Cherkin v. PowerSchool Holdings, Inc.

JAMES DONATO United States District Judge

ORDER RE DISMISSAL

JAMES DONATO United States District Judge

Plaintiffs Emily Cherkin, David Concepcion, and their minor children, have sued defendant PowerSchool Holdings, Inc. (PowerSchool), on behalf of themselves and putative nationwide and California-only classes of parents and public-school students, in connection with the collection, storage, and use of children's information. PowerSchool provides to public school districts a suite of educational products, programs, and software for use by students and teachers. See, e.g., Dkt. No. 1 ¶¶ 13, 15-16, 33. Plaintiffs say that PowerSchool harvests data about students and uses it commercially, all without the consent or knowledge of the students' parents or guardians. See generally Dkt. No. 1.

The complaint alleges a panoply of privacy-based claims: intrusion upon seclusion under California common law (Count I); deceit under Cal. Civ. Code §§ 1709-10 (Count II); violations of the California Invasion of Privacy Act (CIPA), Cal. Pen. Code §§ 630 et seq. (Count III); violations of the California Unfair Competition Law (UCL), Cal. Bus. & Prof. Code §§ 17200 et seq. (Count IV); violations of California's Comprehensive Data Access and Fraud Act (CDAFA), Cal. Pen. Code § 502 (Count V); invasion of privacy under the California Constitution, Cal. Const. Art. I, § 1 (Count VI); statutory larceny, Cal. Pen. Code § 496 (Count VII); and unjust enrichment (Count VIII). Dkt. No. 1 ¶¶ 442-566. PowerSchool asks dismiss the complaint in its entirety on various grounds, Dkt. No. 37, which plaintiffs oppose, Dkt. No. 42. The parties' familiarity with the record is assumed. The complaint is dismissed in part with leave to amend.

LEGAL STANDARDS

The standards governing PowerSchool's motion to dismiss are well-established. See McDonald v. Kiloo ApS, 385 F.Supp.3d 1022, 1030 (N.D. Cal. 2019). A plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 556). Although the plaintiffs' allegations are accepted as true and all reasonable inferences drawn in their favor, the Court need not “accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quotation omitted). “The plausibility analysis is ‘contextspecific' and not only invites, but ‘requires the reviewing court to draw on its judicial experience and common sense.'” Cannara v. Nemeth, 467 F.Supp.3d 877, 882 (N.D. Cal. 2020) (quoting Iqbal, 556 U.S. at 679), aff'd by 21 F.4th 1169 (9th Cir. 2021).

With respect to the state-law claims challenged by PowerSchool, the Court's “duty . . . is to ascertain and apply the existing California law.” Carvalho v. Equifax Info. Servs., LLC, 629 F.3d 876, 889 (9th Cir. 2010) (quoting Munson v. Del Taco, Inc., 522 F.3d 997, 1002 (9th Cir. 2008) (per curiam)). “In the absence of definitive pronouncements from the Supreme Court of California, ‘we follow decisions of the California Court of Appeals unless there is convincing evidence that the California Supreme Court would hold otherwise.'” Cao v. Bank of America, N.A., No. 24-cv-01195-JD, 2025 WL 660248, at *1 (N.D. Cal. Feb. 28, 2025) (quoting Carvalho, 629 F.3d at 889).

DISCUSSION

I. INTRUSION UPON SECLUSION & INVASION OF PRIVACY

Common law intrusion upon seclusion and invasion of privacy, pursuant to Article 1, section 1 of the California Constitution, are “distinct claims with different elements.” Heeger v. Facebook, Inc., No. 18-cv-06399-JD, 2019 WL 7282477, at *3 (N.D. Cal. Dec. 27, 2019). The Court has previously observed, though, that “[w]hen brought together on the same factual basis . . . ‘it is appropriate to assess the two claims together and examine “the largely parallel elements” of these two claims which call on the Court to consider “(1) the nature of any intrusion upon reasonable expectations of privacy, and (2) the offensiveness or seriousness of the intrusion, including any justification and other relevant interests.”'” Id. (quoting McDonald, 385 F.Supp.3d at 1031-37). The parties' motion papers also treat the claims as identical for present purposes.

