MICHAEL MATTHEWS v. APPLE INC (2024)

ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT APPLE INC.'S MOTION TO DISMISS

Before the Court is Defendant Apple Inc.'s motion to dismiss. ECF No. 38. The Court will grant the motion in part and deny it in part.

I. BACKGROUND

For the purpose of deciding this motion, the Court accepts as true the following allegations from Plaintiff Michael Mathews'¹ complaint. Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005).

On December 23, 2023, in Scottsdale, Arizona, Mathews was pickpocketed. ECF No. 1 ¶ 21. The thieves took his iPhone and, within minutes, had hacked into it and locked Mathews out of his AppleID and iCloud accounts. Id. Among the data Mathews had stored in his Apple accounts were “Social Security numbers, passport data, credit cards, bank accounts, brokerage accounts,” “work files, research, tax returns, photos, music,” and “30 years-worth of work-product that is the foundation for Mathews' business.” Id. ¶¶ 22–23.

Mathews alleges that the hackers were able to lock him out of his accounts because of “a known flaw in Apple's data security”—namely, Apple's “Recovery Key” feature. Id. ¶ 2. The Recovery Key is “a randomly generated 28-character code that is required to regain access to an AppleID.” Id. ¶ 17. “Even if a user has the Recovery Key set to their desired 28-character code, a hacker need only obtain access to the Apple device using the pin to gain access and create a Recovery Key or replace an existing Recovery Key directly on the device.” Id. ¶ 19. Once a hacker sets or resets a Recovery Key, they “can effectively lock a person out of their Apple accounts and use the information stored in the victim's Apple accounts to steal from the victim, open fictitious accounts in [the victim's] name, and block the victim from gaining access to the accounts.” Id. ¶ 17. “Apple's policy gives the owner of the Apple ID virtually no way back into their accounts without the ‘Recovery Key.’ ” Id. ¶ 4. After Mathews was pickpocketed and locked out of his Apple accounts, he provided Apple with information to verify his identity and his ownership of the accounts, but “Apple flatly refuses to provide Mathews with access to his accounts and data.” Id. ¶ 24.

On January 16, 2024, Mathews filed his complaint in this action. ECF No. 1. The complaint alleges nine causes of action: (1) invasion of privacy, (2) conversion, (3) trespass to chattels, (4) civil theft under California Penal Code § 496(c), (5) unjust enrichment, (6) intentional infliction of emotional distress, (7) negligent infliction of emotional distress, (8) civil conspiracy, and (9) violations of California's Unfair Competition Law (UCL), Cal. Bus. & Prof. Code § 17200, et seq. ECF No. 1 ¶¶ 31–97.

On July 15, 2024, Apple filed the instant motion to dismiss. EF No. 38. Plaintiffs oppose the motion, ECF No. 49, and Apple filed a reply, ECF No. 51. The Court took this matter under submission on November 4, 2024 without a hearing. ECF No. 57.

II. JURISDICTION

The Court has jurisdiction under 28 U.S.C. § 1332.

III. LEGAL STANDARD

Federal Rule of Civil Procedure 8(a)(2) requires that a complaint contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” While a complaint need not contain detailed factual allegations, facts pleaded by a plaintiff must be “enough to raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). To survive a Rule 12(b)96) motion to dismiss, a complaint must contain sufficient factual matter to, when accepted as true, state a claim that is plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. While this standard is not a probability requirement, “[w]here a complaint pleads facts that are merely consistent with a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief.” Id. (internal quotation marks and citation omitted).

In determining whether a plaintiff has met this plausibility standard, the Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable” to the plaintiff. Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005). “Dismissal under Rule 12(b)(6) is appropriate ․ where the complaint lacks a cognizable legal theory of sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008).

IV. DISCUSSION

A. Requests for Judicial Notice

Apple requests that the Court take judicial notice of two categories of exhibits: (1) Apple's terms and conditions for Apple services (“Media Terms”) and iCloud (“iCloud Terms”), and (2) webpages on Apple's website describing Apple's security features. ECF No. 39 at 2. Mathews objects to the request. ECF No. 50; ECF No. 49 at 5–10. Apple filed a reply. ECF No. 52.

In general, “district courts may not consider material outside the pleadings when assessing the sufficiency of a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 2018). But “[t]he court may judicially notice a fact that is not subject to reasonable dispute because it: (1) is generally known within the trial court's territorial jurisdiction; or (2) can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). On a motion to dismiss, the court may also “consider materials incorporated into the complaint” when “the complaint necessarily relies upon a document or the contents of the document are alleged in a complaint, the document's authenticity is not in question and there are no disputed issues as to the document's relevance.” Coto Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010). This is true even if “the plaintiff does not explicitly allege the contents of that document in the complaint.” Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005). The court “must take judicial notice if a party requests it and the court is supplied with the necessary information.” Fed. R. Evid. 201(c)(2). However, courts “cannot take judicial notice of the contents of documents for the truth of the matters asserted therein when the facts are disputed.” Cal. Sportsfishing Prot. All. v. Shiloh Grp., LLC, No. 16-CV-06499-DMR, 2017 WL 3136443, at *5 (N.D. Cal. July 24, 2017).

