Q.J. v. PowerSchool Holdings LLC

 IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION Q.J., individually and on behalf of all others ) similarly situated, ) ) Plaintiff, ) ) Case No. 23 C 5689 v. ) ) Judge Jorge Alonso POWERSCHOOL HOLDINGS, LLC, ) HOBSONS, INC., HEAP, INC., and ) BOARD OF EDUCATION OF THE CITY ) OF CHICAGO, ) ) Defendants, ) ) MEMORANDUM OPINION AND ORDER In this putative class-action data-privacy case, Plaintiff, Q.J., alleges that Defendants, PowerSchool Holdings, LLC, its predecessor Hobsons, Inc., Heap, Inc., and the Board of Education of the City of Chicago, failed to protect personal data exposed by and through Plaintiff’s use of Naviance, an online higher education preparedness platform available to students enrolled in Chicago public schools. Now before the Court are Defendants’ motions to dismiss for failure to state a claim and lack of personal jurisdiction and Plaintiff’s motion for appointment as interim class counsel. For the following reasons, Heap, Inc.’s motion to dismiss for lack of personal jurisdiction is granted, the remaining defendants’ motion to dismiss for failure to state a claim is granted in part and denied in part, and Plaintiff’s motion for appointment of interim class counsel is denied without prejudice. Background In the years leading up to the filing of this lawsuit, Plaintiff, Q.J., was a student enrolled in the Chicago Public Schools system, governed and operated by Defendant, the Board of Education of the City of Chicago (hereafter, “CPS”). CPS contracted with Defendant PowerSchool Holdings LLC (“PowerSchool”)—formerly known as Hobsons, Inc. (“Hobsons”)—to provide its students with access to PowerSchool’s Naviance platform. Naviance helps students prepare for higher education by providing them with tools for assessing their strengths and interests, facilitating their research into higher education institutions and programs, and fostering communication and collaboration among students, their schools, their families, and their institutions of interest. CPS first obtained access to Naviance by entering into what Plaintiff’s complaint refers to as the “Initial Contract” with Hobsons in 2015. In 2020, after PowerSchool acquired Hobsons, the “Initial Contract” was replaced and superseded by a “Subsequent Contract” for Naviance between CPS and PowerSchool. Use of Naviance was mandatory for all CPS students. PowerSchool and Hobsons (collectively, “PowerSchool”) obtained personal student data, including identifying information such as names, birthdates, contact information, and addresses, as well as education information such as grade point averages, test scores, schools attended and courses taken, through students’ use of the Naviance platform. PowerSchool allegedly configured the platform to track Naviance users on an individualized basis, including by engaging various software providers to track, analyze, and organize data obtained from Naviance users. One of those software providers was Defendant Heap, Inc. (“Heap”), a Delaware corporation with its principal place of business in California. Heap is a software-as-a-service provider offering code that permits the collection of data via a feature known as Autocapture. A website operator can install Heap’s data analytics platform, which includes Autocapture, by embedding and integrating Heap’s code into its website. By doing so, the website operator can “automatically capture the user interactions on [the] site, from the moment of 2 installation forward,” including “every click, swipe, tap, pageview and fill.” (1st Am. Compl. ¶ 116, ECF No. 118.) PowerSchool incorporated Heap’s software into Naviance. This allegedly results in the interception of confidential student communications and collection of confidential student data that students and their families expect to remain private when students use Naviance. The operative First Amended Complaint contains nineteen counts, in which Plaintiff asserts the following claims, on behalf of himself and all others similarly situated. First, in Counts One, Seven, Eight, Nine, and Fourteen, Plaintiff asserts that Defendants violated numerous state and federal statutes by improperly obtaining and/or disclosing his sensitive personal information. These statutes include the Electronic Communications and Privacy Act (“ECPA”), 18 U.S.C. § 2511(a); the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 631 & 632; the Stored Communications Act (“SCA”), 18 U.S.C. § 2702(a)(1); the Illinois Eavesdropping Act (“IEA”), 720 ILCS 5/14-1; and the Illinois School Student Records Act (“ISSRA”), 105 ILCS 10/6. In Counts Two through Six, Plaintiff asserts that PowerSchool, Heap, and their employees, acting under color of law by way of their contractual relationship with CPS, violated 42 U.S.C. § 1983 by improperly obtaining and/or disclosing student data, in violation of the Fourth Amendment prohibition on unreasonable searches. In Counts Eleven, Twelve, Thirteen, and Sixteen,1 Plaintiff asserts common-law claims of intrusion upon seclusion against Heap; breach of contract against PowerSchool; and unjust enrichment against PowerSchool and Heap. Finally, in 1 The unjust enrichment count is mislabeled as Count Sixteen, although it is actually the fifteenth count asserted in the complaint. 3 Counts Sixteen through Nineteen, Plaintiff asserts that Defendants are liable for the actions of their agents under a respondeat superior theory.2 Analysis Because jurisdiction is always a “threshold” issue, which deserves consideration before others to ensure that the Court “makes no assumption of law-declaring power” in excess of constitutional constraints, Ruhrgas AG v. Marathon Oil Co., 526 U.S. 574, 583-84 (1999) (internal quotation marks omitted), the Court begins with Heap’s motion to dismiss for lack of personal jurisdiction. Then, the Court takes up PowerSchool’s motion to dismiss for failure to state a claim, in which CPS joins. Finally, the Court considers Plaintiff’s motion for appointment of interim class counsel. I. Personal Jurisdiction A motion to dismiss pursuant to Rule 12(b)(2) tests whether a federal court has personal jurisdiction over a defendant. Central States v. Phencorp. Reins Co., 440 F.3d 870, 875 (7th Cir. 2006); Fed. R. Civ. P. 12(b)(2). Plaintiffs need not plead facts establishing personal jurisdiction in their complaint, but “once the defendant moves to dismiss . . . for lack of personal jurisdiction, the plaintiff bears the burden of demonstrating the existence of jurisdiction.” Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003). For purposes of a Rule 12(b)(2) motion 2 Defendants purport to move to dismiss these counts, but the parties seem to agree that they do not contain any independent claims. Plaintiff responds that he sets out his respondeat superior theory in separate counts in an abundance of caution, to ensure that Defendants are on notice of all theories of liability on which he may rely. With that understanding, the Court “do[es] not dismiss th[ese] count[s], but simply clarif[ies]” that they are not independent claims. Strzykalski v. Bd. of Educ. of Summit Hill Sch. Dist. 161, No. 23 CV 1284, 2024 WL 580012, at *6 (N.D. Ill. Feb. 13, 2024). 4 supported only by written materials, in the absence of an evidentiary hearing, the plaintiff’s burden of proof is met by “a prima facie showing” of personal jurisdiction. Id. To determine whether the plaintiff has met its burden, the court may consider affidavits from both parties. Felland v. Clifton, 682 F.3d 665, 672 (7th Cir. 2012). “[O]nce the defendant has submitted affidavits or other evidence in opposition to the exercise of jurisdiction, the plaintiff must go beyond the pleadings and submit affirmative evidence supporting the exercise of jurisdiction.” Purdue, 338 F.3d at 783. “When affidavits regarding the issue of personal jurisdiction are submitted, the district court may weigh the affidavits,” accepting as true “any facts in the defendants’ affidavits that do not conflict with . . . [the plaintiff’s] submissions.” Curry v. Revolution Lab’ys, LLC, 949 F.3d 385, 393 (7th Cir. 2020). Courts must resolve factual disputes in the plaintiff’s favor, but “accept as true any facts contained in the defendant’s affidavits that remain unrefuted by the plaintiff.” GCIU-Emp. Ret. Fund v. Goldfarb Corp., 565 F.3d 1018, 1020, 1020 n.1 (7th Cir. 2009). “Because this case involves claims under both federal law and state law, the district court’s jurisdiction rest[s] on a federal question, 28 U.S.C. § 1331, and supplemental jurisdiction, 28 U.S.C. § 1367.” Curry, 949 F.3d at 393. “In a case involving federal question jurisdiction, a federal court has personal jurisdiction over the defendant if either federal law or the law of the state in which the court sits authorizes service of process to that defendant.” Id. (internal quotation marks omitted). The parties do not address whether the federal statutes Plaintiff has invoked authorize nationwide service of process, apparently assuming that they do not, and that Heap is therefore subject to personal jurisdiction “under the laws of the state where the forum is located.” See Kinslow v. Pullara, 538 F.3d 687, 690 (7th Cir. 2008) (“Though some federal statutes expressly 5 provide rules for service of process . . . § 1983 is not one of them.”). The Court assumes the parties are correct and considers them to have waived any argument to the contrary. Therefore, Heap is subject to personal jurisdiction to the extent “authorized both by Illinois law”—in particular, the Illinois long-arm statute, 735 ILCS 5/2–209(c)—“and by the United States Constitution.” be2 LLC v. Ivanov, 642 F.3d 555, 558 (7th Cir. 2011) (citing Fed. R. Civ. P. 4(k)(1)(A)). Because the Illinois long-arm statute permits the exercise of personal jurisdiction “to the full extent permitted by the Fourteenth Amendment’s Due Process Clause,” Tamburo v. Dworkin, 601 F.3d 693, 700 (7th Cir. 2010), there is “no operative difference between these two constitutional limits,” Mobile Anesthesiologists Chicago, LLC v. Anesthesia Assocs. of Houston Metroplex, P.A., 623 F.3d 440, 443 (7th Cir. 2010), so a single inquiry suffices. “The key question is . . . whether the defendants have sufficient ‘minimum contacts’ with Illinois such that the maintenance of the suit ‘does not offend traditional notions of fair play and substantial justice.’” Tamburo v. Dworkin, 601 F.3d 693, 700-01 (7th Cir. 2010) (quoting Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). The nature of the defendant’s contacts with the forum state determines what framework courts use to analyze whether they meet minimum requirements. See Tamburo, 601 F.3d at 701. A defendant is subject to “general jurisdiction” in the forum state if its contacts are so “continuous and systematic” that it can be “regarded as at home” there. See Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 924 (2011); Kipp v. Ski Enter. Corp. of Wis., 783 F.3d 695, 698 (7th Cir. 2015). But no party contends that Heap, a Delaware corporation with its principal place of business in California, can be regarded as at home in Illinois; plainly, general jurisdiction does not apply. That means that personal jurisdiction depends on “specific jurisdiction,” i.e., whether Heap 6 “purposely availed itself of the privilege of conducting business in the forum state or purposefully directed its activities at the forum state,” and whether Plaintiff’s injury arose out of those forum- related activities. Lexington Ins. Co. v. Hotai Ins. Co., Ltd., 938 F.3d 874, 878 (7th Cir. 2019) (cleaned up). To establish specific jurisdiction, the plaintiff “‘cannot be the only link between the defendant and the forum.’” Advanced Tactical Ordnance Sys., LLC v. Real Action Paintball, Inc., 751 F.3d 796, 802 (7th Cir. 2014) (quoting Walden