Kristanalea Dyroff, individually and on behalf of the estate of Wesley Greer, deceased v. the Ultimate Software Group , Inc .

FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
KRISTANALEA DYROFF, individually
and on behalf of the estate of Wesley
Greer, deceased,
Plaintiff-Appellant,
v.
THE U LTIMATE S OFTWARE GROUP ,
INC .,
Defendant-Appellee.
No. 18-15175
D.C. No.
3:17-cv-05359-
LB
OPINION
Appeal from the United States District Court
for the Northern District of California
Laurel D. Beeler, Magistrate Judge, Presiding
Argued and Submitted June 4, 2019
Seattle, Washington
Filed August 20, 2019
Before: Dorothy W. Nelson, Johnnie B. Rawlinson,
and Carlos T. Bea, Circuit Judges.
Opinion by Judge D.W. Nelson

-- 1 of 18 --

2 DYROFF V . THE U LTIMATE S OFTWARE GROUP
SUMMARY*
Communications Decency Act
The panel affirmed the district court’s dismissal, based
on The Ultimate Software Group’s immunity from liability
under Section 230 of the Communications Decency Act, of
an action alleging claims concerning Ultimate Software’s
role in the death of plaintiff’s son.
Ultimate Software was the operator of the Experience
Project website, which allegedly facilitated illegal drug
sales. Plaintiff’s son died of a drug overdose after buying
drugs from a fellow Experience Project user.
The panel held that Ultimate Software satisfied all three
prongs of the test for immunity under Section 230 of the
Communications Decency Act. Specifically, the panel held
that Ultimate Software was an interactive computer service
because it did not create or publish its own content under the
plain language of the statute. The panel also held that
plaintiff’s son treated Ultimate Software as a publisher or
speaker of other’s information or content. Finally, the panel
held that Ultimate Software published information/content
provided by another information content provider where the
content at issue was created by plaintiff’s son and his drug
dealer. The panel rejected plaintiff’s argument that a website
develops content if it manipulates the content in a unique
way through content-neutral tools.
* This summary constitutes no part of the opinion of the court. It
has been prepared by court staff for the convenience of the reader.

-- 2 of 18 --

DYROFF V . THE U LTIMATE S OFTWARE GROUP 3
The panel held that plaintiff did not plead sufficient facts
to show that Ultimate Software colluded with drug dealers
on Experience Project. The panel held that plaintiff’s
allegation that user anonymity equaled promoting drug
transactions was not plausible. The panel concluded that the
district court was right to dismiss all claims related to this
supposed theory of liability because Ultimate Software was
immune under Section 230 of the Communications Decency
Act.
The panel held that Ultimate Software did not owe a duty
of care to plaintiff’s son because Experience Project’s
features amounted to content-neutral functions that did not
create a risk of harm. The panel rejected plaintiff’s claim
that misfeasance by Ultimate Software created a duty to
plaintiff’s son.
COUNSEL
David F. Slade (argued), Carney Bates & Pulliam PLLC,
Little Rock, Arkansas; Sin-Ting Mary Liu, Aylstock Witkin
Kreis & Overholtz PLLC, Alameda, California; for Plaintiff-
Appellant.
Jeffry A. Miller (argued) and Scott M. Schoenwald, Lewis
Brisbois Bisgaard & Smith LLP, San Diego, California;
Shawn A. Tolliver, David E. Russo, and Justin S. Kim,
Lewis Brisbois Bisgaard & Smith LLP, San Diego,
California; for Defendant-Appellee.

-- 3 of 18 --

4 DYROFF V . THE U LTIMATE S OFTWARE GROUP
OPINION
D.W. NELSON, Circuit Judge:
Plaintiff Kristanalea Dyroff appeals the district court’s
dismissal of her claims against Defendant The Ultimate
Software Group (“Ultimate Software”), operator of the
Experience Project website, for its alleged role in the death
of her son, Wesley Greer. While the circumstances and facts
of this case are no doubt tragic, we find that Ultimate
Software is immune from liability under Section 230 of the
Communications Decency Act. We therefore affirm.
BACKGROUND
This being an appeal from a motion to dismiss, we
describe the case as Plaintiff presents it. We take her
plausible allegations as true and draw all reasonable
inferences in her favor.
Experience Project was a social networking website
made up of various online communities or groups where
users anonymously shared their first-person experiences,
posted and answered questions, and interacted with other
users about different topics. The site did not limit or promote
the types of experiences users shared. The site’s “blank box”
approach to user content resulted in an array of topics and
forums ranging from “I like dogs” and “I am going to
Stanford” to “I have lung cancer” and “I Love Heroin.”
Users registered with the site anonymously; in other
words, the site did not collect users’ identifying information,
including name, phone number, or mailing address. The
site’s operator, Ultimate Software, believed that anonymity
would promote users to share more personal and authentic
experiences without inhibition. Experience Project’s