The Supreme Court of California has emphasized the “context specific nature of the inquiry” for these claims. Id. (citing Hill v. Nat'l Collegiate Athletic Ass'n, 7 Cal.4th 1, 31, 36 (1994)). It has stated that “privacy interests and accompanying legal standards are best viewed flexibly and in context” and that “[a] plaintiff's expectation of privacy in a specific context must be objectively reasonable under the circumstances, especially in light of the competing social interests involved.” Hill, 7 Cal.4th at 26-27, 31. For the offensiveness or seriousness of the intrusion on privacy, “California tort law provides no bright line,” and “each case must be taken on its facts.” Shulman v. Grp. W. Prods., Inc., 18 Cal.4th 200, 237 (1998).

The complaint plausibly alleges that PowerSchool, via its various applications and software used by public-school students on- or off-campus as part of their curriculum, and by their teachers, collects data about students. This data includes, among other items, student enrollment information; grades, evaluations, and coursework materials; personal demographic information; “conduct data,” “behavior data,” and “social-emotional learning indicators and inputs”; certain health records; and college and career interests, applications, and assessments. See, e.g., Dkt. No. 1 ¶¶ 40, 61, 93-96, 228-31. The complaint also alleges plausibly that, when students access PowerSchool apps and websites on personal devices, PowerSchool harvests “user-device information” and embeds “tracking technologies” on the device that allow it to “track [the student] across the internet for purpose of collecting data about them,” even after they have navigated away from PowerSchool's application or website. Id. ¶¶ 40, 282-89.

Plaintiffs say that this data is not collected for idle purposes. PowerSchool is said to analyze, package, and sell it to third parties, and use it to improve its own products and technologies. See id. ¶¶ 57-58, 61, 64-69, 82-92, 102-34. Plaintiffs emphasize, plausibly, that all this allegedly happens in connection with public-school children without their parents' or guardians' knowledge or consent. See, e.g., id. ¶¶ 3, 5, 136, 148-65, 222, 254-60, 388-93.

Overall, these well-pleaded allegations, and others in the complaint, plausibly allege that the PowerSchool is misappropriating sensitive information about students, including their identities, academics, health, behavior, and web-browsing habits, in which students have an objectively reasonable expectation of privacy. The privacy interest is expressly recognized in federal and California state law. The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, was passed by Congress to “assure parents of students . . . access to their educational records and to protect such individuals' rights to privacy by limiting the transferability of their records without their consent.” Frazier v. Fairhaven Sch. Comm., 276 F.3d 52, 67-68 (1st Cir. 2002) (omission in original) (quoting 120 Cong. Rec. 39,862 (1974) (joint statement of Sens. Pell and Buckley)); see United States v. Miami Univ., 294 F.3d 797, 806 (6th Cir. 2002) (“For the last quarter of a century, the FERPA has helped protect the privacy interests of students and their parents.”). And California Education Code § 49076, which prohibits the accessing of “pupil records” absent parental consent or a judicial order, similarly recognizes students' privacy interests in such information, for it was “a statutory response to” FERPA and “adopted . . . to eliminate potential conflicts between FERPA and state law.” BRV, Inc. v. Superior Court, 143 Cal.App.4th 742, 751-52 (2006).

The allegations also plausibly establish that PowerSchool's collection and commercial exploitation of this information is a sufficiently offensive intrusion upon reasonable expectations of privacy to state claims at common law and under the California Constitution. The complaint amply alleges that PowerSchool collects, for its own commercial benefit, data about public-school kids from information that the students share as part of their legally required education. See, e.g., Cal. Educ. Code § 48200; Rev. Code of Wash. § 28A.225.010. Doing so without parental notice or consent, as is alleged, plausibly describes conduct that is “highly offensive to a reasonable person and . . . constitutes an egregious breach of the social norms.” Hernandez v. Hillside, Inc., 47 Cal.4th 272, 295 (2009) (cleaned up). There is little doubt that, for purposes of a Rule 12(b)(6) motion to dismiss, a private company's videotaping of students at school to collect similar information in kind and quantity for profit would be highly offensive to the reasonable person. See White v. Davis, 13 Cal.3d 757, 773-76 (1975) (finding a prima facie violation of the right to privacy where the government was surveilling students and faculty in classrooms at a university); Hill, 7 Cal.4th at 43 (deeming “particularly intrusive monitored urination procedures” for college athlete drug testing a sufficiently serious privacy invasion). The Court sees no basis for concluding that invasion is any less egregious because students are themselves producing the relevant information by using a pedagogical tool for their public education when it is alleged that neither they nor their parents or guardians had notice. See McDonald, 385 F.Supp.3d at 1034 (expressing skepticism at “the propriety of terminating privacy claims at the motion to dismiss stage”).

