Cahen v. Toyota Motor Corp.

147 F.Supp.3d 955

Helene Cahen, et al., Plaintiffs,

v.Toyota Motor Corporation, et al., Defendants.

Case No. 15-cv-01104-WHO

United States District Court, N.D. California.

Signed November 25, 2015

Donald H. Slavik, Steamboat, Springs, Matthew Joseph Zevin, Stanley Law Group, San Diego, CA, Marc R. Stanley, Stanley Iola, LLP, Martin Darren Woodward, Stanley Law Group, Dallas, TX, for Plaintiffs.

Christopher Chorba, Gibson, Dunn & Crutcher LLP, Michael Lawrence Mallow, Sidley Austin LLP, Los Angeles, CA, Simone Jones, Johnnet Simone Jones, Livia M. Kiser, Sidley Austin LLP, Chicago, IL, Douglas Warren Sullivan, Crowell & Moring LLP, San Francisco, CA, Cheryl Adams Falvey, Kathleen Taylor Sooy, Rebecca Baden Chaney, Crowell Moring LLP, Washington, DC, for Defendants.

ORDER ON MOTIONS TO DISMISS

WILLIAM H. ORRICK, United States District Judge

INTRODUCTION

Plaintiffs filed this putative class action against defendants Ford Motor Company, General Motors LLC (“GM”), Toyota Motor Corporation and Toyota Motor Sales, U.S.A., Inc. (the latter two collectively as “Toyota”), alleging that defendants have equipped their vehicles with computer technology that is susceptible to being hacked by third parties. They also assert that defendants improperly collect and transmit information about vehicle performance and the geographical location of the cars they sell in violation of plaintiffs' right to privacy.

Plaintiffs have not established specific or general jurisdiction against Ford. Additionally, given the lack of injury flowing from the asserted potential hacking issue, they lack standing to sue the defendants. Their privacy claims are conclusorily pleaded and need more specificity. For these reasons, I GRANT defendants' motions to dismiss with leave to amend.

FACTUAL BACKGROUND

Plaintiffs' First Amended Complaint (“FAC”) identifies three classes of plaintiffs: (1) the “California Class,” consisting of plaintiffs who bring California state law and California constitutional law claims against GM and Toyota in connection with vehicles purchased in California; (2) the “Oregon Class,” consisting of plaintiffs who bring Oregon state law claims against Ford in connection with vehicles purchased in Oregon; and (3) the “Washington Class,” consisting of plaintiffs who bring Washington state law claims against Ford in connection with vehicles purchased in Washington. FAC [Dkt. No. 37]. The central problem alleged is that because the cars' computer systems lack security, basic vehicle functions can be controlled by individuals outside the car, endangering the safety of vehicle occupants. FAC ¶ 2. For example, hacking can result in the loss of driver control over the throttle, brakes, and steering wheel. FAC ¶ 1.

Defendants' vehicles utilize dozens of electronic control units (“ECUs”), which are small computers that control various vehicle operations. FAC ¶ 3. Vehicle safety depends on “near real time” communication between the ECUs. FAC ¶ 28. The ECUs communicate through a controller area network, or “CAN bus,” by sending each other digital messages called “CAN packets.” FAC ¶¶ 3-4. Because “there is no ECU source or authentication, nor any encryption, built into CAN packets,” anyone with physical access to a vehicle can utilize the CAN bus to send malicious CAN packets to the ECUs. FAC ¶ 30. Additionally, defendants' vehicles are equipped with wireless Bluetooth and cell phone integration capabilities that, when activated by the user, make the vehicles susceptible to remote hacking via wirelessly transmitted CAN packets. FAC ¶ 34. Plaintiffs do not allege that any of their vehicles have actually been hacked, or that they are aware of any vehicles that have been hacked outside of controlled environments, but instead allege that hacking is an “imminent eventuality.” FAC ¶ 40. “Any expert will tell you that you can't prevent it; it's just a question of when.” Id .

Plaintiffs assert that defendants have known for a long time that their vehicles can be hacked, and cite numerous research studies and media articles dating back to 2011 that document the electronic security vulnerabilities of defendants' vehicles. FAC ¶¶ 36-40. In one article, for example, a journalist wrote,

“As I drove to the top of the parking lot ramp, the car's engine suddenly shut off, and I started to roll backward....This wasn't some glitch triggered by a defective ignition switch, but rather an orchestrated attack performed wirelessly, from the other side of the parking lot, by a security researcher.”

FAC ¶ 35.

