No. The RockYou settlement did not prove that RockYou was legally liable for the 2009 data breach. In Claridge v. RockYou, Inc., a federal judge allowed several contract and negligence claims to proceed past the pleading stage in April 2011, but the case later ended in a settlement and stipulated dismissal rather than a trial or merits ruling. The settlement therefore resolved the private dispute without deciding whether RockYou breached a duty or caused compensable harm.
What the private lawsuit alleged
The putative class action, Claridge v. RockYou, Inc., No. C 09-6032 PJH, followed a December 15, 2009 notification to plaintiff Alan Claridge that sensitive information might have been compromised. The complaint alleged that RockYou had not adequately protected user information, including email addresses, passwords and login credentials for social-network accounts. Those descriptions come from the complaint and the court’s procedural summary; they are allegations, not findings after a trial.
The case was a private civil action. Its central question was whether the plaintiffs could establish legally actionable contract, negligence or related claims and obtain a remedy—not whether a regulator had violated a separate consumer-protection statute.
What the April 11, 2011 ruling actually decided
Judge Phyllis J. Hamilton of the U.S. District Court for the Northern District of California granted RockYou’s motion to dismiss in part and denied it in part. The order addressed whether the complaint pleaded legally sufficient claims, not whether the evidence ultimately proved them.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
Claims that survived dismissal
The court declined to dismiss the breach-of-contract, breach-of-implied-contract, negligence and negligence-per-se theories identified in the order as the fifth, seventh, eighth and ninth causes of action. That ruling meant the plaintiffs could continue litigating those theories, subject to later proof and legal rulings.
Claims dismissed or limited
The court dismissed the implied covenant of good faith and fair dealing claim, allowing an opportunity to amend, and dismissed other causes of action under different prejudice and amendment terms. The mixed result matters: it was not a blanket ruling for either side.
Why surviving a motion to dismiss is not a liability finding
At this stage, the judge generally accepts well-pleaded factual allegations as true and asks whether they could support a recognized claim. The negligence discussion identified duty, breach and proximate or legal cause as elements, but the order did not find that RockYou breached any duty, that its conduct caused a legally cognizable injury, or that damages were owed.
How the settlement ended the case
The parties later settled and filed a stipulated dismissal. A settlement is a negotiated compromise, not a verdict. The available settlement record and contemporaneous reporting indicate that the private litigation ended without adjudicating the core breach-liability question. They do not establish an admission of wrongdoing, a judicial finding that RockYou’s security was inadequate, or a value assigned by a court to the plaintiffs’ personal data.
Readers should therefore distinguish three different events: allegations about the 2009 incident, the 2011 pleading-stage order, and the later settlement. None of those events, taken alone or together, supplies a trial judgment establishing private-law liability.
The FTC proceeding was separate
RockYou also faced a Federal Trade Commission proceeding, but it was not the Claridge class action. The FTC’s March 27, 2012 release described alleged deceptive representations concerning children’s information and security practices. The agency’s proposed resolution was subject to court approval and addressed regulatory remedies rather than deciding the private plaintiffs’ contract and negligence claims.
- A $250,000 civil penalty was included in the FTC’s proposed resolution.
- RockYou was required to establish an information-security program and undergo independent security audits every other year for 20 years.
- The resolution addressed Children’s Online Privacy Protection Act (COPPA) compliance and barred certain deceptive privacy and security claims.
Those terms belong to the FTC matter. They should not be presented as damages or a liability judgment in Claridge. The FTC release headline referred to 32 million email addresses and passwords, but that figure was not verified in the underlying material available for the private lawsuit; it should not be treated here as a confirmed breach count.
Private lawsuit and FTC case compared
| Proceeding | Question addressed | Outcome or effect |
|---|---|---|
| Claridge v. RockYou, Inc. (private action) | Whether the complaint adequately pleaded contract, negligence and related claims arising from the alleged 2009 breach | Several claims survived the April 2011 motion to dismiss; the parties later settled and dismissed the case without a merits verdict |
| FTC enforcement action (2012) | Whether RockYou’s privacy and security representations and handling of children’s information violated the FTC’s enforcement authority | Proposed consent-decree terms included a $250,000 civil penalty, a security program, two-year audits for 20 years and COPPA-related provisions, subject to court approval |
What can—and cannot—be said about breach liability
- Supported: Users alleged that RockYou failed to secure account information; a federal court found several legal theories sufficient to continue past dismissal; and the private case ended by settlement.
- Not established by the settlement: A final finding that RockYou breached contract, acted negligently, caused compensable loss or owed a particular amount to the class.
- Separate regulatory record: The FTC imposed or proposed remedies in a different proceeding concerning privacy representations, children’s information and security practices.
For anyone evaluating the legal significance of the RockYou incident, the most accurate conclusion is limited but clear: the 2011 order kept claims alive, while the settlement closed the case before a court decided liability on the merits.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