PowerSchool nonetheless challenges the sufficiency of the complaint's allegations on two narrow grounds. To start, PowerSchool says the complaint is deficient because it did not allege “a reasonable expectation of privacy vis-a-vis [the students'] schools and their schools' contractor with respect to the information they knowingly provide their own schools.” Dkt. No. 37 at 6. Specifically, with respect to information like students' grades, memberships in extracurriculars, demographics, and disciplinary and behavioral information, PowerSchool argues it is acceptable for schools to keep these sorts of record. Id. at 6-7. That the collection of these types of records is done by a private party is, in PowerSchool's view, of no moment because state and federal law permit schools to disclose students' personal information without prior consent to contractors or consultants to whom the school has outsourced “institutional services or functions” under certain circumstances. See id. at 6-7 (citing 34 C.F.R. §§ 99.31(a)(1)(i)(B); Cal. Educ. Code § 49073.1).

The point is not well taken. “The extent of [a privacy] interest is not independent of the circumstances.” Hill, 7 Cal.4th at 36 (alteration in original) (quoting Plante v. Gonzalez, 575 F.2d 1119, 1135 (5th Cir. 1978)). Further, “privacy, for purposes of the intrusion tort, is not a binary, all-or-nothing characteristic....The mere fact that a person can be seen by someone does not automatically mean that he or she can legally be forced to be subject to being seen by everyone.” Sanders v. Am. Broad. Cos., Inc., 20 Cal.4th 907, 915-16 (1999) (citation omitted). When students voluntarily give information to give their schools, such as by submitting vaccination records at the beginning of a school year or a pop quiz during class, they have a reasonable expectation of privacy with respect to how that information will be used for bona fide educational purposes, and by whom. See, e.g., 20 U.S.C. § 1232g(b) (limiting the categories of persons to whom student education records may be disclosed without prior consent); 34 C.F.R. § 99.31(a)(1)(i)(A) (permitting disclosure to “other school officials . . . whom the agency or institution has determined to have legitimate educational interests” (emphasis added)); Ragusa v. Malverne Union Free Sch. Dist., 549 F.Supp.2d 288, 291-92 (E.D.N.Y. 2008) (explaining that “a party seeking disclosure of education records protected by FERPA bears ‘a significantly heavier burden . . . to justify disclosure than exists with respect to discovery of other kinds of information” and collecting cases (citation omitted)); Krebs v. Rutgers, 797 F.Supp. 1246, 1258-59 (D.N.J. 1992) (permitting FERPA-based § 1983 claims to proceed where a university identification-card policy required students to disclose certain personal information to persons without a “legitimate educational interest,” like post-office personnel).

It also bears mention that, with the ever-rapid progression of technology and data processing, courts in various contexts have acknowledged the heightened privacy interests implicated by “the aggregation of data over time to create detailed profile[s]” about individuals. Lau v. Gen Digital Inc., No. 22-cv-08981-RFL, 2024 WL 1880161, at *3 n.2 (N.D. Cal. Apr. 3, 2024); see also, e.g., Carpenter v. United States, 585 U.S. 296, 314 (2018); In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598-99 (9th Cir. 2020); Katz-Lacabe v. Oracle Am., Inc., 668 F.Supp.3d 928, 942 (N.D. Cal. 2023). Insofar as PowerSchool disputes plaintiffs' characterization of what it does with students' data, see Dkt. No. 37 at 4 n.6, 4-5, 7 n.7, that is neither here nor there for purposes of testing the sufficiency of the allegations.

PowerSchool next challenges the allegations about the offensiveness of the privacy intrusion only with respect to what it calls “passively collected technical data,” Dkt. No. 37 at 7-8, which refers to the allegations about user-device information and information gleaned by tracking technology allegedly embedded in PowerSchool's applications and websites, Dkt. No. 1 ¶¶ 40, 282-89. This sort of data collection, PowerSchool says, cannot be considered an egregious breach of the social norms because the collection of this type of data is ubiquitous, expected, and was adequately disclosed by PowerSchool. Dkt. No. 37 at 8. This argument, too, is not a roadblock to plaintiffs' intrusion-upon-seclusion and constitutional privacy claims.

