Summary
finding an injury-in-fact did not exist based on the risk of future hacking
Summary of this case from In re Apple Processor Litig.Opinion
Case No. 15-cv-01104-WHO
2015-11-25
Helene Cahen, et al., Plaintiffs, v. Toyota Motor Corporation, et al., Defendants.
Donald H. Slavik, Steamboat, Springs, Matthew Joseph Zevin, Stanley Law Group, San Diego, CA, Marc R. Stanley, Stanley Iola, LLP, Martin Darren Woodward, Stanley Law Group, Dallas, TX, for Plaintiffs. Christopher Chorba, Gibson, Dunn & Crutcher LLP, Michael Lawrence Mallow, Sidley Austin LLP, Los Angeles, CA, Simone Jones, Johnnet Simone Jones, Livia M. Kiser, Sidley Austin LLP, Chicago, IL, Douglas Warren Sullivan, Crowell & Moring LLP, San Francisco, CA, Cheryl Adams Falvey, Kathleen Taylor Sooy, Rebecca Baden Chaney, Crowell Moring LLP, Washington, DC, for Defendants.
Donald H. Slavik, Steamboat, Springs, Matthew Joseph Zevin, Stanley Law Group, San Diego, CA, Marc R. Stanley, Stanley Iola, LLP, Martin Darren Woodward, Stanley Law Group, Dallas, TX, for Plaintiffs.
Christopher Chorba, Gibson, Dunn & Crutcher LLP, Michael Lawrence Mallow, Sidley Austin LLP, Los Angeles, CA, Simone Jones, Johnnet Simone Jones, Livia M. Kiser, Sidley Austin LLP, Chicago, IL, Douglas Warren Sullivan, Crowell & Moring LLP, San Francisco, CA, Cheryl Adams Falvey, Kathleen Taylor Sooy, Rebecca Baden Chaney, Crowell Moring LLP, Washington, DC, for Defendants.
ORDER ON MOTIONS TO DISMISS
WILLIAM H. ORRICK, United States District Judge
INTRODUCTION
Plaintiffs filed this putative class action against defendants Ford Motor Company, General Motors LLC (“GM”), Toyota Motor Corporation and Toyota Motor Sales, U.S.A., Inc. (the latter two collectively as “Toyota”), alleging that defendants have equipped their vehicles with computer technology that is susceptible to being hacked by third parties. They also assert that defendants improperly collect and transmit information about vehicle performance and the geographical location of the cars they sell in violation of plaintiffs' right to privacy.
Plaintiffs have not established specific or general jurisdiction against Ford. Additionally, given the lack of injury flowing from the asserted potential hacking issue, they lack standing to sue the defendants. Their privacy claims are conclusorily pleaded and need more specificity. For these reasons, I GRANT defendants' motions to dismiss with leave to amend.
FACTUAL BACKGROUND
Plaintiffs' First Amended Complaint (“FAC”) identifies three classes of plaintiffs: (1) the “California Class,” consisting of plaintiffs who bring California state law and California constitutional law claims against GM and Toyota in connection with vehicles purchased in California; (2) the “Oregon Class,” consisting of plaintiffs who bring Oregon state law claims against Ford in connection with vehicles purchased in Oregon; and (3) the “Washington Class,” consisting of plaintiffs who bring Washington state law claims against Ford in connection with vehicles purchased in Washington. FAC [Dkt. No. 37]. The central problem alleged is that because the cars' computer systems lack security, basic vehicle functions can be controlled by individuals outside the car, endangering the safety of vehicle occupants. FAC ¶ 2. For example, hacking can result in the loss of driver control over the throttle, brakes, and steering wheel. FAC ¶ 1.
Defendants' vehicles utilize dozens of electronic control units (“ECUs”), which are small computers that control various vehicle operations. FAC ¶ 3. Vehicle safety depends on “near real time” communication between the ECUs. FAC ¶ 28. The ECUs communicate through a controller area network, or “CAN bus,” by sending each other digital messages called “CAN packets.” FAC ¶¶ 3-4. Because “there is no ECU source or authentication, nor any encryption, built into CAN packets,” anyone with physical access to a vehicle can utilize the CAN bus to send malicious CAN packets to the ECUs. FAC ¶ 30. Additionally, defendants' vehicles are equipped with wireless Bluetooth and cell phone integration capabilities that, when activated by the user, make the vehicles susceptible to remote hacking via wirelessly transmitted CAN packets. FAC ¶ 34. Plaintiffs do not allege that any of their vehicles have actually been hacked, or that they are aware of any vehicles that have been hacked outside of controlled environments, but instead allege that hacking is an “imminent eventuality.” FAC ¶ 40. “Any expert will tell you that you can't prevent it; it's just a question of when.” Id .
Plaintiffs assert that defendants have known for a long time that their vehicles can be hacked, and cite numerous research studies and media articles dating back to 2011 that document the electronic security vulnerabilities of defendants' vehicles. FAC ¶¶ 36-40. In one article, for example, a journalist wrote,
“As I drove to the top of the parking lot ramp, the car's engine suddenly shut off, and I started to roll backward....This wasn't some glitch triggered by a defective ignition switch, but rather an orchestrated attack performed wirelessly, from the other side of the parking lot, by a security researcher.”
FAC ¶ 35.
Plaintiffs also allege that despite defendants' knowledge of significant security vulnerabilities, they market their vehicles as safe. FAC ¶¶ 41-48. Toyota's promotional materials claim, for example, that “Toyota's Integrated Safety Management Concept sets the direction for safety technology development and vehicle development, and covers all aspects of driving by integrating individual vehicle safety technologies and systems rather than viewing them as independently functioning units.” FAC ¶ 42. Toyota also claims to be developing “advanced driving support systems where the driver maintains control and the fun-to-drive aspect of controlling a vehicle is not compromised.” FAC ¶ 44. Ford makes similar safety claims, such as, “When you look over the impressive list of collision avoidance and occupant protection features, you'll know how well-equipped Fusion is when it comes to you and your passengers' safety.” FAC ¶ 46. Ford makes the same claim about the Focus, stating, “You don't have to pick and choose when it comes to safety. Focus is well equipped with an impressive list of safety features.” Id . GM says “Quality and safety are at the top of the agenda at GM, as we work on technology improvements in crash avoidance and crashworthiness to augment the post-event benefits of OnStar, like advanced automatic crash notification.” FAC ¶ 47. GM also touts the “vast test capabilities” of its new “Active Safety Testing Area,” which will “increase GM's ability to bring the best new safety technologies to the customer.” FAC ¶ 48.
Plaintiffs further contend that defendants collect owner data, specifically geographic location, driving history, and vehicle performance, from the vehicle computers and then share that data with third parties without securing the transmission. FAC ¶¶ 49-50, 135. Defendants disclose their data collection practices in owners' manuals, online privacy statements, and the terms and conditions of specific feature activations, but drivers cannot opt-out of data collection without disabling the relevant feature. FAC ¶ 50.