Plaintiffs also allege that despite defendants' knowledge of significant security vulnerabilities, they market their vehicles as safe. FAC ¶¶ 41-48. Toyota's promotional materials claim, for example, that “Toyota's Integrated Safety Management Concept sets the direction for safety technology development and vehicle development, and covers all aspects of driving by integrating individual vehicle safety technologies and systems rather than viewing them as independently functioning units.” FAC ¶ 42. Toyota also claims to be developing “advanced driving support systems where the driver maintains control and the fun-to-drive aspect of controlling a vehicle is not compromised.” FAC ¶ 44. Ford makes similar safety claims, such as, “When you look over the impressive list of collision avoidance and occupant protection features, you'll know how well-equipped Fusion is when it comes to you and your passengers' safety.” FAC ¶ 46. Ford makes the same claim about the Focus, stating, “You don't have to pick and choose when it comes to safety. Focus is well equipped with an impressive list of safety features.” Id . GM says “Quality and safety are at the top of the agenda at GM, as we work on technology improvements in crash avoidance and crashworthiness to augment the post-event benefits of OnStar, like advanced automatic crash notification.” FAC ¶ 47. GM also touts the “vast test capabilities” of its new “Active Safety Testing Area,” which will “increase GM's ability to bring the best new safety technologies to the customer.” FAC ¶ 48.

Plaintiffs further contend that defendants collect owner data, specifically geographic location, driving history, and vehicle performance, from the vehicle computers and then share that data with third parties without securing the transmission. FAC ¶¶ 49-50, 135. Defendants disclose their data collection practices in owners' manuals, online privacy statements, and the terms and conditions of specific feature activations, but drivers cannot opt-out of data collection without disabling the relevant feature. FAC ¶ 50.

This class action has five named plaintiffs. Helene Cahen resides in Berkeley, California. She purchased a Lexus RX 400 H in September 2008 from a Lexus dealer in San Rafael, California. FAC ¶ 12. Lexus vehicles are manufactured and sold by Toyota. FAC ¶ 8. Merrill Nisam lives in Mill Valley, California, and purchased a Chevrolet Volt in March 2013 from a Chevrolet dealer in Novato, California. FAC ¶ 14. Chevrolet vehicles are manufactured and sold by GM. FAC ¶ 8. Kerry Tompulis lives in Beaverton, Oregon, and leased a Ford Escape in August 2014 from a Ford dealer in Tigard, Oregon. FAC ¶ 13. Richard Gibbs and Lucy Langdon purchased a Ford Fusion in 2014 from a Ford dealer in Renton, Washington and, at the time the FAC was filed, resided in Sequim, Washington.¹ FAC ¶ 15.

Plaintiffs bring multiple causes of action which differ for each sub-class. The “California Class,” led by plaintiffs Cahen and Nisam, brings eight causes of action against GM and Toyota: (1) violation of the California's Unfair Competition Law (“UCL”), Cal. Bus. Prof. Code § 17200, et seq . ; (2) violation of California's Consumers Legal Remedies Act (“CLRA”), Cal. Civ. Cod § 1250, et seq .; (3) violation of California's False Advertising Law (“FAL”), Cal. Bus. Prof. Code § 17500, et seq . ; (4) breach of California's Implied Warranty of Merchantability, Cal. Com. Code § 2314 ; (5) breach of contract at California common law; (6) fraud by concealment at California common law; (7) violation of California's Song-Beverly Consumer Warranty Act, Cal. Civ. Code §§ 1791.1 & 1792 ; and (8) invasion of privacy under the California Constitution, Cal. Const. art. I, § 1. FAC ¶¶ 62-138.

The “Oregon Class,” led by plaintiff Tompulis, brings three causes of action against Ford: (1) violation of Oregon's Unlawful Trade Practices Act, Or. Rev. Stat. § 646.605, et seq . ; (2) breach of Oregon's Implied Warranty of Merchantability, Or. Rev. Stat. § 72.3140 ; and (3) fraudulent concealment at Oregon common law. FAC ¶¶ 139-167.

Finally, the “Washington Class,” led by plaintiffs Gibbs and Langdon, brings four causes of action against Ford: (1) violation of Washington's Consumer Protection Act, Rev. Code Wash. Ann. § 19.86.010, et seq . ; (2) breach of Washington's Implied Warranty of Merchantability, Rev. Code Wash. § 62A.2–614 ; (3) breach of contract at Washington common law; and (4) fraudulent concealment at Washington common law. FAC ¶¶ 168-200.

Plaintiffs seek relief in the form of an injunction that enjoins defendants from continuing to market their cars as safe and requires them to establish a recall program and provide free repairs, such as the addition of Trusted Platform Modules. FAC at p. 34-35. They also request costs, fees, and damages, including punitive damages and disgorgement. Id . After the parties briefed defendants' motions to dismiss, I heard argument on November 3, 2015.

LEGAL STANDARD

Federal Rule of Civil Procedure 8(a)(2) requires a complaint to contain “a short and plain statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ. P. 8(a)(2), in order to “give the defendant fair notice of what the claim is and the grounds upon which it rests,” Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (internal quotation marks and alterations omitted).

A motion to dismiss for failure to state a claim under Federal Rule of Civil...