v. Fiore, 571 U.S. 277, 276 (2014)). “Due process requires that a defendant be haled into court in a forum State based on his own affiliation with the State, not based on the random, fortuitous, or attenuated contacts he makes by interacting with other persons affiliated with the State.” Walden, 571 U.S. at 286 (internal quotation marks omitted). The Seventh Circuit has “consistently . . . declined to fashion a special jurisdictional test for Internet-based cases”; instead, it makes the same “traditional due process inquiry” it makes in all other contexts. Curry, 949 F.3d at 398 (internal quotation marks omitted). Thus, to determine whether certain “online activity translates into ‘contacts’ for purposes of the ‘minimum contacts’ analysis,” district courts are to assess whether the defendant “purposefully exploited” or “targeted” the forum state somehow. Advanced Tactical, 751 F.3d at 802-03 (internal quotation marks omitted). It is settled that “simply operating a website accessible in the forum state” does not amount to targeting a jurisdiction, such that the defendant is subject to personal jurisdiction there. Id. at 802. Similarly, sending blast emails to a list of all past customers does not subject a defendant to personal jurisdiction in any state where any such customer might be found; “[s]uch a relation would be entirely fortuitous, depending entirely on activities out of the defendant’s control.” Id. at 803. 7 Plaintiff argues that this case is different from the typical internet-based case because Heap installed “cookies,” which are files on a user’s device that store metadata about the user, here including distinct User IDs, in the devices of Illinois-based users. But even if there is any meaningful distinction to be made on this ground, Plaintiff has not adduced evidence to substantiate it. Heap has submitted a declaration from David Fullerton, its Senior Vice President of Engineering, to establish that Heap does not directly install software on end users’ devices; the installation of cookies is a function of Heap software that website operators—Heap’s customers— integrate into their platforms. (Fullerton Decl. ¶ 4, ECF No. 167-1.) According to Mr. Fullerton, this process is automated, Heap has no control over where its customers’ website users might be found, and Heap has made no effort to target Illinois or any other jurisdiction; it simply provides its software to website operators who want it. (Id. ¶¶ 5-6, 8.) The installation of cookies is thus “fortuitous” and depends on “activities out of [Heap’s] control,” just like the sending of blast emails in Advanced Tactical. See Castelaz v. Estee Lauder Companies., Inc., No. 22 CV 5713, 2024 WL 136872, at *4-5 (N.D. Ill. Jan. 10, 2024); Mayhew v. Candid Color Sys., Inc., 743 F. Supp. 3d 994, 1004-05 (S.D. Ill. 2024). Plaintiff attempts to support his position with only the bare allegations of the complaint concerning installation of cookies (see 1st Am. Compl. ¶¶ 42-43) and certain deposition testimony of Vijay Umapathy, Heap’s Senior Director of Product Management. He must go beyond the pleadings, so citing the complaint allegations gets him nowhere, and Mr. Umapathy’s deposition testimony does not refute the evidence Heap has adduced. True, Mr. Umapathy made certain statements that, viewed in isolation, may seem to create a factual dispute as to whether Heap reaches out to Illinois users on its own. For example, when 8 asked whether “Heap, in connection with the Heap platform, installs cookies on users’ devices,” he answered, “Yes.” (Umapathy Dep. at 36:19-21, ECF No. 156-1 at 20.) But immediately afterward, when asked, “How does Heap do that,” he answered, “I’m not familiar with the technical details.” (Id. at 36:22-23.) Mr. Umapathy is not an engineer or developer, and his job is not coding or programming; he explained that, as a product manager, he assesses and devises plans for adding capabilities to the Heap analytics platform from the standpoint of customer needs. And he confirmed that the Heap platform must first be installed on a customer website before its tracking abilities come into play, which is consistent with Mr. Fullerton’s declaration stating that installation of cookies is an automated function of Heap-enabled websites, not a function Heap deliberately performs. (Umapathy Dep., ECF No. 156-1, at 27, 37.) While the Court must resolve any conflict in the evidence in Plaintiff’s favor at this stage, it may not manufacture a conflict by reading more into Mr. Umapathy’s deposition transcript than is there. See Salkauskaite v. Sephora USA, Inc., No. 18-CV-08507, 2020 WL 2796122, at *5 (N.D. Ill. May 30, 2020) (ruling that deposition testimony taken during jurisdictional discovery did not support the plaintiff’s theory of personal jurisdiction); see also Tianjin Universal Link Enters., Ltd. v. Midwest Contracting Concepts, Inc., No. 16 C 08352, 2017 WL 4157702, at *6 (N.D. Ill. Sept. 19, 2017) (“[W]hile we construe factual disputes in Plaintiff’s favor, the evidence [Plaintiff] offers in support of its prima facie case relies on speculation and fails to draw a connection between [the defendant] and the forum state.”). Taking the deposition testimony as a whole, it does not refute the statements in the Fullerton Declaration unless the Court reads more into Mr. Umapathy’s testimony than he actually said, which would amount to indulging in speculation. “Both parties have had a sufficient opportunity to develop the record,” and Plaintiff has not 9 adduced evidence “indicat[ing[ that a hearing would be helpful,” so the Court resolves the jurisdictional issue based on the documents the parties have submitted. See Initiatives Inc. v. Korea Trading Corp., 991 F. Supp. 476, 477-78 (E.D. Va. 1997). Plaintiff has not made a prima facie showing of personal jurisdiction because he has not shown that Heap purposely exploited or targeted Illinois; to the