The Court will not take judicial notice of the first category of documents—Apple's Media Terms and iCloud Terms. Apple argues these documents are “incorporated by reference” into the complaint, No. 39 at 6, but the documents do not meet the requirements of the Ninth Circuit's incorporation-by-reference test. “Unlike rule-established judicial notice, incorporation-by-reference is a judicially created doctrine that treats certain documents as though they are part of the complaint itself.” Khoja, 899 F.3d at 1002. At the motion to dismiss stage, a court may take into account documents not included in the complaint when “the plaintiff's claim depends on the contents of [the] document[s], the defendant attaches the document to its motion to dismiss, and the parties do not dispute the authenticity of the document.” Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005). But here, Mathews does dispute the authenticity of the Media Terms and iCloud Terms Apple attached to its motion. See ECF No. 49 at 13–14. Moreover, the complaint does not mention the Media Terms or iCloud Terms, and the complaint and its claims sound primarily in tort, as opposed to contract claims premised on the agreements the parties purportedly made in the Media Terms or iCloud Terms. See Rollins v. Dignity Health, 338 F. Supp. 3d 1025, 1034 (N.D. Cal. 2018) (“the [complaint] does not mention the [document in question], much less incorporate it by reference”).

Apple also argues that “[c]ourts in this District routinely take judicial notice of publicly available terms and conditions as well as company policies.” ECF No. 39 at 4. Apple's cases are inapposite. In both Garcia v. Enterprise Holdings, Inc., 78 F. Supp. 3d 1125, 1136 (N.D. Cal. 2015) and In re Yahoo Mail Litigation, 7 F. Supp. 3d 1016, 1025 (N.D. Cal. 2014), the plaintiffs did not dispute the authenticity of the documents in question. And in Oracle America, Inc. v. CedarCrestone, Inc., 938 F. Supp. 2d 895 (N.D. Cal. 2013), the request for judicial notice was unopposed. Id. at 901. Moreover, this Court has previously expressed its disagreement with courts that take a more liberal view of the judicial notice of a corporate defendant's own documents. See, e.g., Rollins v. Dignity Health, 338 F. Supp. 3d 1025, 1032 (N.D. Cal. 2018) (“Many of Defendants' requests also seek notice of material taken from websites, including their own website. These materials are not proper subjects of judicial notice.”). The Court denies Apple's request to take judicial notice of its Media Terms and iCloud Terms.

The second category of documents is a handful of “web pages that are currently on Apple's public-facing website” that describe Apple's security features and policies. ECF No. 39 at 4. Apple argues the contents of these documents “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned,” id. (quoting Fed. R. Evid. 201(b)). As this Court has previously observed, “courts should be cautious before taking judicial notice of documents simply because they were published on a website. That is particularly so when a party seeks to introduce documents it created and posted on its own website.” Rollins v. Dignity Health, 338 F. Supp. 3d 1025, 1033 (N.D. Cal. 2018). That a document “resides on a publicly-available website” “is an insufficient basis for judicial notice.” Id. The Court denies Apple's request to take judicial notice of this second category of documents.

B. Limitation of Liability Provisions

Moving to Apple's arguments in favor of dismissal, Apple first contends that the limitation of liability provisions contained in its Media Terms and iCloud Terms “bar all of Plaintiff's claims because Plaintiff agreed that Apple would not be liable for the loss of any data resulting from third-party acts.” ECF No. 38 at 6. Because the Court has denied Apple's request to take judicial notice of those Terms, the Court also denies Apple's argument premised on the limitation of liability provisions contained within them.

C. Economic Loss Rule

Apple next argues that the economic loss rule bars Mathews's claims for invasion of 5 privacy, conversion, trespass to chattels, negligent infliction of emotional distress, and civil conspiracy. ECF No. 38 at 18–20. Mathews responds that his claims arise not from “disappointed expectations nor purely economic loss due to a broken contractual promise” but instead seek to redress “damages to Mathews' personal and professional reputation, business viability, goodwill, sentimental value, personal security, and the like,” and thus are exempt from the economic loss rule. ECF No. 49 at 17.

