Wozniak v. Youtube

319 Cal.Rptr.3d 597

100 Cal.App.5th 893

Steve WOZNIAK et al., Plaintiffs and Appellants,

v.YOUTUBE, LLC et al., Defendants and Respondents.

H050042

Court of Appeal, Sixth District.

Filed March 15, 2024

As Modified on Denial of Rehearing April 2, 2024

Trial Court: Santa Clara County Superior Court No.: 20CV370338, Trial Judge: The Honorable Sunil R. Kulkarni (Santa Clara County Super. Ct. No. 20CV370338)

Attorneys for Plaintiffs and Appellants Steve Wozniak et al.: Joseph W. Cotchett, Burlingame, Brian Danitz, Burlingame, Christopher Owen Holleran, Julia Qisi Peng, Andrew F. Kirtley, Gia Jung, San Francisco

Attorneys for Defendants and Respondents YouTube, LLC et al.: David H. Kramer, Palo Alto, Amit Q. Gressel, San Francisco, Carmen Sobczak, San Francisco, Mark R Yohalem, Los Angeles, Ariel

C. Green Anaba, Los Angeles

Wilson, J.

This lawsuit stems from a common cryptocurrency scam perpetrated on YouTube: popular channels are hijacked to show fake videos depicting a tech celebrity hosting a live event, during which anyone who sends cryptocurrency to a specified account will receive twice as much in return. Users who send their cryptocurrency in response actually receive nothing in return.

Plaintiffs are Steve Wozniak—whose name and likeness were used in the fake videos—and 17 individuals who fell victim to the scam and lost varying amounts of cryptocurrency. They sued YouTube and Google (defendants), asserting nine causes of action alleging that defendants have been knowingly hosting, promoting, and profiting from the scam for years.

The trial court sustained defendants’ demurrer on the ground that plaintiffs’ claims are barred by the Communications Decency Act of 1996, 47 U.S.C. § 230 (section 230), which generally provides immunity to interactive computer services that a plaintiff seeks to treat as a publisher or speaker of information provided by another content provider.

On appeal, plaintiffs argue their claims are not subject to section 230 immunity because they do not seek to treat defendants as a publisher or speaker of third-party content, but instead seek to hold them liable for engaging in actions they knew would further criminal activity, thereby materially contributing to its illegality.

We hold that most of plaintiffs’ claims seek to treat defendants as a publisher or speaker of third-party content and are therefore precluded by section 230. However, we also conclude that one of plaintiffs’ claims—that defendants created their own content and materially contributed to the unlawfulness of the scam by proriding verification badges to hijacked YouTube channels—includes allegations which potentially could fall outside the scope of section 230 immunity. As currently pleaded, though, we are unable to conclude that those allegations save any of plaintiffs’ causes of action.

Nevertheless, because there is a reasonable possibility plaintiffs could cure the defects, we also conclude the trial court abused its discretion in not granting leave to amend the claims related to verification badges. Accordingly, we reverse and remand for further proceedings.

I. Factual and Procedural Background¹

A. YouTube cryptocurrency scams

YouTube, LLC (YouTube) is a video-sharing service that enables its users to view, post, and comment on video content hosted on its platform.² Users can create their own YouTube channels, thereby making it easy for other users to find a creator’s content in one place and be notified when new content is uploaded. The most popular YouTube channels have millions of subscribers.

User-personalized video recommendations appear when a user first opens the YouTube website or mobile app, and then automatically play after a video ends. YouTube utilizes an algorithm that recommends videos to users based on their personal information and data that YouTube and Google have collected, including clicks, watch time, likes and dislikes, comments, and upload frequency.

According to plaintiffs, YouTube’s lax security practices over the years have led to a steady stream of security breaches through which popular YouTube channels are hijacked and taken over by criminals who then use the channels to perpetrate a scam that has defrauded YouTube users of millions of dollars. YouTube has not only knowingly allowed the security breaches and scams, it has also affirmatively promoted and profited from them.

The scam generally operates as follows. First, scammers will breach YouTube’s security to unlawfully gain access to verified and popular YouTube channels with tens or hundreds of thousands of subscribers. The scammers then transfer ownership or control of the channel to themselves or a co-conspirator, rename the channel to impersonate tech celebrities or companies, and delete the channel’s pre-existing content.