-- 4 of 18 --

DYROFF V . THE U LTIMATE S OFTWARE GROUP 5
founder stated, “We don’t want to know [users’] real name,
their phone number, what town they’re from.” Id. “The
impetus behind this policy [of anonymity] was to encourage
users to share experiences with the least amount of inhibition
possible. The greater the anonymity, the more ‘honest’ the
post . . . .”
Experience Project was live from 2007 until March
2016, during which its users shared 67 million experiences,
made 15 million connections, and asked 5 million questions.
Users could join groups and the site also recommended
groups for users to join, based on the content of their posts
and other attributes, using machine-learning algorithms.
When a user posted content to a group, the site would send
an email notification to the other users active in that group.
The site generated revenue through advertisements and the
sale of tokens that users used to post questions to other users
in their groups.
Some of the site’s functions, including user anonymity
and grouping, facilitated illegal drug sales. Wesley Geer
was involved in one such transaction, which turned fatal.
Wesley suffered from drug addiction, which began when a
doctor overprescribed him opioid pain killers after a serious
sports-related injury. After several unsuccessful
rehabilitation attempts, Wesley bought what he believed to
be heroin from a fellow Experience Project user. Wesley
posted in a heroin-related group, “where can i [sic] score
heroin in jacksonville, fl.” The site sent him an email
notification when another user, Hugo Margenat-Castro or
“Potheadjuice,” an Orlando-based drug dealer, posted in the
same group. Wesley and Margenat-Castro connected off the
site and Wesley bought heroin from Margenat-Castro on
August 18, 2015.

-- 5 of 18 --

6 DYROFF V . THE U LTIMATE S OFTWARE GROUP
Wesley died the next day from fentanyl toxicity. He did
not know that the heroin Margenat-Castro sold him was
laced with fentanyl. Margenat-Castro was ultimately
arrested and prosecuted. He pleaded guilty in March 2017
admitting that he sold heroin laced with fentanyl while active
on Experience Project.
In March 2016, Experience Project announced, in an
open letter to its users, that it was shutting down. The letter
expressed concern for the future of online privacy because
of government overreach. It stated that the site always
supported proper law enforcement efforts but recognized
that it did not have the resources to respond to increased
government information requests. The site shut down on
April 21, 2016.
Plaintiff Kristanalea Dyroff, Wesley Greer’s mother,
filed a complaint in San Francisco Superior Court. She
alleges that Ultimate Software: (1) allowed users to traffic
anonymously in illegal, deadly narcotics and to create
groups dedicated to their sale and use; (2) steered users to
additional groups dedicated to the sale and use of narcotics;
(3) sent users alerts to posts within groups that were
dedicated to the sale and use of narcotics; (4) permitted users
to remain active accountholders despite evidence that they
openly engaged in drug trafficking and that law enforcement
had undertaken related investigations; and (5) demonstrated
antipathy toward law enforcement efforts to stop illegal
activity on Experience Project.
Ultimate Software removed the action from state court
based on diversity jurisdiction and filed a motion to dismiss
all claims under Federal Rule of Civil Procedure 12(b)(6).
The district court granted the motion without prejudice.
Dyroff filed a notice stating that she would not file an