The economic loss rule is designed to “prevent[ ] the law of contract and the law of tort from dissolving one into the other.” Robinson Helicopter Co. v. Dana Corp., 34 Cal. 4th 979, 988 (2004) (citations omitted). The rule bars a party from bringing tort claims in a breach of contract action for pure economic loss “unless [the party] can demonstrate harm above and beyond a broken contractual promise.” Id. However, the economic loss rule does not apply when a plaintiff's tort claims are “independent of the contract arising from principles of tort law.” Id. at 989; see also United Guar. Mortg. Indem. Co. v. Countrywide Fin. Corp., 660 F. Supp. 2d 1163, 1181–82 (C.D. Cal. 2009). The “touchstone” is “intentional conduct,” which “ ‘gives substance to the proposition that a breach of contract is tortious only when some independent duty arising from tort law is violated.’ ” Anderson v. Apple, Inc., 500 F. Supp. 3d 993, 1021 (N.D. Cal. 2020) (quoting Robinson Helicopter Co., 34 Cal. 4th at 990).

This case is not one where a plaintiff alleges merely that the defendant failed to perform its contractual promises and the plaintiff suffered harm as a result. Instead, Mathews's claims center around what he alleges to be Apple's wrongful withholding of Mathews's own data, which he alleges continues to this day, even though Apple has no “ownership or property rights to ․ the data the consumer saves to iCloud” and knows that Mathews is currently unable to access his own property held in Apple's possession. ECF No. 1 ¶ 14; see Grace v. Apple, Inc., No. 17-CV-00551-LHK, 2019 WL 3944988, at *10 (N.D. Cal. Aug. 21, 2019) (“the economic loss rule does not apply because Apple had an independent tort duty not to intentionally interfere with Plaintiffs' possession of their iPhones”); In re Apple Inc. Device Performance Litig., 347 F. Supp. 3d 434, 456 (N.D. Cal. 2018) (economic loss rule did not apply because “Plaintiffs plead their trespass to chattels claim with its attendant damages separate and apart from any breach of contract”).

To support its economic loss rule argument, Apple relies extensively on Pollok v. Vanguard Grp., Inc., No. 2:16-cv-6482-JLS-JCGx, 2017 WL 4786007 (C.D. Cal. Aug. 21, 2017), in which the court held the economic loss rule barred plaintiff's negligence and conversion claims. Id. at *5–6. But, as Mathews points out in opposition, ECF No. 49 at 17, Pollok was decided at the summary judgment stage, and the court specifically noted that it had rejected the defendant's economic loss rule argument at the motion to dismiss stage because “nowhere in Pollok's complaint did he allege the breach of a contractual promise, and the purported existence of contracts governing the parties' relationship amounted to a factual defense rather than an attack on the sufficiency of Pollok's pleadings.” Id. at *4. Because the same is true here, Apple's economic loss rule argument fails.

D. Proximate Cause

Under California law, proximate cause “is that cause which, in natural and continuous sequence, unbroken by any efficient intervening cause, produced the injury [or damage complained of] and without which such result would not have occurred.” California v. Superior Ct., 150 Cal. App. 3d 848, 857 (1984) (citation and internal quotation marks omitted) (alteration in original). “Proximate cause, like negligence, is generally held to be a question of fact for the jury.” 6 W.B. Witkin, Summary of California Law § 1333 (Torts) (11th ed. 2018).

Apple contends that Mathews failed to plead that Apple's conduct was the proximate cause of Mathews's harm because the criminal conduct of the hackers operated as a superseding cause of harm, and thus his conversion, trespass to chattels, intentional infliction of emotional distress, and negligent infliction of emotional distress claims should fail. ECF No. 38 at 21 (citing Kane v. Hartford Accident & Indemnity Co., 98 Cal. App. 3d 350, 360 (1979) (“The act of a third person in committing an intentional tort or crime is a superseding cause of harm to another resulting therefrom.”)).

“[T]he defense of ‘superseding cause[ ]’ ․ absolves [the original] tortfeasor, even though his conduct was a substantial contributing factor, when an independent event [subsequently] intervenes in the chain of causation, producing harm of a kind and degree so far beyond the risk the original tortfeasor should have foreseen that the law deems it unfair to hold him responsible.” Chanda v. Fed. Home Loans Corp., 215 Cal App. 4th 746, 755 (2013) (citation omitted) (alterations in original). “To qualify as a superseding cause so as to relieve the defendant from liability for the plaintiff's injuries, both the intervening act and the results of that act must not be foreseeable. Significantly, what is required to be foreseeable is the general character of the event or harm ․ not its precise nature or manner of occurrence.” Id. (internal citations and quotation marks omitted) (alteration in original). “Whether an intervening force is superseding or not generally presents a question of fact, but becomes a matter of law where only one reasonable conclusion may be reached.” Id. (citation omitted).

