Opinion
23-cv-1104
12-21-2023
NOAH SAEEDY, et al., individually, and on behalf of all others similarly situated, Plaintiffs, v. MICROSOFT CORPORATION, Defendant.
ORDER GRANTING DEFENDANT'S MOTION TO DISMISS
Barbara Jacobs Rothstein, U.S. District Court Judge
I. INTRODUCTION
Plaintiffs sued Microsoft Corporation on July 21, 2023 in this putative class action, alleging that the Microsoft Edge browser intercepts and collects users' internet browsing activities and private data for Microsoft's use, which results in numerous violations of both federal and state laws. Currently pending before the Court is Microsoft's Motion to Dismiss Under Rules 12(b)(1) and 12(b)(6), ECF No. 36, which Plaintiffs have opposed. Having reviewed the parties' filings and the relevant legal authorities, the Court GRANTS Microsoft's motion to dismiss under Rule 12(b)(1) for lack of standing. The reasoning for the Court's decision follows.
Referring to Federal Rules of Civil Procedure.
Mot., ECF No. 36; Opp'n, ECF No. 39 (corrected version); Reply, ECF No. 40, and the Complaint, ECF No. 1, together with the exhibits accompanying the motion and reply.
The facts recited below are taken from Plaintiffs' Complaint (“Compl.,” ECF No. 1). For the purposes of the present motion, the Court takes the factual allegations in the Complaint as true.
Plaintiffs allege that certain Microsoft Edge internet browser versions “surreptitiously intercept, collect and send to Defendant a wide range of private data relating to users' internet browsing activities, internet searches, and online shopping behavior, including while in ‘private' browsing mode.” Compl. ¶¶ 1-2, ECF No. 1. This allegedly private data is collected and associated with unique user identifiers and sent to Microsoft-controlled servers, which allows Microsoft to determine an individual users' internet browsing activities and habits. Id. ¶¶ 2-4. Plaintiffs allege that this is done without the users' consent. Id. ¶ 5.
There are four named Plaintiffs: Noah Saeedy, Vishal Shah, M.S., a minor, by and through his natural parent and legal guardian Crystal Arterberry, (collectively, the “California Plaintiffs”), and Tina Wilkinson (“Washington Plaintiff”).
Plaintiffs used Edge for both personal and work purposes and allege that they would not have used the Edge browser if they had known that Microsoft was collecting their data and using it to improve its software and services, provide targeted advertising, and develop artificial intelligence. Id. ¶¶ 7-10; 176-79. Plaintiffs claim economic injury because of Microsoft's unlawful and unauthorized interceptions and recordings. Id. Plaintiffs have sued Microsoft, on behalf of a nationwide class and subclasses, for violations of the Electronic Communications Privacy Act, 18 U.S.C. § 2510, et seq., the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and various California and Washington state law claims. In total, they assert 13 causes of action:
• First Cause of Action - Violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2510, et seq. (All Plaintiffs, Classes, and Subclasses)
• Second Cause of Action - Violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (All Plaintiffs, Classes, and Subclasses)
• Third Cause of Action - Intrusion Upon Seclusion (California Plaintiffs, California Class, and California Subclasses)
• Fourth Cause of Action - Violation of the Right to Privacy - California Constitution (California Plaintiffs, California Class, and California Subclasses)
• Fifth Cause of Action - Violation of California Invasion of Privacy Act, California Penal Code §§ 630, et seq. (California Plaintiffs, California Class, and California Subclasses)
• Sixth Cause of Action - Statutory Larceny, Cal. Penal Code §§ 484 and 496 (California Plaintiffs, California Class, and California Subclasses)
• Seventh Cause of Action - Conversion (California Plaintiffs, California Class, and California Subclasses)
• Eighth Cause of Action - Violation of the California Unfair Competition Law, Bus. & Prof. Code §§ 17200, et seq. (California Plaintiffs, California Class, and California Subclasses)
• Ninth Cause of Action - Intrusion Upon Seclusion (Washington Plaintiff, Washington Class, Washington Subclasses)
• Tenth Cause of Action - Conversion (Washington Plaintiff, Washington Class, Washington Subclasses)
• Eleventh Cause of Action - Violation of the Washington Privacy Act, Wash. Rev. Code ch. 9.73 (Washington Plaintiff, Washington Class, Washington Subclasses)
• Twelfth Cause of Action - Violation of the Washington Consumer Protection Act, Wash. Rev. Code ch. 19.86 (Washington Plaintiff, Washington Class, Washington Subclasses)
• Thirteenth Cause of Action - Restitution / Unjust Enrichment (All Plaintiffs, Classes, and Subclasses)
Microsoft seeks to dismiss Plaintiffs' complaint for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1), arguing that Plaintiffs lack standing under Article III of the Constitution. Microsoft also argues that Plaintiffs' claims should be dismissed under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim on which relief may be granted.
