govinfo:USCOURTS-casd-3_25-md-03149-5

-1- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
 
 
 
 
 
 
UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF CALIFORNIA 
 
IN RE: POWERSCHOOL 
HOLDINGS, INC. AND 
POWERSCHOOL GROUP, LLC 
CUSTOMER SECURITY BREACH 
LITIGATION. 
) 
) 
) 
) 
) 
) 
) 
) 

 
AMENDED 
ORDER GRANTING IN PART AND 
DENYING IN PART DEFENDANT 
POWERSCHOOL HOLDINGS, INC. 
AND POWERSCHOOL GROUP, 
LLC’S MOTION TO DISMISS 
(TRACK 2) 
 
[Dkt. 302] 
 
I. INTRODUCTION 
This multidistrict litigation arises from a data breach involving Defendants 
PowerSchool Holdings, Inc. and PowerSchool Group, LLC (collectively, 
“PowerSchool”). PowerSchool provides cloud-based data management software for 
students and educators in K-12th. PowerSchool stores sensitive student medical, 
academic, and other personally identifiable information in a searchable format. 
Powerschool moves to dismiss the Track 2 Plaintiffs' claims against it. For the 
reasons set forth below, the Court GRANTS IN PART and DENIES IN PART 
Powerschool’s motion. 
 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 1 of 28
 
-2- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
II. BACKGROUND1 
It is alleged that PowerSchool is a Sacramento-based provider of educational 
management software used by schools. Schools require students, parents, and teachers to 
provide PowerSchool with sensitive personally identifiable information (“PII”), and 
PowerSchool stores and maintains this data. There are approximately 4,700 school 
customers, 4,668,000 teachers and 43,800,000 students affected by Powerschool’s 
maintenance of PII. Powerschool, according to the Complaint, holds out its school 
software product as being a secure repository of PII data. 
On December 20, 2024, the criminal group ShinyHunters used the stolen employee 
credentials of a Powerschool cybersecurity subcontractor (Movate, Inc.) to access 
PowerSchool’s student information system through its PowerSource portal. PowerSchool 
discovered the breach on December 28, 2024, and notified customers on January 7, 2025. 
The hacker(s) exfiltrated PII and demanded a ransom from Powerschool. Powerschool 
paid the ransom. The Complaint alleges that the breach compromised the PII of 
approximately 50 million individuals, PII including social security numbers, medical 
information, financial information, addresses, disability records, and custody information. 
III. APPLICABLE LAW 
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the legal 
sufficiency of the claims alleged in the complaint. Under Federal Rule of Civil 
Procedure 8, a complaint should include a “short and plain statement of the claim 
showing that the pleader is entitled to relief,” and may be dismissed under Rule 12(b)(6) 
if the plaintiff fails to state a cognizable legal theory or has not alleged sufficient facts to 
support such a theory. Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). The 
 
1 When deciding whether to grant a motion to dismiss, the court generally accepts as true 
all well-pleaded factual allegations. Ashcroft v. Iqbal, 556 U.S. 662, 664 (2009). The 
Court is not making findings of fact, but summarizing some of the allegations made in the 
436 page, 81 claim, Consolidated Individual Users Class Action Complaint (filed August 
11, 2025) (Dkt. 259) (“Complaint”). 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 2 of 28
 
-3- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
court construes the alleged facts in the light most favorable to the plaintiff. See Retail 
Prop. Trust v. United Bhd. of Carpenters & Joiners of Am., 768 F.3d 938, 945 (9th Cir. 
2014). However, “courts are not bound to accept as true a legal conclusion couched as a 
factual allegation.” Iqbal, 556 U.S. at 678. 
To survive a motion to dismiss, a complaint must state a claim to relief that is 
plausible on its face. Iqbal, 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly, 550 
U.S. 544, 570 (2007)). A claim has “facial plausibility when the plaintiff pleads factual 
content that allows the court to draw the reasonable inference that the defendant is liable 
for the misconduct alleged.” Twombly, 550 U.S. at 556. If the plaintiff’s explanation is 
plausible, the complaint survives a motion to dismiss under Rule 12(b)(6), “regardless of 
whether there is a more plausible alternative explanation.” Iqbal, 556 U.S. at 678. While 
some courts disagree,
2 this Court is not persuaded that a class action complaint has a 
higher plausibility threshold than a garden variety complaint. 
Thus, a “Rule 12(b)(6) motion tests the sufficiency of a complaint; it does not . . . 
resolve contests surrounding the facts, the merits of the claim, or the applicability of 
defenses.” W. Ins. Co. v. Frontier Homes, LLC, 2018 WL 8220544, at *2 (C.D. Cal. 
Mar. 27, 2018) (quoting King v. Rubenstein, 825 F.3d 206, 214 (4th Cir. 2016)). 
IV. DISCUSSION 
There are two groups of plaintiff school districts asserting claims against 
Powerschool. The School District Amended Class Action Complaint (“CAC”) (Dkt. 
263) sets out eight claims for relief. The School District Direct Action First Amended 
Consolidated Master Complaint (“DAC”) (Dkt. 288) sets forth 46 claims for relief. 
Because both complaints are voluminous and claims for relief manifold, not all claims are 
 
2 See e.g., Grigsby v. Valve Corp., No. C12-0553JLR, 2012 WL 5993755, at *4 (W.D. 
Wash. Nov. 14, 2012) (“Plaintiffs' [class action] complaint must rise to a higher 
plausibility threshold than it would if it were a garden-variety tort claim or a claim 
brought by Mr. Grigsby alone.”). 
 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 3 of 28
 
-4- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
addressed individually and not all grounds for dismissal are mentioned and discussed. 
Claims that are not specifically identified as requiring dismissal are considered to be 
plausible and sufficiently pleaded for purposes of the motion to dismiss. The claims are 
not addressed in numerical order but generally in the order used by the movant. 
A. Joint Motion 
By joint motion, three Direct Action School Plaintiffs’ claims for relief have 
already been dismissed without prejudice: Count 4 (Computer Fraud and Abuse Act), 
Count 23 (New York Education Law), and Count 6 (California Unfair Competition Law). 
See Joint Mot. Dkt. 362; Dkt. 373. 
 B. Powerschool’s Motion to Dismiss 
Powerschool seeks dismissal of the remaining claims for failure to state a claim 
under Rule 12(b)(6). 
1. Breach of Contract Claims 
 
The Track Two school Plaintiffs’ primary claims against Powerschool are based on 
contract agreements for Powerschool software products. Powerschool argues that the 
breach of contract claims (CAC Count 1, DAC Counts 10, 13, 15, 18, 20, 24, 26, 28, 30, 
33, 35, 37, 40, 42 & 44) should be dismissed for failure to plead that Powerschool 
breached the contracts or that plaintiffs have not incurred resulting damages. 
All Track Two Plaintiffs allege that they had contracts with PowerSchool that 
required PowerSchool to perform certain actions related to the Data received from 
Plaintiffs’ users, including encrypting and safeguarding that Data, and that PowerSchool 
breached those contracts. CAC ¶¶ 1, 149-158; DAC passim. 
a. Class Action Plaintiffs 
 
