Judge Stanley Blumenfeld, int he Central District of California, dismissed a putative class action against an edtech provider, which alleged improper collection, use, and disclosure of student data in violation of federal and state laws.
Plaintiffs, parents of minor children required to use the defendant’s educational software in public schools, claimed that the company’s products collected extensive student data—including personally identifiable information, educational records, and device usage—and disclosed it to third parties for commercial purposes. They asserted violations of constitutional rights (Fourth and Fourteenth Amendments via 42 U.S.C. § 1983), California’s Invasion of Privacy Act (CIPA), the Comprehensive Computer Data Access and Fraud Act (CDAFA), California’s Unfair Competition Law (UCL), the Tom Bane Act, and common-law privacy and unjust enrichment theories.
Insufficient Specificity in Pleadings
The court found the plaintiffs’ complaint to be overly broad and lacking in specific facts about their own experiences with the defendant’s products. The allegations did not identify which data was collected from the plaintiffs, to whom it was disclosed, or how the alleged conduct caused harm. The court emphasized that litigation cannot be used as a “fishing expedition” for discovery without a factual basis.
No State Action for Constitutional Claims
The court dismissed the § 1983 claims, holding that the edtech provider was not a state actor. The company’s provision of educational services, even as a school contractor, did not meet the legal standard for state action. The court noted that the alleged data collection and disclosure were not attributable to government entities, and the plaintiffs failed to show joint action or entwinement with schools sufficient to convert the company’s conduct into state action.
Failure to State Claims Under California Statutes
The CIPA claims were dismissed due to lack of plausible allegations of real-time interception or eavesdropping.
As alleged, Plaintiffs’ §§ 631 and
632 claims undisputedly require live interception of the confidential communication.
Plaintiffs argue that they plead live interception by alleging that Defendant permits third parties to “intercept student data … in real time through automatic-syncing and data-transmission technologies like APIs.” Dkt. No. 54 at 13 (citing Dkt. No. 33 ¶¶ 92–109). But that is not what their pleading says. The FAC only vaguely references Defendant’s use of APIs without explaining how the technology allows real-time interception in general or how it was used to intercept Plaintiffs’ data in particular. That is not enough to plausibly allege eavesdropping under CIPA, which “refer[s] to a third party secretly listening to a conversation between two other parties.” Thomasson v. GC Servs. Ltd. P’ship, 321 F. App’x 557, 559 (9th Cir. 2008). Learning the content of a communication after it has been sent is not eavesdropping; and Plaintiffs’ allegations, as currently pleaded, merely suggest that third parties gain access to student users’ communications at some point, not that third parties “secretly listen” to the communication as it is being transmitted from the students to Defendant. See Dkt. No. 33 ¶¶ 93, 98, 101–03.
The UCL and CDAFA claims failed because the plaintiffs did not adequately allege economic injury or loss of data value, as required for standing under these statutes. The court cited recent precedent narrowing the scope of data privacy claims based on economic harm.
CDAFA prohibits knowingly accessing and taking, copying, or using computer data without permission and allows plaintiffs who “suffer[ ] damage or loss by reason of a violation” of the statute to seek compensatory damages and injunctive or other equitable relief. Cal. Penal Code §§ 502(c)(2), (e)(1). District courts in the Ninth Circuit are divided as to whether the diminution in value of plaintiffs’ data constitutes “damage or loss” under CDAFA. See, e.g., Shah v. Cap. One Fin. Corp., 768 F. Supp. 3d 1033, 1048 (N.D. Cal. 2025) (dismissing CDAFA claim and explaining that “experienc[ing] a diminution of the value of their private and personal information” would be insufficient to confer standing); Doe v. Cnty. of Santa Clara, No. 23-CV-04411, 2024 WL 3346257, at *9 (N.D. Cal. July 8, 2024) (same); but see Brown v. Google LLC, 685 F. Supp. 3d 909, 940 (N.D. Cal. 2023) (denying motion to dismiss CDAFA claim because “plaintiffs can state an economic injury for their misappropriated data” based on the economic value of their browsing history).
Even assuming that the diminution in value of Plaintiffs’ data may provide a basis for standing, they have not alleged that theory in a nonconclusory fashion. Instead, they allege general facts regarding the market for user data and conclude that by profiting from students’ data generally, Defendant “[has] thus caused students economic injury.” Dkt. No. 33 ¶ 247. Because these allegations do not explain what valuable data Defendant obtained from Plaintiffs or how Defendant’s use of the data causes its value to Plaintiffs to diminish, the FAC fails to allege standing under CDAFA. See Lineberry v. AddShopper, Inc., No. 23-CV-01996, 2025 WL 551864, at *2 (N.D. Cal. Feb. 19, 2025) (dismissing CDAFA claim where plaintiffs did not “articulate [their] theory of loss in a concrete way” because the complaint did not “provide any allegations about how or why” the “plaintiffs suffer[ed] an economic loss every time their data is used and shared”). The CDAFA claim is therefore dismissed.
No Coercion or Threats Under the Bane Act
The Bane Act claim was rejected because the alleged coercion stemmed from school policies, not the company’s conduct. The court clarified that the company was not responsible for compulsory attendance laws or the requirement to use its products.
Common-Law Privacy and Unjust Enrichment
The court dismissed the common-law privacy claims, finding insufficient detail about what private facts were disclosed or how the conduct was offensive. The unjust enrichment claim was dismissed because California law does not recognize it as an independent cause of action absent a quasi-contract theory, which was not alleged.
While the court dismissed all claims, it granted the plaintiffs leave to amend most of them, except for the constitutional claims under § 1983, which were dismissed without leave to amend.
Hernandez-Silva v. Instructure, Inc., No. 2:25-CV-02711-SB-MAA, 2025 WL 2233210 (C.D. Cal. Aug. 4, 2025).
