Camplisson v. Adidas America, Inc.

FACTUAL BACKGROUND

Defendant adidas ("Defendant") owns and uses its website www.adidas.com/us, allowing consumers to buy and access information about the brand's products. ECF No. 3 ("Compl.") ¶ 21; ECF No. 19 ("Mot.") at 4.¹As part of its website, Defendant has installed tracking pixels TikTok Pixel and Microsoft Bing (together, "Trackers"). Compl. ¶ 3. Tracking pixels are "small, almost-invisible image[s]…embedded in a website or an email to track a user's activities." Id. ¶ 23. When a user visits a website, the website's code installs the tracker into the user's browser and can, at that point, track user interactions "on its platform in order to place targeted advertisements." Id. ¶¶ 26-27. The tracked data can include "the user's operating system, the type of website or email used, the time when the website was accessed, the user's IP address, and whether there are cookies that previously have been set by the server hosting the pixel image." Id. ¶ 23. Each of the Trackers have different tracking capabilities. The TikTok Pixel

"enables website owners to track users' interactions with the website" and "collects and reports supplementary metadata, including timestamp (when an action took place), IP address (which can be used to determine the geographic location of the user), unique identifiers (which are assigned to a user's device or browser session that distinguish one user from another), device details (make, model, operating system), and browser information." Id. ¶ 30. It also uses "fingerprinting"—a process that collects information about the website user and matches it to information within the existing TikTok database across other websites with the pixel installed. Id. ¶ 31. This process associates information gathered from the pixel with personally identifying information, allowing one to track specific device activity. Id. TikTok Pixel also utilizes "AutoAdvanced

Page 2 of 18

Matching," which allows personal information (e.g., name, date of birth, address) to be sent to TikTok and identify a targeted individual with certainty. Id. ¶ 34. This information is used for analytics and advertising purposes for the website owner, but TikTok can also share the data with third parties. Id. ¶¶ 35-36. Plaintiffs allege concerns that this private data could also be shared with China to surveil the user, given previous concerns from Congress, independent tech watchdogs, and human rights groups. Id. ¶¶ 38-42. In comparison, the Microsoft Bat Bing Tracker similarly places a cookie on the user's browser to collect information, which is tracked by both the website owner and Microsoft. Id. ¶ 43. This information includes a unique Microsoft ID, which "track users' activity across the internet." Id. ¶ 44.

Defendant does not actively notify users of the Trackers on its website. However, the website has a link to its Terms and Conditions as well as its Privacy Policy. The Terms and Conditions outlines that third-party trackers, such as cookies, are used for targeted advertising. Mot. at 11. It also "explicitly directs consumers on how to opt out of the collection of their data." Id. The Privacy Policy "describe[s] that cookies and other tracking technologies are implemented on the browser in order to collect and store data, including the ability to recognize the users' devices to deliver relevant advertisements."

Compl. ¶ 50.

Access to the Terms and Conditions and Privacy Policy is located in a hyperlink at the "very bottom" or footer of the website in "small font." Id. ¶ 51. The Defendant maintains this location pursuant to the California Online Privacy Protection Act ("CalOPPA"), Cal. Bus. & Prof. Code § 22575 et seq. Mot. at 12. Plaintiffs, like other members of the defined Class, visited the adidas website and did not "consent to having their personally identifiable and addressing information collected, stored, or disseminated." Id. ¶ 54. Thus, Plaintiffs maintain that their "injuries

Page 3 of 18

occurred at the moment their information was improperly acquired by" Defendant. Id. ¶

56.

PROCEDURAL HISTORY

On March 14, 2025, Plaintiffs Maeve Complisson, David Sanchez, and S.D., a minor, (collectively, "Plaintiffs") filed a class action complaint against Defendant for allegedly violating the California Invasion of Privacy Act ("CIPA") when Defendant installed and used tracking pixels on Plaintiffs' and the Class' browsers, which collected their private information without their consent. ECF No. 1. Because Class members' information would be stored via a tracking pixel on the Defendant's website, Plaintiffs argue these website trackers constitute a "pen register" under Cal. Penal Code § 638.50(b) and, without the Class members' consent, violate CIPA § 638.51. ECF No. 3 ("Compl.") ¶¶ 4-5. Defendant moves to dismiss the complaint for lacking Article III standing and statutory standing and for failing to state a claim under Federal Rule of Civil Procedure 12(b)(6). ECF No. 19 ("Mot.") at 13-29.

