Facebook Isn’t Liable for Account Hack/Hijack–Damner v. Facebook

This is a pro se lawsuit. Damner claims his Facebook account was hacked in April 2020 and the hacker(s) took it over. He notified Facebook but allegedly it never responded. Damner sued Facebook for Stored Communications Act claims and others. The court grants Facebook’s 12(b)(6) motion to dismiss, holding that Facebook isn’t liable for the account hack/hijacking.

ECPA. The 2701 SCA claim fails:

Plaintiff asserts a claim under § 2701(a) based on the allegation that Facebook “intentionally refused to take the necessary steps and dedicate[ ] resources to restore Plaintiff’s account” after it was hacked. Yet Plaintiff has not alleged any access to Plaintiff’s account by Facebook (as opposed to the alleged third-party hacker) that was without authorization.

The 2702 claim fails because “Plaintiff must allege facts establishing that Facebook knowingly divulged the contents of Plaintiff’s communications….no facts are alleged in the FAC that would establish that Facebook knew with substantial certainty that its allegedly insufficient efforts to safeguard Plaintiff’s account or restore access to it would result in Plaintiff’s communications being divulged by a third-party hacker.”

Intrusion into Seclusion.

Plaintiff has pointed to no authority that suggests that failure to take adequate measures to protect against the intentional intrusion of a third party satisfies the first element of a claim for intrusion on seclusion and the Court has found none. Further, Plaintiff cannot base his claim against Facebook on the actions of the third party who allegedly hacked his account because Plaintiff alleges in the FAC that he agreed to the terms of service in the SRR, which releases Facebook from any liability based on the actions of third parties.

Negligence. “Plaintiff’s allegation that Facebook owed him a duty of care to keep his personal information safe is contradicted by the terms of the SRR, which expressly disclaim such a duty.”

Breach of Contract. “the SRR makes clear that Facebook did not promise to safeguard Plaintiff’s private information.” A misrepresentation claim also fails.

Cal. Civil Code 1798.29. This provision only applies to state agencies.

Case citation: Damner v. Facebook, Inc., 2020 WL 7862706 (N.D. Cal. Dec. 31, 2020)