III. LEGAL STANDARD
A. 12(b)(1) Standard
Federal Rule of Civil Procedure 12(b)(1) allows litigants to seek the dismissal of an action for lack of subject matter jurisdiction. A motion to dismiss for lack of subject matter jurisdiction can either attack the sufficiency of the pleadings on their face (a “facial attack”) or present affidavits or other evidence that contest the truth of the allegations in the pleadings (a “factual attack”). Sullivan v. Ferguson, 636 F.Supp.3d 1276, 1283 (W.D. Wash. 2022) (citing Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004)).
When the movant does not offer affidavits or other evidence challenging the truth of the allegations in the complaint, the Court construes the motion as a facial attack on subject matter jurisdiction. See id. And the Court resolves a facial jurisdictional challenge “as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff's allegations as true and drawing all reasonable inferences in the plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court's jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). The Court presumes that a case lies outside of its “limited jurisdiction” unless the plaintiffs establish otherwise. Kokkonen v. Guardian Life Ins. Co., 511 U.S. 375, 377 (1994). If at any time the court determines that it lacks subject matter jurisdiction, it must dismiss the action. Fed.R.Civ.P. 12(h)(3).
B. 12(b)(6) Standard
A motion to dismiss for failure to state a claim under Rule 12(b)(6) is properly granted if the complaint does not “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). The plaintiff must plead “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. “A complaint may fail to show a right to relief either by lacking a cognizable legal theory or by lacking sufficient facts alleged under a cognizable legal theory.” Woods v. U.S. Bank N.A., 831 F.3d 1159, 1162 (9th Cir. 2016). When considering a motion to dismiss under Rule 12(b)(6), courts must accept the factual allegations in the complaint as true and construe such allegations in the light most favorable to the plaintiff. Interpipe Contracting, Inc. v. Becerra, 898 F.3d 879, 886-87 (9th Cir. 2018).
IV. DISCUSSION
“Under Article III, the Federal Judiciary is vested with the ‘Power' to resolve not questions and issues but ‘Cases' or ‘Controversies.'” Ariz. Christian Sch. Tuition Org. v. Winn, 563 U.S. 125, 132 (2011). Among other things, that limitation requires a plaintiff to have standing.” Fed. Election Comm'n v. Cruz, 596 U.S. 289, 295-96 (2022). Whether Plaintiffs have Article III standing to proceed with this lawsuit implicates the Court's subject matter jurisdiction. See Warth v. Seldin, 422 U.S. 490, 498 (1975) (stating that standing is jurisdictional). Therefore, the Court will begin by considering Microsoft's standing arguments.
The three elements of standing “are well established: A plaintiff must show (1) an injury in fact, (2) fairly traceable to the challenged conduct of the defendant, (3) that is likely to be redressed by the requested relief.” Id. at 296 (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). Plaintiffs bear the burden of establishing each of these elements “with the manner and degree of evidence required at the successive stages of the litigation.” Lujan, 504 U.S. at 561. “At the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice[.]” Id.; accord Tingley v. Ferguson, 47 F.4th 1055, 1066 (9th Cir. 2022); see also Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) as revised (May 24, 2016) (“[T]he plaintiff must clearly allege facts demonstrating each element.” (citation omitted)).