LEGAL STANDARD

A. Federal Rule of Civil Procedure 12(b)(1)

Rule 12(b)(1) permits challenges to a court's subject matter jurisdiction and includes a challenge for lack of Article III standing. See Chandler v. State Farm Mut. Auto. Inc. Co., 598 F.3d 1115, 1122 (9th Cir. 2010). Article III, Section 2 the United States Constitution requires that a plaintiff have standing to bring a claim. See Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). Article III standing requires that a plaintiff show that he has (1) "suffered an injury in fact" that is "concrete and particularized" and "actual or imminent" (2) "that is fairly traceable to the challenged conduct of the defendant," and (3) "that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, 578 U.S. 330, 338-39 (2016) (citing Lujan v.

Page 4 of 18

Defenders of Wildlife, 504 U.S. 555, 560 (1992)). The plaintiff has the burden to allege Article III standing. See Lujan, 504 U.S. at 561.

"At the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice, for on a motion to dismiss we 'presum[e] that general allegations embrace those specific facts that are necessary to support the claim.'" Lujan,

504 U.S. at 561 (citation omitted); Cal. Rest. Ass'n v. City of Berkeley, 89 F.4th 1094, 1100 (9th Cir. 2023) (when "standing is challenged on the basis of the pleadings," we must "accept as true all material allegations of the complaint" and "construe the complaint in favor of the complaining party.").

B. Federal Rule of Civil Procedure 12(b)(6)

Rule 12(b)(6) allows a court to dismiss a complaint for "failure to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). Dismissal under Rule 12(b)(6) is appropriate where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory. Election Integrity Project Cal., Inc. v. Weber,

113 F.4th 1072, 1081 (9th Cir. 2024) (citing Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001)). To survive a motion to dismiss, the complaint must contain a "short and plain statement showing that the pleader is entitled to relief," Fed. R. Civ. P. 8(a)(2), backed by sufficient facts that make the claim "plausible on its face." Ashcroft v. Iqbal,

556 U.S. 662, 678, (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 547 (2007)). Plausibility requires "more than a sheer possibility that a defendant has acted unlawfully." Iqbal, 556 U.S. at 678. Rather, it requires enough factual content for the court to "draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. (citing Twombly, 550 U.S. at 556). In reviewing the plausibility of a complaint, courts must "accept factual allegations in the complaint as true and construe them in the light most favorable to the non-moving party." Dent v. Nat'l Football League, 968 F.3d 1126, 1130 (9th Cir. 2020). But courts do not accept as true allegations

Page 5 of 18

that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences. Coronavirus Rep. v. Apple, Inc., 85 F.4th 948, 954 (9th Cir. 2023). Ultimately, the court must be able to "draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal, 556 U.S. at 663.

Where a motion to dismiss is granted, "leave to amend should be granted 'unless the court determines that the allegation of other facts consistent with the challenged pleading could not possibly cure the deficiency.'" DeSoto v. Yellow Freight Sys., Inc.,

957 F.2d 655, 658 (9th Cir. 1992) (quoting Schreiber Distrib. Co. v. Serv-Well Furniture Co., 806 F.2d 1393, 1401 (9th Cir. 1986)).

REQUEST FOR JUDICIAL NOTICE & INCORPORATION BY REFERENCE

Generally, on a motion to dismiss, courts will limit their review to the contents of the complaint and may only consider extrinsic evidence that is properly presented as part of the complaint. See Lee v. City of L.A., 250 F.3d 668, 688-89 (9th Cir. 2001). However, under Federal Rule of Evidence 201, a district court may take notice of facts not subject to reasonable dispute that are capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned. Fed. R. Evid. 201(b). The incorporation by reference doctrine "is a judicially created doctrine", where the court "treats certain documents as though they are part of the complaint itself." Khoja

v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018); Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001).

Defendant asks the Court to incorporate by reference and take judicial notice of Defendant's archival version of its Terms and Conditions as well as its Privacy Policy. ECF No. 20. Defendant also requests judicial notice of 78 separate civil actions. Id. Plaintiff requests judicial notice of the First Amended Complaint filed in Licea v. Hickory Farms LLC, No. 23STCV26148, 2023 WL 11113637 (Superior Court of California, Los Angeles County Dec. 4, 2023).