-- 6 of 18 --

DYROFF V . THE U LTIMATE S OFTWARE GROUP 7
amended complaint and asked the district court to enter
judgement. Dyroff timely appealed the judgment.
STANDARD OF REVIEW
We review de novo both a district court order dismissing
a plaintiff’s claims pursuant to Federal Rule of Civil
Procedure 12(b)(6) and questions of statutory interpretation.
Fields v. Twitter, Inc., 881 F.3d 739, 743 (9th Cir. 2018).
The Court must “accept all factual allegations in the
complaint as true and construe the pleadings in the light most
favorable to the nonmoving party.” Rowe v. Educ. Credit
Mgmt. Corp., 559 F.3d 1028, 1029–30 (9th Cir. 2009). Only
a complaint that states a plausible claim for relief may
survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662,
678 (2009). Plausibility exists when a court may “draw the
reasonable inference that the defendant is liable for the
misconduct alleged.” Id.
DISCUSSION
Plaintiff argues that in granting the motion to dismiss,
the district court made three errors. First, she argues, the
district court erred when it held that Communications
Decency Act (CDA) Section 230 immunizes Defendant
Ultimate Software. Plaintiff reasons that Ultimate Software,
as the operator of the Experience Project website, was an
information content provider, as defined by the statute,
because its recommendation and notification functions were
“specifically designed to make subjective, editorial
decisions about users based on their posts.” Second,
according to Plaintiff, the district court erred when it found
that her allegations of collusion between Ultimate Software
and drug dealers using Experience Project were not
plausible. Her third argument is that the district court erred
in finding that Ultimate Software owed no duty of care to her

-- 7 of 18 --

8 DYROFF V . THE U LTIMATE S OFTWARE GROUP
son, Wesley Greer, an Experience Project user. We affirm
because the district court did not err in any of these respects.
I. CDA Section 230 Immunizes Ultimate Software from
Plaintiff’s Claims
The CDA provides that website operators are immune
from liability for third-party information (or content, like the
posts on Experience Project) unless the website operator “is
responsible, in whole or in part, for the creation or
development of [the] information.” 47 U.S.C. §§ 230(c)(1)
& (f)(3). Ultimate Software did not create content on
Experience Project, in whole or in part. Accordingly,
Ultimate Software, as the operator of Experience Project, is
immune from liability under the CDA because its functions,
including recommendations and notifications, were content-
neutral tools used to facilitate communications. See Fair
Hous. Council of San Fernando Valley v. Roommates.com,
521 F.3d 1157, 1167–69 (9th Cir 2008) (en banc).
A. Scope of CDA Section 230 Immunity
The CDA instructs us that “[n]o provider or user of an
interactive computer service shall be treated as the publisher
or speaker of any information provided by another
information content provider.” 47 U.S.C. § 230(c)(1)
(emphasis added). The CDA defines an “interactive
computer service” as
[A]ny information service, system, or access
software provider that provides or enables
computer access by multiple users to a
computer server, including specifically a
service or system that provides access to the
Internet and such systems operated or

-- 8 of 18 --

DYROFF V . THE U LTIMATE S OFTWARE GROUP 9
services offered by libraries or educational
institutions.
47 U.S.C. § 230(f)(2).
On the other hand, an “information content provider” is
[A]ny person or entity that is responsible, in
whole or in part, for the creation or
development of information provided
through the Internet or any other interactive
computer service.
47 U.S.C. § 230(f)(3).
“The prototypical service qualifying for [CDA]
immunity is an online messaging board (or bulletin board)
on which Internet subscribers post comments and respond to
comments posted by others.” Kimzey v. Yelp! Inc., 836 F.3d
1263, 1266 (9th Cir. 2016) (internal quotations omitted). In
other words, a website like Experience Project. Taking the
relevant statutory definitions and case law in account, it
becomes clear that, in general, Section 230(c)(1) “protects
websites from liability [under state or local law] for material
posted on the[ir] website[s] by someone else.” Doe v.
Internet Brands, Inc., 824 F.3d 846, 850 (9th Cir. 2016); see
also 47 U.S.C. § 230(e)(3).
Combining the above principles, in Barnes v. Yahoo!,
Inc., we created three-prong test for Section 230 immunity.
570 F.3d 1096, 1100 (9th Cir. 2009). Immunity from liability
exists for “(1) a provider or user of an interactive computer
service (2) whom a plaintiff seeks to treat, under a state law
cause of action, as a publisher or speaker (3) of information
provided by another information content provider.” Id.
at 1100–01. When a plaintiff cannot allege enough facts to