“[S]tanding is not dispensed in gross; rather, plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek.” TransUnion LLC v. Ramirez, 594 U.S. ___, 141 S.Ct. 2190, 2208 (2021) (citations omitted). Further, for each of the state claims asserted, at least one plaintiff must demonstrate standing. See, e.g., Fenerjian v. Nongshim Co., Ltd., 72 F.Supp.3d 1058, 1082-83 (N.D. Cal. 2014) (finding that named plaintiffs “lack standing to assert claims based on” states' laws where they neither resided nor suffered an injury); Hamilton v. NuWest Grp. Holdings LLC, C22-1117-JCC, 2023 WL 130485, at *3 (W.D. Wash. Jan. 9, 2023) (“[C]ourts dismissed state law claims where no named plaintiff has alleged injury, residence, or other pertinent connection (i.e., standing).”). Even in a class action, “standing is the threshold issue .... If the individual plaintiff lacks standing, the court need never reach the class action issue.” Lierboe v. State Farm Mut. Auto. Ins. Co., 350 F.3d 1018, 1022 (9th Cir. 2003).
At issue here is the “[f]irst and foremost” of standing's three requirements-“a harm suffered by the plaintiff that is concrete and actual or imminent, not conjectural or hypothetical.” Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 103 (1998) (citations omitted). To establish an injury in fact, plaintiffs must show that they suffered “an invasion of a legally protected interest.” Lujan, 504 U.S. at 560 (citations omitted). Injury is particularized if it affects a plaintiff “in a personal and individual way.” Id. at 560 n.1. And it is concrete if it “actually exist[s],” meaning that it is “real, and not abstract.” Spokeo, 578 U.S. at 340 (citations omitted).
Here, the Complaint contains thirteen causes of action that include both California and Washington statutes. The Complaint identifies two general theories of harm-invasion of privacy-related claims (Counts 1, 3, 4, 5, 9, 11, 12), and property-related claims (Counts 2, 6, 7, 8, 10). The Court will first analyze whether plaintiffs have standing for the privacy-related claims then turn to the property-related claims.
A. Privacy-related claims
In 2021, the Supreme Court clarified that it is not enough that “a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” TransUnion, 141 S.Ct. at 2204-05 (noting that intangible injuries, such as “reputational harms, disclosure of private information, and intrusion into seclusion,” may qualify as “concrete” where there is “a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts”). The Court acknowledged that “the concrete-harm requirement can be difficult to apply in some cases.” TransUnion, 141 S.Ct. at 2207.
Microsoft contends that the data described in the Complaint is not of the type that courts have historically recognized as private. Mot. 7. That is, Plaintiffs have no recognized reasonable expectation of privacy in their browsing data. The Court agrees. The interception of the type of information contained in Plaintiffs' browsing data does not bear a close relationship to a harm traditionally recognized as a basis for lawsuits. The nature of the information that is allegedly intercepted must be private, “personal information, personally identifiable information, or information over which a party has a reasonable expectation of privacy.” Cook v. GameStop, Inc., ___ F.Supp.3d ___, 2:22-CV-1292, 2023 WL 5529772, at *4 (W.D. Pa. Aug. 28, 2023); accord Popa v. PSP Grp., LLC, C23-0294JLR, 2023 WL 7001456, at *3 (W.D. Wash. Oct. 24, 2023). Data and information that has been found insufficiently personal includes mouse movements, clicks, keystrokes, keywords, URLs of web pages visited, product preferences, interactions on a website, search words typed into a search bar, user/device identifiers, anonymized data, product selections added to a shopping cart, and website browsing activities. See Popa, 2023 WL 7001456, at *3-4 (collecting cases); Ji v. Naver Corp., 21-CV-05143-HSG, 2022 WL 4624898, at *7-8 (N.D. Cal. Sept. 30, 2022) (finding that collection of “user and device identifiers” are not the type of information that could give rise to a privacy injury, although collection and storage of biometric information was sufficient to support standing); Lightoller v. Jetblue Airways Corp., 23-CV-00361-H-KSC, 2023 WL 3963823, at *4 (S.D. Cal. June 12, 2023) (“These allegations are insufficient to allege a concrete harm that bears a close relationship to the substantive right of privacy (i.e., an individual's right to control information concerning his or her person).”); Massie v. Gen. Motors LLC, CV 21-787-RGA, 2022 WL 534468, at *3-5 (D. Del. Feb. 17, 2022) (distinguishing cases involving the collection and disclosure of personal information). Further, a California court concluded in a data breach case that “basic contact information, including one's email address, phone number, or Facebook or Zynga username, is [not] private information. All this information is designed to be exchanged to facilitate communication and is thus available through ordinary inquiry and observation,” and the disclosure of such information would not be “highly offensive to a reasonable person.” I.C. v. Zynga, Inc., 600 F.Supp.3d 1034, 1049 (N.D. Cal. 2022).