Page 6 of 18

Defendant's archival versions of its Terms and Conditions and Privacy Policy are incorporated by reference doctrine because the complaint references the details of those two exhibits. Compl. ¶¶ 50-51. Additionally, Defendant's 78 civil actions and Plaintiff' First Amended Complaint from Licea are relevant to the instant case and are matters of public record, so the Court may take judicial notice of them "without converting a motion to dismiss into a motion for summary judgment." Lee, 250 F.3d at 689 (quotations and citations omitted). But the Court will not take judicial notice of the truth of any disputed facts contained in those public records. See id.

DISCUSSION

Defendant moves to dismiss, arguing that the complaint fails to allege a concrete privacy harm and, thus, lacks standing. Mot. at 14. The Defendant also argues that Plaintiffs fail to state a claim under Rule 12(b)(6). Id. In response, Plaintiffs argue that they have standing under CIPA and Article III because they have suffered an injury-in- fact and the Trackers constitute a "pen register" and are unlawful to use under CIPA. See ECF No. 22 ("Opp.").

I. STANDING

A plaintiff "bears the burden of establishing standing." Lopez v. Candaele, 630 F.3d 775, 785 (9th Cir. 2010). A plaintiff "must demonstrate standing for each claim he or she seeks to press and for each form of relief sought." Washington Env't Council v. Bellon, 732 F.3d 1131, 1139 (9th Cir. 2013) (citing DaimlerChrysler Corp. v. Cuno, 547

U.S. 332, 352 (2006)).

Here, Defendant argues that Plaintiffs do not meet (1) statutory and (2) constitutional standing requirements. Specifically, Defendant maintains Plaintiffs have failed to allege an injury in fact because Plaintiffs only plead a bare "procedural violation" that does not accord to traditional privacy harms and legislative intent nor does it allege enough detailed facts to establish concrete harm. Mot. at 7-16.

Page 7 of 18

A. Statutory Standing

Statutory standing essentially provides an "injury in law," giving a plaintiff a pathway "to sue a defendant over the defendant's violation of federal law." TransUnion LLC v. Ramirez, 594 U.S. 413, 426-27 (2021). Statutory standing can be established by pleading a violation of a right conferred by statute so long as the plaintiff alleges "a distinct and palpable injury to himself, even if it is an injury shared by a large class of other possible litigants." Warth v. Seldin, 522 U.S. 490, 501 (1975). Whether or not a plaintiff has stated a basis for statutory standing is tested under Rule 12(b)(6) rather than Rule 12(b)(1). Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). CIPA, Cal. Penal Code § 630 et seq. prohibits unauthorized interceptions of communications in order "to protect the right of privacy of the people of this state." Cal. Penal Code § 630. CIPA allows for an individual's private right of action where the individual "has been injured by a violation of this chapter." Cal. Penal Code § 637.2. Specifically for this case, an individual who has been injured by a party that "install[s] or use[s] a pen register or a trap and trace device without first obtaining a court order"

would have standing. Id. § 638.51.

Based on this text, Defendants argue that Plaintiffs have failed "to plead any

injury…[which] precludes any finding that they have statutory standing to bring their claim." Mot. at 16. However, this restrictive interpretation does not accord with case law or the state legislature's goal to protect privacy rights. A violation of one's privacy rights is an injury in itself, and the statute does not require more. In fact, "district courts in the Ninth Circuit consistently have concluded that, to satisfy injury in fact, a plaintiff in a CIPA action need not allege actual harm beyond the invasion of the private right conferred by the statute." Raffin v. Medicredit, Inc., No. CV154912GHKPJWX, 2016 WL 7743504, at *3 (C.D. Cal. Dec. 19, 2016); see also Conohan v. Rad Power Bikes Inc., No. CV 25-0106 PVC, 2025 WL 1111246, at *5 (C.D. Cal. Apr. 3, 2025).

Page 8 of 18

Here, Plaintiffs have specifically alleged that their personally identifiable information was recorded without their consent, which violates the Plaintiffs right of privacy. Thus, Plaintiffs have sufficiently alleged statutory standing. See, e.g., Shah v. Fandom, Inc., 754 F. Supp. 3d 924, 932 (N.D. Cal. 2024).