Powerschool first objects that at no point, however, do the Class Action Plaintiffs 
identify which provisions of their contracts with PowerSchool were purportedly breached 
and the absence of such basic factual allegations is fatal to the Class Plaintiffs’ claims, 
citing Young v. Facebook, Inc., 790 F. Supp. 2d 1110, 1117 (N.D. Cal. 2011) (“In an 
action for breach of a written contract, a plaintiff must allege the specific provisions in 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 4 of 28
 
-5- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
the contract creating the obligation the defendant is said to have breached.”). But Young 
does not recite a rigid rule. FRCP Rule 8(e) admonishes courts that “[p]leadings must be 
construed so as to do justice.” And Rule 8(a)(2) requires no more than a “short plain 
statement of the claim showing that the pleader is entitled to relief.” 
The Class Action Plaintiffs use 77 pages to state eight claims. They could have 
been more precise, but a passing review of Powerschool’s 12-page, single-spaced, Main 
Services Agreement (“MSA”) and the associated state-specific Data Services Agreements 
(“DSA”) make clear that there were written contracts that imposed obligations on 
Powerschool to take careful measures to protect the personal information data of school 
students and teachers. For example, Paragraph 5.1 of the New Jersey DSA says that 
“Powerschool will maintain all Customer Data in strict confidence . . . .” Likewise, 
Paragraph 6.1 of the DSA says that “Powerschool will safeguard and maintain the 
confidentiality of Customer Data obtained from the Customer.” Similar obligations are 
set out in Paragraph 7, 8, 9.4.5., and Schedule 1C, Section A.1(1-10). Class Plaintiffs 
have not specifically identified these provisions in their Complaint, but it is obvious that 
they could have. Had they done so, they would have made an already too large and 
overly complicated multi-state class action pleading even more verbose. Construing the 
pleading so as to do justice, as Rule 8 requires, the Class Action Plaintiffs have 
adequately stated a plausible claim for breach of contract. 
b. Direct Action Plaintiffs 
 
Next, Powerschool faults the Direct Action School Plaintiffs for the opposite 
condition. Powerschool objects that the DAC alleges too many contractual provisions 
labeling it as an improper “shotgun pleading” and citing this Court’s decision in Borrego 
Cmty. Health Found. v. Hebets, 2024 WL 1269476, at *6 (S.D. Cal. Mar. 25, 2024) 
(Benitez, J.) (“Shotgun pleadings are pleadings that overwhelm defendants with an 
unclear mass of allegations and make it difficult or impossible for defendants to make 
informed responses to the plaintiff’s allegations.”). Hebets, however, was a quite 
different context in which multiple claims were made against multiple defendants without 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 5 of 28
 
-6- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
specifying which one of the defendants was responsible for which acts or omissions, or 
which of the defendants the claim is brought against. The plaintiff alleged 59 separate 
claims for relief, against 40 different defendants, arising out of 12 distinct schemes to 
siphon money, that took place over a decade of fraudulent conduct, and that failed to 
satisfy the heightened pleading standard of FRCP Rule 9(b). Hebets is a far cry from the 
type of pleading the Direct Plaintiffs have set out in their DAC. 
Powerschool agrees that the Direct Plaintiffs “allege breaches of at least 100 
provisions.” But Powerschool still objects arguing that they “provide no factual 
allegations as to how each contractual provision was breached.” Mot. to Dismiss (Dkt. 
302) at 10; see also at 14 (“While the Direct Plaintiffs identify a litany of different 
statutes that PowerSchool supposedly violated, they fail to allege facts that would explain 
how those statutes were violated and thus fail to allege breach of contract on those 
grounds.”). The DAC is already 243 pages in length. Rule 8 does not require a lengthier 
description of how each of the 100+ contract provisions were breached in order to satisfy 
Rule 8. 
Noting several contractual provisions that require PowerSchool to “safeguard and 
maintain the confidentiality of Customer Data,” Powerschool suggests that “the parties 
did not intend for a cybersecurity incident to constitute some violative ‘disclosure’ of 
customer data.” However, evidence of the parties’ intent must wait for summary 
judgment or trial. 
Powerschool also argues that the Direct Action School Plaintiffs’ “reliance on the 
mere occurrence of the Incident— unadorned by any well-pled facts regarding 
PowerSchool’s vetting and monitoring practices—does not allege a breach of the duty to 
supervise provisions.” But for purposes of Rule 8, the incident which is accompanied by 
other well-pled facts does sufficiently allege a breach of the contractual duty to supervise 
provisions. See e.g., New Jersey DSA ¶¶ 7-9. 
Powerschool also takes issue with the Direct Action School Plaintiffs’ allegations 
of breaches of contractual notice and incident response provisions, where PowerSchool 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 6 of 28
 
-7- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
agreed to notify the School Districts of any security incident “without unreasonable 
delay,” or within a specified time period, and to assist in mitigation of any data incident. 
Powerschool does not dispute the existence of these types of contract provisions but 
instead says that the Direct Action School Plaintiffs do not plausibly identify damages 
arising from the supposed delay in notification, and so their claims should be dismissed 
for lack of damages, citing In re MOVEit Customer Data Sec. Breach Litig., 2025 WL 
2179475, at *27 (D. Mass. July 31, 2025). MOVEit addressed a delay in notification 
claim arising under the California Customer Records Act (Cal. Civ. Code § 1798.82(a)), 
rather than a simple breach of contract claim based on a contractual obligation. The DAC 
sufficiently pleads damages arising from the alleged breach of contract. 
 
c. Limitation of Liability -- CAC and DAC 
 
Powerschool’s arguments hit much harder when it asserts that both the Class 
Action and Direct Action School Plaintiffs seek damages that are barred in substantial 
part by the MSA’s Limitation of Liability clause (¶¶ 11.1, 11.2). Powerschool points out 
that in addition to their request for general damages, Plaintiffs seek special damages, 
expectation damages, consequential damages, and incidental damages. (CAC ¶ 158; 
DAC ¶¶ 353, 393, 434, 482, 524, 608, 674, 710, 774, 827, 891, 949, 1011, 1074, 1137.) 
The Limitation of Liability provision in the MSA, however, makes clear that 
Plaintiffs cannot recover for “any lost profits or funding, revenues, goodwill, or indirect, 
incidental, consequential, cover, business interruption, or punitive damages, whether an 
action is in contract or tort.” MSA § 11.1 (“TO THE MAXIMUM EXTENT 
PERMITTED BY LAW, IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES 
BE LIABLE TO THE OTHER PARTY FOR ANY LOST PROFITS OR FUNDING, 
REVENUES, GOODWILL, OR INDIRECT, INCIDENTAL, CONSEQUENTIAL, 
COVER, BUSINESS INTERRUPTION OR PUNITIVE DAMAGES, WHETHER AN 
ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 7 of 28
 
