisions substantively, Plaintiffs claim enforceability issues are “beyond the scope of

a motion to dismiss.” Id. at 25:20-22. But numerous courts, including this one, have decided such 

issues on a 12(b)(6) motion. See, e.g., Davidson v. Apple, Inc., 2017 WL 976048, at **12-13 (N.D. 

Cal. Mar. 14, 2017); Herskowitz v. Apple Inc., 940 F. Supp. 2d 1131, 1145 (N.D. Cal. 2013).11 

Plaintiffs’ inability to plead recoverable damages defeats their claim. 

 

9

 Plaintiffs cite R Power Biofuels, LLC v. Chemex LLC, 2016 WL 6663002, at *19 (N.D. Cal. Nov. 

11, 2016). There, the Court noted that a “general disclaimer of an implied warranty cannot disclaim 

an express warranty provided elsewhere in the contract without clear agreement of the parties.” Id. 

Here, the alleged “promises” are not “provided elsewhere in the contract.” They are disclaimed. 

10 Plaintiffs claim in a footnote that Defendants violated the CRA and SCA. Opp. at n.33. But those 

laws do not even specify standards for data security “safeguards.” 

11 Plaintiffs cite Ramos v. Citimortgage, Inc., 2009 WL 86744, at *7 (E.D. Cal. Jan. 8, 2009). Opp. 

at 25:22-24. But the Ramos court did not even analyze the sufficiency of the plaintiff’s 

unconscionability allegations. Unlike Plaintiffs here, the Ramos plaintiff may have pled actual facts 

to support his unconscionability claim. Plaintiffs here pled no such facts, only conclusory assertions 

that the provisions are unconscionable and otherwise unenforceable. That will not do. 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 16 of 21
11

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

H. Plaintiffs Fail To State An Implied Contract Claim 

Plaintiffs admit their implied contract claim duplicates their express contract claim, which 

requires dismissal. O’Connor v. Uber Techs., Inc., 2013 WL 6354534, at *10 (N.D. Cal. Dec. 5, 

2013). Plaintiffs respond only that the claim is pled in the alternative. Opp. at 26:6-7. As both sides 

agree the TOS constitutes an express contract, the implied contract claim should be dismissed. In 

any event, Plaintiffs must plead the formation of an implied contract. Plaintiffs claim their “opening 

of a Yahoo or Aabaco account” created an implied contract, under which Defendants agreed to 

comply with multiple, unidentified “laws, regulations, and industry standards relating to data 

security.” Id. at 26:17-18; Compl. ¶ 187. Numerous courts have dismissed such vague and overly 

expansive implied contract claims. Frezza v. Google Inc., 2012 WL 5877587, at *4 (N.D. Cal. Nov. 

20, 2012) (dismissing claim alleging promise to comply with industry standards where plaintiffs 

“provid[ed] their financial data”); Doe v. John F Kennedy Univ., 2013 WL 4565061, at **1, 8 (N.D. 

Cal. Aug. 27, 2013); Lovell v. P.F. Chang’s China Bistro, Inc., 2015 WL 4940371, at *3 (W.D. 

Wash. Mar. 27, 2015). The Court should do the same here. 

Plaintiffs’ authorities do not apply. Castillo v. Seagate Tech., LLC, 2016 U.S. Dist. LEXIS 

187428 (N.D. Cal. Sep. 14, 2016) involved the “mandatory receipt of Social Security numbers or 

other sensitive personal information.” Similarly, Walters v. Kimpton Hotel & Rest. Grp., LLC, 2017 

WL 1398660 (N.D. Cal. Apr. 13, 2017) involved the receipt of “payment card data.” Finally, In re 

Target Corp. Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1157 (D. Minn. 2014) involved the 

receipt of “credit- and debit-card information.” By contrast, Defendants did not solicit or receive 

Plaintiffs’ sensitive financial information—e.g., credit card numbers or Social Security numbers12—

and could not have implicitly guaranteed its security. See Willingham v. Glob. Payments, Inc., 2013 

WL 440702, at *21 (N.D. Ga. Feb. 5, 2013) (no implied contract where plaintiffs provided payment 

card data “to a merchant, not directly to Defendant”). That Yahoo expressly disclaims the security 

of email transmissions destroys any claim of an implied contract to the contrary. 

