(Deceit by Concealment, Cal. Civ. Code §§ 1709, 1710)   (Negligence)   (Violation of California Business & Professions Code § 17200, et seq.)   (Violation of the California Customer Records Act,   California Civil Code § 1798.80, et seq.)   14.  Facebook created and operates social networking websites and mobile  applications that facilitate private and public communications, including messages, posts,  locations, activities, photographs, links, and videos, from and between its Users, as well as  providing access to certain account information to third party applications.  Facebook purports  to allow its users the ability to share and restrict information based on their own specific  criteria. By the end of 2017, Facebook had more than 2.2 billion active users.   22.  Plaintiff brings this lawsuit as a class action on behalf of himself and all others  similarly situated as members of the proposed Class pursuant to pursuant to Federal Rules of  Civil Procedure 23(a), 23(b)(2), 23(b)(3), and 23(c)(4). This action satisfies the numerosity,  commonality, typicality, adequacy, predominance, and superiority requirements of those  provisions.   23.  The Class is defined as:  Nationwide Class:  All individuals residing in the United States who  registered for an account, at any time, from four years prior to the filing  of this complaint to the time of class certification, with Facebook  whose personal or financial information was accessed, compromised,  or stolen in the 2018 Data Breach (the “Nationwide Class” or “Class”).  California Sub-Class: All members of the Nationwide Class who  registered for an account with Facebook and reside in the State of  California.    24.  Collectively, the Nationwide Class and the California Sub-Class, and their class  members, will be referred to herein as the “Class” and “Class Members,” except where  otherwise noted.   31.  Plaintiff incorporates by reference the allegations contained in each and every  paragraph of this Complaint.   32.  Plaintiff brings this cause of action on behalf of himself and on behalf of the  Nationwide Class, or in the alternative, on behalf of the California Sub-Class.   33.  As a result of their reliance on Defendant’s representations and omissions,  Facebook Users utilizing its social networking websites and mobile applications suffered an  ascertainable loss due to Defendant’s failure to provide adequate protection of its Facebook  Users’ personal and confidential information and failure to provide sufficient and timely  notice or warning of potential and actual cybersecurity breaches.   34.  California Business & Professions Code § 17200 prohibits acts of “unfair  competition,” including any “unlawful, unfair or fraudulent business act or practice” and  “unfair, deceptive, untrue or misleading advertising.”   35.  Plaintiff and Class Members are reasonable consumers who expected  Defendant to vehemently protect the personal information entrusted to them and to be  informed by Defendant of potential and actual cybersecurity vulnerabilities as soon as  Defendant became aware of such threat.   44.  Plaintiff incorporates by reference the allegations contained in each and every  paragraph of this Complaint.   45.  Plaintiff brings this cause of action on behalf of himself and on behalf of the  California Sub-Class.   46.  The California Legislature enacted Civil Code § 1798.81.5 “to ensure that  personal information about California residents is protected.”  The statute requires that any  business that “owns, licenses, or maintains personal information about a California resident …  implement and maintain reasonable security procedures and practices appropriate to the nature  of the information, to protect the personal information from unauthorized access, destruction,  use, modification, or disclosure.”   47.  Defendant is a “business” as defined by Civil Code § 1798.80(a).   48.  Plaintiff and California Sub-Class Members are “individual[s]” as defined by  Civil Code § 1798.80(d).     49.  The personal information taken in the data breach was “personal information”  as defined by Civil Code § 1798.80(e) and 1798.81.5(d), which includes “information that  identifies, relates to, describes, or is capable of being associated with, a particular individual,  including, but not limited to, his or her name, signature, Social Security number, physical  characteristics or description, address, telephone number, passport number, driver’s license or  state identification card number, insurance policy number, education, employment,  employment history, bank account number, credit card number, debit card number, or any  other financial information, medical information, or health insurance information.”   50.  The breach of the personal information of “50 million Facebook users” was a  “breach of the security system” of Defendant as defined by Civil Code § 1798.82(g).   57.  Plaintiff incorporates by reference the allegations contained in each and every  paragraph of this Complaint.   58.  Plaintiff bring this cause of action on behalf of himself and on behalf of the  Nationwide Class.   65.  Plaintiff incorporates by reference the allegations contained in each and every  paragraph of this Complaint.   66.  Plaintiff brings this cause of action on behalf of himself and on behalf of the  California Sub-Class.   67.  Defendant had an obligation to disclose to all class members that their  Facebook accounts and PII were an easy target for hackers and Defendant was not  implementing measures to protect them.   68.  Defendant did not do these things. Instead, Defendant willfully deceived  Plaintiff and the Class by concealing the true facts concerning their data security, which  Defendant was obligated to, and had a duty to, disclose. Additionally, Facebook made  numerous representations following the prior exposures to ensure users that their PII and other  data was safe, and Facebook was dedicated to maintaining that security.  