-8- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
LIABILITY. . . .”).3 The contract specifies in § 11.2 that the cap on monetary liability 
applies “whether an action is in contract or tort and regardless of liability . . . .” 
The allegations in the Track 2 Complaints, taken as a whole, plausibly allege a 
garden variety breach of contract claim involving Powerschool’s numerous customer 
school district entities. The Class Action and Direct Action School Plaintiffs have 
stretched to mold their breach of contract claim into tort actions, such as claims for 
simple negligence and negligence per se. Unfortunately for the contracting Plaintiffs, the 
MSA Limitation of Liability provision (a provision set out in all capital letters in the 
MSA) expressly extends to tort claims under any theory and cuts off any additional 
damages. Consequently, both the Class and Direct Plaintiffs’ tort claims pleaded in 
addition to simple breach of contract claims fail the plausibility test and will be dismissed 
to the extent they seek such damages. 
 d. The Economic Loss Doctrine -- CAC and DAC 
As an alternative to the Limitation of Liability argument, Powerschool says that the 
negligence claims should be dismissed because Plaintiffs seek to recover economic 
damages that are squarely barred by the economic loss doctrine in multiple states, and 
they do not allege facts that would plausibly show that PowerSchool owed any non-
contract duty to its school district customers. Powerschool argues that in at least twelve 
of the states in which Plaintiffs bring claims, they cannot recover in negligence for purely 
economic losses, especially where, as here, the claim arises under a contract and is not 
appropriately addressed in tort. 
“The economic loss doctrine was created judicially and has been adopted in 
various forms throughout the United States.” Grant Treaster, The Confusion Continues: 
The New Dynamic of the Economic Loss Doctrine in Kansas, 62 U. Kan. L. Rev. 1326 
 
3 There is also a contractual cap on monetary liability which is specified as “two times (2X) the total 
amount paid by customer . . . in the twelve (12) months preceding the first incident out of which the 
liability arose.” See MSA § 11.2. 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 8 of 28
 
-9- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
(2014). It is a recent jurisprudential trend. “The economic loss doctrine was first 
officially adopted by the California Supreme Court in the 1965 case of Seely v. White 
Motor Co.” Id. at 1330. In its most basic form, the economic loss doctrine bars plaintiffs 
from making tort claims based on only economic losses. The doctrine is most typically 
applied to product liability claims. 
“The economic loss doctrine has been labeled “obscure,” “confusing,” and 
“concerning.” Id. at 1325. Nevertheless, in 1986 the Supreme Court adopted the 
doctrine in an admiralty case. See E. River S.S. Corp. v. Transamerica Delaval, Inc., 476 
U.S. 858, 872–73 (1986). The Court explained, “[c]ontract law, and the law of warranty 
in particular, is well suited to commercial controversies of the sort involved in this case 
because the parties may set the terms of their own agreements. The manufacturer can 
restrict its liability, within limits, by disclaiming warranties or limiting remedies. In 
exchange, the purchaser pays less for the product. Since a commercial situation generally 
does not involve large disparities in bargaining power, we see no reason to intrude into 
the parties' allocation of the risk.” The Court continues, “[a] warranty action also has a 
built-in limitation on liability, whereas a tort action could subject the manufacturer to 
damages of an indefinite amount. The limitation in a contract action comes from the 
agreement of the parties and the requirement that consequential damages, such as lost 
profits, be a foreseeable result of the breach.” Id. at 874. 
The same allocation of responsibilities supports the application of the doctrine in 
this case. Powerschool, through the MSA, intended to restrict its liability, within limits, 
by limiting remedies. In exchange, the theory goes, the school district Plaintiffs were 
able to pay less for the Powerschool product. Since the commercial situation did not 
involve large disparities in bargaining power, the parties thereby fairly allocated the risks. 
This case, then, falls squarely within the rationale of the economic loss rule, which the 
Supreme Court famously said prevents “contract law [from] drown[ing] in a sea of tort.” 
Id. at 866; see also Serifos Mar. Corp. v. Glencore Singapore Pte Ltd., No. 24-1303-CV, 
2025 WL 1554798, at *3 (2d Cir. June 2, 2025) (“The District Court also correctly 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 9 of 28
 
-10- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
dismissed Serifos's gross negligence cause of action as duplicative of its breach of 
contract claim. ‘It is a well-established principle’ under New York law ‘that a simple 
breach of contract is not to be considered a tort unless a legal duty independent of the 
contract itself has been violated.’”); In re Snowflake, Inc., Data Sec. Breach Litig, 2025 
U.S. Dist Lexis 212557*18 (D. Mont. 2025) (“The economic loss doctrine precludes 
recovery in tort for alleged negligence on a topic covered by a contract unless a plaintiff 
also can demonstrate noneconomic losses . . . .”). 
The School District Plaintiffs allege economic losses stemming from the alleged 
breach of the contracts with Powerschool. They claim in a general fashion that they 
incurred damages consisting of “inflated contract prices”; “additional wages”; “increased 
workload”; cybersecurity expenses and legal fees; costs for transferring data, security 
implementation, and training; “lost opportunity costs”; credit monitoring costs; identity 
theft protection expenses; ongoing monitoring costs; notification expenses; hotline costs; 
and administrative expenses. (CAC ¶ 80; DAC ¶¶ 136, 348, 388, 429, 477, 519.) These 
claims are foreclosed by the contract Limitation of Liability clause, as discussed above. 
Even if the limitation of liability provision did not apply, these additional economic 
losses claimed by the School District Plaintiffs would be barred by the economic loss 
doctrine. 
Powerschool alternatively argues that there is no tort duty that it owes to the school 
district customers. “Regardless of the Court’s application of the economic loss doctrine, 
Plaintiffs’ claims still fail. A negligence claim requires a plaintiff to establish that a duty 
was owed to them.” Although it may be the case that there is no particular duty owed by 
Powerschool to its school district entity customers, the Court need not reach a decision on 
this question because the negligence tort claims are foreclosed by the contractual 
limitation of liability and the economic loss doctrine. After all, as Powerschool 
persuasively argues, even assuming Plaintiffs can allege a general common law duty to 
safeguard personal information, that duty is not one that PowerSchool would owe to the 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 10 of 28
 
-11- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Track Two Plaintiffs which are schools and school districts that merely collected the 
personal information belonging to individual students and teachers. 
 2. Negligence Per Se Claims 
The Direct Action School Plaintiffs plead negligence per se as a separate claim 
(Count 2), while the Class Action Plaintiffs plead negligence per se as part of their 
negligence claim. Powerschool moves to dismiss both. The motion to dismiss the 
negligence per se claims, whether alleged as a separate count or as a theory of 
negligence, will be granted for the same reasons as Plaintiffs’ simple negligence claims. 
 3. Unjust Enrichment Claims (CAC Count 7, DAC Count 3) 
In addition to their simple breach of contract claims against Powerschool, the 
School District Plaintiffs assert claims for unjust enrichment. (CAC Count 7, DAC 
Count 3). Powerschool moves to dismiss. The motion is granted. 
The general rule is summed up like this: “as a matter of law, a quasi-contract 
action for unjust enrichment does not lie where, as here, express binding agreements exist 
and define the parties' rights. When parties have an actual contract covering a subject, a 
court cannot— not even under the guise of equity jurisprudence—substitute the court's 
own concepts of fairness regarding that subject in place of the parties' own contract.” 
California Med. Ass'n, Inc. v. Aetna U.S. Healthcare of California, Inc., 94 Cal. App. 4th 
151, 172 (2001). In a similar case, where a person’s PII was exfiltrated in a data breach 
in New Jersey the court found that she could not assert an unjust enrichment claim 
against an insurer to which she gave her PII explaining, “[t]he FAC lacks any allegations 
that Defendant benefited from Plaintiff's PII, by, for example, selling the data or 
otherwise commercially profited from same. Without this, Plaintiff's unjust enrichment 
claim fails.” Adkins v. Everest Glob. Servs., Inc., No. CV 23-004 (RK), 2024 WL 
3887127, at *12 (D.N.J. Aug. 21, 2024). 
In this case the school Plaintiffs (which are artificial entities) lost no PII of their 
own. There are no allegations that a school or school district lost in the data breach its 
own social security number, date of birth, age, or health information from which 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 11 of 28
 