Here, Mathews alleges that after his phone was stolen and his accounts hacked, Apple refused to return his data. E.g., ECF No. 1 ¶¶ 5, 24–30. Given this timeline, there is no intervening act between Apple's conduct and Mathews's harm, because the third-party conduct occurred before Apple's actions that Mathews says caused him harm. Accordingly, Mathews's claims cannot be dismissed as a matter of law on the basis of the defense of superseding cause.

E. Claim-Specific Arguments

1. Invasion of Privacy (Count I)

Mathews does not specify, either in his complaint or in his opposition to Apple's motion, whether he brings his invasion of privacy claim under the California Constitution or California common law. To establish a claim under the California Constitutional right to privacy, a plaintiff must demonstrate: “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3) conduct by the defendant that amounts to a serious invasion of the protected privacy interest.” Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1024 (N.D. Cal. 2012) (citing Hill v. Nat'l Collegiate Athletic Ass'n, 7 Cal. 4th 1, 35–37 (1994)). To state a common law invasion of privacy tort claim, a plaintiff must allege “(1) intrusion into a private place, conversation or matter (2) in a manner highly offensive to a reasonable person.” Low, 900 F. Supp. 2d at 1025 (citing Shulman v. Group W Prods., Inc., 18 Cal. 4th 200, 231 (1998). Both the “California Constitution and the common law set a high bar for an invasion of privacy claims.” Id.

Mathews urges the Court to reach the same outcome it came to in Opperman v. Path, 84 F. Supp. 3d 962 (N.D. Cal. 2015), where the Court found that plaintiffs successfully alleged that defendants' software applications' access of plaintiffs' contact information was “highly offensive.” Id. at 993; see also Opperman v. Path, Inc., 87 F. Supp. 3d 1018, 1061 (N.D. Cal. 2014) (same). But in Opperman, plaintiffs alleged that mobile phone manufacturers and software developers engaged in “the surreptitious theft of personal contact information.” Id. at 1061. Here, Mathews alleges that Apple obtained Mathews's data not through “surreptitious theft” but rather through Mathews's own action of saving the data to his iCloud account. ECF No. 1 ¶¶ 14, 22–23. At best, Mathews's allegations amount to a theory that Apple's Recovery Key feature created an increased risk that a third party might be able to steal iCloud users' personal data. Courts have rejected invasion of privacy claims where plaintiffs alleged a defendant created an “increased risk” of theft. Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121, 1127–28 (N.D. Cal. 2008), aff'd, 380 Fed. App'x 689 (9th Cir. 2010).

Because Mathews has not alleged facts sufficient to state a claim for invasion of privacy, the Court will dismiss the claim with leave to amend.

2. Conversion (Count II)

Apple next argues that Mathews's conversion claim fails because Mathews does not sufficiently allege affirmative conduct by Apple. “To establish a conversion, it is incumbent upon the plaintiff to show an intention or purpose to convert the goods and to exercise ownership of the property.” Spates v. Dameron Hosp. Ass'n, 114 Cal. App. 4th 208, 222 (2003) (quoting Zaslow v. Kroenert, 29 Cal. 2d 541, 550 (1946)). But “[a] conversion can occur when a willful failure to return property deprives the owner of possession.” Barrett v. Apple Inc., No. 5:20-cv-014812-EJD, 2022 WL 2119131, at *7 (N.D. Cal. June 13, 2022) (quoting Fearon v. Dep't of Corrections, 162 Cal. App. 3d 1254, 1257 (1984)).

Mathews alleges that he contacted Apple regarding his loss of access to his accounts and “provide[d] Apple with all of the information needed to verify his identify and to ensure that the data he seeks access to is his.” ECF No. 1 ¶ 24. Apple, however, “flatly refuses to provide Mathews with access to his accounts and data.” Id. Apple's alleged design and maintenance of an account security system that disabled Mathews's access to his own data and information, after that data and information have been stolen from Mathews by criminal actors, is an affirmative act that prevents access within the meaning of conversion.

Apple argues that “Plaintiff fails to allege that Apple acted affirmatively to deprive him of his data,” citing Archer v. Coinbase, Inc., 53 Cal. App. 5th 266 (2020). ECF No. 38 at 22–23. In Archer, the plaintiff brought a conversion claim premised on a digital currency platform's refusal to support a new form of forked cryptocurrency. See Archer, 53 Cal. App. at 276. The court affirmed summary judgment on Plaintiff's conversion claim “because the undisputed facts show Coinbase took no affirmative action to deprive plaintiff of a property right or exercise dominion over plaintiff's Bitcoin Gold currency.” Id. at 277. As a colleague court has recognized, however, Archer is distinguishable. See Barrett v. Apple Inc., No. 5:20-cv-04812-EJD, 2022 WL 2119131, at *7 (N.D. Cal. June 13, 2022). As that court noted, “Coinbase did not host the forked cryptocurrency in the first instance” and thus “could not have deprived the plaintiff of a property right.” Barrett, 2022 WL 2119131, at *7. Not so here, where Apple does host Mathews's personal property on its iCloud platform and Mathews alleges that Apple is knowingly withholding that property from him. These allegations are sufficient to plead conversion. See id. (finding plaintiffs adequately pled a conversion claim “where upon prompt notification that certain named Plaintiffs had been scammed, Apple nevertheless refused to provide a refund to Plaintiffs, even where the scammer had not yet redeemed the funds”).

