Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 1 of 28

1
2
3
4
5
6
7
8
9
10
11
12
13
14

Clayeo C. Arnold, California SBN 65070
carnold@justice4you.com
Joshua H. Watson, California SBN 238058
jwatson@justice4you.com
CLAYEO C. ARNOLD, A
PROFESSIONAL LAW
CORPORATION
865 Howe Avenue
Sacramento, California 95825
T: 916-777-7777
F: 916-924-1829
MORGAN & MORGAN
COMPLEX LITIGATION GROUP
John A. Yanchunis (Pro Hac Vice Forthcoming)
jyanchunis@ForThePeople.com
Jean S. Martin (Pro Hac Vice Forthcoming)
jeanmartin@ForThePeople.com
Ryan J. McGee (Pro Hac Vice Forthcoming)
rmcgee@ForThePeople.com
201 N. Franklin Street, 7th Floor
Tampa, Florida 33602
T: 813-223-5505
F: 813-223-5402

15

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA

16
17
18
19

Matt Matic, an individual and California
Resident, and Zak Harris, an individual and
California Resident,

20
21
22

Plaintiffs,

GOOGLE, INC. and ALPHABET, INC.,
Defendants

24

CLASS ACTION COMPLAINT
JURY TRIAL DEMANDED

v.

23

CASE NO.

(1)
(2)
(3)
(4)
(5)

UCL – Unlawful Business Practice
UCL – Unfair Business Practice
Negligence
Invasion of Privacy
California’s Customer Records Act

25
26
27
28

Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 2 of 28

1

TABLE OF CONTENTS

2

I.

SUMMARY OF THE CASE ....................................................................... 1

3

II.

JURISDICTION AND VENUE .................................................................. 2

4

III.

PARTIES ..................................................................................................... 3

IV.

FACTUAL BACKGROUND ...................................................................... 3

5
6
7

A.

Google’s Inadequate Data Security Allows the Massive Leak of Users’
Personal Information .......................................................................... 3

B.

Defendants Make A Business Decision Not To Disclose The Data
Leak ................................................................................................... 6

C.

Personal Information is Very Valuable on the Black Market............... 7

8
9
10
11

V.

CLASS ACTION ALLEGATIONS .......................................................... 10

12

VI.

CLAIMS ALLEGED ON BEHALF OF ALL CLASSES ........................ 15

VII.

ADDITIONAL CLAIMS ALLEGED ON BEHALF OF THE
CALIFORNIA SUBCLASS ONLY ..................................................... 23

15

VIII.

PRAYER FOR RELIEF ............................................................................ 25

16

IX.

JURY TRIAL DEMANDED ..................................................................... 26

13
14

17
18
19
20
21
22
23
24
25
26
27
28

i
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 3 of 28

1

For their Class Action Complaint, Plaintiffs Matt Matic and Zak Harris, on behalf of

2

themselves and all others similarly situated, allege the following against Defendant Google,

3

Inc. (“Google”), based on personal knowledge as to Plaintiffs and Plaintiffs’ own acts and on

4

information and belief as to all other matters based upon, inter alia, the investigation conducted

5

by and through Plaintiffs’ undersigned counsel:

6

SUMMARY OF THE CASE

7

1.

Launched in June 2011, Google+ (or Google Plus) is a social network owned

8

and operated by Google for consumers with Google accounts. Google+ facilitates the sharing
9
10
11

of information, photographs, weblinks, conversations, and other shared content similar in many
respects to the Facebook news feed or Twitter stream.
2.

12
13

seen as one of Google’s biggest failures.1

14
15

Google+ was created as Google’s answer and rival to Facebook, but is widely

3.

As part of the sign up process and as a consequence of interacting with the

network, users of Google+ create, maintain, and update profiles containing significant amounts

16
17
18
19

of Personal Information, including their names, birthdates, hometowns, addresses, locations,
interests, relationships, email addresses, photos, and videos, amongst others, referred to herein
as “Personal Information.”

20
21

4.

or more “circles”, which is a way of categorizing or organizing contacts.

22
23

When you add a contact to your Google+ account, you assign that person to one

5.

Google+ users determine privacy settings for content, allowing content to be

shared with the public or with only those in designated circles.

24

6.

25

This case involves the data leak Google and Alphabet announced on October 8,

26
27
28

THE WALL STREET JOURNAL, Google Exposed User Data, Feared Repercussions of Disclosing to Public
(October 8, 2018), https://www.wsj.com/articles/google-exposed-user-data-feared-repercussions-ofdisclosing-to-public-1539017194? (last visited October 8, 2018).
1

1
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 4 of 28

1
2
3
4
5
6

2018, wherein the Personal Information of up to 500,000 users was exposed due to a software
glitch that gave third-party application developers access to private Google+ profile data
between 2015 and March 2018.
7.

While this information was supposed to be protected, and shared only with

expressed permissions and limitations, Defendants allowed third-party application developers
to improperly collect the Personal Information of up to 500,000 Google+ users .

7

8.

This Class Action Complaint is filed on behalf of all persons in the United

8
9
10

States, described more fully in the following sections, whose Personal Information was
compromised in the data leak.
JURISDICTION AND VENUE

11
12
13
14

9.

This Court has jurisdiction over this action pursuant to the Class Action

Fairness Act (“CAFA”), 28 U.S.C. § 1332(d), because the aggregate amount in controversy
exceeds $5,000,000, exclusive of interests and costs, there are more than 100 class members,

15
16
17
18
19
20
21
22

and at least one class member is a citizen of a state different from Defendants and is a citizen
of a foreign state. The Court also has supplemental jurisdiction over the state law claims
pursuant to 28 U.S.C. § 1367.
10.