-12- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Powerschool was unjustly enriched by, for example, selling such PII data. There appears 
to be nothing given by Plaintiffs to Powerschool by which Powerschool was enriched or 
profited over and above the contracted amounts paid. The theory of unjust enrichment in 
the context presented by this case, viewing the CAC and DAC as a whole, simply does 
apply. Like the New York court points out in In re Waste Mgmt. Data Breach Litig., 
2022 WL 561734, at *6 (S.D.N.Y. Feb. 24, 2022), in a typical data breach case it is the 
“third-party hackers [that] benefitted at the expense of both the plaintiffs and [the data 
breached defendant], and it is that person or persons which in equity and good conscience 
owes restitution to the plaintiffs.” The unjust enrichment claims are dismissed. 
 4. Fraudulent Concealment Claim (DAC Count 5) 
Only the Direct Action Plaintiffs assert a claim against Powerschool for fraudulent 
concealment. (DAC Count 5). Powerschool moves to dismiss on two grounds. First, it 
argues that the complaint does not satisfy the heightened pleading standard required by 
FRCP Rule 9(b). That is correct. More importantly, even if the more stringent 
requirements of Rule 9(b) were to be satisfied, the Direct Action Plaintiffs would be 
unable to plausibly allege that PowerSchool had a duty to disclose concealed information 
that is separate and apart from its contractual duty to perform under their contracts. The 
motion to dismiss is granted. 
 5. The Federal CFAA (CAC Count 4, DAC Count 4) 
Both groups of Track Two Plaintiffs put forth claims that Powerschool violated the 
federal Computer Fraud and Abuse Act, 18 U.S.C. Section 1030, et seq. The CFAA is a 
criminal statute defining a crime of improperly accessing a protected computer. 
Musacchio v. United States, 577 US 237, 240 (2016). “Hacking” is a useful euphemism 
for unauthorized or criminal access to a computer network. Although hacking does not 
appear in the text, the CFAA is fairly described as an anti-hacking statute. See United 
States v. Nosal, 676 F.3d 854, 857-58 (9th Cir. 2012). “CFAA violations require a 
person to engage in the hacking . . . .” Koninklijke Philips N.V. v. Elec-Tech Int’l Co., 
2015 WL 1289984, at *4 (N.D. Cal. Mar. 20, 2015). Plaintiffs do not claim Powerschool 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 12 of 28
 
-13- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
engaged in hacking or was the hacker that infiltrated its own system to exfiltrate PII and 
demand from itself a ransom for the return of its PII. That would be a novel claim. 
But Plaintiffs appear to allege facts describing a different, but equally novel, crime. 
Plaintiffs allege Powerschool made contractual promises to Plaintiffs that it would in 
essence keep student and teacher PII safe from hackers. Plaintiffs then allege that 
Powerschool negligently breached its contractual promises in various ways thereby acting 
without authorization and in criminal violation of the CFAA. In the process, 
Powerschool left open a network vulnerability which a third-party criminal Shiny Hunter 
actor took advantage of in order to exfiltrate Plaintiffs’ PII. See CAC paras 184-209. 
The CFAA does not reach so far. As the Ninth Circuit said in Nosal, construing the 
statute that way would “expand its scope far beyond computer hacking to criminalize any 
unauthorized use of information obtained from a computer.” 676 F.3d at 859. “This 
would make criminals of large groups of people who would have little reason to suspect 
they are committing a federal crime.” Id. 
Instead, Plaintiffs point to provisions of the CFAA as the basis for Powerschool’s 
alleged liability. See CAC ¶ 185 (citing 18 U.S.C. §§ 1030(a)(2)(C) & (a)(5)(C)); DAC 
¶¶ 201-02 (citing 18 U.S.C. §§ 1030(a)(4) & 1030(a)(5)(B)). But Plaintiffs do not allege 
that Powerschool was the hacker of its own computers. Each of these CFAA provisions 
requires the defendant to have accessed a computer either “without authorization” or in a 
manner that “exceeds authorized access,” and to have done so either knowingly or 
intentionally. The weak point of this claim is that Powerschool, of course, accessed its 
own computers with authorization. How could it be otherwise? Plaintiffs by contract 
hired Powerschool to use its computers to continually access and maintain Plaintiffs’ data 
as Plaintiffs’ needs required. Additionally, a plaintiff must allege they have suffered 
“damage or loss by reason of [the CFAA] violation.” 18 U.S.C. § 1030(g). At bottom, 
Plaintiffs’ theory is something along the lines of: we gave Powerschool our students’ data 
to maintain and store so it would be in a useful format, but Powerschool did not actually 
have our authorization to maintain or store the data in the careless way that it did and 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 13 of 28
 
-14- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
when it did we suffered a loss and Powerschool violated the CFAA. The claim is 
implausible in its present form. Rather, Plaintiffs’ allegations demonstrate that 
PowerSchool was the victim of an outside hacker. Because Plaintiffs have failed to 
plausibly allege any of these elements, their CFAA claims are dismissed. 
 6. The State CDAFA (CAC Count 5) 
The Class Action Plaintiffs assert a claim under California Penal Code § 502 
known as the California’s Comprehensive Data Access and Fraud Act (“CDAFA”). The 
CDAFA, like the CCDA, is a criminal statute. Plaintiffs piggyback onto their CFAA 
allegations using similar language and theories for their CDAFA claim. CAC ¶ 222. As 
described in paragraphs 184 through 209 of the CAC, the Class Action Plaintiffs claim 
that in addition to violating the CFAA, PowerSchool violated the CDAFA by knowingly 
and without permission accessing, using, or damaging, Plaintiffs’ and Class Members’ 
data; using Computer Services; assisting in unauthorized access; and causing 
unauthorized access to Plaintiffs’ and Class Members’ Computer Systems, including in 
furtherance of a scheme to defraud and to wrongfully obtain data and property. 
Powerschool moves to dismiss for two reasons. 
First, argues Powerschool, the CDAFA does not apply because PowerSchool did 
not actually participate in unauthorized hacking, which is a requirement for liability 
under the Act. Powerschool suggests that courts have recognized that the CDAFA is not 
meant to impose liability on a defendant when it is a third-party hacker that gains 
unauthorized access to a defendant’s system. See Claridge v. Rock You, Inc., 785 F. 
Supp. 2d 855, 863 N.D. Cal. 2011). Claridge is persuasive. Claridge strictly construed 
the CDAFA statute because it is a criminal statute and found that the legislature intended 
to reach third party hackers, rather than firms that may have “failed to provide a 
sufficiently secure computer system.” Id. at 863. 
The Class Plaintiffs retort that the CDAFA creates broader liability than the CFAA 
in that it predicates liability on as little as “knowing access” rather than unauthorized 
access, relying on Facebook, Inc. v. Power Ventures, 844 F.3d 1058, 1069 (9th Cir. 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 14 of 28
 