This class action has five named plaintiffs. Helene Cahen resides in Berkeley, California. She purchased a Lexus RX 400 H in September 2008 from a Lexus dealer in San Rafael, California. FAC ¶ 12. Lexus vehicles are manufactured and sold by Toyota. FAC ¶ 8. Merrill Nisam lives in Mill Valley, California, and purchased a Chevrolet Volt in March 2013 from a Chevrolet dealer in Novato, California. FAC ¶ 14. Chevrolet vehicles are manufactured and sold by GM. FAC ¶ 8. Kerry Tompulis lives in Beaverton, Oregon, and leased a Ford Escape in August 2014 from a Ford dealer in Tigard, Oregon. FAC ¶ 13. Richard Gibbs and Lucy Langdon purchased a Ford Fusion in 2014 from a Ford dealer in Renton, Washington and, at the time the FAC was filed, resided in Sequim, Washington. FAC ¶ 15.
Plaintiffs assert that by the time of the hearing on this motion, plaintiffs Gibbs and Langdon had moved their permanent residence to within this judicial district for reasons unrelated to this litigation. Mot. at 9 n.4. This does not change the underlying factual allegations or analysis.
Plaintiffs bring multiple causes of action which differ for each sub-class. The “California Class,” led by plaintiffs Cahen and Nisam, brings eight causes of action against GM and Toyota: (1) violation of the California's Unfair Competition Law (“UCL”), Cal. Bus. Prof. Code § 17200, et seq . ; (2) violation of California's Consumers Legal Remedies Act (“CLRA”), Cal. Civ. Cod § 1250, et seq .; (3) violation of California's False Advertising Law (“FAL”), Cal. Bus. Prof. Code § 17500, et seq . ; (4) breach of California's Implied Warranty of Merchantability, Cal. Com. Code § 2314 ; (5) breach of contract at California common law; (6) fraud by concealment at California common law; (7) violation of California's Song-Beverly Consumer Warranty Act, Cal. Civ. Code §§ 1791.1 & 1792 ; and (8) invasion of privacy under the California Constitution, Cal. Const. art. I, § 1. FAC ¶¶ 62-138.
The “Oregon Class,” led by plaintiff Tompulis, brings three causes of action against Ford: (1) violation of Oregon's Unlawful Trade Practices Act, Or. Rev. Stat. § 646.605, et seq . ; (2) breach of Oregon's Implied Warranty of Merchantability, Or. Rev. Stat. § 72.3140 ; and (3) fraudulent concealment at Oregon common law. FAC ¶¶ 139-167.
Finally, the “Washington Class,” led by plaintiffs Gibbs and Langdon, brings four causes of action against Ford: (1) violation of Washington's Consumer Protection Act, Rev. Code Wash. Ann. § 19.86.010, et seq . ; (2) breach of Washington's Implied Warranty of Merchantability, Rev. Code Wash. § 62A.2–614 ; (3) breach of contract at Washington common law; and (4) fraudulent concealment at Washington common law. FAC ¶¶ 168-200.
Plaintiffs seek relief in the form of an injunction that enjoins defendants from continuing to market their cars as safe and requires them to establish a recall program and provide free repairs, such as the addition of Trusted Platform Modules. FAC at p. 34-35. They also request costs, fees, and damages, including punitive damages and disgorgement. Id . After the parties briefed defendants' motions to dismiss, I heard argument on November 3, 2015.
LEGAL STANDARD
Federal Rule of Civil Procedure 8(a)(2) requires a complaint to contain “a short and plain statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ. P. 8(a)(2), in order to “give the defendant fair notice of what the claim is and the grounds upon which it rests,” Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (internal quotation marks and alterations omitted).
A motion to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of a complaint. Navarro v. Block , 250 F.3d 729, 732 (9th Cir.2001). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr. , 521 F.3d 1097, 1104 (9th Cir.2008). While a complaint “need not contain detailed factual allegations” to survive a Rule 12(b)(6) motion, “it must plead enough facts to state a claim to relief that is plausible on its face.” Cousins v. Lockyer , 568 F.3d 1063, 1067–68 (9th Cir.2009) (internal quotation marks and citations omitted). A claim is facially plausible when it “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (internal quotation marks omitted).
In considering whether a claim satisfies this standard, the court must “accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co. , 519 F.3d 1025, 1031 (9th Cir.2008). However, “conclusory allegations of law and unwarranted inferences are insufficient to avoid a Rule 12(b)(6) dismissal.” Cousins , 568 F.3d at 1067 (internal quotation marks omitted). “[I]t is within [the court's] wheelhouse to reject, as implausible, allegations that are too speculative to warrant further factual development.” Dahlia v. Rodriguez , 735 F.3d 1060, 1076 (9th Cir.2013).
DISCUSSION
Defendants moved to dismiss on various grounds, including: (1) lack of personal jurisdiction against Ford; (2) failure to establish Article III standing; (3) failure to state a claim under the applicable state laws and the California constitution; and (4) preemption of plaintiffs' claims by state and federal law. Because I find that personal jurisdiction against Ford is lacking and that the plaintiffs have failed to establish standing for their claims, I do not discuss the other arguments.
I. PERSONAL JURISDICTION
Federal Rule of Civil Procedure 12(b)(2) authorizes a defendant to seek dismissal of an action for lack of personal jurisdiction. Fed. R. Civ. P. 12(b)(2). When a defendant challenges a court's personal jurisdiction over it, the plaintiff bears the burden of establishing that jurisdiction is proper. Ranza v. Nike, Inc ., 793 F.3d 1059, 1068 (9th Cir.2015). “Where, as here, the defendant's motion is based on written materials rather than an evidentiary hearing, the plaintiff need only make a prima facie showing of jurisdictional facts to withstand the motion to dismiss.” Id . (internal quotation marks and citation omitted). Yet, “the plaintiff cannot simply rest on the bare allegations of its complaint.” Schwarzenegger v. Fred Martin Motor Co ., 374 F.3d 797, 800 (9th Cir.2004) (internal quotation marks and citation omitted). Uncontroverted allegations in the complaint are accepted as true, and factual disputes created by conflicting affidavits are resolved in the plaintiff's favor. Id .
When no federal statute governs personal jurisdiction, a district court applies the long-arm statute of the state in which it sits. Id . California's long-arm statute permits a court to exercise personal jurisdiction consistent with constitutional due process. Cal. Code Civ. P. § 410.10. Due process requires that a non-resident defendant have “certain minimum contacts” with the forum “such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice.” Int'l Shoe Co. v. Washington , 326 U.S. 310, 316, 66 S.Ct. 154, 90 L.Ed. 95 (1945) (internal quotation marks and citation omitted).