Venue is proper under 28 U.S.C. § 1391(c) because Defendant is a corporation

that does business in and is subject to personal jurisdiction in this District. Venue is also proper
because a substantial part of the events or omissions giving rise to the claims in this action
occurred in or emanated from this District, including the decisions made by Defendants’

23
24
25
26

governance and management personnel that led to the leak. Further, Google’s terms of service
governing users in the United States provides for venue in the Northern District of California
for all claims arising out of Plaintiffs’ relationship with Google.

27
28

2
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 5 of 28

PARTIES

1
2

A.

Plaintiffs
11.

3

Plaintiff Matt Matic is a resident and citizen of California. Plaintiff Matic

4

opened a Google+ account and used it for many years. Plaintiff Matic also uses a Gmail

5

account for his primary email. Through the opening and use of these accounts, Plaintiff Harris

6

has entrusted Google with his Personal Information for all relevant time periods.

7

12.

Plaintiff Zak Harris is a resident and citizen of Florida. Plaintiff Harris opened

8
9

a Google+ account and used it since the inception of the program. Plaintiff Harris also uses a

10

Gmail account for email. Through the opening and use of these accounts, Plaintiff Harris has

11

entrusted Google with his Personal Information for all relevant time periods.

12
13

13.

Defendant Google, Inc. (“Google”) is a Delaware corporation with its principal

headquarters in Mountain View, California.

14

14.

Defendant Alphabet, Inc. (“Alphabet”) is a Delaware corporation with its

15
16
17
18

principal headquarters in Mountain View, California. Alphabet is a public holding company
formed in a corporate reorganization by Google.

Defendant Google is now a direct, wholly owned subsidiary of Defendant Alphabet.2

19
20

Through the corporate restructuring,

FACTUAL BACKGROUND
A.

21

Google’s Inadequate Data Security Allows the Massive Leak of Users’ Personal
Information
15.

22

Google’s Terms of Service make it clear that Google collects information from

23

its users.3 But at all relevant times, Google has maintained a Privacy Policy advising its users

24

that: “When you use our services, you’re trusting us with your information. We understand

25
26
27
28

2

Google, Inc., Form 8-K, U.S. Securities and Exchange Commission (August 10, 2015),
https://www.sec.gov/Archives/edgar/data/1288776/000128877615000039/a20150810form8-k.htm (last visited
October 8, 2018).
3
Google, Privacy Policy (May 25, 2018), https://policies.google.com/privacy (last visited October 8, 2018).

3
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 6 of 28

1
2
3

this is a big responsibility and work hard to protect your information and put you in control.” 4
Further, Google represents that “We’ll share Personal Information outside of Google when we
have your consent.”5

4

16.

5

Google represents to its users that:
a. “You have choices regarding the information we collect and how it's

6

used.”6

7

b. “We’ll ask for your consent before using your information for a
8

purpose that isn’t covered in this Privacy Policy.”7

9

c. “We’ll ask for your explicit consent to share any sensitive Personal

10

Information.”8

11
12
13

17.

And importantly for this matter, Google represents to its users they can

“[c]ontrol whom you share information with through your account on Google+.”9

14

18.

Despite these representations, Google’s lax approach to data security resulted

15
16
17

in a data leak affecting more than 500,000 Google+ users over a period of at least 3 years (the
“2018 Data Leak”).
19.

18

On October 8, 2018, Alphabet announced that it would be permanently shutting

19

down the consumer functionality of Google+. 10 Along with this announcement, Alphabet

20

disclosed that a “software glitch” had allowed outside application (also “app”) vendors access

21

to private Google+ profile data between 2015 and March 2018.

22
23
24
4

25
26
27
28

Id. (emphasis added).
Id. (emphasis added).
6
Id.
7
Id.
8
Id. (emphasis added).
9
Id.
10
THE WALL STREET JOURNAL, Google Exposed User Data, Feared Repercussions of Disclosing to Public,
supra fn. 1.
5

4
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 7 of 28

20.

1
2

Google+ users may allow third party applications to access their private profile

data. A “glitch” or “bug” in the Application Program Interfaces (“API”) allowed the third

3

party app to access the personal profile data of other Google+ users within the authorized user’s

4

circles.

5
6

21.

The access allowed through this “glitch” is shown in the following

illustration11:

7
8
9
10
11
12
13
14
15
16
17

22.

Immediately, the 2018 Data Leak drew comparisons to Facebook’s leak of user

information to Cambridge Analytica and other third party app developers.12

18

23.

19

Given that Google+ was launched to challenge Facebook, the recent data

20

security incidents suffered by Facebook users should have made Defendants more sensitive to

21

the necessary protection of Google+ users’ data. Instead, Defendants allowed this vulnerability

22

in its system to endure for nearly 3 years, all the while leaking private information to

23

unauthorized third parties.

24
25
26
27
28

11

Id.
Id. See also, https://www.washingtonpost.com/news/the-switch/wp/2018/04/04/facebook-said-the-personaldata-of-most-its-2-billion-users-has-been-collected-and-shared-with-outsiders/?utm_term=.57902e5f3d98 (last
visited October 8, 2018).
12

5
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 8 of 28

24.

1
2

Worse, after discovery of this vulnerability in the Google+ platform,

Defendants kept silent for at least 7 months, making a calculated decision not to inform users

3

that their Personal Information was compromised, further compromising the privacy of

4

consumers‘ information and exposing them to risk of identity theft or worse..

5
6
7

25.

Defendants have advised that at least 438 third party applications may have

used this API and been allowed unauthorized access to Google+ users’ data for nearly 3
years.13

8

26.

9

Because the API logs are designed to keep historical data for only 2 weeks,

10

Defendants are unable to tell exactly how many users may have had their information

11

compromised during this 3 year period.14

12
13
14

27.