contrary, any connections between Heap and Illinois appear to be merely fortuitous. See Advanced Tactical, 751 F.3d at 802-03 Mayhew, 743 F. Supp. 3d at 1004-05; Castelaz, 2024 WL 136872, at *4-5, Salkauskaite, 2020 WL 2796122, at *5. Having concluded that Plaintiff has failed to show minimum contacts with Illinois, the Court need not consider whether requiring Heap to litigate this suit in Illinois offends traditional notions of fair play and substantial justice. N. Grain Marketing, LLC v. Greving, 743 F.3d 487, 496 (7th Cir. 2014). Heap’s motion to dismiss for lack of personal jurisdiction is granted. II. Failure to State a Claim A motion under Federal Rule of Civil Procedure 12(b)(6) tests whether the complaint states a claim on which relief may be granted. Richards v. Mitcheff, 696 F.3d 635, 637 (7th Cir. 2012). To state a claim, the plaintiff must “give the defendant fair notice of what the claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotation marks and alteration marks omitted). Under this standard, a plaintiff’s “[f]actual allegations must be enough to raise a right to relief above the speculative level.” Id. Stated differently, the “complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the 10 misconduct alleged.” Id. (citing Twombly, 550 U.S.at 556). The Court must “construe the complaint in the light most favorable to plaintiff, accept all well-pleaded facts as true, and draw reasonable inferences in plaintiff’s favor.” Taha v. Int’l Bhd. of Teamsters, Loc. 781, 947 F.3d 464, 469 (7th Cir. 2020). However, it need not “accept as true legal conclusions, or threadbare recitals of the elements of a cause of action, supported by mere conclusory statements.” Brooks v. Ross, 578 F.3d 574, 581 (7th Cir. 2009). The Court may consider, “in addition to the allegations set forth in the complaint itself, documents that are attached to the complaint, documents that are central to the complaint and are referred to in it, and information that is properly subject to judicial notice.” Williamson v. Curran, 714 F.3d 432, 436 (7th Cir. 2013). Because the Court has concluded that it lacks personal jurisdiction over Heap, it need not reach Heap’s arguments concerning failure to state a claim. That leaves PowerSchool’s motion to dismiss, which CPS joins as to certain claims, namely, those in Counts One, Seven, Nine, Ten, Fourteen, and Nineteen. Where the Court refers below to arguments made by PowerSchool, it shall be understood that CPS adopts them as to the above-referenced claims, and the same reasoning applies to both defendants. Additionally, where the court refers to “PowerSchool,” it shall be understood to refer to collectively to PowerSchool and Hobsons; the Court agrees with PowerSchool that, although Plaintiff asserts claims against Hobsons separately, it is pointless to differentiate between PowerSchool and Hobsons, now that they have merged. A. ECPA Under the Electronic Communications Privacy Act (“ECPA”), any person who “intentionally intercepts . . . or procures any other person to intercept any wire, oral or electronic communication” may be subject to criminal or civil liability. 18 U.S.C. § 2511(1)(a), 18 U.S.C. 11 § 2520. According to one of several exceptions, however, it is “not . . . unlawful . . . for a person . . . to intercept a[n] . . . electronic communication where such person is a party to the communication . . . unless such communication is intercepted for the purpose of committing any criminal or tortious act.” 18 U.S.C. § 2511(2)(d) (emphasis added). PowerSchool argues that it is not liable because (1) the party exception applies and (2) no “procure[r]” theory is available against civil defendants. The Court is not convinced by either argument. 1. Section 2511(2)(d) Party Exception PowerSchool argues that the exception in § 2511(2)(d) applies because PowerSchool was a “party” to any “communication” between class members and Naviance, and, to whatever extent PowerSchool “intercept[ed]” any such communications, it did not do so for any criminal or tortious purpose. Plaintiff responds that PowerSchool “procure[d]” Heap and other third-parties to “intercept” class members’ communications, and, even if it matters under that theory whether PowerSchool was itself a “party” to those communications,3 PowerSchool is still liable because the communications were intercepted for criminal or tortious purposes, namely, the use of information that had been obtained from class members unlawfully. 3 At least one court has observed that the statutory language is at least fuzzy as to whether the party exception applies when the defendant is sued under a procurer theory, rather than as the party who intercepted the communications in question. In Mekhail v. North Memorial Health Care, 726 F. Supp. 3d 916, 926 (D. Minn. 2024), the plaintiff argued “that only a direct interceptor can invoke the party exception, and . . . no party exception applies in procurement and use scenarios.” The court observed that “the statute’s plain language appears to support the interpretation that the party exception was drafted with active interceptors[, not party procurers and users of others’ interceptions,] foremost in mind.” Id. However, the court did not decide the issue, finding no need to reach it because it concluded that the plaintiff’s claim survived dismissal, even assuming that the party exception applied. Id. at 926-28. Although this Court shares the Mekhail court’s concern, Plaintiff does not raise the issue, and, as in Mekhail, the Court need not reach it because Plaintiff’s claim survives dismissal, even if the Court assumes that the party exception applies, because the crime/tort exception-to-the-exception also applies. 