The “minimum contacts” requirement can be satisfied in two ways: general jurisdiction or specific jurisdiction. General jurisdiction applies where a nonresident defendant's “affiliations with the State are so 'continuous and systematic' as to render it essentially at home in the forum state.” Daimler AG v. Bauman , ––– U.S. ––––, 134 S.Ct. 746, 761, 187 L.Ed.2d 624 (2014) (internal citations and quotation marks omitted). In contrast, specific jurisdiction exists when the defendant's contacts with the forum state are more limited but the plaintiff's claims arise out of or relate to those contacts. Id . at 754. General jurisdiction is referred to as “all-purpose” jurisdiction whereas specific jurisdiction is referred to as “case-specific” or “case-linked” jurisdiction. Ranza , 793 F.3d at 1069 n. 2 (citations omitted).
Ford moves to dismiss the claims brought by Tompulis, Gibbs, and Langdon (the “Ford plaintiffs”) on the basis of lack of personal jurisdiction over Ford in California. Ford makes two primary arguments: (1) because none of the Ford plaintiffs' claims arise out of Ford's California related activities, there is no specific jurisdiction; and (2) general jurisdiction is lacking because Ford it is neither headquartered nor incorporated in California and does not have the sufficient “minimum contacts” with California in order for general jurisdiction to be appropriate. Ford Mot. at 3-9 [Dkt. No. 47]. Ford is correct on both counts.
A. Specific Jurisdiction
The Ford plaintiffs do not address or oppose Ford's contention that specific jurisdiction does not lie here. This is apt.
A three-prong test is used to determine whether specific jurisdiction exists:
(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or relates to the defendant's forum-related activities; and (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.
Schwarzenegger , 374 F.3d at 802. The Ford plaintiffs bear the burden of satisfying the first two prongs of the test. Id . Personal jurisdiction cannot be established if they fail to do so. Id .
The Ford plaintiffs purchased or leased their vehicles in Oregon and Washington. FAC ¶¶ 13, 15. Their claims arise from the allegedly defective CAN bus units in their vehicles and deficiencies in Ford's disclosures to consumers in Oregon and Washington regarding the sale, marketing, and warranties of those cars. However, none of those claims is tied to Ford's activities in California. The 2014 Ford Escape Tompulis leased was manufactured in Louisville, Kentucky and then sold to her in Oregon. Dwyer Dec. ¶ 4 [Dkt. No. 47-1]; FAC ¶ 13. The 2013 Ford Fusion Gibbs and Langdon purchased was manufactured in Sonora, Mexico and sold in Washington. Dwyer Dec. ¶ 5; FAC ¶ 15. The CAN bus systems in both cars were neither manufactured nor designed in California. Pappas Decl. ¶¶ 4-5 [Dkt. No. 47–2]. The warranties at issue were disseminated with the new vehicles at the point of sale and are also available on the website (which is administered from Michigan). Ford Mot. at 8. Notably, the Ford plaintiffs, who at the time of the filing of the FAC were all non-California residents, bring no causes of action against the other defendants, Toyota and GM. See FAC ¶¶ 139-200.
In short, the Ford plaintiffs bring solely Oregon and Washington causes of action stemming from transactions that occurred in those states. They have failed to demonstrate that specific jurisdiction over Ford is appropriate in California.
B. General Jurisdiction
The Ford plaintiffs argue that general jurisdiction exists over Ford because “Ford is a corporation doing business in all fifty states... specifically in the states of California, Washington and Oregon....” FAC ¶ 22. They claim that 103,467 new Ford vehicles have been registered this year already, accounting for 10.5% of the new vehicle market in California. Ford Opp. at 12 [Dkt. No. 54] (citing Dkt. No. 55–7). According to this same source, of sixteen categories of cars and trucks tracked in California, Ford has a top five selling vehicle in nine of those categories. Id . Ford plaintiffs also point to a screen shot of a Google search result for “ford motor company california [sic]” purporting to show that “Ford operates a research center in Palo, Alto, California; is soliciting employees for jobs in California; and at one time operated a large assembly plant in California.” Id . (citing Dkt. No. 55–8).
Plaintiffs request judicial notice of Exhibit 7 (“copy of California Auto Outlook, Volume 11, Number 3 (August 2015)”) Dkt. No. and Exhibit 8 (“a copy of the opening page of a Google search result for ‘ford motor company california’ done on September, 28, 2015”)[ Dkt. No. 55–8]. Dkt. No. 55. Defendants oppose. Dkt. Nos. 63, 65, 66. Under Federal Rule of Evidence 201(b), a court can take judicial notice of facts outside the docket only if they are “not subject to reasonable dispute” because it is either “generally known” or can be “accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). Although this information is inappropriate for a request for judicial notice, it could have been suitably pleaded by affidavit. In determining personal jurisdiction, “[c]onflicts between parties over statements contained in affidavits must be resolved in the plaintiff's favor.” Schwarzenegger , 374 F.3d at 800. Even if such assertions were properly before court, they would still be insufficient to support personal jurisdiction against Ford. Plaintiffs' request for judicial notice of Dkt. No. 55–7 and Dkt No. 55–8 is DENIED. Plaintiffs' request for judicial notice of Exhibits 1-6 are GRANTED as to their existence in the public realm at that time but not as to the truth of their contents. See V o n Saher v. Norton Simon Museum of Art at Pasadena , 592 F.3d 954, 960 (9th Cir.2010).
Plaintiffs' argument rests on the notion that a company's “continuous and systematic” contacts can confer general jurisdiction. See Helicopteros Nacionales de Colombia, S.A. v. Hall , 466 U.S. 408, 416, 104 S.Ct. 1868, 80 L.Ed.2d 404 (1984) (finding no general jurisdiction because defendant lacked continuous and systematic contacts with forum state); Bancroft & Masters, Inc. v. Augusta Nat. Inc ., 223 F.3d 1082, 1086 (9th Cir.2000) (same). However, their analysis is undercut by Daimler.
Plaintiffs also cite In re MyFord Touch Consumer Litig ., 46 F.Supp.3d 936, 946 (N.D.Cal.2014) to support their contention that because Ford has been a defendant in one lawsuit in this district stemming from sales of its vehicles, it should be “keenly aware that its primary conduct should mean that it can be sued in California without offending any traditional notion of fair play or substantial justice.” Ford Opp. at 12. However, specific jurisdiction existed over Ford in MyFord Touch. To state the obvious, the exercise of specific jurisdiction over Ford in a case where it is appropriate to do so does not mean that Ford consents to general jurisdiction in California.