Accordingly, the Court finds that Mathews has adequately pled a claim for conversion.

3. Trespass to Chattels (Count III)

In California, trespass to chattels “lies where an intentional interference with the possession of personal property has proximately caused injury.” In re Apple Inc. Device Performance Litig., 347 F. Supp. 3d at 455 (quoting Thrifty-Tel, Inc. v. Bezenek, 46 Cal. App. 4th 1559 (1996)). The California Supreme Court has held that the principles underlying the tort also apply to allegations of digital trespass. See Intel Corp. v. Hamidi, 30 Cal. 4th 1342 (2003). Thus, “[i]n order to prevail on a claim for trespass based on accessing a computer system, the plaintiff must establish: (1) defendant intentionally and without authorization interfered with plaintiff's possessory interest in the computer system; and (2) defendant's unauthorized use proximately resulted in damage.” eBay, Inc. v. Bidder's Edge, Inc., 100 F. Supp. 2d 1058, 1069–70 (N.D. Cal. 2000) (citing Thrifty-Tel, Inc., 46 Cal. App. 4th at 1566).

Apple argues that “Plaintiff does not allege that Apple took any affirmative action that amounts to ‘intentional interference’ of Plaintiff's possession of property.” ECF No. 38 at 24 (emphasis in original). But just as with the conversion claim, Mathews's allegations that Apple continues to refuse him access to his account, despite Mathews informing it that his account has been hacked and he has been locked out, amounts to an “interfere[enc] with plaintiff's possessory interest in the computer system” within the meaning of trespass to chattels. eBay, Inc., 100 F. Supp. 2d at 1070; see supra, section D.2. Accordingly, the Court finds Mathews has adequately pled a claim for trespass to chattels.

1. Civil Theft, Cal. Penal Code § 496 (Count IV)

California Penal Code section 496(a) makes it unlawful to (1) “buy[ ] or receive[ ] any property that has been stolen or that has been obtained in any manner constituting theft or extorting, knowing the property to be so stolen or obtained,” or (2) “conceal[ ], sell[ ], [or] withhold[ ] any property from the owner, knowing the property to be so stolen or obtained.” Section 496(c) creates a civil cause of action for “[a]ny person who has been injured by a violation of subdivision (a).”

Apple argues that Mathews's civil theft claim, brought under California Penal Code section 496(c), fails because “Plaintiff stored his data on iCloud long before the unidentified thieves allegedly hacked into his Apple ID” and thus Mathews cannot show that the property in question “ ‘ha[d] the character of being stolen’ when it came ‘into the defendants' hands.’ ” ECF No. 38 at 30 (quoting Grouse River Outfitters Ltd. v. NetSuite, Inc., 2016 WL 5930273, at *14 (N.D. Cal. Oct. 12, 2016)).

The cases Apple on which Apple relies are no longer good law. Both Grouse River Outfitters Ltd v. NetSuite, Inc. and Hueso v. Select Portfolio Servicing, Inc., held that property obtained by false pretense did not constitute stolen property for the purpose of stating a section 496(c) claim. See Grouse, 2016 WL 5930273, at *14–16; 527 F. Supp. 3d 1210, 1232 (S.D. Cal. 2021). But the California Supreme Court and the Ninth Circuit have since reached the opposite conclusion. Siry Inv., L.P. v. Farkhondehpour, 13 Cal. 5th 333, 349–50 (2022); Grouse River Outfitters, Ltd. v. Oracle Corp., 848 Fed. App'x 238 (9th Cir. 2021).

In any event, Mathews alleges that Apple violated section 496 not by obtaining his property through false pretense but rather by withholding his property, which Apple knew to be stolen. By the plain meaning of the statute, the alleged conduct amounts to a violation. See Cal. Penal Code § 496(a) (“Every person who ․ withholds, or aids in ․ withholding any property from the owner, knowing the property to be so stolen” is liable); see also Bell v. Feibush, 212 Cal. App. 4th 1041, 1049 (2013) (defendant “violated section 496(a) ․ by withholding that property when [plaintiff] asked for it back”). Moreover, another court in this district has already rejected an identical argument made by Apple in a case that similarly alleged that Apple withheld stolen property from the plaintiffs (there, gift card funds wrongfully obtained by scammers and spent in the Apple Store). Barrett v. Apple Inc., 2022 WL 2119131, at *6 (N.D. Cal. June 13, 2022).