-- 9 of 18 --

10 DYROFF V . THE U LTIMATE S OFTWARE GROUP
overcome Section 230 immunity, a plaintiff’s claims should
be dismissed. See Kimzey, 836 F.3d at 1268–71. Ultimate
Software satisfies all three prongs of the test.
B. Section 230 Immunity—The Barnes test
1. Defendant is an Interactive Computer Service
We interpret the term “interactive computer service”
expansively. Kimzey, 836 F.3d at 1268. Ultimate Software
was an interactive computer service because it did not create
or publish its own content under the plain language of the
statute. Rather, Ultimate Software published Experience
Project users’ posts and did not materially contribute to its
users’ posts.
Millions of users, including Plaintiff’s son, Wesley
Greer, set up accounts on Experience Project, a website, to
communicate with each other. Websites are the most
common interactive computer services. Kimzey, 836 F.3d at
1268; see also Roommates.com, 521 F.3d at 1162 n.6
(“[t]oday, the most common interactive computer services
are websites”).
No binding legal authority supports Plaintiff’s
contention that Ultimate Software became an information
content provider, losing its Section 230 immunity, by
facilitating communication on Experience Project through
content-neutral website functions like group
recommendations and post notifications. Ultimate Software,
therefore, satisfies the first prong.

-- 10 of 18 --

DYROFF V . THE U LTIMATE S OFTWARE GROUP 11
2. Plaintiff Treats Ultimate Software as a
Publisher or Speaker of Other’s
Information/Content
An interactive computer service, like Ultimate Software,
can also be an information content provider, but that is only
relevant, for the purposes of Section 230 immunity, if the
website it operates creates or develops the specific content
at issue. Carafano v. Metrosplash.com, Inc., 339 F.3d 1119,
1124 (9th Cir. 2003). Here, Ultimate Software was not an
information content provider because it did not create or
develop information (or content). 47 U.S.C. § 230(f)(3).
Rather, it published information created or developed by
third parties. Specifically, Experience Project did not create
or develop the posts that led to Greer’s death. Rather, it was
Greer, himself, who posted “where can i [sic] score heroin
in jacksonville, fl” on Experience Project. And it was the
drug dealer, Margenat-Castro, who posted in response to
Greer’s post.
It is true that Ultimate Software used features and
functions, including algorithms, to analyze user posts on
Experience Project and recommended other user groups.
This includes the heroin-related discussion group to which
Greer posted and (through its emails and push notifications)
to the drug dealer who sold him the fentanyl-laced heroin.
Plaintiff, however, cannot plead around Section 230
immunity by framing these website features as content. We
have held that what matters is whether the claims “inherently
require[] the court to treat the defendant as the ‘publisher or
speaker’ of content provided by another.” Barnes, 570 F.3d
at 1102. If they do, then Section 230(c)(1) provides
immunity from liability. Id.
By recommending user groups and sending email
notifications, Ultimate Software, through its Experience

-- 11 of 18 --

12 DYROFF V . THE U LTIMATE S OFTWARE GROUP
Project website, was acting as a publisher of others’ content.
These functions—recommendations and notifications—are
tools meant to facilitate the communication and content of
others. They are not content in and of themselves.
Our recent decision, HomeAway.com, Inc. v. City of
Santa Monica, 918 F.3d 676 (9th Cir. 2019) is of no help to
Plaintiff. There, the City of Santa Monica required short-
term vacation rentals to be licensed and imposed liability on
vacation rental hosting platforms—HomeAway.com and
Airbnb—that facilitated unlicensed short-term vacation
rentals. Id. at 680. The platforms sued, alleging, among other
things, that Section 230 immunized them from liability. Id.
We found that HomeAway.com and Airbnb did not meet the
second prong of the Barnes test because the Santa Monica
ordinance did not “proscribe, mandate, or even discuss the
content of the [website] listings” and required only that the
website’s transactions involve licensed properties. Id. at 683.
In other words, the vacation rental platforms did not face
liability for the content of their listings; rather liability arose
from facilitating unlicensed booking transactions.
Ultimate Software, therefore, satisfies the second prong
of the Barnes test.
3. Ultimate Software Published
Information/Content Provided by Another
Information Content Provider
The third prong is also met because, as stated previously
and as detailed in Plaintiff’s complaint, the content at issue
was created and developed by Greer and his drug dealer.
Plaintiff’s content “manipulation” theory is without support
in the statute and case law. First, Plaintiff misreads
Roommates.com when she argues it holds that a website