The Court in Daimler held that Daimler AG, the German manufacturer of Mercedes-Benz automobiles, was not subject to general jurisdiction in California “despite its multiple offices, continuous operations, and billions of dollars' worth of sales there.” Id . at 772 (Sotomayor, J., concurring). “[O]nly a limited set of affiliations with a forum will render a defendant amenable to all-purpose jurisdiction there.” Daimler , 134 S.Ct. at 760. “With respect to a corporation, the place of incorporation and principal place of business are paradigm...bases for general jurisdiction.” Id . (internal quotation marks, citations, and modifications omitted). “Those affiliations have the virtue of being unique—that is, each ordinarily indicates only one place—as well as easily ascertainable.” Id . The Court rejected the argument that a nonresident defendant should be subject to general jurisdiction “in every State in which [the defendant] engages in a substantial, continuous, and systematic course of business,” finding that such a holding would be “unacceptably grasping.” Id . at 760. In order to find that a corporation is subject to general jurisdiction in a forum, the plaintiff must demonstrate not only that the corporation “engages in a substantial, continuous, and systematic course of business,” but that the “corporation's affiliations with the state are so continuous and systematic as to render it essentially at home in the forum State.” Id . at 761 (internal quotation marks and citations omitted). Only in an “exceptional” case will “a corporation's operations in a forum other than its formal place of incorporation or principal place of business...be so substantial and of such a nature as to render the corporation at home in that State.” Id . at 761 n. 19.
Ford is not incorporated in California, nor does it have its principal place of business here. FAC ¶ 22 (noting that Ford is a Delaware corporation with its principal place of business in Michigan). These facts, alone, are strong evidence that Ford is not at home in California. Daimler , 134 S.Ct. at 760 ; see also Goodyear , 131 S.Ct. at 2853–54 (noting that “the paradigm forum for the exercise of general jurisdiction...[is the corporation's] domicile, place of incorporation, and principal place of business” (citation omitted)). “A corporation that operates in many places can scarcely be deemed at home in all of them, [o]therwise, ‘at home’ would be synonymous with ‘doing business.’ ” Daimler , 134 S.Ct. at 762 n. 20.
The Ford plaintiffs' reliance on pre-Daimler cases that use a “continuous and systematic” analysis must be reconsidered in light of this relatively recent precedent. Even if Ford's business contacts with California are continuous and systematic, approving the exercise of general jurisdiction in every state in which a corporation does business would be “unacceptably grasping.” Id . at 761 ; see also Google Inc. v. Rockstar Consortium U.S. LP ., No. 13-cv-5933–CW, 2014 WL 1571807, at *5 (N.D.Cal. Apr. 17, 2014) (declining to exercise general jurisdiction over a patent licensing entity, incorporated in Delaware and headquartered in Texas, that had engaged in continuous and systematic business in the forum state by targeting a significant part of its business to Silicon Valley in California). The general jurisdiction inquiry does not “focus solely on the magnitude of the defendant's in-state contacts” but must take into account a “corporation's activities in their entirety, nationwide and worldwide.” Daimler , 134 S.Ct. at 762 n. 20 (internal citations, modifications and quotation marks omitted).
In Daimler, the Court denied the exercise of general jurisdiction even though Daimler's subsidiary, whose contacts were imputed for the purposes of the Court's analysis, “ha[d] multiple California-based facilities,” was the “largest supplier of luxury vehicles to the California market,” and its “California sales account[ed] for 2.4% of Daimler's worldwide sales.” 134 S.Ct. at 752. These facts surpass the type of contacts at issue here. Out of approximately 75,000 employees in the United States and 187,000 worldwide, Ford only has 302 employees in California. Pappas Decl. ¶¶7-8 [Dkt. No. 71]. Even if the volume of business the Ford plaintiffs attribute to Ford is true, it would not be enough to render Ford “essentially at home in the forum State.” Daimler , 134 S.Ct. at 761 ; see also Ranza , 793 F.3d at 1069 (declining to exercise general jurisdiction over a foreign company when the defendant's contacts with the forum states consisted of: (1) 20 to 27 employees working in forum state on expatriate assignments at any one time between 2006 and 2008; (2) employees' average of 47 trips per month to the forum state to conduct business meetings between 2006 and 2011; (3) entering into contracts and various business arrangements; and (4) the presence of its products in forum state's stores); Martinez v. Aero Caribbean , 764 F.3d 1062, 1070 (9th Cir.2014) cert. denied , ––– U.S. ––––, 135 S.Ct. 2310, 191 L.Ed.2d 978 (2015) (finding no general jurisdiction over defendant that (1) had contracts worth between $225 and $450 million with eleven California component suppliers; (2) sent representatives to California to attend industry conferences, promote defendant's products, and meet with suppliers; and (3) advertised in trade publications with distribution in California).
At the hearing, plaintiffs attempted to distinguish Daimler because it was a case brought by a foreign plaintiff against a foreign defendant based on events occurring entirely outside the United States. Nothing in the Court's opinion limits its holding regarding general jurisdiction to those facts, and the cases decided since Daimler treat it as precedent in determining whether general jurisdiction exists. See, e.g ., Ivy Bridge Univ., LLC v. Higher Learning Comm'n , No. 15–cv–02187–SC, 2015 WL 6555428, at *3 (N.D.Cal. Oct. 28, 2015) (relying on Daimler to determine general jurisdiction despite all pertinent, underlying events occurring in the United States); Rockstar , 2014 WL 1571807, at *5 (same).
The Court noted that in an “exceptional case,” “a corporation's operations in a forum other than its formal place of incorporation or principal place of business may be so substantial and of such a nature as to render the corporation at home in that State.” Daimler , 134 S.Ct. at 761 n. 19. It did not define what an “exceptional case” is, but its discussion of Perkins v. Benguet Consolidated Mining Co ., 342 U.S. 437, 72 S.Ct. 413, 96 L.Ed. 485 (1952), indicates that the bar for such a finding is very high. In Perkins, the Court held that the defendant, a mining company based in the Philippines, was subject to general jurisdiction in Ohio because the defendant's president directed all of the company's activities from Ohio. 342 U.S. at 448, 72 S.Ct. 413. The Daimler Court noted that Perkins was an “exceptional case” because the defendant's mining operations in the Philippines were halted by Japanese wartime occupation of the Philippines. Id . at 761 n. 19. As a result, the Court found that Ohio could be considered the defendant's “surrogate for the place of incorporation or head office” and principal, if temporary, place of business. Id . at 756 n. 8 (citations omitted). Here, the Ford plaintiffs allege no similar facts to support the proposition that California can be considered Ford's surrogate place of incorporation or temporary place of business. See Xilinx, Inc. v. Papst Licensing GMBH & Co.KG , No. 14–cv–4794–LHK, 113 F.Supp.3d 1027, 1036, 2015 WL 4149166, at *5 (N.D.Cal. July 9, 2015) (“Merely conducting business in California from a home base in Germany is not “exceptional,” even when such business generates substantial revenue.”). In sum, the Ford plaintiffs have failed to establish general personal jurisdiction over Ford in California.