Although Defendants have reported that only up to 500,000 users were affected,

the reality is that this number is what was determined only for the two week period prior to the
discovery of the security vulnerability in March 2018.15 Thus, given that the data leak occurred

15
16

for nearly 3 years, the number of compromised users is expected to be much higher.
28.

17

This case involves the absolute and intentional disregard with which disregard

18

with which Defendants have chosen to treat the Personal Information of users who utilize the

19

Google+ social media platform. While this information was supposed to be protected and

20

shared only with expressed permissions, Defendants, without authorization, exposed that

21
22

information to third parties through lax and non-existent data safety and security policies and
protocols.

23
24

B.

Defendants Make A Business Decision Not To Disclose The Data Leak

25
26
27
28

13

ZD Net, Google Shuts Down Google+ After API Bug Exposed Details For Over 500,000 Users (October 8,
2018),https://www.zdnet.com/article/google-shuts-down-google-after-api-bug-exposed-details-for-over500000-users/ (last visited October 8, 2018).
14
Id.
15
Id.

6
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 9 of 28

29.

1
2
3

Leak, it made the startling revelation that they had discovered and “fixed” the security
vulnerability in March 2018, an astonishing 6 months before the announcement. 16

4
5
6
7

Even more serious and alarming, when Alphabet announced the 2018 Data

30.

It has been reported that, faced with the news of this massive Data Leak,

Defendants made a calculated business decision, with the knowledge of Chief Executive
Sundar Pichai, that disclosure of the incident might invite “regulatory interest” similar to what
Facebook faced in the wake of the Cambridge Analytica debacle. 17

8

31.

9

Incredibly, Defendants chose to protects themselves from potential “regulatory

10

interest” rather than protect the Personal Information of its users and advise them that their

11

Personal Information had been exposed in a massive leak of information to unauthorized third

12

parties.

13
14

32.

Defendants withheld the information of the security incident from its users and

the public until it made the decision that it was shutting down the Google+ service for

15
16

consumers.
33.

17

In every turn, Defendants put their own business interests ahead of the privacy

18

interests of Google+ users causing harm to Plaintiffs and Class members.

19

C.

20
21
22

Personal Information is Very Valuable on the Black Market
34.

The types of information compromised in the 2018 Data Leak are highly

valuable to identity thieves. The names, email addresses, occupation, birthdates, gender,
nicknames, and other valuable Personal Information can all be used to gain access to a variety

23
24

of existing accounts and websites.

25
26
27
28

16

THE WALL STREET JOURNAL, Google Exposed User Data, Feared Repercussions of Disclosing to Public,
supra fn. 1.
17
Id.

7
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 10 of 28

35.

1
2

Identity thieves can also use the Personal Information to harm Plaintiffs and

Class members through embarrassment, blackmail, or harassment in person or online, or to

3

commit other types of fraud including obtaining ID cards or driver’s licenses, fraudulently

4

obtaining tax returns and refunds, and obtaining government benefits. A Presidential Report

5

on identity theft from 2008 states that:

6

In addition to the losses that result when identity thieves fraudulently open
accounts or misuse existing accounts, . . . individual victims often suffer
indirect financial costs, including the costs incurred in both civil litigation
initiated by creditors and in overcoming the many obstacles they face in
obtaining or retaining credit. Victims of non-financial identity theft, for
example, health-related or criminal record fraud, face other types of harm
and frustration.

7
8
9
10

15

In addition to out-of-pocket expenses that can reach thousands of dollars for
the victims of new account identity theft, and the emotional toll identity
theft can take, some victims have to spend what can be a considerable
amount of time to repair the damage caused by the identity thieves. Victims
of new account identity theft, for example, must correct fraudulent
information in their credit reports and monitor their reports for future
inaccuracies, close existing bank accounts and open new ones, and dispute
charges with individual creditors.18

16

36.

11
12
13
14

17
18

To put it into context, as demonstrated in the chart below, the 2013 Norton

Report, based on one of the largest consumer cybercrime studies ever conducted, estimated
that the global price tag of cybercrime was around $113 billion at that time, with the average

19
20

cost per victim being $298 dollars.

21
22
23
24
25
26
27
28

18

The President’s Identity Theft Task Force, Combating Identity Theft: A Strategic Plan, Federal Trade
Commission,
11
(April
2007),
http://www.ftc.gov/sites/default/files/documents/reports/
combating-identity-theft-strategic-plan/strategicplan.pdf.

8
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 11 of 28

1
2
3
4
5
6
7
8
9
10

37.

11

The problems associated with identity theft are exacerbated by the fact that

12

many identity thieves will wait years before attempting to use the Personal Information they

13

have obtained. Indeed, in order to protect themselves, Class members will need to remain

14

vigilant against unauthorized data use for years and decades to come.

15
16

38.

Once stolen, Personal Information can be used in a number of different ways.

One of the most common is that it is offered for sale on the “dark web,” a heavily encrypted

17
18
19

part of the Internet that makes it difficult for authorities to detect the location or owners of a
website. The dark web is not indexed by normal search engines such as Google and is only

20

accessible using a Tor browser (or similar tool), which aims to conceal users’ identities and

21

online activity. The dark web is notorious for hosting marketplaces selling illegal items such

22

as weapons, drugs, and Personal Information. 19 Websites appear and disappear quickly,

23

making it a very dynamic environment.

24

39.

Once someone buys Personal Information, it is then used to gain access to

25
26

different areas of the victim’s digital life, including bank accounts, social media, and credit

27
19

28

Brian Hamrick, The dark web: A trip into the underbelly of the internet, WLWT News (Feb. 9, 2017 8:51 PM),
http://www.wlwt.com/article/the-dark-web-a-trip-into-the-underbelly-of-the-internet/8698419.

