In the area of torts, one of the more difficult issues is determining when a business owner owes a duty to protect others *251from the criminal acts of third parties. Contributing to the complexity are considerations such as these: (1) the difficulty of predicting when and under what circumstances a criminal might strike; (2) the difficulty of determining whether the business owner should be held civilly liable for the harm caused by the third party’s criminal conduct; (3) the need to avoid imposing a particularly onerous burden on business owners in poor areas where the risk of criminal activity is particularly great, as the owners will pass the burden on to customers who, because of their poverty, are less able to shoulder it; and (4) the concern that imposing too onerous a burden on business owners in poor areas may cause them to close their businesses or relocate to safer and more affluent communities, thus depriving the poor of jobs and essential services.
In this case, as plaintiff Michael Wollery Delgado was leaving defendant’s restaurant, a gang of 10 to 15 men, apparently on a prearranged signal, came out of hiding and brutally attacked him. Unlike the majority, I am of the view that the business owner could not have foreseen this vicious assault and thus did not owe a duty to protect him from such an attack.
I.
At approximately 10:00 p.m. on Saturday, November 7, 1998, plaintiff and his wife, together with two friends, went to the Trax Bar & Grill (Trax) in Turlock. They parked their car in front of, and near the entrance to, the restaurant.
Trax employed two security guards: Juan Navarro and Jason Nichols, a former police officer. Each wore a black shirt, with the word “SECURITY” in white letters on the back of the shirt.
During plaintiff’s visit, another patron, Jacob Joseph, who was with three or four companions and was unknown to plaintiff, started staring at plaintiff, who stared back. Because the staring made plaintiff uncomfortable, he decided to leave. He, his wife, and their two friends walked out of the front door toward their car. Plaintiff did not anticipate any attack, and neither he nor his wife noticed anyone in the parking lot. Just before reaching the car, plaintiff heard someone yell in a foreign language; as he turned around, he saw Joseph. When Joseph got near him, Joseph again yelled in a foreign language, at which point roughly a dozen men instantly surrounded and attacked plaintiff. After getting punched, kicked, and sprayed with pepper spray, plaintiff broke free and ran across the parking lot, through a park, and into the street, where some of the assailants caught up with him and seriously injured him by hitting him with a baseball bat.
*252Plaintiff’s wife corroborated his version of events. She testified that upon Joseph’s yell, 10 to 15 men came out of nowhere, “like they had been crouched behind cars,” and attacked her husband. She saw her husband break free of the initial assault, run across the parking lot, through the park, and into the street, where he was again attacked.
According to security guard Nichols, plaintiff’s wife told him inside the restaurant that there was going to be a fight. When he looked over he saw plaintiff and Joseph staring at each other; the staring indicated there was going to be a fight, and he asked plaintiff to leave. As Nichols escorted plaintiff and his companions into the parking lot, one of the men who had been with Joseph came out and asked plaintiff, “What’s up?” When plaintiff in turn asked, “What’s up?,” four men rushed toward plaintiff. Nichols grabbed the arm of one of the men; at that point some 15 men suddenly appeared from behind cars and a trash dumpster and surrounded plaintiff “like a wolf pack.” In coming to plaintiff’s aid, security guard Nichols was injured. Nichols saw plaintiff break free and run across the parking lot and into the street. The other guard, Juan Navarro, called 911, the emergency telephone number, to report the attack. The police responded within two to three minutes.
Called as a rebuttal witness, plaintiff’s wife denied approaching security guard Nichols in the bar and warning him there was going to be a fight. She also disputed Nichols’s version of events leading up to the attack.
Jacob Joseph testified that, while inside, he and plaintiff stared at each other, that after he went outside to smoke a cigarette plaintiff came out and swore at him and put up his hands as if to fight, that Joseph then yelled out something in Assyrian, whereupon a group of men attacked plaintiff. Joseph said that when he came outside, several men were already “[hjanging out in the parking lot.”
