Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

In re VTech Data Breach Litigation

United States District Court, N.D. Illinois, Eastern Division

April 18, 2018

In re VTech Data Breach Litigation


          Manish S. Shah, Judge

         Defendant VTech Electronics North America, LLC manufactures and markets digital learning toys for children. Plaintiffs purchased some of those toys, which came with access to certain online services. Use of the online services required plaintiffs to provide VTech with personally identifiable information about them and their children. VTech's inadequate data-protection measures allowed a hacker to access and download plaintiffs' personal information. As a result, VTech suspended its online services. Plaintiffs seek to represent a class of consumers and bring suit under theories of breach of contract, breach of the implied warranty of merchantability, violation of the Illinois Consumer Fraud and Deception Act, and unjust enrichment. VTech moves to dismiss the second consolidated amended complaint. For the following reasons, the motion is granted.

         I. Legal Standards

         A complaint must contain factual allegations that plausibly suggest a right to relief. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). I must accept as true all of the facts alleged in the complaint and draw reasonable inferences from those facts in plaintiffs' favor, but I am not required to accept as true the complaint's legal conclusions. Id. at 678-79. In considering a motion to dismiss under Rule 12(b)(6), I review the complaint, exhibits attached to the complaint, and, if they are central to the claims, documents referenced by the complaint. Otis v. Demarasse, __F.3d__, 2018 WL 1571916, at *5 n.33 (7th Cir. Apr. 2, 2018).

         II. Facts

         VTech makes and distributes digital learning toys for young children, including tablets, smartwatches, and other handheld learning systems. [94] ¶ 2.[1]Plaintiffs are eight adults who purchased VTech toys for their children. [94] ¶¶ 74- 131. Some VTech toys have access to the Learning Lodge, which is an online application store where toy-users can purchase and download software for their toys. [94] ¶¶ 3, 34. Learning Lodge is also where users install updates to the operating system software and previously installed applications. [94] ¶ 35. Some VTech toys also support Kid Connect, an online communications platform that allows children to use their Kid Connect-enabled toys to communicate with their parents' cell phones. [94] ¶¶ 3, 40. Toys that are able to access these online services-Learning Lodge and Kid Connect-are priced at a premium over toys that are not able to access the online services. [94] ¶¶ 30, 32, 41. Each plaintiff purchased toys that were able to access online services-either Learning Lodge, Kid Connect, or both. [94] ¶¶ 74-131.

         If a customer buys an online services-enabled toy, access to the online services is not automatic. Users have to register for an online account with VTech, which requires providing personally identifiable information like name, home address, email address, password, and credit or debit card information. [94] ¶ 42. After an adult registers for an online account, children create profiles with their names, passwords, birthdates, genders, and photographs. [94] ¶ 43. In addition to account creation, users must also affirmatively agree to VTech's terms and conditions (there are separate terms for Learning Lodge and Kid Connect) before using the online services. [94] ¶ 48. The online services terms incorporate VTech's Privacy Policy. [94] ¶ 48.[2] In the Privacy Policy, VTech promised to keep their customers' personally identifiable information secure, including by transmitting data in an encrypted format and storing the data where it would not be accessible by the internet. [94] ¶¶ 48-49.

         But in 2015, a hacker penetrated VTech's systems, obtaining the data of millions of VTech's customers. [94] ¶ 51. The hacker acquired parents' names, email addresses, and account password information as well as children's names, genders, birthdates, and photos. [94] ¶ 52. The hacker also obtained the messages that children and their parents exchanged in Kid Connect and on Kid Connect's family bulletin board feature. [94] ¶ 52. The hacker's breach was made possible by VTech's inadequate data-protection measures. [94] ¶ 56. He was able to gain access to the VTech database through its website. [94] ¶ 57. It also turned out that VTech did not use encryption to transmit its customers' data. [94] ¶ 58. As VTech itself stated, the databases were “not as secure as [they] should have been.” [94] ¶ 55. VTech found out about the cybersecurity breach from a news organization. [94] ¶ 62. Four days later, VTech issued a press release informing the public of the breach. [94] ¶ 63. VTech also suspended access to the online services. [94] ¶ 6.

         Plaintiffs brought several suits against VTech, which have been consolidated into this action. [43]. I dismissed the first consolidated amended complaint for the failure to state a claim. [87]. VTech now moves to dismiss the second consolidated amended complaint, arguing that plaintiffs have failed to state a claim for the second time.

         III. Analysis

         A. Breach of Contract (Counts I-II)

         Plaintiffs allege that they entered into contracts with VTech when they purchased their toys. And, as part of that exchange, VTech promised plaintiffs two things-(1) that plaintiffs would have access to the online services “without meaningful interruptions” and (2) that VTech would use “effective and industry-standard security measures” to protect plaintiffs' data. [94] ¶¶ 150, 163. Plaintiffs have not been clear about what contracts are the source of the promises they allege, but their claims appear to involve three groups of contracts: (1) purchase contracts, created at the time each plaintiff bought her VTech toy; (2) the Terms and Conditions of Learning Lodge and Kid Connect, agreed to when plaintiffs registered for the online services; and (3) VTech's Privacy Policy, incorporated by reference into the online services terms and deemed accepted by use of the online services. Plaintiffs appear to rest their breach of contract claims on the purchase contracts. See [94] ¶¶ 149-50, 162-63.