B. Article III Standing - Injury in Fact

To establish Article III standing, an injury must be "concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling." Clapper v. Amnesty Int'l USA, 568 U.S. 398, 409 (2013) (quotation marks omitted). An injury is "particularized" if it affects "the plaintiff in a personal and individual way." Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016). In addition, for an injury to be "concrete", it must be "de facto," meaning that it is "real" and not "abstract."

Id. "[I]ntangible harms" can also be "concrete" such as "reputational harms, disclosure of private information, and intrusion upon seclusion" or those "specified by the Constitution itself." TransUnion LLC v. Ramirez, 594 U.S. 413, 425 (2021).

Where the plaintiff alleges an "intangible harm," the Court assesses the identified injury-in-fact by looking to "both history and the judgment of Congress" or the legislature that enacted the provision. Spokeo, 578 U.S. at 340-41 (quotation marks omitted); Patel v. Facebook, Inc., 932 F.3d 1264, 1273 (9th Cir. 2019) (looking to "[t]he judgment of the Illinois General Assembly" to inform the Article III standing inquiry for a claim alleging a violation of an Illinois privacy statute). First, historical practice can indicate "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Spokeo, 578 U.S. at 341. Second, a legislature's pronouncement may elevate de facto injuries that were previously inadequate in law to the status of concrete, legally cognizable injuries. Id.

Page 9 of 18

However, even if the legislature has "grant[ed] a person a statutory right and purport[ed] to authorize that person to sue to vindicate that right," that alone is not sufficient for standing. Id. "When a legislature has enacted a 'bare procedural' protection, a plaintiff 'cannot satisfy the demands of Article III' by pointing only to a violation of that provision, but also must link it to a concrete harm." Campbell v. Facebook, Inc., 951 F.3d 1106, 1117 (9th Cir. 2020) (quoting Spokeo, 578 U.S. at 342) (emphasis in original). In contrast, if the legislature identifies a substantive right, a plaintiff may bring a claim against the infringement of that right without "alleg[ing] any further harm to have standing." Eichenberger v. ESPN, Inc., 876 F.3d 979, 983-84 (9th Cir. 2017); see also Campbell, 951 F.3d at 1118 (concrete interests protected by the Electronic Communications Privacy Act and the California Invasion of Privacy Act, which protect a consumer's "substantive privacy interest" in his communications against someone intercepting those communications "who does not have the right to access them"). Defendants argue there is no concrete injury in fact because Plaintiffs' claims are

a) not supported by legislative intent and b) inconsistent with traditional privacy harms.

1. Legislative Intent

Defendant contends that CIPA was meant to apply to landline telephones and not to internet technologies that had not yet been invented when the statute was enacted. Mot. at 20. Defendant also argues that construing the statute to a website's collection of IP addresses would "create absurd results" and disrupt internet commerce. Id. at 21. The Defendant goes so far as to say, "the internet would cease to function." Id. However, legislators did not limit the statutory language to only telephone technologies. See, e.g., Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at *1 (9th Cir. May 31, 2022); Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1050 (S.D. Cal. 2023); Shah v. Fandom, Inc., 754 F. Supp. 3d 924, 933 (N.D. Cal. 2024). Instead, they focused on broadly "protect[ing] right of privacy of the people of the state."

Page 10 of 18

Cal. Penal Code § 630. In fact, in passing CIPA, legislators have recognized that "the invasion of privacy resulting from the continual and increasing use of such devices and techniques has created a serious threat to the free exercise of personal liberties." Id. This broad language is focused on elevating the privacy injuries and has not limited itself to a specific technology. There is no indication of a bare procedural protection on the part of the legislature, as discussed below. Thus, Plaintiffs' claim of privacy harms from the Trackers fall within the scope of the statute, and analysis of legislative intent does not indicate a lack of standing.

2. Traditional Privacy Harms

Defendant argues that Plaintiffs do not implicate traditional privacy harms because the information was not sensitive and was not disseminated or misused. Mot. at 17. Defendant maintains, by not having these characteristics, the alleged injury is not concrete and particularized.