Accordingly, the Court finds Mathews has adequately pled a civil theft claim under California Penal Code section 496(c).

2. Unjust Enrichment (Count V)

To state a claim for unjust enrichment, a plaintiff must allege “receipt of a benefit and unjust retention of the benefit at the expense of another.” Lectrodryer v. SeoulBank, 77 Cal. App. 4th 723, 726 (2000).

Apple moves to dismiss Mathews's unjust enrichment claim on the ground that “Apple has derived no benefit from Plaintiff's inability to access his Apple accounts.” ECF No. 38 at 31–32. Mathews responds that the “benefit” that Apple retains is the “more than 30 years' worth of Mathews' data in its iCloud,” over which Apple has “sole control.” ECF No. 49 at 25. Apple's only response in reply is “[i]f anything, the continued storage of Plaintiff's data as alleged would be to Apple's detriment because of the costs associated with maintaining the data.” ECF No. 51 at 19 (emphasis in original). Because this question of fact is better reserved for summary judgment or trial, the Court declines to dismiss Mathews's claim for unjust enrichment.

3. Intentional Infliction of Emotional Distress (Count VI)

Under California law, a cause of action for intentional infliction of emotional distress 12 exists when: (1) there is extreme and outrageous conduct by the defendant with the intention of causing, or reckless disregard of the probability of causing, emotional distress; (2) the plaintiff suffers severe or extreme emotional distress; and (3) the defendant's outrageous conduct actually and proximately caused the plaintiff's emotional distress. Hughes v. Pair, 46 Cal. 4th 1035, 1050–51 (2009) (citations and internal quotation marks omitted). Apple argues that Mathews fails adequately to allege any of these elements. ECF No. 38 at 24–27.

Apple's argument that Mathews failed to allege the first element—extreme and outrageous conduct—relies entirely on documents that the Court has already declined to judicially notice. ECF No. 38 at 25 (arguing that the Media Terms and iCloud Terms bar the claim and that “Apple employs effective policies and privacy-preserving technologies to protect user information and data”). See supra, section IV.A. In any event, “[w]hether ․ alleged behavior is sufficiently extreme as to constitute ‘outrageous’ behavior is properly determined by the fact finder after trial or possibly after discovery upon a motion for summary judgment.” Fradkin v. Wunderlich-Malec Eng;g Inc., 2019 WL 7940670, at *3 (Nov. 5, 2019) (quoting Angie M. v. Superior Ct., 37 Cal. App. 4th 1217, 1226 (1995)). The Court finds that Mathews's allegations that Apple refuses to restore Mathews access to his accounts, knowing that doing so allows hackers continued access to 30 years' of Mathews's personal and professional data including Social Security numbers, bank accounts, and photos, are sufficient to plead extreme and outrageous conduct.

Apple is correct, however, that the complaint fails to allege facts sufficient to show extreme emotional distress, as required under California law. Hughes, 46 Cal. 4th at 1050–51. With respect to this requirement, California courts have set a “high bar”: the plaintiff must show “emotional distress of such substantial quality or enduring quality that no reasonable [person] in civilized society should be expected to endure it.” Id. (citation omitted). The “mere allegation that [a plaintiff] suffered severe emotional distress, without facts indicating the nature of extent of any mental suffering incurred as a result of the defendant's alleged outrageous conduct, fail[s] to state a cause of action for intentional infliction of emotional distress.” Pitman v. City of Oakland, 197 Cal. App. 1037, 1047 (1988). Accordingly, courts dismiss claims for intentional infliction of emotional distress where the plaintiff fails to plead facts demonstrating the nature and extent of the emotional distress suffered. See, e.g., Schultz v. Stericycle, Inc., No. CV F 13-1244 LJO MJS, 2013 WL 4776517, at *8 (E.D. Cal. Sept. 4, 2013) (holding that complaint lacked facts to support severe emotional distress where the plaintiff's complaint made “sweeping references to pain and suffering, extreme and severe mental anguish, and emotional distress with no facts to support such symptoms or conditions”) (internal quotation marks omitted)). Here, Mathews alleges only that he suffered “significant emotional harm and mental distress.” ECF No. 1 ¶ 71. He has therefore not alleged sufficient facts to “indicat[e] the nature or extent of any mental suffering incurred” as a result of Apple's extreme and outrageous conduct. Pitman, 197 Cal. App. 3d at 1047.

Accordingly, the Court grants Mathews's motion to dismiss Mathews's intentional infliction of emotional distress claim with leave to amend. Mathews should add to any amended complaint additional facts indicating the nature and extent of his emotional distress.