9
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 12 of 28

1
2

card details. During that process, other sensitive data may be harvested from the victim’s
accounts, as well as from those belonging to family, friends, and colleagues.
CLASS ACTION ALLEGATIONS

3
4
5
6

40.

Pursuant to Rule 23(b)(2), (b)(3) and (c)(4) of the Federal Rules of Civil

Procedure, Plaintiffs, individually and on behalf of all others similarly situated, bring this
lawsuit on behalf of themselves and as a class action on behalf of the following classes:

7

A.

The United States Class

8

All persons who registered for Google+ accounts in the United
States and whose Personal Information was accessed, compromised,
or obtained from Google by third party applications without
authorization or in excess of authorization as a result of the 2018
Data Leak.

9
10
11
12

41.

13

defined as:

14

All persons in California who registered for Google accounts and
whose Personal Information was accessed, compromised, or
obtained from Google by third party applications without
authorization or in excess of authorization as a result of the 2018
Data Leak.

15
16
17
18

In addition, Plaintiff Matic brings this action on behalf of a California subclass

42.

Excluded from the Class are Defendants and any entities in which any

19

Defendant or its subsidiaries or affiliates have a controlling interest, and Defendants’ officers,

20

agents, and employees. Also excluded from the Class are any judge assigned to this action,

21

members of the judge’s staff, and any member of the judge’s immediate family.

22

43.

Numerosity: The members of each Class are so numerous that joinder of all

23

members of any Class would be impracticable. Plaintiffs reasonably believe that Class
24
25

members number hundreds of millions of people or more in the aggregate and well over 1,000

26

in the smallest of the classes. The names and addresses of Class members are identifiable

27

through documents maintained by Defendants.

28

10
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 13 of 28

1
2
3
4

44.

Commonality and Predominance: This action involves common questions of

law or fact, which predominate over any questions affecting individual Class members,
including:
i.

5
6

members’ Personal Information;
ii.

7

Information;
iii.

10

Information;
iv.

13

authorization;
v.

16

authorization or in excess of any authorization;
vi.

19

22

of the 2018 Data Leak;
vii.

Whether Defendants’ conduct violated Cal. Civ. Code § 1750, et seq.;

viii.

Whether Defendants’ conduct was an unlawful or unfair business practice

23
24

under Cal. Bus. & Prof. Code § 17200, et seq.;
ix.

25
26
27

Whether Defendants knew about the 2018 Data Leak before it was
announced to the public and Defendants failed to timely notify the public

20
21

Whether Defendants was aware of other third parties’ collection of
Plaintiffs’ and Class members’ Personal Information without

17
18

Whether third parties improperly obtained Plaintiffs’ and Class members’
Personal Information without authorization or in excess of any

14
15

Whether Defendants breached a legal duty to Plaintiffs and the Class to
exercise due care in collecting, storing, and safeguarding their Personal

11
12

Whether Defendants owed a legal duty to Plaintiffs and the Class to
exercise due care in collecting, storing, and safeguarding their Personal

8
9

Whether Defendants represented to the Class that it would safeguard Class

Whether Defendants’ conduct violated the Consumer Records Act, Cal.
Civ. Code § 1798.80 et seq.;

x.

Whether Defendants’ conduct violated the Online Privacy Protection Act,
Cal. Bus. & Prof. Code § 22575, et seq.,

28

11
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 14 of 28

xi.

1

Commission Act, 15 U.S.C. § 45, et seq.,

2

xii.

3

xiii.

5

Whether Plaintiffs and the other Class members are entitled to actual,
statutory, or other forms of damages, and other monetary relief.

6

8

Whether Plaintiffs and the Class are entitled to equitable relief, including,
but not limited to, injunctive relief and restitution; and

4

7

Whether Defendants’ conduct violated § 5 of the Federal Trade

45.

Defendants engaged in a common course of conduct giving rise to the legal

rights sought to be enforced by Plaintiff individually and on behalf of the members of the class.

9

Similar or identical statutory and common law violations, business practices, and injuries are
10
11
12
13

involved. Individual questions, if any, pale by comparison, in both quantity and quality, to the
numerous common questions that dominate this action.
46.

Typicality: Plaintiffs’ claims are typical of the claims of the other members of

14

their respective classes because, among other things, Plaintiffs and the other Class members

15

were injured through the substantially uniform misconduct by Defendants. Plaintiffs are

16

advancing the same claims and legal theories on behalf of themselves and all other Class

17
18
19
20
21
22
23
24

members, and there are no defenses that are unique to Plaintiffs. The claims of Plaintiffs and
those of other Class members arise from the same operative facts and are based on the same
legal theories.
47.

Adequacy of Representation: Plaintiffs are adequate representatives of the

classes because their interests do not conflict with the interests of the other Class members they
seek to represent; they have retained counsel competent and experienced in complex class
action litigation and Plaintiffs will prosecute this action vigorously. The Class members’

25
26
27
28

interests will be fairly and adequately protected by Plaintiffs and their counsel.
48.

Superiority: A class action is superior to any other available means for the fair

and efficient adjudication of this controversy, and no unusual difficulties are likely to be
12
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 15 of 28

1
2

encountered in the management of this matter as a class action. The damages, harm, or other
financial detriment suffered individually by Plaintiffs and the other members of their respective

3

classes are relatively small compared to the burden and expense that would be required to

4

litigate their claims on an individual basis against Defendants, making it impracticable for

5

Class members to individually seek redress for Defendants’ wrongful conduct. Even if Class

6

members could afford individual litigation, the court system could not. Individualized litigation

7

would create a potential for inconsistent or contradictory judgments, and increase the delay
8
9

and expense to all parties and the court system. By contrast, the class action device presents

10

far fewer management difficulties and provides the benefits of single adjudication, economies

11

of scale, and comprehensive supervision by a single court.

12
13
14

49.

