Juhyun So v. Hyatt Hotels Corporation

2

First, a user sets search parameters such as a destination; trip dates; the number of rooms; the number of adults or children who would be traveling; and any applicable special rates, for example, senior citizen or member rates. Second, a user selects a particular hotel, room type, and any applicable special rates. Third, a user completes his booking by entering his first and last name, email address, phone number, and payment information.

Hyatt enables Adobe and Meta to use data-tracking software on its website. At a high level, the data-tracking software duplicates the user's input data and sends it to Adobe and Meta. That process occurs within milliseconds. Adobe and Meta can match the input data with the user's identity, in part through the use of cookies—small files that are stored in the user's computer and can be used to track user behavior across different sites. Hyatt additionally enables Meta's advanced matching service, which scans form fields on the website for identifying information such as a user's first name, last name, and email. Adobe and Meta can then use the information they acquire for various purposes, such as targeted advertising, content personalization, product improvement, and security.

On at least three occasions in 2024, So visited Hyatt's website, hyatt.com, to browse and book a Hyatt hotel. The complaint generally alleges that Adobe and Meta acquired information about his inputs, but the only specific information referenced in the complaint is a series of screenshots, and the complaint is not clear whether they are generic examples or are from one of So's actual bookings. Assuming they are from one of his actual bookings, they purport to show Adobe and Meta acquiring information about his selected destination, desired trip dates, the number of rooms, the number of

3

adults and children, a "senior" special rate, a particular Hyatt hotel, a room type, and the fact that he booked the hotel. The screenshots do not show that Adobe and Meta also acquired the information that So would have provided to complete his booking—his first and last name, email address, phone number, and payment information. See Compl. ¶¶ 39-48, 93, 102. The complaint does allege in general terms that Hyatt "enables Meta to identify individual Website users through . . . advanced matching . . . by the personal information they provide on [Hyatt's] website, which in this case[] includes the names, email addresses, and phone numbers they input while booking a room at a Hyatt hotel," but it does not allege that Meta acquired this personal information from So specifically. See id. ¶ 103.

So originally sued Hyatt in the Central District of California, alleging that the use of third-party tracking technology on its website violated California's Invasion of Privacy Act (CIPA). Hyatt moved to transfer the case to this Court pursuant to a forum-selection clause contained in the terms and conditions of its loyalty rewards program as well as the terms and conditions of its website. The court in California took judicial notice of fourteen exhibits, including both sets of terms and conditions. It granted Hyatt's motion to transfer without analyzing the website, ruling that So assented to and was bound by the terms and conditions of the loyalty rewards program.

After the case was transferred to this Court, So filed an amended complaint reasserting his CIPA claims. Hyatt filed a motion to dismiss, which the Court denied as moot after So filed the second amended complaint at issue in this opinion. In his second amended complaint, So has replaced his CIPA claims with one count under the Federal Wiretap Act. Hyatt has moved to dismiss the second amended complaint under

4

Federal Rule of Civil Procedure 12(b)(6).

Discussion

Under Rule 8(a), "[a] pleading that states a claim for relief must contain . . . a short and plain statement of the claim showing that the pleader is entitled to relief."

Fed. R. Civ. P. 8(a)(2). That pleading standard requires the plaintiff to allege factual material that, if taken as true, suffices to "state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555-57, 570 (2007). A claim is plausible on its face when the facts alleged "allow[] the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Put differently, the "[f]actual allegations must be enough to raise a right to relief above the speculative level." Twombly, 550 U.S. at 555. Rule 12(b)(6) permits a defendant to challenge whether a complaint meets this standard before filing a responsive pleading. Fed. R. Civ. P. 12(b)(6). In ruling on a Rule 12(b)(6) motion to dismiss, a court is limited to assessing the allegations in the complaint, documents attached to the complaint, documents critical to the complaint and referred to in it, and information subject to proper judicial notice. Wertymer v. Walmart, Inc., 142 F.4th 491, 498 (7th Cir. 2025).