4. Negligent Infliction of Emotional Distress (Count VII)

“[T]here is no independent tort of negligent infliction of emotional distress. The tort is negligence, a cause of action in which a duty to the plaintiff is an essential element. That duty may be imposed by law, be assumed by the defendant, or exist by virtue of a special relationship.” Potter v. Firestone Tire & Rubber Co., 6 Cal. 4th 965, 984–85 (1993) (citations omitted).

Apple persuasively argues that Mathews fails to allege the source of an affirmative duty on Apple's part to protect Mathews from emotional distress. ECF No. 38 at 29–30. In response, Mathews asks this Court to find an affirmative duty not to negligently inflict emotional distress in California's common law of bailments. ECF No. 49 at 23–24. Mathews does not point to any case in which courts have found such a duty. Moreover, even in Mathews's characterization of the duty imposed by the law of bailments, that duty would arise from “an express or implied contract,” from which “[b]reach ․ may be asserted by the bailor when there is failure to return that which is bailed.” Id. (internal citations and quotation marks omitted). Mathews has not alleged that he entered into a contract with Apple that Apple breached by negligently causing Mathews emotional distress. Accordingly, the Court will dismiss Mathews's claim for negligent infliction of emotional distress.

5. Unfair Competition Law, Cal. Bus. & Prof. Code § 17200 et seq. (Count IX)

Apple next moves to dismiss Mathews's claims under California's Unfair Competition Law (“UCL”). “Because the UCL is written in the disjunctive, it establishes three varieties of unfair competition—acts or practices which are unlawful, or unfair, or fraudulent.” Aton Ctr., Inc. v. United Healthcare Ins. Co., 93 Cal. App. 5th 1214, 1248 (2023) (citation and quotation omitted). “An act can be alleged to violate any or all of the three prongs of the UCL—unlawful, unfair, or fraudulent.” Id. (citation and quotation omitted). The Court addresses each prong in turn.

a. “Unlawful” Prong

A UCL action “to redress an unlawful business practice ‘borrows’ violations of other laws and treats [them] ․ as unlawful practices independently actionable.” Farmers Ins. Exch. v. Superior Ct., 2 Cal. 4th 377, 383 (1992). Mathews's complaint alleges that Apple violated this UCL prong by violating California Civil Code section 1798.81.5 (California Customer Records Act, or “CRA”). ECF No. 1 ¶ 96(a).

Apple argues that Mathews failed to state a claim because the CRA “applies only to ․ the personal information of California residents,” and Mathews is a Minnesota resident. ECF No. 38 at 33 (quoting In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-MD-02752-LHK, 2017 WL 3727318, at *34 (N.D. Cal. Aug. 30, 2017). In his opposition, Mathews does not defend the CRA violation alleged in the complaint, instead arguing that “Mathews has alleged conversion, trespass to chattels, and civil theft, ․ which satisfies the pleading requirements for the ‘unlawful’ prong.” ECF No. 49 at 26. On reply, Apple objects that this constitutes an “impermissibl[e] ․ re-plead[ing]” of Mathews's complaint. ECF No. 51 at 19. “[I]t is axiomatic that the complaint may not be amended by briefs in opposition to a motion to dismiss.” Strome v. DBMK Enterprises, Inc., 2014 WL 4437777, at *4 (N.D. Cal. Sept. 9, 2014) (quoting Barbera v. WMC Mortg. Corp., C 04-3738 SBA, 2008 WL 167632 (N.D. Cal. Jan. 19, 2006)). The Court agrees with Apple that Mathews' attempt at recasting the UCL “unlawful” claim in his opposition is impermissible, and the Court will dismiss this claim with leave to amend.

b. “Unfair” Prong

Apple argues that Mathews fails to state a claim under the “unfair” prong of the UCL because he “alleged no specific facts to show that Apple acted unfairly.” ECF No. 38 at 34–35. Mathews responds that he “made numerous specific allegations of the unfairness of Apple's conduct and its injurious impact on him,” including that Apple “ ‘allowed the Hackers to gain access to [Mathews's] accounts,’ ” resulting in a “devastating effect ․ on his personal and professional life.” ECF No. 49 at 26 (quoting ECF No. 1 ¶ 2).

“[T]he determination of whether a particular business practice is unfair necessarily involves an examination of its impact on the alleged victim, balanced against the reasons, justifications and motives of the alleged wrongdoing.” Berryman v. Merit Prop. Mgmt., Inc., 153 Cal. App. 4th 1544, 1555 (2007) (quoting Motors, Inc. v. Times Mirror Co., 102 Cal. App. 3d 735, 740 (1980)). “The UCL does not define the term ‘unfair’ as used in Business and Professions Code section 17200,” Durell v. Sharp Healthcare, 183 Cal. App. 4th 1350, 1364 (2010), but the Ninth Circuit has recognized three tests for the determination of what is an “unfair” business practice: whether (1) the challenged conduct is “tethered to [violation of] any underlying constitutional, statutory or regulatory provision, or that it threatens an incipient violation of an antitrust law, or violates the policy or spirit of an antitrust law”; (2) the challenged conduct is “immoral, unethical, oppressive, unscrupulous, or substantially injurious to consumers”; or (3) the challenged conduct's “impact on the victim outweighs the reasons, justifications and motives of the alleged wrongdoer.” Doe v. CVS Pharmacy, Inc., 982 F.3d 1204, 1214–1215 (9th Cir. 2020).