The Ninth Circuit has determined that allegations of “surreptitious data collection when individuals were not using [the relevant website] are sufficient to survive a dismissal motion on the issue.” In re Facebook Internet Tracking Litig., 956 F.3d at 606. PowerSchool has not asserted any basis for concluding otherwise where, as here, the complaint alleges such tracking of public-school children. The cases to which PowerSchool points, see Dkt. No. 37 at 8, do not concern a private company, contracted by public schools to furnish pedagogical tools, allegedly surreptitiously tracking students' devices and internet usage by applications and websites that those students use for educational purposes as part of their curriculum. The Supreme Court of California has repeatedly admonished that “each case must be taken on its facts,” Shulman, 18 Cal.4th at 237, and that privacy interests must be “viewed . . . in context,” Hill, 7 Cal.4th at 31. Consequently, because of the fact-bound nature of the inquiry, “[t]he Court cannot say that the answers are so patently obvious that plaintiffs' allegations are implausible or inadequate as a matter of law.” McDonald, 385 F.Supp.3d at 1035.

II. DECEIT UNDER CAL. CIV. CODE §§ 1709-10

Count II of the complaint, alleging deceit under Cal. Civ. Code §§ 1709-10, is dismissed with leave to amend. Section 1709 provides that “[o]ne who willfully deceives another with intent to induce him to alter his position to his injury or risk, is liable for any damage which he thereby suffers.” “The elements of fraud, which give rise to the tort action for deceit, are (a) misrepresentation . . .; (b) knowledge of falsity (or ‘scienter'); (c) intent to defraud, i.e., to induce reliance; (d) justifiable reliance; and (e) resulting damage.” Lazar v. Superior Court, 12 Cal.4th 631, 638 (1996) (citation omitted). Because this claim sounds in fraud, the allegations “are subject to Rule 9(b)'s heightened pleading standard,” which requires that “[a]verments of fraud . . . be accompanied by ‘the who, what, when, where, and how' of the misconduct charged.” Kearns v. Ford Motor Co., 567 F.3d 1120, 1124 (9th Cir. 2009) (citations omitted).

Despite discussing the opacity of the privacy representations, see Dkt. No. 1 ¶¶ 137-72, the complaint does not allege, nor is it reasonable to infer from its allegations, that plaintiffs actually read PowerSchool's privacy representations. Consequently, the complaint cannot, and in fact does not, allege that plaintiffs relied on those representations. Just as the plaintiff in Kearns failed to “specify when he was exposed to [the representations] or which ones he found material,” plaintiffs here “fail[] to articulate the who, what, when, where, and how of the misconduct alleged.” 567 F.3d at 1126. Plaintiffs' reliance on Occidental Land, Inc. v. Superior Court is misplaced, for it dealt with the propriety of class certification and the record contained both allegations and evidence of the misrepresentations to which the plaintiffs were exposed. 18 Cal.3d 355, 360-63 (1976).

III. CIPA

Plaintiffs' CIPA claim will go forward. CIPA “prohibits any person from using electronic means to ‘learn the contents or meaning' of any ‘communication' ‘without consent' or in an ‘unauthorized manner.'” In re Facebook Internet Tracking Litig., 956 F.3d at 607 (quoting Cal. Pen. Code § 631(a)). The complaint alleges that PowerSchool “enables many other companies to intercept data collected by PowerSchool in real time through automatic-syncing and data-transmission technologies like plug-ins, software development kits (SDKs), and application programming interfaces (APIs)” and that these interceptions are used by those third parties for purposes other than PowerSchool's own use of the data. Dkt. No. 42 at 6; Dkt. No. 1 ¶¶ 106, 119122, 129, 130-31, 233. These allegations state a plausible claim under CIPA. See, e.g., Gibson v. Planned Parenthood Fed. of Am., Inc., No. 23-cv-04529-JD, 2024 WL 4251892, at *2 (N.D. Cal. July 2, 2024).

IV. UCL

Count IV of the complaint is dismissed with leave to amend. California law provides that only one “who has suffered injury in fact and has lost money or property as a result of the unfair competition” may bring suit under the UCL. Cal. Bus. & Prof. Code § 17204. In other words, a plaintiff must show she suffered an economic injury, or an injury to money or property, before she may proceed with claims under the UCL. The complaint does not plausibly allege that element. At first blush, the taking and use of an individual's personal information without consent is not in any obvious way itself a loss of, or injury to, that individual's money or property. Yet, relying on decisions from other courts in this District, plaintiffs advance what are essentially two theories for how their allegations plausibly allege injury to money or property. See Dkt. No. 42 at 8.