Section 2511 is the main substantive provision of the Wiretap Act. Subsection 2511(1) lists several categories of prohibited conduct, three of which are relevant here. Paragraph (a) makes it unlawful for "any person" to "intentionally intercept[], endeavor[] to intercept, or procure[] any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication." 18 U.S.C. § 2511(1)(a). Paragraphs (c) and

(d) prohibit "any person" from disclosing or using, respectively, the contents of

5

intercepted communications "knowing or having reason to know that the information was obtained through" an "interception . . . in violation of this subsection." Id. § 2511(1)(c)-(d).

The Wiretap Act defines "intercept" as "the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device." Id. § 2510(4). It defines the "contents" of a communication to "include[] any information concerning the substance, purport, or meaning of that communication." Id. § 2510(8).

According to So, Hyatt "intentionally procured" Adobe and Meta to use their data- tracking software to intercept the contents of his communications to Hyatt, in violation of paragraph (a). 2d Am. Compl. ¶ 88. As for paragraphs (c) and (d), So alleges that Hyatt, knowing that Adobe and Meta would intercept his booking information, disclosed this information to Adobe and Meta and used it for profit. To bring this civil suit, So relies on the Wiretap Act's private cause of action in section 2520: "any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter may in a civil action recover from the person or entity . . . which engaged in that violation." 18 U.S.C. § 2520(a).

Given the expansive definition of "intercept," subsection 2511(1) in isolation could reach a wide array of ordinary conduct. For example, a literal reading would mean that anyone who acquires the contents of a communication through a device, even an intended recipient taking a phone call, "intercepts" that information and is therefore liable under paragraph (a). Subsection 2511(2) prevents those kinds of unintended results by carving out several exemptions. Of particular relevance in this

6

case, subsection 2511(2)(d) states:

It shall not be unlawful under this chapter for a person . . . to intercept a . . . communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.

Id. § 2511(2)(d). This exemption provides that interception by a party to the communication is not unlawful—addressing the intended-recipient example above. It further establishes a one-party consent defense: an interception is not unlawful if at least one party gave prior consent. That defense is itself subject to a crime/tort exception: if the communication was "intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State," the interception is unlawful notwithstanding any prior consent. Id. Hyatt contends that it was a party to So's communications and consented to Adobe and Meta intercepting the contents of those communications. Thus, Hyatt argues, subsection 2511(2)(d) exempts it from liability, and the Court should dismiss So's complaint. This argument raises three complicating points: one procedural and two substantive.

Starting with procedure, Hyatt filed a motion to dismiss for failure to state a claim, which tests the sufficiency of the plaintiff's complaint. But consent under the Wiretap Act is an affirmative defense, and a plaintiff need not anticipate or refute potential affirmative defenses in his complaint. Doe v. Smith, 429 F.3d 706, 709 (7th Cir. 2005). Instead, a defendant seeking dismissal based on an affirmative defense generally should raise that defense in a responsive pleading, then file a motion under Rule 12(c) for judgment on the pleadings. Luna Vanegas v. Signet Builders, Inc., 46 F.4th 636,

7

640 (7th Cir. 2022). That distinction is necessary to correctly allocate the burdens of pleading and proof and to ensure that a plaintiff has notice of an affirmative defense and a fair opportunity to contest it. See Gunn v. Cont'l Cas. Co., 968 F.3d 802, 806 (7th Cir.

2020).

There is, however, "a narrow and pragmatic exception" to the general rule against Rule 12(b)(6) dismissals based on affirmative defenses, which applies in the rare situation when a plaintiff pleads himself out of court. Id. "[I]f the affirmative defense is clear from the face of the complaint [and other materials properly considered on a Rule 12(b)(6) motion], the court may dismiss under Rule 12(b)(6) instead" of Rule 12(c). Holmes v. Marion Cnty. Sheriff's Off., 141 F.4th 818, 822 (7th Cir. 2025). This case fits the bill. Within the four corners of So's complaint, he alleges that Hyatt "intentionally procured" Adobe and Meta to intercept the contents of his communications to Hyatt. 2d Am. Compl. ¶ 88; see id. ¶¶ 90-91. His allegations make it apparent that Hyatt was a party to the communications and consented to Adobe and Meta's interception. Hyatt's consent defense is clear from the face of So's complaint, so it can properly serve as a basis for dismissal under Rule 12(b)(6). That leads to the first substantive point. As the Court has indicated, the Wiretap Act's consent defense is limited by a crime/tort exception. See Doe, 429 F.3d at 709. Even when consent is clear, as it is here, dismissal would be inappropriate without considering whether So has plausibly pleaded that the crime/tort exception applies. See id. at 710. Turning to that question, So relies on what he contends are Hyatt's violations of a California statute generally prohibiting "hotelkeeper[s]," among others who own or operate accommodations, from "disclos[ing]" or "otherwise communicat[ing]