-15- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
2016). Perhaps so, but Facebook was addressing a different context where authorized 
access had been formally withdrawn (in a cease and desist letter to the defendant) after 
which the defendant acted to circumvent Facebook’s IP barriers to knowingly gain 
systems access. Id. at 1068. That is not the allegation in the present case. Therefore, 
Powerschool’s motion to dismiss is granted for the CDAFA claims. 
 7.The Illinois Biometric Privacy Act (DAC Count 17) 
The Illinois’ Biometric Privacy Act (“BIPA”) regulates the collection, use, and 
handling of biometric data. It applies only to entities “in possession of” biometric data. 
See 740 Ill. Comp. Stat. 14/15(e). The Direct Action Plaintiffs claim Powerschool 
violated the Act’s restrictions on possession of biometric data. “As a private entity in 
possession of this data containing biometric identifiers and biometric information, 
PowerSchool was required to do the following pursuant to 740 Ill. Comp. Stat. Ann. 
14/15(e): . . . .” DAC ¶ 457. Plaintiffs assert that PowerSchool collects biometric 
information of students because: it “enables students and others to log in to its 
smartphone application, PowerSchool Mobile, by using biometric identifiers including 
Face ID, Touch ID, or Secure ID.” DAC ¶¶ 34, 456. Under the Act, a firm that 
possesses such data is required to use the reasonable standard of care used within the 
firm’s industry and in a manner that is at least as protective as the way the firm protects 
other sensitive information. Plaintiffs allege that standard of care was not met, and that 
“Biometric information is contained within the data that was compromised.” DAC at ¶ 
461. 
Courts have recognized that allegations such as “PowerSchool enabled users to log 
in to a mobile app with Face ID or Touch ID” would not suffice to allege that 
PowerSchool received such data. G.T. v. Samsung Elecs. Am. Inc., 742 F. Supp. 3d 788, 
796 (N.D. Ill. 2024) (dismissing BIPA claim where plaintiff merely alleged that 
defendant controlled an app and its technology, but not that defendant had control over 
biometric information generated from the app). G.T. is persuasive. But Plaintiffs go 
farther and allege that Powerschool also possessed such data -- which was not the case in 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 15 of 28
 
-16- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
G.T. Powerschool takes a better approach when it argues that even if it did possess such 
data, Plaintiffs do not allege that they themselves provided any biometric information to 
PowerSchool. According to the Complaint, it is not the students or other humans who 
provided biometric data that are the named plaintiffs in Track Two. Plaintiffs here are 
Illinois school entities. Consequently, the Court concludes that the Direct Action School 
Plaintiffs are not the “person[s] aggrieved” with the right to bring a private action under 
the BIPA. For all of these reasons, the motion to dismiss the Illinois biometric data claim 
is granted. 
 8. The Consumer Protection Statute Claims (CAC Count 6, DAC 
Counts 12, 14, 16, 19, 21, 22, 25, 27, 29, 31, 34, 38, 41, 43 & 45) 
The Class Plaintiffs bring a claim under the California Unfair Competition Law 
(“UCL”) (CAC Count 6), and the Direct Action Plaintiffs bring claims under the state 
consumer protection statutes of 14 additional states (collectively, the “Consumer 
Protection Claims”). 
 a. California UCL Claim by Class Action Plaintiffs 
Powerschool moves to dismiss the Class Action Plaintiffs’ California UCL claim 
(Count 6) arguing, first, that the Class Plaintiffs are not located in California and 
therefore cannot bring an extraterritorial claim under California’s UCL. Powerschool is 
correct that the application of California law is limited by the presumption against 
extraterritorial application. The California Supreme Court has said that “[n]either the 
language of the UCL nor its legislative history provides any basis for concluding the 
Legislature intended the UCL to operate extraterritorially. Accordingly, the presumption 
against extraterritoriality applies to the UCL in full force.” Sullivan v. Oracle Corp., 51 
Cal. 4th 1191, 1207 (2011). Consequently, California generally does not extend the 
application of the UCL beyond state lines. See, e.g., Diva Limousine, Ltd. v. Uber 
Techs., Inc., 392 F. Supp. 3d 1074, 1094 (N.D. Cal. 2019) (“It is well-established that the 
UCL does not apply extraterritorially.”). The Class Plaintiffs cannot bring a UCL claim 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 16 of 28
 
-17- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
because they cannot show a “clearly expressed” legislative intent to apply the UCL 
extraterritorially. 
Secondly, Powerschool argues that the Class Plaintiffs cannot proceed under the 
UCL because they do not allege lacking an adequate remedy at law. The Court agrees. 
Zaback v. Kellogg Sales Co., 2020 WL 6381987, at *4 (S.D. Cal. Oct. 29, 2020) 
(dismissing UCL claim due to plaintiff’s failure to plead he lacked an adequate remedy at 
law); Sonner v. Premier Nutrition Corp., 971 F.3d 834, 845 (9th Cir. 2020) (“Regardless 
of whether California authorizes its courts to award equitable restitution under the UCL . 
. . when a plain, adequate, and complete remedy exists at law, we hold that federal courts 
rely on federal equitable principles before allowing equitable restitution in such 
circumstances. And because [plaintiff] fails to demonstrate that she lacks an adequate 
legal remedy in this case, we affirm the district court's order dismissing her claims for 
restitution.”). Therefore, Powerschool’s motion to dismiss the Class Plaintiffs’ UCL 
claim (Count 6) is granted. 
 b. State Consumer Protection Laws -- Direct Action Plaintiffs 
The Direct Action Plaintiffs bring state law statutory claims under the laws of 15 
states. 
 i. New York, Rhode Island, Utah, Vermont, and Virginia 
Powerschool asserts that claims under the New York, Rhode Island, Utah, Vermont, 
and Virginia statutes should be dismissed because Plaintiffs cannot allege, as these 
statutes generally require, that its software product was primarily used for personal, 
family, or household use. For example, Utah’s statute applies only to a “consumer 
transaction” for goods or services for “primarily personal, family, or household 
purposes.” Utah Code Ann. § 13-11-3(2)(a)(i) (emphasis added). Vermont’s statute is 
similarly intended to protect a person as defined as follows: “Consumer” means any 
person who purchases, leases, contracts for, or otherwise agrees to pay consideration for 
goods or services . . . for the person's use or benefit or the use or benefit of a member of 
the person's household, or in connection with the operation of the person's household or 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 17 of 28
 