The Zynga court noted that the collected data did not include financial information that would allow criminals to commit identity theft. 600 F.Supp.3d at 1052-53.
According to Plaintiffs, Microsoft intercepted and collected “users' internet browsing activities, internet searches, and online shopping behavior,” Compl. ¶ 2, “keyword search terms, URLs, and unique user identifiers and cookies,” ¶ 5, and the collection of this information was an intrusion into their privacy. Plaintiffs have not alleged that they provided any personal or sensitive information to Microsoft that implicates a protectable privacy interest.
Plaintiffs allege that the data collected can be associated with their names but they allege that this association can be made when the user is logged into a Microsoft account. Compl. ¶¶ 36, 49, 69. None of the Plaintiffs allege that they logged into a Microsoft account either before or during their browsing activities.
In support of their argument that browser activity such as they have described is sufficient for standing, Plaintiffs cite cases that pre-date TransUnion, and are otherwise distinguishable. See Opp'n 8-9. For example, in In re: Google Inc. Cookie Placement Consumer Privacy Litig. (“Google Cookie”), 934 F.3d 316, 321, 325 (3d Cir. 2019), the plaintiffs claimed that Google bypassed their cookie blockers and placed tracking cookies on their web browsers, thereby collecting private data that contained personal information. The Third Circuit relied on its earlier decision in In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262, (3d Cir. 2016), which reasoned that the injury was concrete because Congress so provided. See 827 F.3d at 273-74 (“[A]n injury-in-fact may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing.” (citation omitted)). In neither of these decisions was there an analysis of a historical or commonlaw analogue for the asserted injury apart from the statute. See Cook, 2023 WL 5529772, at *5. In TransUnion, the Supreme Court emphasized that the asserted harm must have “a ‘close relationship' to a harm traditionally recognized as providing a basis for a lawsuit in American courts.” 141 S.Ct. at 2200.
Moreover, in both Google Cookie and Nickelodeon, a third party had tracked the internet browsing information in violation of its own promise not to do so. 934 F.3d at 325. And in In re Facebook, Inc. Internet Tracking Litig. (“Facebook Tracking”), 956 F.3d 589 (9th Cir. 2020), cited by Plaintiffs, the Ninth Circuit emphasized the comprehensive nature of Facebook's unauthorized tracking (Facebook had promised not to collect users' data after they logged out but did so anyway), and the unauthorized correlation of the collected data with the user's personal profiles that it then sold to advertisers to generate revenue-conduct that extends far beyond Plaintiffs' allegations regarding Microsoft's conduct. Plaintiffs do not allege that their data was either disclosed or sold to a third party, or that Microsoft broke its privacy promises.
Microsoft's Privacy Statement outlines the data that Microsoft may collect. Burnside Suppl. Decl. Ex. A, ECF No. 41. Although Plaintiffs argue that the Privacy Statement was not conspicuous, they do not allege that they did not see it, were unable to locate it, or that Microsoft collected any data not impliedly consented to by virtue of the acceptance of terms. The named Plaintiffs each allege that they did not know or consent to the collection of their private data and that they had a reasonable expectation of privacy. The Court need not “assume the truth of legal conclusions merely because they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per curiam) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). However, the Court concludes that Plaintiffs lack standing without analyzing the issue of consent, which may more properly be a merits issue. See In re Facebook, Inc., Consumer Privacy User Profile Litig., 402 F.Supp.3d 767, 788-89 (N.D. Cal. 2019) (assuming for purposes of the standing inquiry that the plaintiffs did not consent).