12 Both sides cite non-binding district court decisions in favor of their position. The Court finds Plaintiff’s cases more persuasive, at least at this early stage. These cases reason that a defendant who procures a third-party entity to intercept communications and obtain data from users of the defendant’s website, when that data is protected from disclosure by law, is liable under the crime/tort exception-to-the-exception. See A.D. v. Aspen Dental Mgmt., Inc., No. 24 C 1404, 2024 WL 4119153, at *3 (N.D. Ill. Sept. 9, 2024); Kurowski v. Rush Sys. for Health, No. 22 C 5380, 2023 WL 8544084, at *3 (N.D. Ill. Dec. 11, 2023); Mayer v. Midwest Physician Admin. Servs., LLC, No. 23-CV-3132, 2025 WL 963779, at *3 (N.D. Ill. Mar. 31, 2025). K.L. v. Legacy Health, No. 23-CV-1886, 2024 WL 4794657, at *6 (D. Or. Nov. 14, 2024). PowerSchool purports to distinguish these cases based on how the defendants used the intercepted data and because they concerned health data protected by HIPAA, the Health Insurance Portability and Accountability Act, see 42 U.S.C. § 1320d-6, not educational data protected by other statutes, including ISSRA and the Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g. Relevant distinctions between HIPAA and the statutes that Plaintiff invokes in this case, or between the use of the intercepted data in this case and in the cases Plaintiff cites, might appear at later stages of the case. But at this early stage, the Court sees none, and it agrees with the reasoning of the above- cited cases. The party exception does not warrant dismissal because it is at least plausible that the crime/tort exception-to-the-exception applies. 2. Whether Defendants Can Be Liable As “Procur[ers]” PowerSchool argues that it cannot be liable in this civil suit for “procur[ing]” the interception of communications because the term “procure” does not appear in 18 U.S.C. § 2520, the statutory provision that provides a private right of action under ECPA. That provision states, 13 in pertinent part, that “any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of [ECPA] may in a civil action recover from the person or entity . . . which engaged in that violation.” Id. The Fifth Circuit has adopted the interpretation of ECPA that PowerSchool argues for, see Peavy v. WFAA-TV, Inc., 221 F.3d 158, 168 (5th Cir. 2000), but other courts have differed, reasoning that § 2520 broadly “allow[s] for recovery against the ‘person or entity’ which engaged in the violation of § 2511(1)(a).” Boseovski v. McCloud Healthcare Clinic, Inc., No. 16 CV 2491, 2020 WL 68578, at *6 (E.D. Cal. Jan. 7, 2020) (citing Lonegan v. Hasty, 436 F. Supp. 2d 419, 428 (E.D.N.Y. 2006)). The statute does not specify any particular theory by which the “person or entity” must have violated the statute to be subject to civil liability, nor is the Court aware of any reason, textual or otherwise, to read the statute in such a restrictive fashion. Plaintiffs argue for reading the statute in accord with Boseovski and like cases, and the Court agrees. Therefore, Defendants’ motion is denied as to the ECPA claims in Count I. B. Section 1983 PowerSchool argues that Plaintiffs’ § 1983 claims must be dismissed because PowerSchool is not a state actor. The Civil Rights Act of 1871, 42 U.S.C. § 1983, provides that any person who deprives another of constitutional rights “under color” of state law may be held liable in a civil suit for causing the deprivation. “The ultimate issue in determining whether a person is subject to suit under § 1983 is the same question posed in cases arising under the Fourteenth Amendment: is the alleged infringement of federal rights ‘fairly attributable to the State?’” Rendell-Baker v. Kohn, 457 U.S. 830, 838 (1982) (quoting Lugar v. Edmondson Oil Co., 457 U.S. 922, 937 (1982)); see Scott v. Univ. of Chicago Med. Ctr., 107 F.4th 752, 757 n.6 (7th Cir. 2024) (“The state action 14 requirement of the Fourteenth Amendment and the ‘under color of state law’ requirement of § 1983 are treated as identical.”) There is no single test for determining whether the state-action requirement is met, but “[t]he Supreme Court has recognized several scenarios when private entities will be considered state actors for the purpose of a claim pursuant to § 1983.” Scott, 107 F.4th at 757. One such scenario arises when “the state effectively directs, controls, or encourages” a private party’s actions, whether by “‘exercis[ing] coercive power’” or “‘provid[ing] such significant encouragement, either overt or covert, that the choice must in law be deemed to be that of the State.’” Wade v. Byles, 83 F.3d 902, 905 (7th Cir. 1996) (quoting Blum v. Yaretsky, 457 U.S. 991, 1009 (1982)); see also Manhattan Cmty. Access Corp. v. Halleck, 587 U.S. 802, 809 (2019) (explaining that, under Blum, 457 U.S. at 1009, “a private entity can qualify as a state actor . . . when the government compels the private entity to take a particular action”). Other recognized scenarios in which the state action requirement is met include the following: Under the “joint action” or “conspiracy” theory, a private party who conspires with the government to infringe on a plaintiff’s rights will be classified as a state actor. Adickes v. S.H. Kress & Co., 398 U.S. 144, 152 (1970). So, too, will a party performing a function that has traditionally been “the exclusive prerogative of the State.” Jackson v. Metro. Edison Co., 419 U.S. 345, 353 (1974). Courts will also find state action when a private party and the State are interdependent “to the point of largely overlapping identity.” Brentwood Acad. v. Tenn. Secondary Sch. Athletic Ass’n, 531 U.S. 288, 303 (2001). Scott, 107 F.4th at 757 (internal citations altered). These scenarios “‘do not so much enunciate a test or series of factors, but rather demonstrate examples of outcomes in a fact-based assessment,’” which helps to organize the analysis. Id. PowerSchool argues that it merely contracted with CPS to provide a service, and if doing so made it a state actor under § 1983, then any government contractor is a state actor. See Rendell- 15 Baker, 457 U.S. at 