8

. . . all or any part of a guest record . . . to a third party." Cal. Civ. Code § 53.5(a). The statute defines "guest record" to "include[] any record that identifies an individual guest,

. . . customer, [etc.]" Id. § 53.5(c). It goes on to provide a non-exhaustive list of examples: "name, social security number or other unique identifying number, date of birth, location of birth, address, telephone number, driver's license number, other official form of identification, credit card number, or automobile license plate number." Id. So argues that Hyatt violated the California statute, and thus committed a tort, by disclosing booking information that Adobe and Meta could then pair with the guest's identity. It is not clear whether this suffices to state a violation under the California statute. The phrase "any record that identifies an individual guest" might refer to (1) records that reveal the identity of an individual guest, and/or (2) records that reveal that an individual is a guest. The list of example guest records strongly suggests that it refers to the first, more natural reading, not the latter. On the first reading, disclosure of booking information that contains no identifiers would not seem to violate the statute simply because it could be paired with other identifying information. To be sure, if a hotelkeeper also disclosed identifying information—such as the guest's name, email address, or phone number—it would violate the statute. But that is not the situation here. So alleges that Hyatt generally enables Meta's advanced tracking, but he conspicuously does not allege that Meta's advanced tracking technology intercepted his personal information. So's complaint and briefing are even less clear on whether Hyatt disclosed identifying information to Adobe. See, e.g., Compl. ¶ 32 (stating that Adobe can "piece together a complete picture of a customer by linking their disconnected identifiers," including email addresses and phone numbers, without saying whether such

9

information is obtained from Hyatt); Pl.'s Opp'n to Mot. to Dismiss at 17 ("Meta collects guest's names and phone numbers . . . and Adobe has the ability to collect guests' emails and phone numbers . . . . (emphasis added)).

In any event, the Court need not definitively decide whether So's allegations would suffice under the California guest record statute, because he faces an antecedent problem. Hyatt argues that the California statute does not apply because So's claim is governed by Illinois law, pursuant to choice-of-law clauses in the terms and conditions of its website and its rewards program. Hyatt also contends that the transferor judge's ruling that the forum-selection clause controlled, in addressing Hyatt's motion to transfer, applies equally to the choice-of-law provision, and this Court should not find to the contrary under the law-of-the-case doctrine. The Court need not decide Hyatt's law- of-the-case argument because So agrees that "Hyatt's choice of law clause requires [the parties] to follow the laws of Illinois" in this case. Id. at 15. This leaves the question of how the choice-of-law provision affects So's claim under the Wiretap Act. So argues that it has no effect because "[t]he Supremacy Clause of the federal Constitution requires Illinois to treat federal law as part of state law." Id. at 14 (italics omitted) (quoting Arres v. IMI Cornelius Remcor, Inc., 333 F.3d 812, 814 (7th Cir. 2003)). True enough, but that only means that the Wiretap Act applies in the first instance. The Supremacy Clause says nothing about the embedded choice-of-law question of which body of state law to consider in determining whether an interception satisfies the Act's crime/tort exception.

