A group of plaintiffs suing toy maker VTech over a 2015 data breach faced another setback when a Chicago federal judge again dismissed their would-be class action lawsuit.
The consolidated suit includes 22 plaintiffs – eight adults and 14 children – who claim they were put at risk when a hacker downloaded personal information including names, ages, addresses and photos from VTech’s online platforms.
VTech makes and sells digital learning toys for young children, including tablets, smartwatches and handheld gaming systems. Some of the toys have access to an online software store called Learning Lodge and to an online communications platform called Kid Connect. To access these online services, parents must register for an account with VTech and children create profiles that include information such as name, gender and birthdate.
Ryan Stephan
| Stephan Zouras LLP
In 2015, a hacker acquired the personal information of 2.8 million people after breaching VTech’s security systems. The hacker contacted a reporter, and VTech reportedly learned of the breach through media reports. The company suspended access to the online services and stated that the databases were “not as secure as [they] should have been.”
U.S. District Judge Manish S. Shah dismissed the plaintiffs’ first complaint last year for failure to state a claim. While some of the deficiencies of the previous complaint were remedied, Shah said plaintiffs still failed to show what harm they had suffered in the data breach and what contractual obligations VTech failed to fulfill.
Shah said the plaintiffs “appear to rest their breach of contract claims on the purchase contracts” created at the time each customer bought a toy. The claim, however, involves the suspension of the online services customers were promised access to “without meaningful interruption.” That promise, Shah wrote, is not governed by the purchase contract, but by online terms of service.
The plaintiffs also claim VTech broke its promise to provide “effective and industry-standard security measures.” But the judge said that promise, again, is in the privacy policy and online terms of service, which are separate from the purchase contract.
“Plaintiffs have not alleged a breach of the express privacy policy or online services terms,” Shah wrote.
Shah also dismissed the plaintiffs’ claims of breach of implied warranty, holding that nothing is wrong with the toys themselves, which perform as promised on their packaging.
An attempt to obtain a ruling under the Illinois Consumer Fraud Act also failed, as Shah found the plaintiffs’ claims lacked specificity. The plaintiffs had argued that VTech promotes the toys as “safe” even though it was not following even basic data safety procedures. But, Shah said, they did not say where VTech misled them, when they saw the misrepresentation and where they expected to find details of data safety practices.
VTech also argued that the plaintiffs cannot claim unjust enrichment on behalf of a nationwide class because every state handles unjust enrichment claims differently, an argument with which Shah agreed.
Shah dismissed the consumer fraud and unjust enrichment claims without prejudice. The breach of contract and breach of implied warranty claims were dismissed with prejudice.
Plaintiffs are represented by attorney Ryan Stephan and others from the firms of Stephan, Zouras LLP, of Chicago; and attorneys from the following firms: The Hinton Law Firm, of New York; Morgan & Morgan Complex Litigation Group, of Tampa, Fla.; Rosen Law Firm, of New York; Abbott Law Group, of Jacksonville, Fla.; Wexler Wallace, of Chicago; Hefner Hurst, of Chicago; Keller Rohrback LLP, of Seattle; and Lieff, Cabraser, Heimann & Bernstein, of New York and San Francisco.
VTech is defended by Steptoe & Johnson, of New York and Chicago.