Plaintiff sued defendant, the restaurant, alleging negligence. The jury found for plaintiff and awarded him $81,391.61 in damages. Defendant appealed. While the appeal was pending, the First District Court of Appeal decided Mata v. Mata (2003) 105 Cal.App.4th 1121 [130 Cal.Rptr.2d 141], which involved a negligence action against a business owner based on a third party’s violent criminal act. Mata held that because the owner had employed a security guard who was working at the time of the shooting, the “duty to protect had already been assumed and therefore the issue of foreseeability becomes irrelevant” (id. at p. 1128), rendering it unnecessary for the plaintiff to “prove the proprietor had notice of prior similar acts” (id. at p. 1129). In this case, the Fifth District Court of Appeal reversed the judgment for plaintiff based on lack of a duty, and expressly disagreed with the Mata court’s holding on foreseeability. We granted review to resolve the conflict.
*253I agree with the majority that the court in Mata v. Mata, supra, 105 Cal.App.4th 1121, erred in saying that in that case foreseeability was irrelevant. (Maj. opn., ante, at p. 250.) But I disagree with the majority’s conclusion that defendant here owed plaintiff a duty to anticipate and take precautions against the unforeseeable violent criminal gang assault that led to plaintiff’s injuries.
II.
Did defendant business owner owe plaintiff a duty to take advance precautions to protect plaintiff from the vicious and violent gang assault he suffered? The answer is no, because the attack could not have been reasonably foreseen.
The existence and the scope of a duty owed is a question of law to be decided by the court. (Ann M. v. Pacific Plaza Shopping Center (1993) 6 Cal.4th 666, 674 [25 Cal.Rptr.2d 137, 863 P.2d 207] (Ann M.).) Whether a duty exists depends on considerations of policy. (Rowland v. Christian (1968) 69 Cal.2d 108, 112-113 [70 Cal.Rptr. 97, 443 P.2d 561].) As a leading treatise has observed, duty “is only an expression of the sum total of those considerations of policy which lead the law to say that the plaintiff is entitled to protection.” (Prosser & Keeton, Torts (5th ed. 1984) § 53, p. 358.) Foreseeability is an important factor in determining the existence of duty. (Ann M., supra, 6 Cal.4th at p. 676.) It also plays a crucial role in determining proximate cause. (Ballard v. Uribe (1986) 41 Cal.3d 564, 572, fn. 6 [224 Cal.Rptr. 664, 715 P.2d 624].) But whereas a jury decides causation, it is the court that determines whether a duty exists. {Ibid.) Here, the issue is one of duty, not causation.
In tort law, the question of when to impose liability against a business owner for not taking precautions against possible future criminal acts of third parties has been a vexing one. Two basic approaches have evolved, as this court explained in Ann M., supra, 6 Cal.4th at pages 677-679. The totality of circumstances test applies general principles of negligence; it takes into account such things as the nature, condition, and location of the premises; it views foreseeability as a question of fact that turns on the evidence. The second approach takes the view that a business owner has no duty in the absence of a prior similar incident on the premises; in other words, it views foreseeability as requiring the occurrence of a prior similar event before a duty to take precautionary measures can be imposed on the business owner. (2 Dobbs, The Law of Torts (2001) § 324, pp. 877-878.) The discussion that follows sheds some light on how this court has applied those two approaches.
*254In 1985, this court in Isaacs v. Huntington Memorial Hospital (1985) 38 Cal.3d 112 [211 Cal.Rptr. 356, 695 P.2d 653] (Isaacs), held that the existence of a business owner’s duty to anticipate criminal acts of third parties could be established, even if there had not been a prior similar incident, by considering the totality of circumstances, with foreseeability of harm being a question of fact for the jury. (Id. at pp. 126, 127, 130; see also Kentucky Fried Chicken of Cal., Inc, v. Superior Court (1997) 14 Cal.4th 814, 823-824 [59 Cal.Rptr.2d 756, 927 P.2d 1260].)