Further, Defendants has acted or refused to act on grounds generally applicable

to the Class and, accordingly, final injunctive or corresponding declaratory relief with regard
to the members of the Class as a whole is appropriate under Rule 23(b)(2) of the Federal Rules

15
16
17

of Civil Procedure.
50.

Likewise, particular issues under Rule 23(c)(4) are appropriate for certification

18

because such claims present only particular, common issues, the resolution of which would

19

advance the disposition of this matter and the parties’ interests therein. Such particular issues

20

include, but are not limited to:

21

a.

22

Whether Class members’ Personal Information was improperly obtained by
third parties;

23
24
25

b.

Whether (and when) Defendant knew about any security vulnerabilities that led
to the 2018 Data Leak before they were announced to the public and whether

26

Defendant failed to timely notify the public of those vulnerabilities and the 2018

27

Data Leak;

28

13
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 16 of 28

1

c.

Cal. Bus. & Prof. Code § 17200, et seq.;

2
3

Whether Defendants’ conduct was an unlawful or unfair business practice under

d.

Whether Defendants’ representations that it would secure and protect the

4

Personal Information of Plaintiffs and members of the classes were facts that

5

reasonable persons could be expected to rely upon when deciding whether to

6

use Defendants’ services;

7

e.

Whether Defendants misrepresented the safety of its many systems and

8

services, specifically the security thereof, and its ability to safely store

9

Plaintiffs’ and Class members’ Personal Information;

10
11

f.

12
13

Whether Defendants concealed crucial information about its inadequate data
security measures from Plaintiffs and the Class;

g.

14

Whether Defendants failed to comply with its own policies and applicable laws,
regulations, and industry standards relating to data security;

15
16

h.

reasonable measures to keep Plaintiffs’ and Class members’ Personal

17

Information secure and prevent the loss or misuse of that information;

18
19

Whether Defendants knew or should have known that it did not employ

i.

20

Whether Defendants failed to “implement and maintain reasonable security
procedures and practices” for Plaintiffs’ and Class members’ Personal

21

Information in violation of California Civil Code section 1798.81.5, subdivision

22

(b) and Section 5 of the FTC Act;

23
24

j.

violation of California Civil Code § 1798.82;

25
26

Whether Defendants failed to provide timely notice of the 2018 Data Leak in

k.

Whether Defendants’ conduct violated Cal. Bus. & Prof. Code § 22575, et seq.;

27
28

14
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 17 of 28

1

l.

Whether Defendants owed a duty to Plaintiffs and the Class to safeguard their
Personal Information and to implement adequate data security measures;

2
3

m.

Whether Defendants breached that duty;

4

n.

Whether Defendants failed to adhere to its posted privacy policy concerning the

5

care it would take to safeguard Plaintiffs’ and Class members’ Personal

6

Information in violation of California Business and Professions Code § 22576;

7

o.

Whether Defendants negligently and materially failed to adhere to its posted

8

privacy policy with respect to the extent of its disclosure of users’ data, in

9

violation of California Business and Professions Code § 22576;

10
11

p.

12
13

Whether such representations were false with regard to storing and
safeguarding Class members’ Personal Information; and

q.

14

Whether such representations were material with regard to storing and
safeguarding Class members’ Personal Information.

15

CLAIMS ALLEGED ON BEHALF OF ALL CLASSES

16
17
18
19
20
21
22

First Claim for Relief
Violation of California’s Unfair Competition Law (“UCL”) – Unlawful Business
Practice (Cal. Bus. & Prof. Code § 17200, et seq.)
51.

Plaintiffs repeat, reallege, and incorporate by reference the allegations

contained in paragraphs 1 through 39 as though fully stated herein.
52.

By reason of the conduct alleged herein, Defendants engaged in unlawful

practices within the meaning of the UCL. The conduct alleged herein is a “business practice”

23
24
25
26

within the meaning of the UCL.
53.

Google represent that it would not disclose Google+ users’ Personal

Information without consent and/or notice. Google further represented that it would utilize

27
28

15
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 18 of 28

1
2
3
4
5
6

sufficient data security protocols and mechanisms to protect Google+ users’ Personal
Information.
54.

Defendants failed to abide by these representations. Defendants did not prevent

improper disclosure of Plaintiff’s and the Class’s Personal Information.
55.

Defendants stored the Personal Information of Plaintiffs and members of their

respective Classes in Defendants’ electronic and consumer information databases. Defendants

7

falsely represented to Plaintiffs and members of the Classes that the Personal Information
8
9

databases were secure and that class members’ Personal Information would remain private.

10

Defendants knew or should have known it did not employ reasonable, industry standard, and

11

appropriate security measures that complied “with federal regulations” and that would have

12

kept Plaintiffs’ and the other Class members’ Personal Information secure and prevented the

13
14

loss or misuse of Plaintiffs’ and the other class members’ Personal Information.
56.

Even without these misrepresentations, Plaintiffs and Class members were

15
16
17

entitled to assume, and did assume Defendant would take appropriate measures to keep their
Personal Information safe. Defendant did not disclose at any time that Plaintiffs’ Personal

18

Information was accessible to third party application vendors because Defendants’ data

19

security measures were inadequate, and Defendant was the only one in possession of that

20

material information, which they had a duty to disclose. Defendant violated the UCL by

21
22

misrepresenting, both by affirmative conduct and by omission, the security of its many systems
and services, and its ability to honor the disclosure authorizations established by Plaintiffs and

23
24
25

Class members for their Personal Information.
57.

Defendants also violated the UCL by failing to implement reasonable and

26

appropriate security measures or follow industry standards for data security, and failing to

27

comply with its own posted privacy policies. If Defendant had complied with these legal

28

16
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 19 of 28

1
2
3

requirements, Plaintiffs and the other Class members would not have suffered the damages
described herein.
58.