First, even if plaintiffs adequately alleged a market for the student data PowerSchool is allegedly appropriating, see, e.g., Dkt. No. 1 ¶¶ 19-24, 43, 60, 357, there is no non-speculative basis in the complaint for thinking plaintiffs can or would transact with the personal information at issue, such as their exam scores or behavioral assessments, in that market. See Moore v. Centrelake Med. Grp., Inc., 83 Cal.App. 5th 515, 538-39 (2022). It is reasonable to infer that plaintiffs would choose not to transact in that market. Dkt. No. 1 ¶ 321 (alleging that the “datafication of a child and their learning process, for commercial purposes, . . . [is] profoundly un-American”). Consequently, plaintiffs have not plausibly pled an economic injury by virtue of their inability to transact in the data market or a diminution in the value of their personal data because of PowerSchool's actions. Nor does the “benefit of the bargain” theory carry the day, Dkt. No. 1 ¶¶ 363-64; Dkt. No. 42 at 8, as it is not clear what was the transaction into which plaintiffs think that they entered with PowerSchool or were the terms of that transaction, especially where plaintiffs have not alleged that they read or relied on PowerSchool's privacy representations. See Moore, 83 Cal.App. 5th at 527 (“[A]ppellants alleged they relied on Centrelake's false representations and promises concerning data security in entering contracts . . . paying more than they would have had they known the truth.”).

V. CDAFA

Plaintiffs may also proceed with their claims under CDAFA. The statute provides a private cause of action to any “owner or lessee of [a] computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of” CDAFA. Cal. Pen. Code § 502(e)(1). The statute prohibits various actions an individual can take as to another's data, computer, or computer network, but the statute proscribes all such actions only when undertaken “[k]nowingly and without permission.” Cal. Pen. Code § 502(c)(1)-(14). PowerSchool challenges the complaint's sufficiency on the grounds that plaintiffs failed to adequately plead (1) “damage or loss” within the meaning of CDAFA and (2) that the alleged tampering was done “without permission.” Dkt. No. 37 at 11-12.

On the first point, PowerSchool rehashes its UCL argument, namely that the complaint has not plausibly alleged an economic injury. See id. at 11. The result is different here. In a case alleging the surreptitious collection and use of women's highly sensitive health information, the Court rejected an identical argument. See Frasco v. Flo Health, Inc., No. 21-cv-00757-JD, 2024 WL 4280933, at *2-3 (N.D. Cal. Sept. 23, 2024). There the Court noted that, unlike the text of the UCL, the plain language of CDAFA's “damage or loss” requirement contains no such limitation. Id. at *3. The Court also acknowledged the California legislature's express finding, which motivated CDAFA's enactment, that “protection of . . . lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals.” Id. (omission in original) (quoting Cal. Pen. Code § 502(a)). PowerSchool neither cites any binding authority nor engages with the statutory text for its position. There is no good reason why the conclusion in Flo Health should not apply here, where plaintiffs have adequately pled their privacy claims.

PowerSchool's second argument is premised solely on a particular interpretation of the statutory language “without permission.” Dkt. No. 37 at 11-12. PowerSchool is of the view that “without permission” must be narrowly construed such that liability only attaches where the alleged offender accessed the computer or computer network “in a manner that overcomes technical or code-based barriers.” Id. at 12 (quoting In re Facebook Privacy Litig., 791 F.Supp.2d 705, 715-16 (N.D. Cal. 2011)). Ninth Circuit precedent makes clear that is not necessary to constitute a violation of CDAFA. See United States v. Christensen, 828 F.3d 763, 789-90 (9th Cir. 2015) (noting that “[s]tate case law is yet undeveloped on this issue” and affirming a conviction under CDAFA where the evidence supportably showed a defendant “logg[ed] into a database with a valid password” and used “information in the database improperly”). PowerSchool has not advanced any other basis for questioning the sufficiency of the complaint for this claim.

VI. STATUTORY LARCENY

The claim of statutory larceny is dismissed with leave to amend because the complaint fails to plausibly allege that any “property” was taken by PowerSchool. California Penal Code § 484 defines theft while § 496 prohibits the obtaining of property “in any manner constituting theft.” Cal. Pen. Code § 496(a). The statute confers a private cause of action, referred to herein as larceny, to those “injured by a violation of subdivision (a).” Id. § 496(c). Under California law, “property” must be (1) “an interest capable of precise definition”; (2) “capable of exclusive possession or control”; and (3) “the putative owner must have established a legitimate claim to exclusivity.” G.S. Rasmussen & Assocs., Inc. v. Kalitta Flying Serv., Inc., 958 F.2d 896, 903 (9th Cir. 1992). The complaint does not allege that any of the information collected and used by PowerSchool, whether it be student grades or coursework or students' mouse clicks, is capable of exclusive possession, nor is that a reasonable inference to draw from these allegations.