Eight years later in Ann M., supra, 6 Cal.4th 666, this court held that in the absence of a prior similar incident, a business owner had no duty to provide security guards to protect a plaintiff against a criminal assault by a third party. (Id. at p. 679.) In reaching this conclusion, Ann M. revisited the totality of circumstances rule this court had adopted in Isaacs, supra, 38 Cal.3d 112, noting there was no need in Isaacs to consider the viability of the prior similar incident approach in order to decide the case because the facts there disclosed ample evidence of prior third party criminal assaults. (Ann M., supra, 6 Cal.4th at p. 678.) Ann M. also observed that, contrary to the broadly worded suggestion in Isaacs, foreseeability in the context of duty analysis is a question of law for the court, not a question of fact for the jury. (Ibid.)
Six years later, in Sharon P. v. Arman, Ltd. (1999) 21 Cal.4th 1181 [91 Cal.Rptr.2d 35, 989 P.2d 121], we applied the prior similar incident rule of Ann M., supra, 6 Cal.4th 666, to a business owner’s failure to provide security measures other than hiring guards. We there held that, in the absence of a prior similar incident or other evidence showing a foreseeable risk of a violent criminal assault, the business owner did not owe the plaintiff a duty to deter criminal assaults in its underground garage by keeping the garage brightly lit and clean, or by “requiring] existing personnel to periodically walk through the garage.” (Sharon P., supra, at p. 1196.)
Most recently, in 2004, we applied the prior similar incident rule to hold that, in the absence of a prior similar incident, the operator of a child care center did not owe a duty to protect against a violent criminal assault by a man intentionally driving a car through a four-foot-high chain link fence onto a playground and into a group of children. (Wiener v. Southcoast Childcare Centers, Inc. (2004) 32 Cal.4th 1138, 1150 [12 Cal.Rptr.3d 615, 88 P.3d 517].) We noted that “our cases analyze third party criminal acts differently from ordinary negligence, and require us to apply a heightened sense of foreseeability before we can hold a defendant liable for the criminal acts of third parties.” (Id. at pp. 1149-1150.)
*255Here, in discussing the sudden, unexpected, and vicious gang attack on plaintiff, the Court of Appeal noted that “[n]othing even remotely similar” had ever occurred before on defendant’s premises, and thus the assault on plaintiff could not have been foreseen. In reaching this conclusion, the Court of Appeal relied on this court’s decision in Ann M., supra, 6 Cal.4th 666. Indeed, like the plaintiffs in Ann M., supra, 6 Cal.4th 666, Sharon P. v. Arman, Ltd., supra, 21 Cal.4th 1181, and Wiener v. Southcoast Childcare Centers, Inc., supra, 32 Cal.4th 1138, plaintiff here was the victim of a criminal assault by a third party. As the Court of Appeal noted, and as the majority here concedes (maj. opn., ante, at p. 245), there had been no prior similar attacks at Trax. Although in the past there had been some altercations between patrons, none involved gang fights or gang attacks on patrons. (See Alvarez v. Jacmar Pacific Pizza Corp. (2002) 100 Cal.App.4th 1190, 1212 [122 Cal.Rptr.2d 890] [“Absent foreseeability of the particular criminal conduct, there is no duty to protect plaintiff from that particular type of harm”].)
The majority here goes far beyond this court’s recent decisions in Ann M., supra, 6 Cal.4th 666, and its progeny. Anyone reading this court’s decisions in Ann M., supra, 6 Cal.4th 666, Sharon P. v. Arman, Ltd., supra, 21 Cal.4th 1181, and Wiener v. Southcoast Childcare Centers, Inc., supra, 32 Cal.4th 1138, would conclude that (1) the prior similar incident rule applies to premises liability claims against business owners for failing to take precautions against possible future criminal conduct of third parties when the conduct is a criminal assault by a third party, and that (2) as suggested in Kentucky Fried Chicken of Cal., Inc. v. Superior Court, supra, 14 Cal.4th at pages 823-824, the totality of circumstances rule applies when the business’s owner or employees become aware that criminal conduct is ongoing or imminent.