-18- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
a farm. . . . “ Vt. Stat. Ann. tit. 9, § 2451a(1) (emphasis added). The claim based on 
Oklahoma’s consumer protection statute (Count 43) falls into the same camp. The 
Oklahoma statute “gives a private right of action only to ‘an aggrieved consumer.’” 
Patterson v. Beall, 19 P.3d 839, 846 (Okla. 2000). 
The Direct Action Plaintiffs disagree, but their rationale is unpersuasive. The 
Direct Action School Plaintiffs explain that Powerschool’s products are used by the 
students and families that they serve. Therefore, the Direct Action School Plaintiffs 
propose, that “Plaintiffs are consumers acting as the vector through which persons, 
families, and households use Powerschool’s products.” Oppo. (Dkt. 343) at 31 
(emphasis added). The weakness of the argument is that these types of statutes are 
intended to protect human consumers rather than “vectors” or corporate intermediaries. 
Consequently, Powerschool’s argument for dismissing these types of consumer 
protection claims is more persuasive. 
The exception is New York’s statute, as Plaintiffs point out. New York’s statute 
does not have the same limiting “personal use” requirement; the New York statute 
protects businesses as well as individual consumers from deceptive advertising. See Gen. 
Bus. Law §§ 349. Therefore, Powerschool’s motion to dismiss is granted as to the 
Rhode Island (Count 34), Utah (Count 12), Vermont (Count 25), Virginia (Count 38), 
and Oklahoma (Count 43) consumer protection claims; the motion to dismiss is denied as 
to the New York Gen. Bus. Law section 349 (Count 21) statutory claim. 
 ii. California and Wisconsin 
Powerschool also argues that both the Class Action and the Direct Action School 
Plaintiffs’ consumer protection claims, whether under the states addressed above or the 
remaining states, fail for additional reasons. In particular, Powerschool says that 
Plaintiffs’ allegations assert that PowerSchool made misrepresentations and omissions 
about its data security practices and procedures. See CAC ¶¶ 233(d)-(g) (California); 
DAC ¶¶ 359-65 (Utah), 397-402 (Wisconsin). Because these claims sound in fraud, 
Plaintiffs must satisfy the heightened pleading standard of Federal Rule of Civil 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 18 of 28
 
-19- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Procedure 9(b). For Rule 9(b), a plaintiff must state with particularity the “who, what, 
where, and when of the allegedly false or fraudulent representation.” In re MOVEit, 2025 
WL 2176590, at *3; Sony I, 996 F. Supp. 2d at 959 (requiring pleading of “time, place, 
and specific content of the false representations as well as the identities of the parties to 
the misrepresentation”). The Utah claim is dismissed above. The California and 
Wisconsin claims as pleaded do not sound primarily in fraud so as to require Rule 9(b) 
pleading specificity so Powerschool’s motion to dismiss on this ground is denied. But 
Powerschool has other theories and objections to the remaining state law statutory claims. 
 iii. Arizona, South Carolina, New York, Tennessee, Utah, 
Vermont, Virginia, Washington, and Wisconsin 
Powerschool next argues more generally that “most of the statutes at issue require 
a causal link between the alleged misrepresentation and the plaintiffs’ claimed injury,” 
and/or reliance on the allegedly deceptive conduct. Powerschool then maintains that 
Plaintiffs do not allege when, how, or even if they saw PowerSchool’s advertisements or 
marketing materials, much less that they relied on them to their detriment, pointing to 
integration clauses in the MSA agreements. 
For example, the Powerschool contracts with the plaintiff schools expressly 
provide that “[e]ach Party acknowledges that it has not made any promise or 
representation that is not expressed in this Agreement.” MSA § 14.9. Consequently, 
Powerschool argues that the Direct Action School Plaintiffs do not plausibly allege 
reliance on Powerschool’s misleading advertising which would be necessary to recover 
under these typical consumer protection state statutes. The Court agrees. 
Take the Direct Action School Plaintiffs’ claim made under Arizona’s consumer 
protection statute (Count 41). In that claim, the school Plaintiffs allege: “PowerSchool 
published on its website the statement that PowerSchool ‘invests in updated security 
technology and adheres to strict security regulations’ while representing on its website 
that it supposedly did these acts to ‘keep your data secure.’ Also, through its website, 
PowerSchool represented itself as an ‘industry leader for protected private data.’ 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 19 of 28
 
-20- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
PowerSchool made representations to members of the public that they could ‘trust’ 
PowerSchool to safeguard and protect children's personal information.” See DAC ¶1018 
(emphasis added). The school Plaintiffs’ South Carolina consumer protection act claim 
(Count 19) is similar. The claim alleges: “PowerSchool repeatedly advertised on its 
website that PowerSchool ‘invests in updated security technology and adheres to strict 
security regulations’ while representing that it did so to ‘keep your data secure.’ Also 
through its website, PowerSchool advertised itself as an ‘industry leader for protected 
private data.’ PowerSchool continually used advertisements and promotions of its 
services to make representations to members of the public that they could ‘trust’ 
PowerSchool to safeguard and protect children's personal and private information.” DAC 
at ¶ 490 (emphasis added); see also Utah (Count 12) at ¶ 360 (same); Vermont (Count 
25) at ¶615 (same); Washington (Count 45) at ¶1144 (same); New York (Count 22) at ¶ 
549 (“PowerSchool published on its website the statement that PowerSchool ‘invests in 
updated security technology and adheres to strict security regulations’ while representing 
on its website that it did so to ‘keep your data secure.’ Also through its website, 
PowerSchool represented itself as an ‘industry leader for protected private data.’”) 
(emphasis added); Tennessee (Count 29) at ¶ 715 (“Before entering into contracts with 
the Tennessee Districts and throughout the duration of the Parties' commercial 
relationship, PowerSchool published in promotional, marketing, and advertising 
materials statements. . . .”) (emphasis added); Virginia (Count 38) at ¶ 954 (“Both before 
entering into contracts with the Virginia Districts and throughout the duration of the 
Parties' commercial relationship, PowerSchool published in promotional, marketing, and 
advertising materials statements . . . .”) (emphasis added). 
In each of these claims the Direct Action School Plaintiffs plead that they relied on 
misleading statements that were part of advertising or website statements made to the 
general public. At the same time, however, the school Plaintiffs allege that they each 
entered into direct written contracts with Powerschool with full integration clauses. 
Applying the federal plausibility standard for pleading, the school Plaintiffs’ claims that 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 20 of 28
 
-21- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
they relied on advertising statements rather than the actual negotiated terms of the MSA 
agreements fall short of satisfying the plausibility requirement. The relied upon 
consumer protection statutes do not contemplate placing liability where a sophisticated 
entity is the consumer and that entity enters into a written contract that excludes the 
allegedly misleading general advertising statements. Plaintiffs do not cite cases to the 
contrary. 
Therefore, because the claims discussed above lack plausible allegations of 
reliance or causation in view of the written MSAs, Powerschool’s motion to dismiss the 
consumer protection claims based upon the consumer protection statutes of the states of 
Arizona, South Carolina, New York (Gen. Bus. Law section 350), Tennessee, Utah, 
Vermont, Virginia, Washington, and Wisconsin, is granted. 
 iv. Idaho, New Hampshire and Pennsylvania 
In a similar vein, the Direct Action School Plaintiffs allege Powerschool misled 
them and are thus liable under the consumer protection statutes of Idaho (Count 27), New 
Hampshire (Count 31) and Pennsylvania (Count 36). However, rather than claiming 
Powerschool made misleading affirmative statements in its public statements, for these 
claims the school Plaintiffs assert that Powerschool made omissions about weaknesses in 
its data security. Here is an example from the Idaho consumer protection statute claim 
(Count 27) at ¶ 682: “The Idaho Districts justifiably acted or relied to their detriment 
upon PowerSchool's omissions of fact concerning the above-described omissions and 
representations regarding PowerSchool's data security practices and procedures, as 
evidenced by their purchase of PowerSchool's products and services.” (Emphasis added.) 
The New Hampshire consumer protection claim similarly relies on omissions 
(Count 31) at ¶¶ 779-781: “In purchasing PowerSchool's products and services, the New 
Hampshire Districts were deceived by PowerSchool's failure to disclose that 
PowerSchool, contrary to its representations, did not: a. properly encrypt data; b. 
implement multi-factor authentication; c. monitor for unauthorized access; d. ensure that 
its staff was adequately trained to recognize and respond to cyber threats; e. regularly and 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 21 of 28
 