Hyatt contends that "[n]o law permits a contractual party to obviate an admittedly enforceable choice-of-law provision by using a barred state claim as a predicate for a

10

federal claim." Def.'s Reply in Supp. of Mot. to Dismiss at 2. Hyatt points out that So has not cited any authority supporting his position, but then again, neither has Hyatt. Indeed, the Court has not found any case expressly discussing whether or how choice- of-law principles affect which state's law can provide a predicate violation under the Wiretap Act or any other federal statute that similarly incorporates state law. Faced with what appears to be a novel issue, the Court concludes that the crime/tort exception looks to the body of state law that would apply to the predicate act under a choice-of-law analysis. The crime/tort exception applies when a

"communication is intercepted for the purpose of committing any criminal or tortious act in violation of the . . . laws . . . of any State." 18 U.S.C. § 2511(2)(d). That language does not incorporate any specific body of state law. Rather, it directs a court to consider whether a criminal or tortious act was committed (and whether the communication was intercepted for that purpose). If a plaintiff sued a defendant for the alleged tortious act directly, the court would undertake a choice-of-law analysis to determine what state's law applied. And if that choice-of-law analysis ended up barring the plaintiff's claim, the defendant would not face tort liability for its action. It would be natural, then, to say in this situation that the defendant's act is not tortious and therefore cannot satisfy the crime/tort exception under the Wiretap Act.

So argues that this interpretation artificially constrains the "laws . . . of any State"

language in the Wiretap Act. See Pl.'s Opp'n to Mot. to Dismiss at 15. The Court disagrees. That language merely reflects the fact that, in general, any states' laws can provide a predicate violation for the crime/tort exception. In an individual case, however, the question is whether a specific act is tortious, and that question depends

11

only on the laws actually applicable to the conduct—that is, the laws that would apply under choice-of-law principles.

In this case, the alleged tortious act is Hyatt's disclosure of guest records in violation of a California statute. If So had filed a tort lawsuit based on the California guest statute, the forum-selection clause would direct that lawsuit to Illinois. The Illinois court—federal or state—would then apply Illinois' choice-of-law rules. See Klaxon Co.

v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941). It is conceivable, in that scenario, that Illinois' choice-of-law rules would require application of another state's substantive laws. See, e.g., Townsend v. Sears, Roebuck & Co., 227 Ill. 2d 147, 170, 879 N.E.2d 893, 907 (2007) (holding that Illinois' relationship to a tort case was not sufficient to overcome the presumption that the law of Michigan, the place of injury, should govern). But the choice-of-law provision avoids this result by specifying that the parties' dispute is

"governed by the laws of the State of Illinois, USA" and, for good measure, "without reference to its conflict of law principles." See Def.'s Mem. in Supp. of Mot. to Dismiss at 8 (quoting Def.'s Req. for Judicial Notice, Ex. 11); cf. Abbott Lab'ys v. Takeda Pharm. Co., 476 F.3d 421, 425 (7th Cir. 2007) ("[W]e doubt that the choice of law provision in the agreement was meant to incorporate the entire law of Illinois, including its conflicts of law principles.").

So does not dispute that this provision is enforceable and covers the conduct at issue—Hyatt's disclosures to Adobe and Meta. As a result, the legality of Hyatt's disclosures is governed by Illinois law, not California law. Cf. Newell Co. v. Petersen,

325 Ill. App. 3d 661, 686, 758 N.E.2d 903, 922 (2001) (stating that Illinois courts give effect to the parties' choice of law unless the chosen state lacks a substantial

12

relationship or application of the chosen state's law would be contrary to a fundamental policy of a state with a materially greater interest); Twohy v. First Nat'l Bank of Chi., 758 F.2d 1185, 1190-91 (7th Cir. 1985) (predicting that Illinois courts would honor choice-of- law stipulations in tort cases). Because So has not alleged that Hyatt's disclosure violated Illinois law, the crime/tort exception does not apply.