840-41 (explaining that “many private corporations . . . depend[] primarily on contracts . . . [with] the government,” but “[a]cts of such private contractors do not become acts of the government by reason of their significant or even total engagement in performing public contracts”). Plaintiff responds that his theory of state action finds support in several of the scenarios the Supreme Court has recognized. The Court agrees with PowerSchool, however, that Plaintiff does not state a claim in accord with any of the recognized theories of state action. First, Plaintiff argues that PowerSchool acted under CPS’s direction and control when it permitted CPS students to use and access the Naviance system at the cost of their personal data, and there is a symbiotic relationship between them with respect to students’ access to the Naviance system. In support of this argument, Plaintiff relies on Woods v. Maryville Academy, No. 17 C 8273, 2018 WL 6045219, at *6 (N.D. Ill. Nov. 19, 2018), and, to a lesser extent, Rodriguez v. Plymouth Ambulance Service, 577 F.3d 816, 823 (7th Cir. 2009). These cases are not analogous. They involve circumstances in which private entities have taken over the state’s responsibility to care for inmates or children in the state’s custody. That custodial function, in a context in which vulnerable people depend entirely on the state for their health and safety, is nothing like the function at issue here, namely, handling student data. Second, Plaintiff argues that CPS delegated a public function—educational recordkeeping—to PowerSchool. But Plaintiff cites no authority establishing that CPS may have delegated to PowerSchool a public function rising to the level of the “exclusive prerogative of the State.” Rendell-Baker, 457 U.S. at 842 (cleaned up). CPS contracted with PowerSchool for a service that required it to handle sensitive student data, but, as PowerSchool argues, the Supreme Court has explained that providing education to high school students generally does not qualify as 16 an “exclusive” public function, and it follows that the element of that function at issue here— handling their data—is likewise not an exclusive public function. See id. (“That a private entity performs a function which serves the public does not make its acts state action.”). Finally, Plaintiff argues that CPS conspired with PowerSchool to obtain student data in violation of their constitutional rights. But Plaintiff makes no allegation plausibly suggesting a “concerted effort between a state actor and” private individuals such as PowerSchool employees to deprive students of their constitutional rights, nor is there any apparent “nexus between the state and the private actors to support a finding that the deprivation committed by the private actor is fairly attributable to the state.” L.P. v. Marian Cath. High Sch., 852 F.3d 690, 696 (7th Cir. 2017) (cleaned up). To the contrary, the allegations are that CPS contracted with PowerSchool so that PowerSchool would provide a service to CPS students, and in providing that service, PowerSchool improperly obtained and disclosed sensitive student data. There is no allegation that CPS was involved in the improper collection of sensitive data, nor that the improper elements of the collection and use of data were essential to the agreement—or even foreseeable, from CPS’s point of view. See id. at 696-97. There is no basis for attributing PowerSchool’s actions to CPS, nor, for similar reasons, does Plaintiff plausibly allege that PowerSchool employees conspired with CPS to deprive students of their constitutional rights. For all these reasons, the motion to dismiss is granted as to the § 1983 claims against PowerSchool and its employees. C. CIPA CIPA imposes liability on anyone who, among other things, “intentionally taps, or makes any unauthorized connection . . . with any . . . instrument,” or who “intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording 17 device to eavesdrop upon or record the confidential communication” of another. Cal. Penal Code §§ 631, 632. Plaintiff claims that Heap eavesdropped on Plaintiff’s communications via Naviance, using student data for its own purposes, and PowerSchool violated the statute by aiding or conspiring with Heap in that endeavor. Defendants argue that this Court should dismiss the CIPA claim because, as some district courts have held, a party to a conversation does not violate CIPA by using a third-party’s data analytics software, where the use of the software represents only the adoption of a tool—a virtual “tape recorder”—rather than the clandestine inclusion of a third-party eavesdropper in the conversation. See, e.g., Graham v. Noom, Inc., 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021). Other decisions have differed where the data analytics vendor recorded the communication itself, such that it was capable of using its record of the communication for its own purposes, even if was engaged to do no more than make the recording. See Turner v. Nuance Commc’ns, Inc., 735 F. Supp. 3d 1169, 1183 (N.D. Cal. 2024) (citing Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 900 (N.D. Cal. 2023)); Cody v. Ring LLC, 718 F. Supp. 3d 993, 1002 (N.D. Cal. 2024). In response to the motion to dismiss, Plaintiff points to allegations of action by Heap that make the reasoning of the latter cases more apposite here than the former. It is at least plausible that Heap eavesdropped on Plaintiff’s communications, and that PowerSchool suborned the eavesdropping, so Plaintiff’s CIPA claim survives the motion to dismiss.4 PowerSchool also 4 The Court notes that Plaintiff may not be able to substantiate these allegations, if his failure to substantiate the allegations going to personal jurisdiction over Heap is any indication. But, under Rule 12(b)(6), unlike under Rule 12(b)(2), the Court does not assess the evidence, nor does it ask what is probable, as opposed to plausible; it “will ask itself could these things have happened, not did they happen.” Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir. 2010); see Alexander v. United States, 721 F.3d 418, 424 (7th Cir. 2013). Under this liberal standard, Plaintiff states a claim. 18 attacks the CIPA claim on grounds of extraterritoriality, but, as the Court will discuss in more detail below, that line of argument is likewise premature at this stage. D. SCA Under the Stored Communications Act, no “person or entity providing an electronic communication service to the public” may “knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service.” 18 U.S.C. § 2702(a). PowerSchool argues that (1) it does not provide an “electronic communication service to the public,” and (2) it did not divulge student data while it was in “electronic storage by that service.” Neither argument supports dismissal at this stage. The first argument depends on whether PowerSchool provided its Naviance product “to the public,” i.e., “to the community at large.” Andersen Consulting LLP v. UOP, 991 F. Supp. 1041, 1042 (N.D. Ill. 1998). PowerSchool contends that it did not because its Naviance product is not available to any student who wants it; it is only available to students in school systems that have contracted for student access to Naviance. But the Court fails to see why it matters whether PowerSchool’s customers are school systems, rather than students. Whether its direct commercial relationships are with students or schools, PowerSchool is in the business of providing Naviance to students in school systems that pay for access to it, and presumably it will provide Naviance to any school system that wants it. It is at least plausible that PowerSchool provides an electronic communication service to the public, i.e., the community at large. As for the second argument, the “electronic storage” that qualifies for protection under the SCA is “temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof” or “storage of such communication by an electronic 19 communication service for purposes of backup protection of such communication.” 18 U.S.C. § 2510(17). PowerSchool argues that “electronic storage” of student data incidental to the use of the Naviance system is not the sort of transitory “storage” that occurs during the transmission of communications, so it is not the kind that the SCA protects. Some courts have found this line of argument convincing, see, e.g., Wesch v. Yodlee, Inc., No. 20-CV-05991, 2021 WL 1399291, at *4 (N.D. Cal. Feb. 16, 2021), and there may be some force in it, but it requires an assessment of the evidence that is inappropriate at the pleading stage. It is at least plausible that Naviance performs the sort of “electronic storage” that the SCA requires. The claim survives dismissal, although PowerSchool may return to the issue at summary judgment, if the evidence supports its position. E. Extraterritoriality and IEA, ISSRA, and CIPA PowerSchool argues that the IEA, ISSRA, and CIPA claims should all be dismissed because these Illinois and California statutes do not apply to wrongful conduct that takes place in other states. Plaintiff responds that the argument is premature at the pleading stage. The Court agrees. Wilk v. Brainshark, Inc., 631 F. Supp. 3d 522, 528 (N.D. Ill. 2022) (“[C]ourts frequently find it premature to dismiss claims at the pleading stage based upon the extraterritorial doctrine given the doctrine’s fact-intensive inquiry.”); Cherkin v. PowerSchool Holdings, Inc., No. 24-CV- 02706-JD, 2025 WL 844378, at *7 (N.D. Cal. Mar. 17, 2025) (ruling that an extraterritoriality challenge to CIPA claims was “premature and may be raised again at the class-certification stage as the record and circumstances warrant”). It is at least plausible that these statutes apply extraterritorially to Plaintiff or other class members; in-depth consideration of the issue is better left for later stages of the case. 20 F. Breach of Contract Plaintiff claims that PowerSchool breached both the Initial Contract and Subsequent Contract by failing to protect his sensitive student data, and that he is entitled to enforce the contracts as a third-party beneficiary. “To succeed on a breach of contract claim, a plaintiff must plead and prove (1) the existence of a valid and enforceable contract, (2) substantial performance by the plaintiff, (3) breach by the defendant, and (4) damages caused by that breach.” Ivey v. Transunion Rental Screening Sols., Inc., 215 N.E.3d 871, 877 (Ill. 2022). A non-party is not entitled to sue to enforce a contract unless he is “someone whom the parties intended to directly benefit by the performance of the contract,” as evidenced by “the language of the contract and the circumstances surrounding its execution.” Crawford v. Belhaven Realty LLC, 109 N.E.3d 763, 776 (Ill. App. Ct. 2018). “Because parties typically enter into contracts to benefit themselves rather than third parties, there is a presumption against intended beneficiary status that can only be overcome by an implication so strong as to be practically an express declaration.” Id. (internal quotation marks omitted). But “if the promisee bargains with the promisor to render a performance directly to a third party, in nearly every case the promisee will have intended to benefit that third party.” Advanced Concepts Chicago, Inc. v. CDW Corp., 938 N.E.2d 577, 581 (Ill. App. Ct. 2010). And “the contract does not need to specifically name the third-party beneficiary as long as it adequately defines a class of individual beneficiaries.” Crawford, 109 N.E.3d at 777. Defendants argue that Plaintiff and students like him are not entitled to sue as third-party beneficiaries of CPS’s contracts with PowerSchool for access to Naviance, arguing that there are no terms in the contract that imply so strongly as to amount to an “express declaration” that