Plaintiffs point to two federal district court cases and contend there is a “growing trend across courts” of recognizing that the taking of personal information can suffice to allege the deprivation of a property interest. Dkt. No. 42 at 12. Even assuming that the reasoning of those rulings correctly reflects California law, their grounds for so concluding find no support in the complaint. In both cases to which plaintiffs cite, the courts' conclusions that the plaintiffs there had plausibly pled the deprivation of a property interest were based on their review of decisions recognizing the “lost value” of the particular information at issue to those litigants. See Calhoun v. Google LLC, 526 F.Supp.3d 605, 635 (N.D. Cal. 2021) (collecting cases); Griffith v. TikTok, Inc., 697 F.Supp.3d 963, 975-76 (C.D. Cal. 2023) (discussing Calhoun). As plaintiffs recognize, see Dkt. No. 42 at 11:4-5, the conclusions that a deprivation of a property right had occurred were premised on the same basis for concluding that the collection of personal data can constitute an injury to money or property for purposes of the UCL. Because that argument did not fly under the UCL, it cannot sustain the larceny claim. Dkt. No. 42 at 11:4-8, 12:6-11; see Moore, 83 Cal.App. 5th at 539-41, 541 n.13.

VII. UNJUST ENRICHMENT

The claim for unjust enrichment will go forward. PowerSchool says that the standalone unjust-enrichment claim must be dismissed on the ground that it is a remedy, not an independent cause of action. Dkt. No. 37 at 13. For a long time, “California's case law on whether unjust enrichment could be sustained as a standalone cause of action was uncertain and inconsistent.” Bruton v. Gerber Prods. Co., 703 Fed. App'x 468, 470 (9th Cir. 2017) (unpublished). However, “[w]hen a plaintiff alleges unjust enrichment, a court may ‘construe the cause of action as a quasicontract claim seeking restitution.'” Astiana v. Hain Celestrial Grp., Inc., 783 F.3d 753, 762 (9th Cir. 2015) (quoting Rutherford Holdings, LLC v. Plaza Del Rey, 223 Cal.App.4th 221, 231 (2014)). Following a decision by the Supreme Court of California “allowing an independent claim for unjust enrichment to proceed in an insurance dispute,” the Ninth Circuit, in unpublished decisions, has twice recognized such standalone claims may be viable under California law. Bruton, 703 Fed. App'x at 470; see Chong v. Nestle Water N.A., Inc., No. 20-56373, 2021 WL 4938128, at *1 (9th Cir. Oct. 22, 2021) (unpublished).

“To allege unjust enrichment as an independent cause of action, a plaintiff must show that the defendant received and unjustly retained a benefit at the plaintiff's expense.” ESG Capital Partners, LP v. Stratos, 828 F.3d 1023, 1038-39 (9th Cir. 2016). Because PowerSchool does not challenge the substance of the unjust-enrichment claim, and plaintiffs have plausibly alleged severe intrusions on public-school students' privacy, “the claim may proceed at this stage, subject to being folded into other substantive claims upon being further refined.” Effinger v. Ancient Organics LLC, 657 F.Supp.3d 1290, 1302 (N.D. Cal. 2023).

VIII. NON-CALIFORNIA RESIDENTS

Plaintiffs Cherkin and her minor child, S.G., are residents of the state of Washington, Dkt. No. 1 ¶¶ 13-14, and seek to bring claims under California state law on behalf of themselves and nationwide classes of parents and students, id. ¶¶ 413-21. PowerSchool asks to dismiss all claims brought under California law by Cherkin and S.G. on the grounds that California law does not apply extra territorially and other states' interests outweigh California's interest in having its law applied to the alleged nationwide classes. Dkt. No. 37 at 13-15.

The challenge is premature and may be raised again at the class-certification stage as the record and circumstances warrant. See Milan v. Clif Bar & Co., 489 F.Supp.3d 1004, 1008 (N.D. Cal. 2020) (“The choice-of-law issue is best resolved in this case at the class certification stage.”).

CONCLUSION

Counts II, IV, and VII are dismissed with leave to amend. The complaint took a kitchen sink approach that unduly complicates plaintiffs' core privacy claims, but the remaining claims are plausibly alleged and will go forward. Plaintiffs may file an amended complaint consistent with this order by April 4, 2025. No new parties or claims may be added without the Court's prior consent. Failure to meet the filing deadline will result in dismissal of the amended claims pursuant to Federal Rule of Civil Procedure 41(b).

IT IS SO ORDERED.