Defendants’ acts, omissions, and misrepresentations as alleged herein were

4

unlawful and in violation of, inter alia, Cal. Civ. Code § 1798.81.5(b), Section 5(a) of the

5

Federal Trade Commission Act, 15 U.S.C. § 45(a), Cal. Bus. & Prof. Code § 22576 (as a result

6

of Google failing to comply with its own posted privacy policies).

7

59.

Plaintiffs and the Class members suffered injury in fact and lost money or

8
9

property as the result of Defendants’ unlawful business practices. In particular, Plaintiffs’ and

10

Class members’ Personal Information was taken and is in the hands of those who will use it

11

for their own advantage, or is being sold for value, making it clear that information is of

12

tangible value.

13
14

60.

As a result of Defendants’ unlawful business practices, violations of the UCL,

Plaintiffs and the Class members are entitled to restitution, disgorgement of wrongfully

15
16
17
18
19
20
21
22

obtained profits and injunctive relief.
Second Claim for Relief
Violation of California’s Unfair Competition Law (“UCL”) – Unfair Business Practice
(Cal. Bus. & Prof. Code § 17200, et seq.)
61.

Plaintiffs repeat, reallege, and incorporate by reference the allegations

contained in paragraphs 1 through 39 as though fully stated herein.
62.

By reason of the conduct alleged herein, Defendants engaged in unfair

“business practices” within the meaning of the UCL.

23
24
25

63.

Defendants stored the Personal Information of Plaintiffs and members of their

respective Classes in their electronic and consumer information databases. Defendants

26

represented to Plaintiffs and members of the classes that its Personal Information databases

27

were secure and that class members’ Personal Information would remain private and be

28

17
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 20 of 28

1
2
3
4
5
6

disclosed only with expressed authorization. Defendants engaged in unfair acts and business
practices by representing that would require expressed consent and authorization prior to
disclosure of Personal Information to third parties.
64.

Even without these misrepresentations, Plaintiffs and Class members were

entitled to, and did, assume Defendants would take appropriate measures to keep their Personal
Information safe. Defendants did not disclose at any time that Plaintiffs’ Personal Information

7

was vulnerable to unauthorized disclosure because Defendants’ data security measures were
8
9
10
11
12
13
14

inadequate, and Defendants were in sole possession of that material information, which they
had a duty to disclose.
65.

Defendants knew or should have known it did not employ reasonable measures

that would have kept Plaintiffs’ and the other Class members’ Personal Information secure
from unauthorized disclosure.
66.

Defendants engaged in unfair acts and business practices by representing that

15
16
17

they would not disclose this Personal Information without authorization, and/or by obtaining
that Personal Information without authorization. Defendants also violated its commitment to

18

maintain the confidentiality and security of the Personal Information of Plaintiffs and their

19

respective Classes, and failed to comply with its own policies and applicable laws, regulations,

20

and industry standards relating to data security.

21
22

67.

Defendant engaged in unfair business practices under the “balancing test.”

The harm caused by Defendants’ actions and omissions, as described in detail above, greatly

23
24
25
26

outweigh any perceived utility. Indeed, Defendants’ failure to follow basic data security
protocols and misrepresentations to consumers about Defendants’ data security cannot be said
to have had any utility at all.

27
28

18
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 21 of 28

1
2

68.

Defendant engaged in unfair business practices under the “tethering test.”

Defendants’ actions and omissions, as described in detail above, violated fundamental public

3

policies expressed by the California Legislature. See, e.g., Cal. Civ. Code § 1798.1 (“The

4

Legislature declares that ... all individuals have a right of privacy in information pertaining to

5

them.... The increasing use of computers ... has greatly magnified the potential risk to

6

individual privacy that can occur from the maintenance of Personal Information.”); Cal. Civ.

7

Code § 1798.81.5(a) (“It is the intent of the Legislature to ensure that Personal Information
8
9

about California residents is protected.”); Cal. Bus. & Prof. Code § 22578 (“It is the intent of

10

the Legislature that this chapter [including the Online Privacy Protection Act] is a matter of

11

statewide concern.”) Defendants’ acts and omissions, and the injuries caused by them are thus

12

“comparable to or the same as a violation of the law …” Cel-Tech Communications, Inc. v.

13
14

Los Angeles Cellular Telephone Co. (1999) 20 Cal.4th 163, 187.
69.

Defendant engaged in unfair business practices under the “FTC test.” The

15
16
17

harm caused by Defendants’ actions and omissions, as described in detail above, is substantial
in that it affects approximately 50 million Class members and has caused those persons to

18

suffer actual harms. Such harms include a substantial risk of identity theft, disclosure of Class

19

members’ Personal Information to third parties without their consent, diminution in value of

20

their Personal Information, consequential out of pocket losses for procuring credit freeze or

21
22

protection services, identity theft monitoring, and other expenses relating to identity theft
losses or protective measures. This harm continues given the fact that Class members’ Personal

23
24
25

Information remains in Defendants’ possession, without adequate protection, and is also in the
hands of those who obtained it without their consent. Defendants’ actions and omissions

26

violated, inter alia, Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45. See,

27

e.g., F.T.C. v. Wyndham Worldwide Corp., 10 F. Supp. 3d 602, 613 (D.N.J. 2014), aff'd, 799

28

19
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 22 of 28

1
2

F.3d 236 (3d Cir. 2015); In re LabMD, Inc., FTC Docket No. 9357, FTC File No. 102-3099
(July 28, 2016) (failure to employ reasonable and appropriate measures to secure Personal

3

Information collected violated § 5(a) of FTC Act); In re BJ’s Wholesale Club, Inc., FTC

4

Docket No. C-4148, FTC File No. 042-3160 (Sept. 20, 2005) (same); In re CardSystems

5

Solutions, Inc., FTC Docket No. C-4168, FTC File No. 052-3148 (Sept. 5, 2006) (same); see

6

also United States v. ChoicePoint, Inc., Civil Action No. 1:06-cv-0198-JTC (N.D. Ga. Oct. 14,

7

2009) (“failure to establish and implement, and thereafter maintain, a comprehensive
8
9

information security program that is reasonably designed to protect the security.