 

12 Only Plaintiff Neff would have provided payment information to open his Aabaco account. But 

Plaintiffs do not claim that information was compromised in the breaches. 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 17 of 21
12

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

I. Plaintiffs Fail To State An Implied Covenant Claim 

Plaintiffs claim they are not seeking to impose new or additional terms on Defendants 

through an implied covenant theory. Opp. at 27:12. But they are. The Opposition fails to cite 

specific provisions in any agreement wherein Defendants promised to: (1) employ specific 

password encryption standards; (2) employ specific protocols in cases of suspected or confirmed 

breaches; (3) employ a particular set of cybersecurity standards; or (4) invest a particular sum of 

time or money in any “cybersecurity resources.” Compl. ¶ 193. And an implied covenant theory 

cannot be used to rewrite the generalized statements in the TOS and Privacy Policy regarding a 

commitment to user security and convert those into after-the-fact actionable “obligations” to provide 

specific encryption standards, resources, or protocols where no such promise exists. Carma 

Developers (Cal.), Inc. v. Marathon Dev. Cal., Inc., 2 Cal. 4th 342, 374 (1992) (“[I]mplied terms 

should never be read to vary express terms.”); Avidity Partners, LLC v. State, 221 Cal. App. 4th 

1180, 1204 (2013) (implied covenant does not “impose substantive terms and conditions beyond 

those to which the parties actually agreed”). 

J. Plaintiff Neff Fails To State A Fraudulent Inducement Claim 

Plaintiff Neff cannot state a fraudulent inducement claim. First, Neff limits the alleged 

“misrepresentations and omissions” to Paragraphs 98, 99 and 102 of the Complaint. Opp. at 28:11-

12. But none of the cited advertisements or Privacy Policy excerpts contained statements of fact that

were false when made. The Privacy Policy says Defendants would use “safeguards that comply with 

federal regulations.” Compl. ¶ 102. But Neff fails to identify any “safeguards” that did not “comply

with federal regulations.” Instead, he insufficiently alleges “fraud-by-hindsight,” claiming 

Defendants should have done better in light of past intrusions and alleged vulnerabilities. 

Second, Plaintiffs claim disclaimers in the TOS cannot exculpate fraudulent conduct. Opp. at 

19-20. But Defendants never argued otherwise. Rather, Defendants argued those cautionary 

disclaimers preclude falsity and reliance. See, e.g., Sony I, 903 F. Supp. 2d at 968 (“Plaintiffs have 

failed to sufficiently allege how Sony’s representations taken as a whole would be likely to deceive 

the reasonable consumer” in light of “clear admonitory language that Sony’s security was not 

‘perfect’”). Plaintiffs fail to respond to that argument. 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 18 of 21
13

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

K. The Foreign Plaintiffs Cannot Bring A Negligence Claim 

The Foreign Plaintiffs should litigate their claims in the jurisdictions to which they 

contractually agreed, and under the laws to which they agreed. To avoid these contractual 

obligations, the Foreign Plaintiffs claim Yahoo cannot enforce the forum selection and choice-of-law 

clauses contained in the ATOS and their respective TOS because it is “not a party” to them. Opp. at 

29:19-20. However, the Foreign Plaintiffs cannot avoid their agreement to litigate their claims 

elsewhere simply by suing a corporate parent in place of a wholly-owned subsidiary. As the Ninth 

Circuit has held, “where the alleged conduct of the nonparties is closely related” to the contract 

containing the forum selection and choice-of-law provisions, the nonparties can enforce such 

provisions. Holland Am. Line Inc. v. Wartsila N. Am., Inc., 485 F.3d 450, 456 (9th Cir. 2007); see 

also Columbus Univ. v. Tummala, 2014 WL 12675010, at *4 (C.D. Cal. July 15, 2014); Bugna v. 