II. STANDING
Defendants assert that plaintiffs lack standing for all of their claims. “[T]he irreducible constitutional minimum of standing contains three elements.” Lujan v. Defenders of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). First, the plaintiff must show an “injury in fact” that is “actual or imminent, not conjectural or hypothetical.” Id. (citations and internal quotation marks omitted). Second, the injury must be “traceable to the challenged action of the defendant, and not the result of the independent action of some third party.” Id. (citations and internal quotation marks omitted). Finally, the injury must be redressable by a favorable judicial decision. Id. A plaintiff bears the burden of establishing standing, but that burden is low at the pleading stage, where “general factual allegations of injury resulting from the defendant's conduct may suffice, for on a motion to dismiss we presume that general allegations embrace those specific facts that are necessary to support the claim.” Id. at 561, 112 S.Ct. 2130 (citations and internal quotation marks omitted).
Plaintiffs claim that they have been injured as a result of defendants' alleged misrepresentation. They assert that “they would not have purchased their [vehicles] or would not have paid as much as they did to purchase them.” FAC ¶ 66. Similarly, they contend that “they paid an inflated purchase or lease price for the [vehicles].” FAC ¶ 78.
A. Whether Injury In Fact Exists Based On The Risk Of Future Hacking.
Defendants argue that plaintiffs cannot assert injury in fact based on the risk of future harm from the alleged product defect (that defendants' cars are susceptible to hacking by third parties). The crux of defendants' contention is that the risk of future injury caused by insecure software is not an injury in fact under Article III because such a scenario is too speculative to constitute a “certainly impending” injury. Clapper v. Amnesty Intern. USA , –––U.S. ––––, 133 S.Ct. 1138, 1147–48, 185 L.Ed.2d 264 (2013) ; GM Mot. at 4 [Dkt. No. 43]; Toyota Mot. at 8 [Dkt. No. 49]; Ford Mot. at 9. Defendants point out that plaintiffs do not allege any hacking incidents that have taken place outside of controlled settings, and that the entire threat rests on the speculative premise that a sophisticated third party cybercriminal may one day successfully hack one of plaintiffs' vehicles. GM Mot. at 5; Toyota Mot. at 8; Ford Mot. at 10.
The Court recently discussed injury in fact in Clapper, where the plaintiffs sought to invalidate a federal law that “allows the Attorney General and the Director of National Intelligence to acquire foreign intelligence information by jointly authorizing the surveillance of individuals who are not ‘United States persons' and are reasonably believed to be located outside the United States.” 133 S.Ct. at 1142. Because the plaintiffs regularly communicated with individuals they believed to be surveillance targets, they claimed injury in fact based on the likelihood that their own communications would be unlawfully acquired by the federal government. Id. at 1143. In finding that plaintiffs failed to establish injury in fact, the Court held that the “theory of future injury [was] too speculative to satisfy the well-established requirement that threatened injury must be ‘certainly impending.’ ” Id. (emphasis in original). The court explained that plaintiffs could not establish standing based on the “highly attenuated chain of possibilities” that:
(1) the Government will decide to target the communications of non-U.S. persons with whom they communicate; (2) in doing so, the Government will choose to invoke its authority under § 1881a rather than utilizing another method of surveillance; (3) the Article III judges who serve on the Foreign Intelligence Surveillance Court will conclude that the Government's proposed surveillance procedures satisfy § 1881a's many safeguards and are consistent with the Fourth Amendment; (4) the Government will succeed in intercepting the communications of respondents' contacts; and (5) respondents will be parties to the particular communications that the Government intercepts.
Id. at 1148.
Defendants place great weight on U.S. Hotel and Resort Management, Inc. v. Onity, Inc. , No. 13–499, 2014 WL 3748639 (D.Minn. July 30, 2014), which focused specifically on the implications of Clapper in cases where injury in fact rests on the risk of future harm based on a product defect. In Onity, the defendant sought to dismiss claims brought by hotel owners who had purchased electronic door locks that were susceptible to hacking, although no lock had ever been hacked. Id. at *1, 3. Noting that “there are no allegations that the locks are not presently operational,” id. at *3, the court found that injury in fact was not “certainly impending” because plaintiff's theory of injury necessarily rested on speculation that a third party would hack the locks. Id. at *4. “While it is possible that a potential intruder would in fact attempt to gain entry, ‘allegations of possible future injury’ are not sufficient.” Id. (citing Clapper , 133 S.Ct. at 1147 ) (emphasis in original) (modifications omitted).
Plaintiffs respond that Onity is inapposite because the susceptibility to hacking in Onity merely posed the threat of break-in, whereas the potential hacking of plaintiff's vehicles poses the more substantial risk of serious bodily injury or death. GM Opp. at 12 [Dkt. No. 53]; Toyota Opp. at 13 [Dkt. No. 52]; Ford Opp. at 17-18. But plaintiffs conflate the nature of the future risk at stake with the plausibility of the future risk for standing purposes—that a greater risk may be at stake in this case does not speak to whether the risk is any more plausible.
Plaintiffs also note that Onity did not arise in the Ninth Circuit. GM Opp. at 12; Toyota Opp. at 13; Ford Opp. at 17. That is true, but Ninth Circuit precedent is in line with the Onity court's interpretation of Clapper. For example, although Birdsong v. Apple, Inc. , 590 F.3d 955 (9th Cir.2009) predates Clapper, it is consistent with the requirement that a risk of future harm be certainly impending. The Birdsong court dismissed claims against Apple alleging that the iPod posed an unreasonable risk of hearing loss to its users. Id . at 960. In dismissing the complaint for lack of standing, the court noted that the plaintiffs failed to plead that they themselves suffered or would likely suffer any hearing loss. Id . Accordingly, it was insufficient for the plaintiffs to plead injury to “unidentified iPod users” without also pleading injury that was “concrete and particularized as to themselves. ” Id. (emphasis in original). The Birdsong plaintiffs further lacked standing because even the injury as pleaded with regard to “unidentified iPod users” was purely hypothetical—indeed, there had been no claim that anybody suffered reduced hearing loss from iPod use. Id. at 961.
Onity and Birdsong are instructive. As in Onity, which involved a similar risk of future hacking, here plaintiffs allege only that their vehicles are susceptible to future hacking by third parties. FAC ¶¶ 1-2, 30, 34. Plaintiffs therefore fail to allege that any harm is “certainly impending” because while it is possible that a potential hacker would in fact attempt to gain control of a vehicle, “allegations of possible future injury are not sufficient.” Onity, 2014 WL 3748639 at *3 (internal modifications, citations and quotation marks omitted) (emphasis in original). Although plaintiffs do allege that “it's just a question of when” until hackers start infiltrating the CAN bus in defendants' vehicles, FAC ¶ 40 (internal citations and quotation marks omitted), plaintiffs do not allege that any future risk of harm is “concrete and particularized as to themselves. ” Birdsong , 590 F.3d at 960 (emphasis in original). They allege only that car owners in general face a risk of hacking at some point in the future. The risk faced by the individual plaintiffs themselves remains speculative.