10

confidentiality, and integrity of Personal Information collected from or about consumers”

11

violates § 5(a) of FTC Act); 15 U.S.C. § 45(n) (defining “unfair acts or practices” as those that

12

“cause[] or [are] likely to cause substantial injury to consumers which [are] not reasonably

13
14

avoidable by consumers themselves and not outweighed by countervailing benefits to
consumers or to competition.”).

15
16
17

70.

Plaintiffs and the Class members suffered injury in fact and lost money or

property as the result of Defendants’ unfair business practices. In addition, their Personal

18

Information was taken and is in the hands of those who will use it for their own advantage, or

19

is being sold for value, making it clear that the hacked information is of tangible value.

20
21
22

71.

As a result of Defendants’ unfair business practices, violations of the UCL,

Plaintiffs and the Class members are entitled to restitution, disgorgement of wrongfully
obtained profits, and injunctive relief.

23

Third Claim for Relief
Negligence

24
25

72.

Plaintiffs repeat, reallege, and incorporate by reference the allegations

26

contained in paragraphs 1 through 39 as though fully stated herein.
27
28

20
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 23 of 28

1
2
3
4
5
6

73.

Defendants owed a duty to Plaintiffs and the Class to exercise reasonable care

in safeguarding and protecting their Personal Information and keeping it from being
compromised, lost, stolen, misused, and or/disclosed to unauthorized parties.
74.

Defendants knew that the Personal Information of Plaintiffs and the Class was

personal and sensitive information that is valuable to identity thieves and other criminals.
Defendants also knew of the serious harms that could happen if the Personal Information of

7

Plaintiffs and the Class was wrongfully disclosed, that disclosure was not fixed, or Plaintiffs
8
9
10

and the Class were not told about the disclosure in a timely manner.
75.

By being entrusted by Plaintiffs and the Class to safeguard their Personal

11

Information, Defendants had a special relationship with Plaintiffs and the Class. Plaintiffs and

12

the Class signed up for Defendants’ services and agreed to provide their Personal Information

13
14

with the understanding that Defendants would take appropriate measures to protect it, and
would inform Plaintiffs and the Class of any breaches or other security concerns that might

15
16
17

call for action by Plaintiffs and the Class. But, Defendants did not. Defendants not only knew
its data security was inadequate, Defendants also knew it didn’t have the tools to detect and

18

document intrusions or exfiltration of Personal Information. Defendants are morally culpable,

19

given its repeated security breaches, wholly inadequate safeguards, and refusal to notify

20

Plaintiffs and the Class of breaches or security vulnerabilities,

21
22

76.

Defendants breached tduty to exercise reasonable care in safeguarding and

protecting Plaintiffs’ and the Class members’ Personal Information by failing to adopt,

23
24
25

implement, and maintain adequate security measures to safeguard that information and prevent
unauthorized disclosure of Plaintiffs’ and the other Class members’ Personal Information.

26
27
28

21
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 24 of 28

1
2
3
4
5
6

77.

Defendants also breached their duty to timely disclose that Plaintiffs’ and the

other class members’ Personal Information had been, or was reasonably believed to have been,
improperly obtained.
78.

But for Defendants’ wrongful and negligent breach of its duties owed to

Plaintiffs and the Class, their Personal Information would not have been compromised, stolen,
and viewed by unauthorized persons.

7

79.

Defendants’ negligence was a direct and legal cause of the theft of the Personal

8
9
10

Information of Plaintiffs and the Class and all resulting damages.
80.

The injury and harm suffered by Plaintiffs and the Class members was the

11

reasonably foreseeable result of Defendants’ failure to exercise reasonable care in safeguarding

12

and protecting Plaintiffs’ and the other class members’ Personal Information. Defendant knew

13
14

its systems and technologies for processing and securing the Personal Information of Plaintiffs
and the Class had numerous security vulnerabilities.

15
16
17

81.

As a result of this misconduct by Defendants, the Personal Information of

Plaintiffs and the Class were compromised, placing them at a greater risk of identity theft and

18

subjecting them to identity theft, and their Personal Information was disclosed to third parties

19

without their consent.

20

Fourth Claim for Relief
Invasion of Privacy

21
22
23
24
25
26
27

82.

Plaintiffs repeats, reallges, and incorporates by reference the allegations

contained in paragraphs 1 through 39 as through fully stated herein.
83.

Google’s terms and conditions designate California law as the sole applicable

law governing the relationship between Google and its users.
84.

The California Constitution expressly provides for a right to privacy. Cal.

Const. Art. I, Sec. 1.

28

22
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 25 of 28

1
2
3

85.

Google’s terms of use for all times relevant to this matter provided that users’

Personal Information would not be released to third parties without express consent.
86.

Absent their express consent, Plaintiffs and the Class members used Google+

4

under the impression that Personal Information was safeguarded and would not be provided to

5

or stolen by third parties.

6

87.

Plaintiffs and the Class members had an interest in the protection and non-

7

dissemination of the Personal Information that Defendants electronically stored, including the

8

right not to have that Personal Information stolen and used for profit.

9

88.

Absent the express consent of Google+ users, Defendants intentionally intruded

10

on Plaintiffs’ and the Class members’ private life, seclusion, and solitude, protected under the

11

California constitution as well as common law.

12
13

89.