Absent from Plaintiffs citations are the host of cases decided subsequent to TransUnion. For example, in Phillips v. United States Customs & Border Protection, the Ninth Circuit held that a group of immigration activists lacked standing to sue over the government's retention of records that several federal law enforcement agencies had compiled about them as part of a covert surveillance operation. 74 F.4th 986 (9th Cir. 2023). The Ninth Circuit reasoned that the unlawful collection and retention of records, without more, does not give rise to a concrete harm of the sort the Supreme Court has recognized. Id. at 993-96. The records “- names, birthdays, social security numbers, occupations, addresses, social media profiles, and political views and associations-” were collected from both open sources available to the public and preexisting databases that were not publicly available. Id. at 996, 989. The Circuit went on to hold that this type of information did not give rise to privacy interests and was not “generally considered ‘private.'” Id. at 996 (citation omitted). “This identifying information is also a far cry from the types of information that we have held are so sensitive that another's retention of the information is analogous to tortious conduct.” Id. The district court in Cook reached a similar conclusion, stating that the information allegedly intercepted must clear the threshold of information sufficiently personal or private within the common law understanding of a privacy right. 2023 WL 5529772, at *4.
In sum, the collected browser information of which Plaintiffs complain is not a legally protected privacy interest in which they had a reasonable expectation of privacy. Therefore, they have not alleged a sufficiently concrete privacy injury to provide a basis for Article III standing.
B. Property-related claims
Plaintiffs have alleged violations of the Computer Fraud and Abuse Act, California Unfair Competition Law and Statutory Larceny under California law, and conversion under California and Washington State law. Plaintiffs claim that the data regarding Plaintiffs' internet activity constitutes property that has value, and that they have suffered harm in the form of diminution of the value of their private data by Microsoft's theft or unfair and deceptive trade practices. See, e.g., Compl. ¶¶ 221, 277-80, 283-87, 292-96, 312-17. Microsoft argues that Plaintiffs have not pleaded economic injury and thus fail to establish standing. Mot. 11-12 (citing Ji, 2022 WL 4624898, at *9).
To establish standing for their claims of loss of value in their data as property, Plaintiffs must show that they personally lost money or property as a result of Microsoft's conduct. See, e.g., Ji, 2022 WL 4624898, at * 9 (“Courts in this District have held that to proceed on an economic injury theory, data privacy plaintiffs must allege the existence of a market for their data and the impairment of the ability to participate in that market.”); Bass v. Facebook, Inc., 394 F.Supp.3d 1024, 1039 (N.D. Cal. 2019) (“In order to establish standing for [the loss of the value of personal information], plaintiffs must show that they personally lost money or property ‘as a result of the unfair competition.'” (citation omitted)); Weizman v. Talkspace, Inc., ___ F.Supp.3d ___, 23-CV-00912-PCP, 2023 WL 8461173, at *3 n.2 (N.D. Cal. Dec. 6, 2023) (noting that to establish standing under unfair competition law, a plaintiff must allege economic injury caused by the unfair business practice).