Fike, 80 Cal. App. 4th 229, 235 (2000). A “close relation” between Yahoo and the Foreign Plaintiffs 

plainly exists here. As an initial matter, each and every Yahoo user—foreign and domestic—is 

bound by the same ATOS to which Yahoo also is a party—and those ATOS contain the forum 

selection and choice-of-law provisions. RJN, Exh. C (ATOS). Even more fundamental, the Foreign 

Plaintiffs expressly agreed to “transfer” their information “to the United States and/or other countries 

for storage, processing and use by Yahoo!...” See, e.g., RJN, Exh. B (Australia TOS) ¶ 4 (emphasis 

added). Accordingly, Yahoo’s alleged duties, if any, arose solely because of the TOS to which the 

Foreign Plaintiffs agreed. In the end, the Foreign Plaintiffs can’t have it both ways: they cannot 

claim Yahoo owed them contractual duties “to exercise reasonable care in safeguarding and 

protecting [their] PII and financial information,” but then deny Yahoo’s right to enforce the forum 

selection and choice-of-law provisions contained in those same agreements. Compl. ¶ 225. The 

Foreign Plaintiffs expressly agreed to a “close relationship” with Yahoo in the ATOS and TOS, and 

Yahoo can enforce the forum selection and choice-of-law provisions in those agreements. 

But Plaintiffs’ detour into privity is a red herring in any event. Even if the Foreign Plaintiffs 

could bring their negligence claims here under California law, the economic loss rule bars them.13 

 

13 The rule also bars Neff’s negligent misrepresentation claim. A “majority of courts” have applied 

the rule to such claims, including this one. Strumlauf v. Starbucks Corp., 192 F. Supp. 3d 1025, 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 19 of 21
14

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

The Foreign Plaintiffs claim the economic loss rule only applies if there is contractual privity with 

Yahoo, but “that proposition is clearly belied by California law.” Dubbs v. Glenmark Generics Ltd., 

2014 WL 1878906, at *4 (C.D. Cal. May 9, 2014) (rejecting argument that “economic loss rule does 

not apply when a plaintiff lacks contractual privity with a defendant”) (citing Ott v. Alfa-Laval Agri, 

Inc., 31 Cal. App. 4th 1439, 1454 (1995) (“privity or the absence of privity is not a controlling 

factor”)). “In California, the only kinds of damages caused by negligence which may be recovered 

from a defendant not in privity with plaintiff are for bodily injury and physical damage.” Anthony v. 

Kelsey-Hayes Co., 25 Cal. App. 3d 442, 446-47 (1972). There is “no duty to prevent economic loss 

to third parties in negligence actions at common law” with or without privity. Cisco Sys., Inc. v. 

STMicroelectronics, Inc., 77 F. Supp. 3d 887, 895 (N.D. Cal. 2014) (citing Greystone Homes, Inc. v. 

Midtec, Inc., 168 Cal. App. 4th 1194, 1216 (2008)); see also id. at n.2 (rejecting argument that 

“economic loss rule does not apply when a plaintiff lacks contractual privity with a defendant” as 

“contrary to California law”); Aas v. Sup. Ct., 24 Cal. 4th 627, 632-33 (2000); Seely v. White Motor 

Co., 63 Cal. 2d 9, 12, 18-19 (1965) (same). Although limited exceptions exist, none could be 

pleaded or have been pled here.14

L. Plaintiffs Cannot Pursue Declaratory Relief 

Despite Plaintiffs’ claims to the contrary, the Complaint still lacks sufficient facts to support 

declaratory relief. First, Plaintiffs fail to address their bare allegations (Compl. ¶ 234) that the 

disputed provisions are “precluded” by unspecified “federal and state law.” See, e.g., Anthem I, 162 

F. Supp. 3d at 982 (claim failed based on unspecific allegations that defendants “were required to 

 

1036 (N.D. Cal. 2016). This Court recently dismissed a negligent misrepresentation claim that failed 

to “establish an exception to the economic loss rule.” R Power Biofuels, 2016 WL 6663002, at *14. 