Defendants’ wrongful conduct constitutes breach of the social norms

underpinning the constitutionally-protected right to privacy.

14

90.

Defendants’ wrongful conduct harmed Plaintiffs and the Class members.

15

91.

As a direct and proximate result of Defendants’wrongful conduct, Plaintiff and

16

the Class members have suffered injury and are entitled to appropriate relief, including

17

injunctive relief and damages.

18
19

ADDITIONAL CLAIMS ALLEGED ON BEHALF OF THE CALIFORNIA
SUBCLASS ONLY

20
21
22
23
24

Fifth Claim for Relief
Violation of California’s Customer Records Act – Inadequate Security
(Cal. Civ. Code § 1798.81.5)
92.

Plaintiff Matic repeats, realleges, and incorporates by reference the allegations

contained in paragraphs 1 through 39 as though fully stated herein.

25

93.

Plaintiff Matic brings this claim on behalf of the California Subclass.

26

94.

California Civil Code section 1798.80, et seq., known as the “Customer

27

Records Act” (“CRA”) was enacted to “encourage business that own, license, or maintain

28

23
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 26 of 28

1
2
3

Personal Information about Californians to provide reasonable security for that information.”
Cal. Civ. Code § 1798.81.5(a)(1).
95.

Section 1798.81.5, subdivision (b) of the CRA requires any business that

4

“owns, licenses, or maintains Personal Information about a California resident” to “implement

5

and maintain reasonable security procedures and practices appropriate to the nature of the

6

information,” and “to protect the Personal Information from unauthorized access, destruction,

7

use, modification, or disclosure.” Section 1798.81.5, subdivision (d)(1)(B) defines “Personal
8
9

Information” as including “A username or email address in combination with a password or

10

security question and answer that would permit access to an online account.” “Personal

11

Information” also includes an individual’s first name or first initial in combination with a social

12

security number, driver’s license number, account number or credit or debit card number and

13
14

access code, medical information, or health insurance information. Cal. Civ. Code §
1798.82(h).

15
16
17

96.

Google is a business that owns, licenses, or maintains Personal Information

about California residents. As alleged in detail above, Defendants failed to implement and

18

maintain reasonable security procedures and practices appropriate to the nature of the

19

information, and protect the Personal Information from unauthorized access, destruction, use,

20

modification, or disclosure, resulting in the 2018 Data Leak.

21
22

97.

As the direct and legal result of Defendants’ violation of section 1798.81.5,

Plaintiff Matic and the members of the California subclass were harmed because their Personal

23
24
25

Information was compromised, placing them at a greater risk of identity theft and their Personal
Information disclosed to third parties without their consent. Plaintiff Matic and Class members

26

also suffered diminution in value of their Personal Information in that it is now in the hands of

27

unauthorized third parties who may use that information for their own personal and financial

28

24
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 27 of 28

1
2
3
4
5
6

gain. The California subclass members are further damaged as their Personal Information
remains Defendants’ possession, without adequate protection, and is also in the hands of those
who obtained it without their consent.
98.

Plaintiff Matic and the California subclass seek all remedies available under

Cal. Civ. Code § 1798.84, including, but not limited to damages suffered by Plaintiffs and the
other class members as alleged above and equitable relief.

7

99.

Defendants’ misconduct as alleged herein is fraud under Civil Code §

8
9

3294(c)(3) in that it was deceit or concealment of a material fact known to the Defendant

10

conducted with the intent on the part of Defendant of depriving Plaintiffs and the Class of

11

“legal rights or otherwise causing injury.” In addition, Defendants’ misconduct as alleged

12

herein is malice or oppression under Civil Code § 3294(c)(1) and (2) in that it was despicable

13
14

conduct carried on by Defendant with a willful and conscious disregard of the rights or safety
of Plaintiff and the Class and despicable conduct that has subjected Plaintiff and the Class to

15
16
17

cruel and unjust hardship in conscious disregard of their rights. As a result, Plaintiff and the
Class are entitled to punitive damages against Defendant under Civil Code § 3294(a).
PRAYER FOR RELIEF

18
19
20
21
22

WHEREFORE, Plaintiffs, individually and on behalf of the other Class members,
respectfully request that this Court enter an Order:
(a)

Certifying the United States Class and California Subclass, and appointing

Plaintiffs as Class and Subclass Representatives;

23
24
25
26
27

(b)

Finding that Defendants’ conduct was negligent, deceptive, unfair, and

unlawful as alleged herein;
(c)

Enjoining Defendants from engaging in further negligent, deceptive, unfair, and

unlawful business practices alleged herein;

28

25
Class Action Complaint

 Case 5:18-cv-06164 Document 1 Filed 10/08/18 Page 28 of 28

1
2
3
4
5
6

(d)

Awarding Plaintiffs and the Class members actual, compensatory, and

consequential damages;
(e)

Awarding Plaintiffs and the Class members statutory damages and penalties, as

allowed by law;
(f)

Awarding Plaintiffs and the Class members restitution and disgorgement;

(g)

Requiring Defendants to provide appropriate credit monitoring services to

7

Plaintiffs and the other class members;
8
9
10
11
12
13
14

(h)

Awarding Plaintiffs and the Class members punitive damages;

(i)

Awarding Plaintiffs and the Class members pre-judgment and post-judgment

interest;
(j)

Awarding Plaintiffs and the Class members reasonable attorneys’ fees costs and

expenses, and;
(k)

Granting such other relief as the Court deems just and proper.

15

JURY TRIAL DEMANDED

16
17

Plaintiffs demand a trial by jury of all claims in this Class Action Complaint so triable.

18
19
20
21

Dated: October 8, 2018

/s/ Joshua H. Watson
JOSHUA H. WATSON
Attorney for Plaintiffs

22
23
24
25
26
27
28

26
Class Action Complaint