Plaintiffs have generally asserted that they have “a property right and interest” in their private data, the “interception and use of that data is violative of those rights and therefore causes [them] injury and damages,” and they “suffered further economic injury as a result of Defendant's unlawful and unauthorized interceptions and recordings of communications.” Compl. ¶¶ 7-9. Courts have recognized that the loss of personal identifying information may constitute a cognizable injury in data breach cases, but that is not what Plaintiffs have alleged here. Plaintiffs argue that their personal identifying data, as well as their web browsing and online shopping data, has monetary value, Opp'n at 10-11, but the individual Plaintiffs have failed to allege how they have lost value from the loss of their data, or lost profit from the sale of their data without compensation, or how they were prevented from deriving economic benefit from their data.“California's state and federal courts have consistently dismissed informational-privacy claims resting on bald references to the ‘economic value' of a plaintiff's information.” Murphy v. Kochava Inc., 2:23-CV-00058-BLW, 2023 WL 6391061, at *9 (D. Idaho Oct. 2, 2023); see also Greenley v. Kochava, Inc., 22-CV-01327-BAS-AHG, 2023 WL 4833466, at *18 (S.D. Cal. July 27, 2023) (“Courts have consistently found that alleging the economic value of data is not enough, if a plaintiff fails to allege the economic value to him.”); In re Google, Inc. Privacy Policy Litig., C-12-01382-PSG, 2013 WL 6248499, at *5-6 (N.D. Cal. Dec. 3, 2013) (finding that users lacked standing for failure to allege how the defendant's use of personal data deprived them of the ability to profit from the same information); Viveros v. Audible, Inc., C23-0925JLR, 2023 WL 6960281, at *5 (W.D. Wash. Oct. 20, 2023) (“It is not enough that a plaintiff lost money; to have standing, there must be a causal link between the unlawful practice and the loss.” (citation omitted)).
Plaintiffs allege generally that Class and Subclass members lost the benefit of their bargain and are precluded from selling their data because it is now worthless, Compl. ¶¶ 163-74, 293-94, but there are no individual allegations by the named Plaintiffs of losses particular to them.
Although Plaintiffs allege that they would not have used Microsoft Edge had they known that Microsoft was intercepting and using their data, they have no claim of loss on their purchase of the product because Microsoft Edge is included with the operating system and can be downloaded at no cost. Compl. ¶¶ 7-9, 18-20, 140. And no named Plaintiffs have alleged that they provided their data in a transaction in which they were not paid the fair value for the data provided.
In sum, Plaintiffs have failed to allege how they were personally injured by the collection of their data sufficient to establish standing for their property-related claims.
C. Leave to amend
Because the named Plaintiffs fail to allege a particularized, concrete injury to a legally protected interest, they have failed to allege standing to proceed with their claims. Given this lack of standing, the Court will not consider Microsoft's alternative argument under Rule 12(b)(6). Microsoft's Motion to Dismiss is granted. Plaintiffs' Complaint is dismissed without prejudice for lack of subject matter jurisdiction. See Mo. ex rel. Koster v. Harris, 847 F.3d 646, 656 (9th Cir. 2017) (“In general, dismissal for lack of subject matter jurisdiction is without prejudice.”).
Plaintiffs have asked for leave to amend. Ordinarily, leave to amend a complaint should be freely given. Fed.R.Civ.P. 15(a)(2); see also Eminence Capital, LLC v. Aspeon, Inc., 316 F.3d 1048, 1051 (9th Cir. 2003) (“[L]eave shall be freely given when justice so requires”).
Microsoft asks the Court to dismiss Plaintiffs' claims with prejudice, contending that all of Plaintiffs' claims fail on some essential element and cannot be adequately pleaded under Plaintiffs' theories. Because the Court lacks jurisdiction to consider Plaintiffs' claims on the merits, it would be premature to dismiss with prejudice. If Plaintiffs wish to amend their Complaint, they must file a motion for leave to amend within 30 days of the date of this Order. The motion must attach any proposed amended complaint and cite relevant authority explaining why leave to amend is appropriate, how they have addressed the raised deficiencies, and why the proposed amendments will not be subject to dismissal under the legal authorities discussed above.
The Court notes however, that Plaintiffs' failure to plausibly allege standing also implicates the essential elements of their various causes of action. Dismissal likely would be warranted for failure to state plausible claims.
V. CONCLUSION
For the foregoing reasons:
1. Microsoft's Motion to Dismiss Under Rules 12(b)(1) and 12(b)(6), ECF No. 36, is GRANTED; and
2. Plaintiffs may file a motion for leave to amend their Complaint within 30 days of the date of this Order.