## Facts

- LinkedIn operated a professional networking website offering free accounts and paid “premium” subscriptions.
- Users agreed to LinkedIn’s User Agreement and Privacy Policy during registration.
- LinkedIn’s Privacy Policy stated that user information would be protected with “industry standard protocols and technology” and that access was password-protected; it also stated that sensitive data such as credit card information was protected by SSL encryption in transit.
- In 2012, hackers accessed LinkedIn systems and posted about 6.5 million passwords with associated email addresses online; LinkedIn later strengthened password encryption.
- Plaintiffs were premium subscribers who alleged LinkedIn’s pre-breach security was not “industry standard” and that they suffered economic harm because they allegedly paid, in part, for data security they did not receive.
- Plaintiffs alleged no identity theft, unauthorized charges, or other misuse of their data, and did not allege they read the privacy-policy statements before purchasing premium subscriptions.

## Issues

1. Whether plaintiffs plausibly alleged an injury-in-fact, including Article III standing, based on an overpayment or “benefit-of-the-bargain” theory without consequential misuse of data.
2. Whether claims under California consumer-protection and related theories were adequately pled without allegations that plaintiffs saw and relied on the specific security statements.
3. Whether plaintiffs stated a non-speculative, measurable economic loss tied to premium subscription pricing and the challenged security representations.

## Decision

- The court granted LinkedIn’s Rule 12(b)(6) motion and dismissed the first amended consolidated complaint in full.
- The court held plaintiffs did not plead a cognizable, non-speculative economic injury; allegations amounted to conclusory assertions of overpayment based on the breach itself.
- The court held plaintiffs failed to plead reliance because they did not allege they read, encountered, or were influenced by the asserted privacy-policy security statements when purchasing premium subscriptions.
- The court concluded the overpayment theory was inadequately supported because the complaint did not plausibly allege that premium subscribers paid for enhanced security distinct from security provided to nonpaying users.
- Dismissal was with leave to amend.

## Legal Principles

- A data-breach allegation, without facts showing concrete financial harm or other measurable loss, does not by itself establish a cognizable injury for standing and damages-based claims.
- An overpayment or “benefit-of-the-bargain” theory must be supported by factual allegations showing a price premium tied to the challenged representation and a plausible method to measure loss.
- Under California consumer-protection theories grounded in misrepresentation, plaintiffs generally must plead that they were exposed to and actually relied on the alleged misstatement as an immediate cause of their loss.
- Alleging breach of stated security practices, without plausible allegations of resulting measurable damages, is insufficient to state claims seeking monetary relief.

## Conclusion

The court dismissed premium users’ privacy and consumer claims arising from a LinkedIn password breach because the complaint did not plausibly allege non-speculative economic loss or actual reliance on LinkedIn’s security statements, while allowing plaintiffs an opportunity to amend to cure those deficiencies.


In re LinkedIn User Privacy Litig., 932 F. Supp. 2d 1089 (N.D. Cal. 2013)