Judges in this District regularly deny standing in product liability cases where there has been no actual injury and the injury in fact theory rests only on an unproven risk of future harm. In a closely analogous automobile product liability case, the Hon. Jeffrey S. White denied standing to a group of plaintiffs who brought a class action against Toyota alleging that low temperature driving conditions could render the brakes on certain Corolla model cars harder to apply, resulting in increased stopping distances. Contreras v. Toyota Motor Sales USA, Inc. , No. 09–cv–06024–JSW, 2010 WL 2528844, at *1 (N.D.Cal. June 18, 2010). In dismissing the complaint without leave to amend, the court held that the injury as pleaded was too speculative to confer standing because “[p]laintiffs do not allege that their vehicles have manifested the alleged defect” and “[p]laintiffs have not alleged that it is reasonably likely that they intend to drive their vehicles in [low temperature] conditions,” which would put them at increased risk of experiencing the defect. Id. at *6. The case for standing here is more speculative than that presented in Contreras, where the alleged brake problems had manifested with other drivers, if not with the plaintiffs themselves. See also Boysen v. Walgreen Co. , No. 11–cv–06262–SI, 2012 WL 2953069, at *7 (N.D.Cal. July 19, 2012) (upon motion to dismiss, injury in fact was speculative where plaintiff brought claims alleging defendant failed to disclose the presence of lead and arsenic in its juice, but where plaintiff failed to plead facts that show a likelihood of physical harm caused by the chemicals). Here, plaintiffs do not allege that any consumer, outside the realm of controlled experiments, has ever been a victim of vehicle hacking.
At the hearing on these motions, plaintiffs' counsel encouraged me to rely on In re MyFord Touch Consumer Litigation to find standing in this case. MyFord Touch is not analogous. The contested defects in MyFord Touch were numerous, had already manifested, and had been experienced by the plaintiffs bringing the case. 46 F.Supp.3d at 949 (“Plaintiffs have identified various problems with the [car component] system, ranging from the entire system freezing up or crashing (in which case no features connected to [car component] are operational, including the navigation technology, the radio, the rearview camera, and the defroster) to isolated problems such as random but frequent screen black outs, nonresponsiveness to touch or voice commands, locking up of the rearview camera, and inaccurate directions on the navigation system.”). None of those factors is present in this case. The FAC does not allege that plaintiffs have suffered a hacking attack, nor does it plead any facts that would establish that they face an increased risk of a future hacking attack on their vehicles as opposed to other vehicle owners.
All of this is not to say that a future risk of harm can never satisfy injury in fact analysis. Although a speculative future risk will not suffice, “a credible threat of harm is sufficient to constitute actual injury for standing purposes.” Riva v. Pepsico, Inc. , 82 F.Supp.3d 1045, 1052 (N.D.Cal.2015) (internal citations and quotation marks omitted). In Riva, the court rejected Pepsi drinkers' claims that they were put at an increased risk of cancer because of carcinogens that were present in Pepsi at levels that exceeded California standards. Id . at 1049–51. Although the Pepsi drinkers cited studies showing an increased risk of cancer in mice exposed to extremely high levels of the carcinogen at issue, they failed to allege that humans experienced the same cancer risk when exposed to the lower levels present in Pepsi. Id. at 1053. The Pepsi drinkers' claims of risk therefore lacked credibility and “effectively invited the Court to engage in an 'ingenious academic exercise in the conceivable to explain how defendants' actions caused their injury.”' Id. (internal quotation marks and citations omitted).
The requirement that a threat of harm be credible is not an empty one, especially in light of Clapper's requirement that the threat be “certainly impending.” Just as it was impossible for the Riva court to determine whether the Pepsi drinkers faced an increased risk of cancer, it is difficult for me to conclude whether plaintiffs' vehicles might be hacked at some point in the future, especially in light of the fact that plaintiffs do not allege that anybody outside of a controlled environment has ever been hacked. Plaintiffs have alleged only that their cars are susceptible to hacking but have failed to plead that they consequently face a credible risk of hacking.
B. Whether Injury In Fact Exists Based On The Alleged Economic Loss Flowing From The Risk Of Future Hacking .
Plaintiffs argue that they have Article III standing because of the economic loss that flows from the risk of future injury. GM Opp. at 10; Toyota Opp. at 11; Ford Opp. at 15. They principally rely on Hinojos v. Kohl's Corp. , 718 F.3d 1098 (9th Cir.2013) and In re Toyota Motor Corp. Unintended Acceleration Marketing, Sales Practices, & Products Liability Litigation , 754 F.Supp.2d 1145 (C.D.Cal.2010) (hereinafter “In re Toyota I ”). However, plaintiffs fail to discuss the specific facts of either Hinojos or In re Toyota I, which are not analogous to the instant case and do not help them.
In Hinojos, plaintiffs alleged they were induced to purchase products that were falsely advertised as on sale but had in reality been “marked down” from fictitiously high “original” prices. Hinojos , 718 F.3d at 1101. The court held that “when, as here, [p]laintiffs contend that class members paid more for a product than they otherwise would have paid, or bought it when they otherwise would not have done so[,] they have suffered an Article III injury in fact.” Id. at 1104 n. 3 (internal quotation marks, modifications and citations omitted). Because Hinojos involved plaintiffs who had purchased products that were falsely advertised as on sale but had actually been “marked down” from fictitiously high “original” prices, the economic injury was not speculative but directly ascertainable. Id. at 1101. Plaintiffs here do not assert any demonstrably false misrepresentations of value, but rather make conclusory allegations that their cars are worth less because of the risk of future injury. FAC ¶¶ 66, 78, 81, 156, 198. The asserted economic harm is much more speculative than that in Hinojos.
In re Toyota I involved widespread and well-documented sudden unintended acceleration in Toyota model cars. 754 F.Supp.2d at 1164. The court found that a “manifested defect” was not required to establish standing “[a]s long as plaintiffs allege a legally cognizable loss under the 'benefit of the bargain' or some other legal theory.” Id . There the economic harm suffered by the plaintiffs was not at all speculative because of the decrease in value caused by the defect. Id. at 1162. The In re Toyota I court found that “[w]hile a statistically significant propensity for [the sudden unintended acceleration] may not be considered ‘actual’ or ‘imminent,’ the market effect of the alleged [sudden unintended acceleration] defect undoubtedly is actual or imminent.” Id. (emphasis in original).