-22- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
proactively patch vulnerabilities that could be exploited by hackers; and f. properly 
isolate sensitive student and teacher data from other less secure systems. The New 
Hampshire Districts reasonably relied on PowerSchool's omissions, and they did not and 
could not unravel PowerSchool's deception on their own. PowerSchool's concealment, 
suppression, and omission of material facts were likely to and did in fact deceive 
reasonable consumers.” (Emphasis added); see also DCA Count 36 (Pennsylvania) at ¶ 
896 (“PowerSchool . . . failed to disclose the truth about the measures and protocols it 
implemented to protected data containing PII that was entrusted to it, and did so with the 
intent that consumers rely on that failure to disclose in deciding whether to purchase its 
EdTech products and services.”) (emphasis added). 
Applying the federal plausibility standard for pleading, the Direct Action School 
Plaintiffs’ claims that they were misled by omissions beyond the actual negotiated terms 
of the MSA agreement fall short of satisfying the plausibility requirement. The 
applicable consumer protection statutes do not contemplate placing liability where a 
sophisticated entity is the consumer and that entity enters into a written contract that 
excludes any other statements or omissions. And again, Plaintiffs do not cite cases to the 
contrary. 
Therefore, because the claims discussed above lack plausible allegations of 
reliance or causation in view of the written MSAs, Powerschool’s motion to dismiss the 
consumer protection claims based upon the consumer protection statutes of the states of 
Idaho, New Hampshire and Pennsylvania, is granted. 
4 
 
4 Powerschool makes an alternative argument that in order to correctly plead a claim 
based on unlawful, unfair, or unconscionable conduct under several of the state statutes, 
they must allege that PowerSchool’s conduct offends established public policy, is 
“immoral, unethical, oppressive, unscrupulous,” or substantially injurious to consumers, 
citing Ahern v. Apple Inc., 411 F. Supp. 3d 541, 579-80 (N.D. Cal. 2019) (Illinois, New 
Hampshire, North Carolina); Okla. Stat. Ann. tit. 15, § 752(14) (Oklahoma); Ames v. 
Oceanside Welding & Towing Co., 767 A.2d 677, 681 (R.I. 2001) (Rhode Island) (“In 
looking to determine whether a practice is “unfair” under the statute, this Court considers: 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 22 of 28
 
-23- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
 9. The New Hampshire, Virginia, and Washington Data Breach 
Notification Laws (DAC Counts 32, 39 & 46) 
The Direct Action School Plaintiffs also assert claims alleging violations of the 
data breach notifications laws of New Hampshire, Virginia and Washington (Counts 32, 
39 & 46). Powerschool moves to dismiss because Plaintiffs do not allege facts 
demonstrating PowerSchool’s notification was unreasonably delayed or that they were 
injured by any delay in receiving notice. 
New Hampshire’s statute requires one to “notify and cooperate with the owner or 
licensee of the information of any breach of the security of the data immediately 
 
(1) Whether the practice, without necessarily having been previously considered 
unlawful, offends public policy as it has been established by statutes, the common law, or 
otherwise-whether, in other words, it is within at least the penumbra of some common-
law, statutory, or other established concept of unfairness; (2) whether it is immoral, 
unethical, oppressive, or unscrupulous; (3) whether it causes substantial injury to 
consumers (or competitors or other businessmen).”); World Cam, LLC v. Omnibond Sys., 
LLC, 2021 WL 4132100, at *6 (D.S.C. Sept. 9, 2021) (South Carolina) (“A trade practice 
is ‘unfair’ when it is offensive to public policy or when it is immoral, unethical, or 
oppressive; a practice is ‘deceptive’ when it has a tendency to deceive.”); Picket Fence 
Preview, Inc. v. Zillow, Inc., 623 F. Supp. 3d 371, 382 (2022) (Vermont) (the Vermont 
Supreme Court has reiterated that in order to recover for an alleged violation of § 2453 of 
the VCPA, a plaintiff must establish that they are a consumer); Taylor v. Amazon.com, 
Inc., 2025 WL 104381, at *5 (W.D. Wash. Jan. 15, 2025) (Washington) (“To prevail in a 
private CPA claim, the plaintiff must prove (1) an unfair or deceptive act or practice, (2) 
occurring in trade or commerce, (3) affecting the public interest, (4) injury to a person's 
business or property, and (5) causation.”); Cotte v. CVI SGP Acquisition Tr., 2022 WL 
464307, at *10 (D. Utah Feb. 15, 2022) (Utah) (“And Plaintiffs have failed to allege any 
facts specifically demonstrating unconscionability, must less any facts that would rise to 
the level of “extreme unfairness” required to constitute unconscionability.”). 
Powerschool argues that Plaintiffs do not explain how their allegations of negligent or 
inadequate cybersecurity countermeasures rise to the level of “immoral,” “unethical,” 
“oppressive,” or the equivalent. 
Because these state consumer protection statutory claims are dismissed for other 
reasons, the argument is not resolved here. 
 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 23 of 28
 
-24- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
following discovery. . . .” N.H. Rev. Stat. Ann. § 359-C:20. Virginia’s statute provides 
that notice of a data breach is to be given “without unreasonable delay.” However, it also 
provides that, “[n]otice required by this section may be reasonably delayed to allow the 
individual or entity to determine the scope of the breach of the security of the system and 
restore the reasonable integrity of the system.” Va. Code Ann. § 18.2-186.6(B) 
(emphasis added). Washington’s data breach notification statute provides, [n]otification 
to affected consumers under this section must be made in the most expedient time 
possible, without unreasonable delay, and no more than thirty calendar days after the 
breach was discovered . . . .” Wash. Rev. Code Ann. § 19.255.010(8) (emphasis added). 
The Direct Action School Plaintiffs here simply allege: “Powerschool breached that 
obligation.” DAC at ¶1165. 
When the plausibility requirement is applied for evaluating these three claims for 
alleged delay, the school Plaintiffs do not state claims upon which relief may be granted. 
Powerschool’s breach announcement is alleged to have been initiated only ten days after 
the breach was discovered including weekends and national holidays. Ten days of 
“delay” is reasonable and would likely satisfy the notice obligations imposed by any of 
these three state statutes. Therefore, Powerschool’s motion to dismiss the Direct Action 
School Plaintiffs’ claims alleging violations of the data breach notifications laws of New 
Hampshire, Virginia, and Washington (Counts 32, 39 & 46) is granted. 
 10. Express Indemnity (DAC Count 6) 
The Direct Action School Plaintiffs also assert a claim for indemnification, which 
is premised upon a provision in the MSA specifying that PowerSchool “will defend 
Customer . . . from and against any claim, demand, suit or proceeding brought by a third 
party against a Customer” under certain circumstances. DAC ¶ 245; MSA § 10.1. 
Powerschool asks that this claim be dismissed because the Direct Action School Plaintiffs 
do not identify any actual third-party claim as of today that would make their indemnity 
claim ripe for adjudication. The Plaintiffs instead seek declaratory relief, “whereby this 
Court will use its authority under 28 U.S.C. §§ 2201, et seq., to issue a declaration that, in 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 24 of 28
 