As mentioned above, an intangible injury, such as a privacy harm, is "concrete"

when it bears a "close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts." TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021). Within this understanding, "violations of the right to privacy have long been actionable at common law." Patel v. Facebook, 932 F.3d 1264, 1272 (9th Cir. 2019) (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)). More specifically, this right "encompass[es] the individual's control of information concerning his or her person." Eichenberger, 876 F.3d at 983 (quoting U.S. Dep't of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989)). In fact, the Ninth Circuit recognizes that "the statutory claims, the legislative history and statutory text demonstrate that Congress and the California legislature intended to protect these historical privacy rights when they passed…CIPA." In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020). CIPA codifies "a substantive right to privacy, the violation of

Page 11 of 18

which gives rise to a concrete injury sufficient to confer standing." Id. There is no requirement that there be additional injury beyond the violation of that right or that the information collected must necessarily be sensitive and misused. See, e.g., Conohan v. Rad Power Bikes Inc., No. CV 25-0106 PVC, 2025 WL 1111246, at *5 (C.D. Cal. Apr. 3,

2025).

Defendant, in turn, relies on Popa, arguing the Ninth Circuit clarified that the harm must be "embarrassing, invasive, or otherwise private." Popa v. Microsoft Corp., 153 F.4th 784, 791 (9th Cir. 2025). However, Defendant's reliance on Popa is misplaced. Rather than introducing new case law that adds heightened requirements for privacy harms, Popa uses the same common law rules discussed above and evaluates the specific facts of that case. Popa involved a claim against the defendant's use of session-replay technology, which collected information on what products the plaintiff browsed and where her mouse hovered while on the website. Id. at 786. Given that the information concerned how the plaintiff interacted with the site rather than her personal, private information, the Popa court found that the nature of the collected information was not

"embarrassing, invasive, or otherwise private" and did not fall within the traditional privacy harms at common law. Id. at 791-92.

This is distinguishable from the facts presented in this case, where the collection of Plaintiffs' information concerns their person, is much broader in scope, and has been found to be a privacy harm in a wide variety of cases. See, e.g., Gabrielli v. Haleon US Inc., No. 25-CV-02555-WHO, 2025 WL 2494368 (N.D. Cal. Aug. 29, 2025) ("[T]he session-replay technology [in Popa] was not alleged to track anything beyond her interactions with the website she chose to visit, and the information gathered was only alleged to be used by the owner of that website. In contrast, [the plaintiff here] alleges that the cookies [the defendant] stores on users' devices allow third parties 'to track and collect data in real time regarding ... user input data,' which includes '[t]he information

Page 12 of 18

the user entered into the Websites' form fields, including search queries, the user's name, age, gender, email address, location, and/or payment information, demographic information,' and also 'device information, session information, and/or geolocation data.'). Here, rather than just recording clicks and movements on the Defendant's website, Plaintiffs have alleged that the Trackers on Defendant's website have collected a broad set of their personal identifying and addressing information without their consent and in violation of CIPA. This claim maintains a violation of privacy, particularly in the control of their own information. Thus, the injury-in-fact is in accordance with traditional privacy harms and is concrete. Plaintiffs do not lack Article III standing.

II. RULE 12(b)(6): FAILURE TO STATE A CLAIM

Defendant argues that Plaintiff has failed to "state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). Specifically, Defendant maintains there is a failure because 1) cookies are not "pen registers" under CIPA's plain text and legislative intent;

2) alternatively, Defendant consented to installing the "pen registers" on its site as the

"user;" and 3) alternatively, Plaintiffs agreed to the Privacy Policy and, thus, consented to the cookies. Mot. at 14. The Court takes each of Defendant's arguments in turn.

A. CIPA Pen Register

Section 638.50 defines pen register as "a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication." Cal. Penal Code § 638.50(b). This definition has been understood to be intentionally broad and not limited to specific technology, as "all CIPA provisions are to be interpreted in light of the broad privacy-protecting statutory purposes of CIPA." Javier v. Assurance IQ, LLC, 2022 WL 1744107, at *1-2 (9th Cir. May 31, 2022); see also Matera v. Google Inc., No. 15-CV-04062-LHK, 2016 WL 8200619, at

Page 13 of 18

*20 (N.D. Cal. Aug. 12, 2016). Thus, a pen register can encapsulate internet communications.