While it was appropriate for that court to infer a market effect from widespread and well-documented acceleration problems, here the market effect is hypothetical. As Ford points out, all vehicles manufactured post-2008 are required to be equipped with some form of the CAN bus protocol that plaintiffs allege to be insufficient. This means that potentially all post-2008 cars vehicles on the American market, and not just defendants' vehicles, lack the allegedly necessary security protections and firewalls. Because the alleged harm is unmanifested and widespread, how that would translate into economic injury is unclear.
Additionally, in a later order from that very same case, the court found that “[w]hen economic loss is predicated solely on how a product functions, and the product has not malfunctioned, the Court agrees that something more is required than simply alleging an overpayment for a 'defective' product.” In re Toyota Motor Corp. Unintended Acceleration Litig. , 790 F.Supp.2d 1152, 1166 n. 11 (C.D.Cal.2011) (hereinafter “In re Toyota II ”). The court found standing because of “specific allegations of diminution in value, and repeated recalls...in millions of vehicles [that] have driven down resale values.” Id . at 1162 (internal quotation marks and citations omitted). There, plaintiffs alleged that the Kelley Blue Book, and other car value guides, had “lowered the values of Toyota vehicles subject to recalls.” Id. at 1159. Here, plaintiffs make no specific allegations of diminution in value. Instead, the economic loss is “predicated solely on how [the vehicles] function [ ],” namely, that they are susceptible to hacking, but plaintiffs do not plead the required “something more.” Id . at 1165 n. 11.
Cases in this District hold that conclusory allegations of economic loss stemming from a speculative future risk of harm cannot establish Article III standing unless plaintiffs plead “something more.” In Boysen, for example, the court found that economic injury could not establish injury in fact where “plaintiffs did not plead a distinct risk of harm from a defect in defendants' products that would make such an economic injury cognizable.” 2012 WL 2953069, at *7. In other words, an economic injury that rests on the risk presented by an underlying product defect fails to establish injury in fact if the underlying risk is itself speculative. See Id. The Boysen court found the alleged economic harm speculative because although arsenic and lead were indisputably present in defendant's juice, plaintiff could not plausibly plead a risk of physical injury from consuming the juice that would affect its value. Id.
Similarly, in Contreras, the economic harm stemming from alleged but unmanifested deficiencies in Toyota brakes failed to establish injury in fact. Contreras , 2010 WL 2528844, at *7. First, “[p]laintiffs' allegation that their vehicles are worth substantially less than they would be without the alleged defect is conclusory and unsupported by any facts,” and second, plaintiffs failed to allege “that they were forced to replace their vehicles after learning of the alleged defect or that they incurred any out-of-pocket damages.” Id.
Here, the California Class plaintiffs allege that had they known about the lack of electronic security in their vehicles, “they would not have purchased their Class Vehicles or would not have paid as much as they did to purchase them.” FAC ¶¶ 66, 81. The California plaintiffs also contend that they “suffered injury in fact and actual damages resulting from [d]efendants' material omissions and misrepresentations because they paid an inflated purchase or lease price for the Class Vehicles.” FAC ¶ 78. The plaintiffs in the Oregon and Washington classes similarly allege that they have been injured “[a]s a result of their reliance” upon defendants' omissions because of “their lost benefit of the bargain and overpayment at the time of purchase or lease and/or the diminished value of their Class Vehicles.” FAC ¶¶ 165, 198. But those allegations cannot obscure that the alleged economic injury rests solely upon the existence of a speculative risk of future harm. Here, as in Contreras, “[p]laintiffs allegation that their vehicles are worth substantially less than they would be without the alleged defect is conclusory and unsupported by any facts.” See Contreras , 2010 WL 2528844, at *7. The plaintiffs have not, for example, alleged a demonstrable effect on the market for their specific vehicles based on documented recalls or declining Kelley Bluebook values. In re Toyota II , 790 F.Supp.2d at 1159 ; In re Toyota I , 754 F.Supp.2d at 1162. Nor have they alleged a risk so immediate that they were forced to replace or discontinue using their vehicles, thus incurring out-of-pocket damages. See Contreras , 2010 WL 2528844, at *7 ; Whitson v. Bumbo , No. 07–cv–05597–MHP, 2009 WL 1515597, at *6 (N.D.Cal. Apr. 16, 2009). In short, plaintiffs fail to establish economic injury in fact because they have not alleged the required “something more” beyond the speculative risk of future harm that underlies the allegations of economic damage. In re Toyota II , 790 F.Supp.2d at 1166 n. 11.
C. Whether Injury In Fact Exists Based On The Invasion Of Privacy Claims Asserted By The California Class Against GM And Toyota.
Finally, Toyota and GM dispute whether the California Class plaintiffs have established injury in fact to bring the invasion of privacy claim under the California Constitution. All of plaintiffs' factual allegations with regard to the privacy claim are contained within just three paragraphs of the FAC, reproduced here in their entirety:
49. Without drivers ever knowing, Defendants also collect data from their vehicles and share the data with third parties. While Defendants agreed to adopt voluntary privacy guidelines governing their collection and sharing of this data, the American Automobile Association and Senator Markey of Massachusetts stated that these measures are insufficient, as they do not provide drivers the right to control their own information and fail to allow drivers to withhold sensitive information from collection in the first instance.
50. As detailed in Sen. Markey's report, Defendants collect large amounts of data on driving history and vehicle performance, and they transmit the data to third-party data centers without effectively securing the data. Defendants only make drivers aware of such data collection in owners' manuals, online “privacy statements,” and terms & conditions of specific feature activations—but drivers can't comprehensively opt out of all collection of data by Defendants, and in the limited situations where opting out is permitted, the driver must turn off a feature or cancel a service subscription.
....
135. Plaintiffs maintain a legally protected privacy interest in their personal data collected and transmitted to third parties by Defendants, including but not limited to the geographic location of their vehicles at various times.
FAC ¶¶ 49, 50, 135.
Despite the California Class plaintiffs' assertion that they “maintain a legally protected privacy interest in their personal data,” FAC ¶ 135, “[p]laintiffs have not identified a concrete harm from the alleged collection and tracking of their personal information sufficient to create injury in fact.” In re iPhone Application Litig ., No. 11–MD–02250–LHK, 2011 WL 4403963, at *5 (N.D.Cal. Sept. 20, 2011). Without showing an “injury in fact” that is “actual or imminent, not conjectural or hypothetical,” plaintiffs cannot establish Article III standing. Lujan , 504 U.S. at 560, 112 S.Ct. 2130.
