## Facts

- I.C., a minor acting through a guardian, sued Zynga Inc. in a putative nationwide class action after a reported data breach involving Zynga game users.
- Zynga operates free-to-play games and monetizes in part through collecting and using user data.
- Zynga disclosed that a hacker allegedly accessed its systems and exfiltrated personal information associated with millions of user accounts.
- The amended complaint alleged compromised data included names, usernames and passwords, email addresses, phone numbers, and dates of birth.
- The plaintiff alleged injury based on (1) privacy harms comparable to intrusion upon seclusion and public disclosure of private facts and (2) increased risk of identity theft and related consequences (phishing, account monitoring, password changes, emotional distress, and unsolicited communications).
- Zynga moved to dismiss under Rule 12(b)(1) for lack of Article III standing, arguing the complaint alleged no concrete injury.

## Issues

1. Whether unauthorized access to and exfiltration of personal data, without alleged widespread dissemination or specific misuse, constitutes a concrete injury analogous to traditionally recognized privacy torts sufficient for Article III standing.
2. Whether allegations of future identity-theft risk and related mitigation efforts, anxiety, and unsolicited communications constitute concrete injury under Article III after *Spokeo* and *TransUnion*.

## Decision

- The court granted Zynga’s Rule 12(b)(1) motion and dismissed the action for lack of Article III standing.
- The court held the alleged privacy-tort analogues were not sufficiently close to traditional harms because the complaint did not plausibly allege publicity akin to public disclosure of private facts or a highly offensive intrusion akin to intrusion upon seclusion.
- The court held the alleged risk of future identity theft was too speculative and insufficiently imminent and substantial, and the claimed mitigation costs and emotional distress were self-imposed responses to a hypothetical future harm.
- The court concluded unsolicited communications were not tied with adequate specificity to the breach to constitute a concrete injury.
- The dismissal was without further leave to amend, and the case was closed.

## Legal Principles

- Article III standing requires a concrete, particularized injury in fact that is actual or imminent; statutory violations alone do not establish concreteness.
- Concreteness may be assessed by asking whether the alleged harm bears a close relationship to harms traditionally recognized as bases for suit in American courts.
- For privacy-tort analogies:
  - Public disclosure of private facts generally requires disclosure to the public at large (or to a level making public knowledge substantially certain), not merely unauthorized access by a third party.
  - Intrusion upon seclusion generally requires an intentional, highly offensive intrusion into private seclusion; voluntary provision of information to a service provider may undermine an asserted parallel absent allegations of an offensive intrusion comparable to the tort.
- Under *TransUnion*, risk of future harm alone generally does not support standing for damages, and plaintiffs cannot create standing through self-inflicted costs taken to mitigate feared, hypothetical harm.
- Alleged downstream effects (e.g., spam/phishing) must be plausibly traceable to the specific breach rather than general background internet conditions.

## Conclusion

The court dismissed the data-breach class action for lack of Article III standing because the complaint did not plausibly allege a concrete privacy injury comparable to traditional torts, actual misuse of the plaintiff’s data, or an imminent and substantial risk of misuse; mitigation efforts, distress, and generalized unsolicited communications were insufficient to supply concreteness.


I.C. v. Zynga Inc., 600 F. Supp. 3d 1034 (N.D. Cal. 2022)