-- 12 of 18 --

DYROFF V . THE U LTIMATE S OFTWARE GROUP 13
develops content if it manipulates the content in a unique
way through content-neutral tools.
The question in Roommates.com was whether Section
230 immunized a website, which matched people renting
rooms with people looking for somewhere to live, from
claims that it violated federal and state housing anti-
discrimination laws by requiring subscribers to disclose,
using dropdown menus and checkboxes, their sex, sexual
orientation, and family status. See Roommates.com,
521 F.3d at 1161–2, 1165.
We answered “no” to this question. We rested our
decision, however, on the fact that Roommates.com
affirmatively required users to disclose information related
to protected classes through discriminatory questions and
answer choices. As a result, this information, especially
information related to a user’s protected class, served as the
focus of the registration process and, ultimately, became the
cornerstone of each user’s online profile. Moreover, the
website designed its search function to guide users through
the required discriminatory criteria. Id. at 1164, 1167. Under
these set of facts, the website in Roommates.com was clearly
the developer of the discriminatory content at issue. Id.
at 1170.
In Roommates.com, we also identified the type of
conduct that does not constitute the “development” of
content under Section 230. Id. at 1169. For example, a
housing website that lets users create their own criteria for
identifying and choosing potential roommates (including
criteria based on protected classes like race or sex) in a blank
text box, does not become a developer of content if it does
not require the use of that discriminatory criteria. Id. In other
words, a website does not become a developer of content
when it provides neutral tools that a user exploits to create a

-- 13 of 18 --

14 DYROFF V . THE U LTIMATE S OFTWARE GROUP
profile or perform a search using criteria that constitutes a
protected class. Id. We, furthermore, concluded that
“[w]here it is very clear that the website directly participates
in developing the alleged illegality—as it is clear here with
respect to [Roommates.com’s] questions, answers and the
resulting profile pages—immunity will be lost.” However,
“in cases of enhancement by… inference—such as with
respect to the ‘Additional Comments’ [on
Rommates.com]—[S]ection 230 must be interpreted to
protect websites not merely from ultimate liability, but from
having to fight costly and protracted legal battles.” Id.
at 1174–75.
Here, Ultimate Software’s functions on Experience
Project most resemble the “Additional Comments” features
in Roommates.com in that Experience Project users,
including Wesley Greer, were not required to disclose that
they were looking for heroin or other illegal drugs. Rather,
users were given something along the lines of blank text
boxes in which they could post and share experiences,
questions, and answers. The recommendation and
notification functions helped facilitate this user-to-user
communication, but it did not materially contribute, as
Plaintiff argues, to the alleged unlawfulness of the content.
Roommates.com, 521 F.3d at 1175; see also Kimzey,
836 F.3d at 1269 n.4 (the material contribution test makes a
“‘crucial distinction between, on the one hand, taking actions
(traditional to publishers) that are necessary to the display of
unwelcome and actionable content and, on the other hand,
responsibility for what makes the displayed content illegal
or actionable.’”).
In summary, Plaintiff is unable to allege that Ultimate
Software materially contributed to the content posted on
Experience Project that led to Greer’s death. Plaintiff cannot

-- 14 of 18 --

DYROFF V . THE U LTIMATE S OFTWARE GROUP 15
and does not plead that Ultimate Software required users to
post specific content, made suggestions regarding the
content of potential user posts, or contributed to making
unlawful or objectionable user posts. Ultimate Software is
entitled to immunity under the plain terms of Section 230
and our case law as a publisher of third-party content.
II. Plaintiff Does Not Plead Sufficient Facts to Show that
Ultimate Software Colluded with Drug Dealers on
Experience Project
The complaint’s allegations as it relates to Plaintiff’s
“collusion” with bad actors does not establish an
independent theory of liability. Rather, Plaintiff tries, again,
to circumvent Section 230 immunity by alleging that
Ultimate Software knew or should have known that users
sold drugs on Experience Project, and it supported and
protected these drug dealers through its anonymity policies.
The district court characterized this claim well, stating “The
idea is that Ultimate Software is less Match.com and more
Silk Road (a notorious online platform for criminal
activities, including selling illegal drugs).”
To advance this collusion and inducement theory,
Plaintiff relies on a Washington Supreme Court decision,
J.S. v. Village Voice Media Holdings, LLC, 184 Wash. 2d 95
(2015) (en banc). In Village Voice Media, plaintiffs, minors
featured in advertisements for sexual services, sued the
operators of the website Backpage.com alleging, among
other things, violations of state laws prohibiting the sexual
exploitation of children. Id. at 98. The court held that
plaintiffs sufficiently alleged that the website operators
helped develop the illegal content and therefore were not
immune from liability under Section 230. Id. at 103.