Here, Plaintiffs have alleged that the Trackers were installed on Plaintiffs' and Class members' browsers and collected personally identifying and addressing information, such as IP addresses. Compl. ¶ 55. Defendants, in turn, argue that trackers cannot be a pen register because it only captures "certain specific outgoing information"

rather than a technology "installed on devices that allow law enforcement to identify all outgoing communications from that device." Mot. at 24 (emphasis in original). Additionally, Defendants contend that the information collected through fingerprinting is substantive rather than just dialing, routing, addressing, and signaling information, thus making the claim outside the scope of the statute. Id. at 24-25. Turning to Defendant's first argument, Section 638.50's language does not limit a pen register to a process that collects all information. Limiting the statute's intentionally broad language in such away would take away from CIPA's purpose of protecting privacy, making it underinclusive. See Fregosa v. Mashable, Inc., No. 25-CV-01094- CRB, 2025 WL 2886399, at *5 (N.D. Cal. Oct. 9, 2025) ("Courts interpreting CIPA have consistently treated the broad statutory language as intentional and significant."). Additionally, most cases in this and other districts have also recognized that website-based trackers can plausibly constitute a pen register. See, e.g., Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1050 (S.D. Cal. 2023) (finding "a private company's surreptitiously embedded software" that "identifies consumers, gathers data, and correlates that data through unique 'fingerprinting'" can be a pen register); Zarif v. Hwareh.com, Inc., 789 F. Supp. 3d 880 (S.D. Cal. 2025) (same); Moody v. C2 Educ. Sys. Inc., 742 F. Supp. 3d 1072, 1076 (C.D. Cal. 2024) ("Plaintiff's allegations that the TikTok Software is embedded in the Website and collects information from visitors plausibly fall within the scope of §§ 638.50 and 638.51."); but see Kishnani v. Royal

Page 14 of 18

Caribbean Cruises Ltd., No. 25-CV-01473-NW, 2025 WL 1745726, at *4 (N.D. Cal. June 24, 2025) (finding a tracker's fingerprinting did fall within the language of § 638). This is true even if only IP addresses are collected. See, e.g., Shah v. Fandom, Inc., 754 F. Supp. 3d 924, 931 (N.D. Cal. 2024) (finding tracking software that record IP addresses to plausibly constitute a pen register); Mirmalek v. Los Angeles Times Commc'ns LLC, No. 24-CV-01797-CRB, 2024 WL 5102709, at *4 (N.D. Cal. Dec. 12, 2024) (same); Gabrielli v. Haleon US Inc., No. 25-CV-02555-WHO, 2025 WL 2494368, at *11 (N.D. Cal. Aug. 29, 2025) (same).

This Court agrees with those cases. Plaintiffs have sufficiently alleged that the Trackers record Class members' personal information, including the addressing information contained in an IP address, and thus plausibly constitute pen registers.

B. Consent Exception

Though in most cases a pen register requires a court order, a pen register may be used "[i]f the consent of the user of that service has been obtained." Cal. Penal Code § 638.51(b)(5). Defendant argues that, if the Trackers are pen registers, the Trackers may be lawfully used because (1) Defendant consented and (2) Plaintiffs consented.

1. Defendant's Consent

Defendant first maintains that its consent defeats Plaintiffs' claim. Specifically, Defendant contends that it is a "user" of the Trackers and have, thus, consented to the use and installation of the Trackers on its website. Mot. at 27.

However, this argument is unconvincing. The point at issue is that the Trackers were installed on Class member's personal browsers and collected their information. Thus, the consent exception does not turn on whether Defendant can consent to cookies and trackers on its website but whether Plaintiffs and Class members consented to the placement of Trackers on their browsers. See Rodriguez v. Autotrader.com, Inc., 762 F. Supp. 3d 921 (C.D. Cal. 2025) ("Given the location and degree of control that the visitor

Page 15 of 18

has over the software, it only seems natural that the visitor, not Defendant, would be software's user in these circumstances."); Moody v. C2 Educ. Sys. Inc., 742 F. Supp. 3d 1072, 1077 (C.D. Cal. 2024) (finding similar arguments "do not foreclose the possibility that Plaintiff is the relevant user under California law, at least at the motion to dismiss stage").

Thus, Defendant is not the appropriate "user" to defeat Plaintiffs' claim.