Moving on from the choice-of-law issue, the last substantive consideration in this case is one not raised by the parties. Other district court decisions have identified the possibility that consent may not be a defense to a procurement claim under the Wiretap Act, but none have had to decide the issue. See, e.g., Dawson v. Univ. of Phx., Inc., No. 25 C 3497, 2026 WL 92248, at *14 & n.11 (N.D. Ill. Jan. 13, 2026); Q.J. v. PowerSchool Holdings, LLC, No. 23 C 5689, 2025 WL 2410472, at *6 n.3 (N.D. Ill. Aug. 20, 2025); Mekhail v. N. Mem'l Health Care, 726 F. Supp. 3d 916, 926-27 (D. Minn. 2024). The basic concern seems to be a mismatch between the statutory language establishing procurement liability and the language of the consent defense. Mekhail,

726 F. Supp. 3d at 926. Subsection 2511(1)(a) prohibits "any person" from

"intentionally intercept[ing], endeavor[ing] to intercept, or procur[ing] any other person to intercept or endeavor to intercept, any . . . communication." 18 U.S.C. § 2511(1)(a). Subsection (2)(d), which provides the consent defense, states in relevant part that "[i]t shall not be unlawful under this chapter for a person . . . to intercept a . . . communication where . . . one of the parties to the communication has given prior consent." Id. § 2511(2)(d) (emphasis added). Read literally, subsection 2511(1)(a) makes the act of procurement unlawful, without reference to whether the interception is itself unlawful, and subsection (2)(d) exempts only the interception, not the

13

procurement. That would leave So's procurement theory intact, notwithstanding Hyatt's consent defense.

The Court declines to adopt this reading. For one, it would implausibly impose liability where all parties consent to the interception. One example would be a conversation where all of the parties "procure" a non-party to record the conversation and consent to the recording. Under the proposed reading, they could all be liable for procuring the non-party to intercept the contents of their communications. Considering other statutory defenses reveals further anomalous results. For example, the broad definition of "intercept" sweeps in communication services that merely facilitate the transfer of communications by acquiring them from a sender, then directing them to an intended recipient. Subsection (2)(a)(i) prevents that by stating that

"[i]t shall not be unlawful under this chapter for an . . . agent of a provider of wire or electronic communication service, whose facilities are used in the transmission of a wire or electronic communication, to intercept, disclose, or use that communication" in the course of rendering the service. Id. § 2511(2)(a)(i) (emphasis added). That language, like the consent defense, exempts interception but not procurement. Accordingly, the logic of carving out procurement claims from the consent defense would also apply equally to this defense. Anyone who "procures" a communication service to "intercept"

the contents of communications—even if such interception is merely part of getting the communication to the intended recipient—would face liability. That would seem to include anyone who purchases a phone plan.

In any event, the proposed reading would make no difference in a civil case like this one. The civil cause of action authorizes "any person whose . . . communication is

14

intercepted, disclosed, or intentionally used in violation of this chapter" to "recover from the person or entity . . . which engaged in that violation." Id. § 2520(a) (emphasis added). Procurement may be an independent violation under section 2511(a)(1), but the civil cause of action requires the interception, disclosure, or intentional use to be "in violation of this chapter." The consent defense, under any reading, states that an interception is not unlawful when one party consents (and when the crime/tort exception does not apply). That leaves disclosure and intentional use, which are prohibited by subsections 2511(1)(c) and (d), respectively. Those provisions, however, only prohibit disclosure and use when the "information was obtained through the interception of a . . . communication in violation of this subsection." Id. § 2511(c)(d) (emphasis added). Again, the consent defense means that the interception itself is not unlawful. The bottom line is that there is no civil cause of action for a procurement theory where the underlying interception is not unlawful under the consent defense. To summarize, So's complaint establishes that Hyatt consented to the interception at issue. That suffices to establish a defense under the Wiretap Act, and So has not adequately pleaded that the crime/tort exception applies. Consent is also a defense to So's procurement claims and, even if it were not, it would deprive So of a private cause of action to pursue his procurement theory.

Conclusion

For the above reasons, the Court grants Hyatt's motion to dismiss So's second amended complaint [dkt. 53]. Unless So files, by May 26, 2026, a motion to amend attaching a proposed amended complaint including at least one viable claim over which the Court has jurisdiction, the Court will enter judgment against him. The Court sets the

15

case for a telephonic status hearing on June 1, 2026 at 9:15 a.m., using call-in number 650-479-3207, access code 2305-915-8729.

Date: May 5, 2026

________________________________

MATTHEW F. KENNELLY

United States District Judge