the 21 parties intended to benefit Plaintiff and the other class members, rather than themselves. The Court bears in mind, as Defendants argue, that “every contract made by the government is presumed to be for the benefit of its citizens,” and it does not follow that the public has the right to enforce every such contract. Hodges by Hodges v. Pub. Bldg. Comm’n of Chicago, 864 F. Supp. 1493, 1510 (N.D. Ill. 1994). But the fact remains that the contracts at issue required PowerSchool to provide a service directly to students, see Crawford, 109 N.E.3d at 776 (citing Advanced Concepts, 938 N.E.2d at 581), and imposed certain obligations as to how PowerSchool protected student data. Although, in the final analysis, it may turn out that students are mere “user[s],” see Fed. Ins. Co. v. Turner Constr. Co., 660 N.E.2d 127, 132 (Ill. App. Ct. 1995), who lack rights as third-party beneficiaries, Plaintiff has alleged at least enough facts, taken as true, to demonstrate a right to relief that rises above the level of mere speculation. See Bayer HealthCare LLC v. Aeropres Corp., 727 F. Supp. 3d 738, 752 (N.D. Ill. 2024). The briefing is thin on this issue, with the parties occasionally arguing past each other, and the decision may turn on details and “surrounding circumstances” that have not yet been fully aired at this early stage. ReceiverShip Mgmt., Inc. v. A.J. Corso & Assocs., Inc., No. 19-CV-01385, 2021 WL 1222897, at *17 (N.D. Ill. Mar. 31, 2021) (citing In re Chicago Flood Litig., No. 93 C 1214, 1993 WL 239041, at *9 (N.D. Ill. Jun. 28, 1993)). Here, again, the “prudent course is to permit the . . . claims to proceed, with the understanding that Defendants may renew their argument at summary judgment.” Summerland v. Exelon Generation Co., 510 F. Supp. 3d 619, 631 (N.D. Ill. 2020). Defendants also argue that, even putting aside whether Plaintiff is entitled to enforce the contract as a third-party beneficiary, he does not state a claim for breach of contract because the contract permits the disclosure of data to “subcontractors” such as Heap. (See PowerSchool Mem. 22 Ex. 1, CPS/Hobsons Software and Servs. Agr., § 11, ECF No. 136-1 at 9-14.) Plaintiff responds that the collection of data by Heap went much farther than the contract authorized or contemplated. Again, the briefing is thin on this issue, without citations to case law, so the better course is to allow the claims to proceed, at least until summary judgment, when PowerSchool may renew this argument, if the evidence supports it. G. Motion for a More Definite Statement PowerSchool asks, in the alternative, for a more definite statement under Federal Rule of Civil Procedure 12(e), to the extent Plaintiff asserts claims based on allegations of “other online products,” in addition to Naviance, without providing any additional factual detail. A more definite statement is not warranted in the present circumstances. Motions for more definite statement are disfavored, particularly when they are “used to gain additional information,” rather than to correct a pleading that is “unintelligible.” MacNeil Auto. Prods., Ltd. v. Cannon Auto. Ltd., 715 F. Supp. 2d 786, 790 (N.D. Ill. 2010) (internal quotation marks omitted). They “should not be used as a substitution for discovery,” Coleman v. Majestic Star Casino, LLC, No. 2:11-CV-391-PPS-PRC, 2012 WL 1424396, at *1 (N.D. Ind. Apr. 24, 2012), or “when the complaint merely lacks detail,” Panah v. California Dep't of Corr. & Rehab., No. 14-CV-00166-BLF, 2015 WL 1263494, at *5 (N.D. Cal. Mar. 19, 2015); see Boswell v. Panera Bread Co., 91 F. Supp. 3d 1141, 1144 (E.D. Mo. 2015); Allstate Indem. Co. v. Dixon, 304 F.R.D. 580, 582 (W.D. Mo. 2015). Plaintiff’s complaint 23 is sufficiently specific to permit PowerSchool to frame a response, and doubts about the scope of the claim can be resolved in discovery. III. Motion for Interim Class Counsel Under Federal Rule of Civil Procedure 23(g)(3), the Court may “designate interim counsel to act on behalf of a putative class before determining whether to certify the action as a class action.” “Interim class counsel might be appropriate where overlapping, duplicative, or competing class suits are pending before a court, so that appointment of interim counsel is necessary to protect the interests of class members.” Levey v. Concesionaria Vuela Compania de Aviacion, S.A.P.I. de C.V., 529 F. Supp. 3d 856, 866 (N.D. Ill. 2021) (internal quotation marks omitted). Plaintiff seeks appointment as interim class counsel based on other, overlapping cases against PowerSchool, including the above-cited Cherkin action. PowerSchool opposes the motion, and the Court agrees with PowerSchool that Plaintiff has not demonstrated that the sort of rivalry between prospective counsels over substantially overlapping cases that would warrant the appointment of interim class counsel exists here. See McFadden v. Nationstar Mortg. LLC, No. CV 20-166 (EGS), 2022 WL 18542489, at *3 (D.D.C. Mar. 31, 2022). The purportedly related cases that Plaintiff relies on appear to present mostly distinct issues, and the Court considers appointment of interim class counsel to be premature. Plaintiff may re-raise the matter in the future, if circumstances change. Conclusion For the foregoing reasons, Plaintiff’s motion for appointment of interim class counsel [125] is denied; Heap’s motion to dismiss for lack of personal jurisdiction [134] is granted; and PowerSchool/CPS’s motion to dismiss for failure to state a claim [135] is granted in part and denied in part. The motion is granted as to the claims asserted under 42 U.S.C. § 1983; it is 24 otherwise denied. Plaintiff's motion to seal [154] is granted because the redactions are minimal and they appropriately protect certain limited confidential information, while leaving the substance of the dispute open to public view. SO ORDERED. ENTERED: JORGE L. ALONSO United States District Judge 25