-- 15 of 18 --

16 DYROFF V . THE U LTIMATE S OFTWARE GROUP
Specifically, the court pointed to allegations that
Backpage.com required users to disclose certain information
within its “escorts” section that encouraged the sexual
exploitation of children. Id. at 102. One such allegation is
that Backpage.com’s “content requirements [were]
specifically designed to control the nature and context of
[escort] advertisements so that pimps can continue to use
Backpage.com to traffic in sex, including the trafficking of
children.” Id. at 102–03. In other words, the court found that
the plaintiffs alleged enough facts such that it was plausible
to infer that Backpage.com’s content requirements—within
the website’s escort section—were designed to facilitate the
prostitution of children.
Here, Ultimate Software’s anonymity features along
with its public statements expressing concern for internet
privacy and detailing the burden of law enforcement
information requests are not facts whose inferences, viewed
in the light most favorable to Plaintiff, plausibly allege
collusion with drug dealers or other bad actors. Today,
online privacy is a ubiquitous public concern for both users
and technology companies. These statements do not
establish, on the part of Ultimate Software, antipathy to law
enforcement, especially given the corresponding statements
about always supporting “proper law enforcement requests.”
Unlike the plaintiffs in Village Voice Media, Plaintiff
here did not allege that Experience Project had a section for
drug-related experiences on its website with specific content
posting requirements that facilitated illegal drug
transactions. Plaintiff’s allegation that user anonymity
equals promoting drug transactions is not plausible. Iqbal,
556 U.S. at 678. The district court was right to dismiss all
claims related to this supposed theory of liability because

-- 16 of 18 --

DYROFF V . THE U LTIMATE S OFTWARE GROUP 17
Ultimate Software is, as reasoned above, immune under
Section 230.
III. Ultimate Software Did Not Owe a Duty to
Plaintiff’s Son
Ultimate Software owed Greer no duty of care because
Experience Project’s features amounted to content-neutral
functions that did not create a risk of harm. Plaintiff rests her
“failure to warn claim” on a misguided premise that
misfeasance by Ultimate Software created a duty to Greer.
When analyzing a duty of care in the context of third-
party acts, California courts distinguish between
“misfeasance” and “nonfeasance.” Melton v. Boustred,
183 Cal. App. 4th 521, 531 (2010). Misfeasance is when a
defendant makes the plaintiff’s position worse while
nonfeasance is when a defendant does not help a plaintiff.
Lugtu v. Cal. Highway Patrol, 26 Cal. 4th 703, 716 (2001).
Misfeasance, unlike nonfeasance, creates an ordinary duty
of care where none may have existed before. See id.
Ultimate Software did not make Plaintiff’s son, Greer,
worse off because the functions Plaintiff references—
recommendations and notifications—were used regardless
of the groups in which a user participated. No website could
function if a duty of care was created when a website
facilitates communication, in a content-neutral fashion, of its
users’ content. See e.g., Klayman v. Zuckerberg, 753 F.3d
1354, 1359–60 (D.C. Cir. 2014) (no special relationship
between Facebook and its users). We decline to create such
a relationship. Accordingly, the district was correct to
dismiss Plaintiff’s duty to warn claim.

-- 17 of 18 --

18 DYROFF V . THE U LTIMATE S OFTWARE GROUP
CONCLUSION
For the preceding reasons, we AFFIRM the district
court’s order granting Defendant Ultimate Software’s
motion to dismiss.

-- 18 of 18 --