-25- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
the event that Plaintiffs are sued as a result of PowerSchool’s failure to adequately secure 
the PII at issue, Plaintiffs will be indemnified.” DAC ¶ 247 (emphasis added). The 
Declaratory Judgment Act (“DJA”) does require an “actual controversy.” 28 U.S.C. § 
2201(a) (emphasis added). And a “claim is not ripe for adjudication if it rests upon 
contingent future events that may not occur as anticipated, or indeed may not occur at 
all.” On the other hand, the Plaintiffs state a claim that is plausible. The claim may or 
may not eventually prove to be ripe by the time of trial, but permitting the claim to go 
forward rather than requiring an amendment later better serves scarce judicial resources. 
Therefore, the motion to dismiss Count 6 is denied. 
 11. Class Action Plaintiffs’ Claim for Declaratory And 
Injunctive Relief (CAC Count 8) 
The Class Action Plaintiffs state a claim for declaratory and injunctive relief Count 
8). Powerschool moves to dismiss. The Declaratory Judgment Act mainly provides a 
remedy, not an independent cause of action. City of Reno v. Netflix, Inc., 52 F.4th 874, 
878–79 (9th Cir. 2022) (“We agree with our sister circuits that have considered the issue 
that the Declaratory Judgment Act does not provide an affirmative cause of action where 
none otherwise exists.”).
5 
Here, because the Class Action Plaintiffs other claims for relief may proceed and 
because Plaintiffs’ declaratory judgment claim is predicated on those claims, the Class 
Action Plaintiffs have sufficiently established a plausible claim for declaratory relief and 
injunctive relief. Therefore, Powerschool’s motion to dismiss the Class Action Plaintiffs’ 
Count 8 is denied. 
 
5 “A plaintiff's inability to rely on the Declaratory Judgment Act to obtain affirmative 
relief where no cause of action otherwise exists contrasts with the well-established 
availability of the Act for defensive use against anticipated claims. See Peterson v. 
Highland Music, Inc., 140 F.3d 1313, 1322 (9th Cir. 1998) (observing that, “[f]requently, 
the point of a declaratory action is to assert a defense anticipatorily”).” City of Reno, 52 
F.4th at 879. 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 25 of 28
 
-26- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
V. CONCLUSION 
For the foregoing reasons, the Court ORDERS that the: 
1. The Class Action Plaintiffs and the Direct Action School Plaintiffs’ claims for 
breach of contract are sufficiently pleaded. 
2. The Class Action and the Direct Action School Plaintiffs’ simple negligence 
claims and other tort claims pleaded in addition to the simple breach of contract claims 
found at CAC Count 1 and DAC Counts 10, 13, 15, 18, 20, 24, 26, 28, 30, 33, 35, 37, 40, 
42 and 44 do not satisfy the plausibility test and are dismissed. 
3. The Direct Action School Plaintiffs’ claims for economic losses stemming from 
the alleged breach of the contracts with Powerschool (i.e., “inflated contract prices”; 
“additional wages”; “increased workload”; cybersecurity expenses and legal fees; costs 
for transferring data, security implementation, and training; “lost opportunity costs”; 
credit monitoring costs; identity theft protection expenses; ongoing monitoring costs; 
notification expenses; hotline costs; and administrative expenses) (CAC ¶ 80; DAC ¶¶ 
136, 348, 388, 429, 477, 519) are foreclosed by the contract Limitation of Liability clause 
or the economic loss doctrine and are dismissed. 
4. The negligence per se claims, whether alleged as a separate count or as a theory of 
negligence, are dismissed for the same reasons as Plaintiffs’ simple negligence claims. 
5. The claims for unjust enrichment by the Class Action Plaintiffs (CAC Count 7) and 
the Direct Action School Plaintiffs (DAC Count 3) are dismissed. 
6. The Direct Action School Plaintiffs’ Fraudulent Concealment Claim (Direct Action 
Count 5) is dismissed. 
7. The Class Action Plaintiffs and the Direct Action School Plaintiffs’ CFAA Claims 
(CAC Count 4, DAC Count 4) are dismissed. 
8. The Class Action Plaintiffs’ CDAFA Claim (CAC Count 5) is dismissed. 
9. The Direct Action School Plaintiffs’ Illinois Biometric Privacy Act Claim (DAC 
Count 17) is dismissed. 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 26 of 28
 
-27- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
10. The Class Action Plaintiffs’ UCL claim (CAC Count 6) is dismissed, as previously 
stipulated. 
11. The Direct Action School Plaintiffs’ claims under the consumer protection statutes 
of Rhode Island (Count 34), Utah (Count 12), Vermont (Count 25), Virginia (Count 38), 
and Oklahoma (Count 43) are dismissed. 
The claim based on New York’s Gen. Bus. Law section 349 (Count 21) is 
sufficiently pleaded. 
12. The Direct Action School Plaintiffs’ claims under the consumer protection statutes 
of the states of Arizona (Count 41), South Carolina (Count 19), New York’s Gen. Bus. 
Law section 350 (Count 22), Tennessee (Count 29), Washington (Count 45), and 
Wisconsin (Count 14), are dismissed. 
13. The Direct Action School Plaintiffs’ claims under the consumer protection statutes 
of the states of Idaho, New Hampshire and Pennsylvania, are dismissed. 
14. The Direct Action School Plaintiffs’ claims alleging violations of the data breach 
notifications laws of New Hampshire, Virginia, and Washington (Counts 32, 39 & 46) 
are dismissed. 
15. The Direct Action School Plaintiffs’ claim for express indemnity (Count 6) is 
sufficiently pleaded. 
16. The Class Action Plaintiffs’ Claim for Declaratory and Injunctive Relief (CAC 
Count 8) is sufficiently pleaded. 
17. Direct Action School Plaintiffs’ Count 4 (Computer Fraud and Abuse Act) and 
Count 23 (New York Education Law) are dismissed, as previously stipulated. 
 IS SO ORDERED. 
DATED: March 19, 2026 
 _________________________________ 
 Hon. Roger T. Benitez 
 United States District Judge 
 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 27 of 28
 
-28- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
 
 
 
 
 
 
 
 
 
 
Case 3:25-md-03149-AJB-MSB Document 440 Filed 03/19/26 PageID.<pageID> 
Page 28 of 28

Passage view · GavelSight