Relying on certain language in Wiener v. Southcoast Childcare Centers, Inc., supra, 32 Cal.4th 1138, the majority announces a different rule in which the existence of a business owner’s duty to prevent harm from third-party criminal acts is determined through a “sliding-scale” approach by balancing the degree of foreseeability of harm against the weight of the burden that a particular preventive measure would impose on the business owner. (Maj. opn., ante, at p. 243.) Turning to the facts of this case, the majority asserts that the restaurant owner had a duty to take minimally burdensome actions, such as having security guard Nichols try to dissuade Joseph from following plaintiff as he left the restaurant because some sort of criminal assault was foreseeable. (Maj. opn., ante, at p. 246.) Thus, instead of focusing on whether what occurred at the restaurant was foreseeable, the majority decides that *256here the owner owed a duty to plaintiff because the owner’s employee (the security guard) could have done something different that might have broken the causal chain of events. “While causation is an indispensable element of negligence liability, it is neither the only element, nor a substitute for ‘duty.’ ” (Hegyes v. Unjian Enterprises, Inc. (1991) 234 Cal.App.3d 1103, 1134 [286 Cal.Rptr. 85].) Because there are numerous causes of any event that precede its occurrence, it is always possible to point to something that could have been done differently, and the majority’s approach is perilously close to imposing liability that has no limits.
In this case, whether one applies the prior similar incident approach or the totality of circumstances approach, the result is the same: no liability on the part of the business owner. As I discussed earlier, the Court of Appeal noted the absence of any prior criminal acts similar to the gang assault here in concluding that the vicious attack on plaintiff by a gang of 10 to 15 men who suddenly came out of hiding was not an event that the owner could reasonably have foreseen, thus precluding liability.
The result is the same under the totality of circumstances approach, which applies general principles of negligence. As noted earlier, foreseeability is a crucial consideration in determining the existence of a duty. (Ann M., supra, 6 Cal.4th at p. 678; Issacs, supra, 38 Cal.3d at pp. 123-124.) It is the general character of the event that is required to be foreseeable. (Bigbee v. Pacific Tel. & Tel. Co. (1983) 34 Cal.3d 49, 57-58 [192 Cal.Rptr. 857, 665 P.2d 947].) Here, the hostile staring by Joseph and the reported statement by plaintiff’s wife that a fight seemed imminent were insufficient to alert defendant business owner to the likelihood that a brutal gang assault on plaintiff by 10 to 15 men would later occur outside the restaurant. Viewing the totality of the circumstances known to the restaurant’s employees, that form of violent criminal conduct was unforeseeable.
The majority faults defendant for failing to “address the imminent danger” (maj. opn., ante, at p. 246) because security guard Nichols did not try to stop Joseph from leaving the restaurant. But the existence and scope of a business owner’s duty to protect against a threat of future criminal activity, imminent or otherwise, depends on the foreseeability of the sort of criminal conduct that actually occurred. (See Sharon P. v. Arman, Ltd., supra, 21 Cal.4th at p. 1195 [“defendants’ duty of care did not include the hiring of security guards for the garage because the bank robberies were not sufficiently similar to the sexual assault crime to establish a high degree of foreseeability”]; Lopez v. McDonald's Corp. (1987) 193 Cal.App.3d 495, 510-511 [238 Cal.Rptr. 436] [existence of prior crimes on business premises in high crime area, including two robberies, did not make massacre by armed criminal reasonably foreseeable]; Gregorian v. National Convenience Stores, Inc. *257(1985) 174 Cal.App.3d 944, 950 [220 Cal.Rptr. 302] [“[w]hile the proprietor of an allnight convenience store may . . . reasonably anticipate that his place of business will be the target of armed robbers, the same cannot be said for a crime resulting from gang violence”].) As I have explained, the vicious group attack that occurred outside the restaurant was not reasonably foreseeable. Once the attack occurred, security guard Navarro did call 911.