14 Plaintiffs cite two cases to the contrary—Interworld Network Int’l, Inc. v. VWR Int’l, Inc., 2012 

WL 78738 (N.D. Cal. Jan. 10, 2012) and Agape Family Worship Ctr., Inc. v. Gridiron, 2016 WL 

633864 (C.D. Cal. Feb. 16, 2016). With all due respect to those courts, those decisions run counter 

to California law and the clear majority of courts. Those courts cite no cases to support the 

proposition that the economic loss rule turns on contractual privity. Indeed, that is precisely why the 

Supreme Court of California created a narrow “special relationship” exception to the economic loss 

rule in J’Aire Corp. v. Gregory, 24 Cal. 3d 799 (1979)—to allow, in limited circumstances, third 

parties to recover otherwise non-recoverable economic losses in tort. Plaintiffs do not and cannot 

plead a “special relationship” exists here. 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 20 of 21
15

REPLY IN SUPPORT OF DEFENDANTS’ MOTION TO DISMISS, Case No. 16-MD-02752-LHK 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Hunton & Williams LLP 

550 South Hope Street, Suite 2000 

Los Angeles, California 90071-2627 

comply with ‘federal and state laws and regulations, including HIPAA, and industry standards’”). 

Second, Plaintiffs failed to plead facts to support either procedural or substantive unconscionability 

(much less both), and their Opposition fails to show otherwise. Poublon v. C.H. Robinson Co., 846 

F.3d 1251, 1260 (9th Cir. 2017) (party opposing contractual enforcement bears the burden to 

establish procedural and substantive unconscionability). Plaintiffs’ hypothetical unconscionability 

example (Opp. at 35 n.45) likewise cannot cure the absence of requisite facts. Third, Plaintiffs’ 

additional attempt to distinguish Defendants’ cited authority makes a distinction without a 

difference: whether the requested relief concerns a contract or a matter of state or federal law is 

immaterial. What is relevant is that the declaratory relief merely anticipated an affirmative defense

and remains redundant. Brunette v. Humane Soc’y of Ventura Cty., 40 F. App’x 594, 598 (9th Cir. 

2002) (declaratory relief inappropriate when it serves “no purpose beyond the remedies ... sought on 

[the] claims at law”). Fourth, Plaintiffs’ reliance on Principal Life Ins. Co. v. Robinson, 394 F.3d 

665, 668 (9th Cir. 2005), which applied the federal Brillhart abstention doctrine, is inapplicable. 

Plaintiffs cite nothing to suggest that Brillhart abstention applies to a redundant declaratory relief 

claim within an action for damages. State Farm Mut. Auto. Ins. Co. v. James M. Liguori, M.D., 

P.C., 589 F. Supp. 2d 221, 238 (E.D.N.Y. 2008) (“As plaintiff in this case seeks damages ... in 

addition to declaratory relief, Brillhart abstention does not apply.”). 

III. CONCLUSION 

For these reasons and for those set forth in the moving papers, the Court should dismiss 

Plaintiffs’ Complaint in its entirety. 

Dated: August 1, 2017 HUNTON & WILLIAMS LLP 

 

By: /s/ Ann Marie Mortimer 

Ann Marie Mortimer 

Attorneys for Defendants 

Yahoo! Inc. and Aabaco Small 

Business, LLC 

Case 5:16-md-02752-LHK Document 121 Filed 08/01/17 Page 21 of 21