The Court cannot say that Mathews's UCL claim under the “unfair” prong is precluded as a matter of law. As another court in this district held in litigation over Apple's distributions of consumer data to third parties without the consumers' consent, “[w]hile the benefits of Apple's conduct may ultimately outweigh the harm to consumers, this is a factual determination that cannot be made at this stage of the proceedings. Nor can the Court conclude at this stage that Apple's practices are not injurious to consumers as a matter of law.” In re iPhone Application Litigation, 844 F. Supp. 2d 1040, 1073 (N.D. Cal. 2012); see also Davis v. HSBC Bank Nevada, N.A., 691 F.3d 1152, 1170 (9th Cir. 2012) (noting that generally “what is ‘unfair’ is a question of fact, ‘which involves an equitable weighing of all the circumstances’ ” (quoting Bardin v. Daimlerchrysler Corp., 136 Cal. App. 4th 1255 (2006))). The same is true here, where Mathews has alleged that Apple “allowed the Hackers to gain access” to his accounts, that Apple's “policy decision to assist and perpetuate the lawlessness of criminals” was made at the expense of “the ownership and privacy rights of its users,” and that Apple's conduct has had a “devastating effect ․ on Mathews' personal data” as well as the “work-product that is the foundation for Mathews' business.” ECF No. 1 ¶¶ 2, 23, 30.

Accordingly, the Court declines to dismiss Mathews's UCL claim under the “unfair” prong.

c. “Fraudulent” Prong

With respect to this prong, Apple argues that Mathews “has neither alleged any deceptive statements nor explained how Apple's statements are misleading.” ECF No. 38 at 34. Mathews does not defend his “fraudulent business act or practice” claim in opposition. See ECF No. 49 at 26–27. Thus, to the extent Mathews sought to plead such a claim in his complaint, it is dismissed. See Plumbers & Steamfitters Local 60 Pension Trust v. Meta Platforms, Inc., No. 4:22-cv-01470-YGR, 2024 WL 4251896, at *4 n.12 (N.D. Cal. Sept. 17, 2024) (“Plaintiffs do not address [a particular argument] in their opposition and therefore forfeit any challenge to it.”) without prejudice.

6. Civil Conspiracy

Finally, Apple argues that the Court should dismiss Mathews's civil conspiracy claim “because civil conspiracy is not a standalone cause of action.” ECF No. 38 at 35; see Ent. Rsch. Grp., Inc. v. Genesis Creative Grp., Inc., 122 F.3d 1211, 1228 (9th Cir. 1997) (“Under California law, there is no separate and distinct tort cause of action for civil conspiracy.”). Mathews acknowledges that “civil conspiracy allegations should be made within the sections of the complaint that contain plaintiff's tort claims,” states that “[t]he underlying tort claims asserts in Mathews' Complaint that encompass the conspiracy are conversion, trespass to chattels and civil theft,” and requests leave to “plead[ ] a conspiracy into these Counts.” ECF No. 49 at 27–28. Accordingly, the civil conspiracy claim is dismissed with leave to amend.

CONCLUSION

Apple's request for judicial notice, ECF No. 39, is denied. Apple's motion to dismiss, ECF No. 38, is denied with respect to Counts II (conversion), III (trespass to chattels), IV (civil theft), V (unjust enrichment), and IX (UCL “unfair” prong). The motion to dismiss is granted with respect to Counts I (invasion of privacy), VI (intentional infliction of emotional distress), VII (negligent infliction of emotional distress), VIII (civil conspiracy), and IX (UCL “unlawful” and “fraudulent” prongs).

Leave to amend is granted solely to cure the deficiencies identified in this order. Any amended complaint shall be filed within 28 days.

IT IS SO ORDERED.

FOOTNOTES

1.   The caption of the complaint lists Plaintiff as “Michael Matthew”; the caption lists Plaintiff's counsel as “Attorneys for Plaintiff Michael Matthews”; and the body of the complaint refers to Plaintiff as “Michael Mathews.” ECF No. 1. Plaintiff's opposition to the motion to dismiss uses the same nomenclature. ECF No. 49. Apple refers to the Plaintiff only as “Michael Mathews.” ECF No. 38. The Court follows Apple's lead.

JON S. TIGAR United States District Judge