         Plaintiffs have not labeled the purchase contracts as express or implied, but the allegations show that they must be implied. Illinois recognizes contracts that are implied in fact, meaning contracts in which there is no express written or oral contract, but the facts and circumstances show that the promisor meant to be bound by a promise. Marcatante v. City of Chicago, Ill., 657 F.3d 433, 440 (7th Cir. 2011). Or more simply, the promisor did not expressly promise anything, but the promise was implied. An implied-in-fact contract is “a true contract, containing all necessary elements of a binding agreement; it differs from other contracts only in that it has not been committed to writing or stated orally in express terms, but rather is inferred from the conduct of the parties in the milieu in which they dealt.” Id. (citation omitted). The complaint makes no allegations that the terms of the purchase contracts were written, nor does it allege that VTech and plaintiffs made an oral contract. Rather, plaintiffs describe VTech's actions-offering products for sale (with particular statements on the packaging)-and plaintiffs' actions- “purchasing and using the VTech Products and the Online Services, ” [94] ¶¶ 149, 162-and infer that a contract arose from those actions. That would be an implied contract, not an express one.[3]

         VTech's lead argument for dismissing both the online services and data-security theories of breach is that plaintiffs did not plead “facts sufficient to demonstrate that the initial purchase transaction included both the hardware device and the Online Services.” [101] at 18 (emphasis omitted). This argument is based on my opinion on the first motion to dismiss. On the first go-round, I dismissed plaintiffs' breach of contract claims because the claims hinged on the initial purchase transaction including both the toy and the online services, and I found that the complaint did not allege sufficient facts to show that the initial purchase encompassed a contract for online services. [87] at 18-22. Plaintiffs are right that they have fixed that issue, particularly by including photos of the toys' packaging in the new complaint. See [94] ¶¶ 25-28, 32. The photos show that the toys' packaging included references to Learning Lodge and Kid Connect that suggested access to the online services was part of the deal upon purchase, not just an addition available later. But there are other problems with the complaint.

         1. Access to Online Services

         Plaintiffs allege that as part of the purchase contracts, VTech promised to provide “access to and use of the Online Services without meaningful interruptions, ” [94] ¶¶ 150, 163, and that it broke this promise by suspending access to the online services. [94] ¶¶ 155, 168. But this alleged promise is not governed by the terms of the implied purchase contracts, it is governed by the express online services terms. “As in physics, two solid bodies cannot occupy the same space at the same time, so in law and common sense, there cannot be an express and implied contract for the same thing, existing at the same time.” Gadsby v. Health Ins. Admin., Inc., 168 Ill.App.3d 460, 470 (1988) (citation omitted). Where an express contract exists on the same subject-matter as an implied contract, the implied contract cannot exist. Marcatante, 657 F.3d at 440. The online services terms cover the same subject-matter as the alleged implied contracts-the provision of online services.[4] So the online services terms are the contracts that control, not any implied contract formed at the time of purchase. And plaintiffs have not alleged a breach of the express online services terms.

         Even if plaintiffs had alleged a breach of the online services terms, both the Learning Lodge terms and Kid Connect terms contain provisions that allow VTech to terminate the services at any time and without providing prior notice. [94-2] § 7.3; [94-3] § 2.7. Plaintiffs argue that these provisions are procedurally and substantively unconscionable, mostly because the online services terms added those provisions after plaintiffs had already bought their toys. As they put it, “[t]o hold these terms are enforceable would simply enable VTech to continue making promises to customers at the time of purchase, get them to pay for that promise, and then retract those promises once the consumer gets home and opens the product they purchased, while keeping the premium the customers paid for itself.” [104] at 23 (citations omitted) (emphasis in original). Plaintiffs' characterization of the contract-an initial purchase contract later supplemented or amended by the online services terms-is incorrect. The express online services terms negate the existence of any implied purchase contract terms about the provision of online services. See Maness v. Santa Fe Park Enterprises, Inc., 298 Ill.App.3d 1014, 1023 (1998) (“[E]xpress contracts negate the existence of any implied in fact contract.”). So VTech did not contractually promise to provide online services and then take back the promise after plaintiffs had already purchased their toys-rather, the parties mutually vacated their implied agreement by entering into an express one. There is no indication that plaintiffs did not have a full and fair opportunity to review the online terms before they agreed to them.[5] So the provisions that allowed VTech to terminate the online services at any time are not unconscionable, and VTech was within its rights to suspend plaintiffs' access to the online services.

         Plaintiffs also argue that VTech's interpretation of the online services terms as allowing VTech “unilateral, unfettered discretion to decide whether to provide the Online Services at all” would render the contracts illusory and unenforceable. [104] at 21. But instead of asking for a finding that the contracts are unenforceable, plaintiffs interpret the provisions at issue to mean “that VTech cannot be held liable for occasional outages (e.g., for software updates) or for discontinuing the Online Services many years after purchase.” [104] at 21. Plaintiffs' interpretation of the terms of service is not consistent with its language, but even if I adopted plaintiffs' interpretation, there is no allegation that VTech breached the contract: the suspension of Learning Lodge and Kid Connect very well may qualify as an “occasional outage.” VTech also argues that the limitations of liability contained in the online services terms preclude plaintiffs' claims. Although I need not reach this argument, it remains true that the limitation of liability provisions in the online services terms disclaim liability for damages relating to the use of Learning Lodge and Kid Connect. See [87] at 21-22.

         2. ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.