To summarize: irrespective of whether one follows the prior similar incident approach, the totality of circumstances approach, or some intermediate “sliding-scale” approach, the conclusion is the same: the business owner here did not owe a duty to anticipate and protect plaintiff from the violent gang assault that occurred. Providing additional support for this conclusion are various policy considerations, as discussed below.
III.
Thirty-seven years ago, in Rowland v. Christian, supra, 69 Cal.2d 108, this court articulated certain policy considerations that determine when one person (the defendant) owes a duty in tort to take an action to protect another person (the plaintiff) from harm. Those considerations are: (1) the foreseeability of the harm to the plaintiff; (2) the degree of certainty that the plaintiff suffered injury; (3) the closeness of the connection between the defendant’s conduct and the plaintiff’s injury; (4) the policy of preventing future harm; (5) the extent of the burden imposed on the defendant and the consequences to the community in imposing a duty to exercise care, with resulting liability in the event of a breach; and (6) the availability, cost, and prevalence of insurance for the risk involved. {Id. at p. 113.)
These policy considerations support a conclusion that the business owner here did not owe a duty to prevent plaintiff’s injuries. As demonstrated in part n, above, here the particular harm to plaintiff was not foreseeable. Although it is undisputed that plaintiff was seriously injured in the vicious gang attack, the connection between the conduct of defendant business owner and the harm to plaintiff is highly attenuated, and very little moral blame can be attached to defendant’s conduct, for it was the conduct of the criminals, not that of the business owner, that was primarily responsible, both legally and morally, for plaintiff’s injuries. As to the burden on defendant, it is substantial. In the absence of a prior similar incident or some other indication of a reasonably foreseeable risk of a criminal assault, a business owner can only guess when, where, and how a criminal assault might occur, and what protective measures among an infinite number of possible precautions should be taken.
*258Particularly significant are the adverse consequences to the community of the duty that the majority recognizes and imposes here. Although no segment of our community is immune from violent crime, it is generally more prevalent in less affluent areas. (See Kaufman, When Crime Pays: Business Landlord’s Duty to Protect Customers from Criminal Acts Committed on the Premises (1990) 31 S.Tex. L.Rev. 89, 107-108, and authorities cited.) In such areas, the cost to businesses of elaborate security measures is likely to be prohibitive. In the absence of a prior similar incident, requiring business owners to anticipate and prevent a wide array of violent criminal conduct, including vicious group assaults like the one that occurred here, is likely to produce two unfortunate consequences in these economically depressed areas. Some businesses may take the elaborate precautions that the majority’s holding requires, and will pass on the added costs to their customers in the form of higher prices (this has been referred to as a “crime tax”), thereby increasing the costs of goods and services for the people least able to afford the higher prices. (Id. at p. 108; Cabrera, Negligence Liability of Landowners and Occupiers for the Criminal Conduct of Another: On a Clear Day in California One Can Foresee Forever (1987) 23 Cal. Western L.Rev. 165, 188.) Other businesses will simply close their doors, thereby depriving the local community of employment opportunities as well as goods and services. Either way, the effect will be to make life more difficult and costly for the innocent residents of crime-plagued neighborhoods.
The final policy consideration in determining the existence of a tort duty is the availability, cost, and prevalence of liability insurance. This consideration too weighs against recognizing a duty here. The broader the duty imposed on businesses to anticipate and guard against violent criminal assaults on their customers and others, the more expensive liability insurance is going to be, if it is available at all. Because the duty that the majority imposes requires business owners to anticipate all forms of violent criminal conduct, even when there has been no prior similar incident, insurance coverage for this expanded liability will become more expensive and harder to obtain.
Accordingly, the policy considerations that this court articulated in Rowland v. Christian, supra, 69 Cal.2d 108, support my conclusion that the business owner here should not be held liable for not anticipating the violent criminal gang assault on plaintiff.
For all of these reasons, I dissent. I would affirm the judgment of the Court of Appeal.