2. Plaintiffs' Consent

In the alternative, Defendant asserts that Plaintiff has consented to the use of pen registers. Mot. at 27. Defendant's Privacy Policy states that "cookies and other tracking technologies are implemented on the browser in order to collect and store data." Compl. ¶

50. The Terms and Conditions, "which is binding on all visitors to the website,"

incorporates the Privacy Policy. Mot. at 28. Both the Privacy Policy and the Terms and Conditions are in the footer of every page of Defendant's website, so in Defendant's view, Plaintiff was put on notice that the website had Trackers and consented to their use. Id. at 28-29.

Plaintiff responds by highlighting that "Plaintiffs were never notified that [Defendant's] website used [the] Trackers, and…were never provided a meaningful opportunity to consent to having their data collected." Opp. at 28. In essence, Plaintiffs maintain that because the Terms and Conditions were not readily visible and because there was no "pop-up window informing users that their data is being collected." Id. For a website user to be contractually bound by a site's terms, the user need not have actual knowledge of the browsewrap agreement. Nguyen v. Barnes & Noble Inc.,

763 F.3d 1171, 1177 (9th Cir. 2014). Instead, the website must put "a reasonably prudent user on inquiry notice of the terms of the contract." Id. "Whether a user has inquiry notice of a browsewrap agreement, in turn, depends on the design and content of the website and the agreement's webpage." Id. Still, "[u]nless the website operator can show that a

Page 16 of 18

consumer has actual knowledge of the agreement, an enforceable contract will be found based on an inquiry notice theory only if: (1) the website provides reasonably conspicuous notice of the terms to which the consumer will be bound; and (2) the consumer takes some action, such as clicking a button or checking a box, that unambiguously manifests his or her assent to those terms." Berman v. Freedom Fin. Network, LLC, 30 F.4th 849, 856 (9th Cir. 2022).

In terms of conspicuousness, many courts have refused to enforce browsewrap agreements "[w]here the link to a website's terms of use is buried at the bottom of the page or tucked away in obscure corners of the website where users are unlikely to see it."

Nguyen, 763 F.3d at 1177; see, e.g., In re Zappos.com, Inc., Customer Data Sec. Breach Litig., 893 F. Supp. 2d 1058 (D. Nev. 2012) ("The Terms of Use is inconspicuous, buried in the middle to bottom of every Zappos.com webpage among many other links, and the website never directs a user to the Terms of Use."); Hines v. Overstock.com, Inc., 668 F. Supp. 2d 362 (E.D.N.Y. 2009), aff'd, 380 F. App'x 22 (2d Cir. 2010) (finding no notice where plaintiff "could not even see the link to them without scrolling down to the bottom of the screen").

Here, Defendant's website does not make the Terms and Conditions conspicuous. The website users must, instead, find the details of the terms and the Privacy Policy by scrolling down to the footer of the page. Thus, Defendant does not meet the first requirement to put Plaintiffs on notice.

However, even if the notice was conspicuous, the website must provide a mechanism for "affirmative action to demonstrate assent." Nguyen, 763 F.3d at 1178. For example, though Defendant cites to Moretti and Silver as cases in support of its position, those cases involved websites where affirmative consent was requested. In Moretti, "an individual using the Hotwire website cannot complete a booking without checking the 'Acceptance Box' acknowledging the acceptance of 'Hotwire's terms and conditions and

Page 17 of 18

other applicable rules.'" Moretti v. Hertz Corp., 2014 WL 1410432, at *3 (N.D. Cal. Apr. 11, 2014). Silver, similarly, involved a "purchase checkout page [that] required plaintiffs to agree to Instacart's terms of service and privacy policy whenever they placed an order." Silver v. Stripe Inc., No. 4:20-CV-08196-YGR, 2021 WL 3191752, at *3 (N.D. Cal. July 28, 2021). Defendant's website only hyperlinked the Terms and Conditions at the footer of the website and did not have a pop-up window or other mechanism that would obtain Plaintiffs' and Class members' affirmative consent. Therefore, Defendant does not meet the second requirement to put Plaintiffs on notice. In sum, Defendants have not adequately shown that Plaintiffs and Class members were put on notice of the Terms and Conditions and the Privacy Policy that outlined the use of the Trackers. Thus, Plaintiffs have not consented to the use of pen registers on their web browsers.

CONCLUSION

For the foregoing reasons, the Court DENIES the Defendant's motion to dismiss the complaint.

IT IS SO ORDERED.

Dated: November 18, 2025

Page 18 of 18