Plaintiffs string cites to various Ninth Circuit and California district court cases to argue that their allegations are sufficient to establish injury for their privacy claims. GM Opp. at 14; Toyota Opp. at 15. Their cases are inapposite because they fail to establish a comparable credible risk of future harm that would constitute injury in fact. For example, Krottner v. Starbucks Corp ., 628 F.3d 1139 (9th Cir.2010) involved employees who sued their employer after a laptop that contained unencrypted personally identifying information such as names, addresses, and social security numbers was stolen. 628 F.3d at 1143. Though the employees did not allege their identities had actually been stolen, the court found that an individual Starbucks employee did not need to have his identity actually stolen in order to establish that he faced “a credible threat of harm”—the fact that a computer containing his personal information had already been stolen was enough. Id. at 1142–43. The court was careful to note, however, that no credible risk of harm, and thus no injury in fact, would have existed “if no laptop had been stolen, and Plaintiffs had sued based on the risk that it would be stolen at some point in the future.” Id. at 1143 ; see also Low v. LinkedIn Corp. , No. 11–cv–01468–LHK, 2011 WL 5509848 at *5–6 (N.D.Cal. Nov. 11, 2011) (noting that in the absence of the “publication or theft” of personally identifying information, the plaintiff failed to establish a “credible threat” of future harm).
Similarly in In re Sony Gaming Networks & Customer Data Security Breach Litigation , 996 F.Supp.2d 942 (S.D.Cal.2014), the plaintiffs had their “names, mailing addresses, email addresses, birth dates, credit and debit card information (card numbers, expiration dates, and security codes), and login credentials” compromised after malicious hackers broke into Sony's servers. 996 F.Supp.2d at 954. Analogizing to Krottner, the In re Sony court found that a data breach purposefully perpetrated by hackers involving sensitive personal identifying information created a “certainly impending” “credible threat” of future harm. Id. at 962–63 ; see also Doe 1 v. AOL LLC , 719 F.Supp.2d 1102, 1105 (N.D.Cal.2010) (cited by the California Class) (finding injury in fact because AOL created a credible risk of future injury when it inadvertently published to its website a database containing AOL users' search records, “names, social security numbers, addresses, telephone numbers, credit card numbers, user names, passwords, and financial/bank account information,” which was then downloaded and reposted on numerous third party websites around the internet).
The California Class plaintiffs fail to establish a comparable credible risk of future identity theft that would establish an injury in fact. At worst, they allege that GM and Toyota “collect large amounts of data on driving history and vehicle performance, and transmit the data to third-party data centers without effectively securing the data.” FAC ¶ 50. Nowhere do plaintiffs allege the kind of theft, malicious breach, or widespread accidental publication of sensitive personally identifying information such as social security numbers or credit card information that the Krottner, In re Sony, and Doe I courts found so dangerous. Instead, the only data plaintiffs specifically identify is “the geographic location of their vehicles at various times.” FAC ¶ 135. It is not apparent how the purposeful disclosure of such data to third party data centers would establish any credible risk of future harm. See Low , 2011 WL 5509848 at *4 (finding that to the extent the plaintiff sought to establish future harm, his allegation that sensitive information may be transmitted to third parties without identifying how it would be transmitted or associated with him was too theoretical to establish Article III standing).
Furthermore, plaintiffs do not specifically allege that they themselves have been affected by these alleged behaviors. See LaCourt v. Specific Media, Inc ., No. 10–cv–1256, 2011 WL 1661532, at *4 (C.D.Cal. Apr. 28, 2011) (finding that plaintiffs had not shown injury-in-fact in part because they had not alleged that they were personally affected by the complained of practices). Without any evidence of a breach or data compromise, speculative and generalized allegations of geographic tracking and data collection is insufficient to establish Article III standing.
Plaintiffs' additional allegation that defendants collect and transmit the data “without effectively securing” it cannot save them. FAC ¶ 50. In Whitaker v. Health Net of California, Inc ., No. 11–cv–0910, 2012 WL 174961, *1 (E.D.Cal. Jan. 20, 2012), defendants lost servers containing personally identifying medical information. In finding no injury in fact, the court found that “plaintiffs do not explain how the loss here has actually harmed them or threatens to harm them, or that third parties have accessed their data,” and distinguished Krottner on its facts, where the “credible threat” of future harm “arose from the theft of information, not its loss.” Whitaker , 2012 WL 174961 at *2. The threat here is even less. If the total loss of personally identifying medical data which might later fall into the hands of an unknown, malicious third party does not create a credible risk, then plaintiffs' allegations that their data is transmitted to data centers without sufficient security must also fail. Nowhere do plaintiffs explain how such transmission would result in unknown malicious parties accessing the information.
Even if plaintiffs' allegations were sufficient to establish standing, they would not demonstrate a violation of the right to privacy under the California Constitution. In order to establish an invasion of privacy claim under Article I, Section 1 of the California Constitution, a plaintiff must plead “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.” Hill v. Nat'l Collegiate Athletic Assn ., 7 Cal.4th 1, 39–40, 26 Cal.Rptr.2d 834, 865 P.2d 633 (1994).
The California Class plaintiffs fail to adequately identify a protected privacy interest. “Legally recognized privacy interests are generally of two classes: interests in precluding the dissemination or misuse of sensitive and confidential information (informational privacy), and interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (autonomy privacy).” Id. at 35, 26 Cal.Rptr.2d 834, 865 P.2d 633. As pleaded, defendants' tracking of a vehicle's driving history, performance, or location “at various times,” is not categorically the type of sensitive and confidential information the constitution aims to protect. FAC ¶¶49, 135. Plaintiffs rely on a report by Senator Edward Markey of Massachusetts that discusses concerns about vehicle hacking based on responses to letters sent out and responded to by sixteen automobile manufactures. FAC, Exh. 1 at 12 [Dkt No. 37–3]. However, the report does not fill in the missing gaps in plaintiffs' allegations. For example, it does not identify which car manufactures are collecting data, the frequency of which the data is being tracked, or the type of data is being collected. Id . Without more robust allegations, I am unable to adopt the plaintiffs' view that “[t]he Court can reasonably infer that simply by driving, Cahen is constantly creating data about her personal travel locations, which Toyota collects, aggregates, and disseminates.” Toyota Opp. at 22. CONCLUSION
If plaintiffs choose to amend their complaint to allege more concrete, particularized allegations of information dissemination or selling to third parties, they should also consider whether they continue to have a reasonable expectation of privacy in light of information previously disclosed to them. In the FAC, plaintiffs recognize that defendants make “drivers aware of such data collection in owners' manuals, online 'privacy statements,' and terms & conditions of specific feature activations....” FAC ¶50. Defendants argue that a consumer cannot reasonably expect privacy in data when a manufacturer has explicitly provided notice and consent. Toyota Mot. at 23; GM Mot. at 17. Even assuming, as plaintiffs' allege, that a comprehensive opt-out is not feasible and that instead a consumer must cancel an individual feature or subscription to opt out, it is unclear whether the notice and consent would vitiate a plausible invasion of privacy claim under the California Constitution.
For the foregoing reasons, defendants' motions to dismiss are GRANTED. Given the upcoming holidays, plaintiffs shall file an amended complaint, if any, by January 8, 2016.
IT IS SO ORDERED .