Next, they upload and play scam videos they have created using pre-existing images and videos of famous tech entrepreneurs such as plaintiff Wozniak, Bill Gates or Elon Musk speaking at a cryptocurrency or technology conference, which is intended to deceive YouTube users into believing that the celebrity is hosting a live "biteoin giveaway" event.³ Plaintiffs allege that Wozniak, who co-founded Apple Computer in the 1970s, is a "Silicon Valley icon," who has "engaged in many entrepreneurial and philanthropic ventures" and is a "widely known, recognized, and beloved public figure."

The scam video is surrounded with images and text stating that, for a limited time, anyone who sends bitcoin to a specified account, via a QR code included in the video, will receive twice as much in return. The images and text often include trademarks, such as the Apple logo, and a link to a fraudulent web address that incorporates the particular tech entrepreneur’s name. However, after the users transfer their cryptocurrency in an irreversible transaction, they receive nothing in return and the scam is complete.

The scam has existed on YouTube since at least October 2018 and has been replicated many times in substantially the same form. In the process, millions of people have viewed the scam videos, resulting in the loss of millions of dollars of bitcoin and other cryptocurrencies. Specific to this lawsuit, unnamed third parties have perpetrated the scam since at least May 8, 2020, using Wozniak’s name and likeness and thereby stealing hundreds of thousands of dollars worth of bitcoin and similar cryptocurrencies from the 17 other named plaintiffs. The scam has continued through the date plaintiffs filed the initial complaint in this action.

According to plaintiffs, defendants have known about the scam, yet have allowed it to continue. In many instances, YouTube knew specific channels had been hijacked but failed to remove or suspend the preexisting verification badges appearing on those channels. In at least one instance, YouTube issued a verification badge to a channel while it was perpetrating the scam. YouTube has allowed the scam to continue, despite its own stated policies that it does not allow scams or other deceptive practices that take advantage of the YouTube community.

Defendants have both the human and technological capabilities to implement reasonable security measures that would prevent hijacking of popular channels and quickly detect and remove scam videos. Despite having the means to stop or limit the proliferation of the scam, defendants have declined to do so.

According to plaintiffs, beyond merely allowing it to continue, defendants have actively promoted and profited from the scam. For instance, YouTube has promoted the scam videos in plaintiffs’ and other users’ home page video recommendations, in their "up-next" videos which often begin playing automatically upon the conclusion of the previous video, and in the list of recommended videos shown while one video is playing. YouTube’s algorithm targets the scam videos directly at plaintiffs because the personal information and data that defendants have collected about them—such as clicks, watch time, likes and dislikes, comments, upload frequency, emails sent and received, saved photos and videos, documents and spreadsheets created, YouTube video comments, and other behavior through their apps, browsers, and devices—indicated they were interested in cryptocurrency.

YouTube also issues verification badges to certify to its users that a verified channel has been vetted and is trustworthy. According to plaintiffs, in issuing a verification badge, YouTube is communicating that an account is "the official channel of a creator, artist, company or public figure" and therefore can be trusted. YouTube has maintained verification badges on channels it knew had been hijacked.

Plaintiffs allege YouTube has also negligently designed its video metrics and other public-facing features of its platform to permit the scammers to falsely represent that large numbers of viewers have "liked" and viewed the videos when they have not. The scammers use bots and other tools to falsely inflate the number of likes, views, and those currently watching, to make the videos appear authentic and more legitimate. Similarly, YouTube enables the scammers to falsely represent that an event is live when it is not.

Lastly, defendants sold the scammers paid advertising space that targeted users based on their browsing history and other personal information defendants have collected and analyzed, which indicates an interest in cryptocurrency. According to plaintiffs, despite knowing about the cryptocurrency scams, defendants have continued to sell scammers "all the targeted scam ads that they are willing to buy," and have delivered those ads directly to plaintiffs and other users likely to be interested in the scam video content. YouTube has continued selling these targeted advertisements to the scammers, notwithstanding its own stated polices that it verifies the identity of its advertisers.

B. Initial complaints and first demurrer

Plaintiffs filed the initial complaint in this action in San Mateo...