In re PayPal Honey Browser Extension Litigation

influencers ("Affiliate Marketers") use their websites and/or online platforms to promote goods and services sold by e-commerce merchants ("Merchants") to their audiences in exchange for a fee any time their marketing efforts result in a sale ("Affiliate Commissions"). SAC ¶¶ 40-41. Affiliate Marketers enter contracts with Merchants and third-party "Affiliate Networks,"

intermediate entities that offer standardized terms to facilitate contracts between Merchants and Affiliate Marketers and to distribute Affiliate Commissions. Id. ¶ 2. Affiliate Commissions can be significant—up to 40% of the sale price—and the affiliate marketing industry drives a significant and increasing volume of e-commerce. Id. ¶ 3.

The basic structure of the affiliate marketing ecosystem is straightforward and generally proceeds in five steps. First, an Affiliate Marketer—often acting through an Affiliate Network— partners with a Merchant to promote the Merchant's goods and services to consumers. SAC ¶ 50. Second, the Affiliate Marketer generates an associated "Affiliate Link," a hyperlink that directs the consumer to the Merchant's website, where the consumer can purchase the Merchant's goods and services that the Affiliate Marketer is promoting: The Affiliate Link contains a unique identifier, known as an "Affiliate ID," that is used to track referrals and assign commissions. Id. ¶ 51. Third, the Affiliate Marketer promotes the Merchant's products to the Affiliate Marketer's audience. Id. ¶ 52. Fourth, when the consumer views the Affiliate Marketer's content, the consumer is presented with the opportunity to click on the Affiliate Link to go to the promoted goods and services on the Merchant's website. Id. ¶ 53. Fifth, when the consumer clicks on the Affiliate Marketer's Affiliate Link, a tracking code or cookie containing the Affiliate Marketer's Affiliate ID is stored on the consumer's web browser and logs the consumer's purchasing activity—if the consumer purchases the Merchant's goods or services, the Affiliate Marketer may earn an Affiliate Commission. Id. ¶ 54.

Because these transactions generally take place online, participants in the affiliate marketing ecosystem use certain digital mechanisms to assign commissions. SAC ¶ 56. Specifically, Merchants and Affiliate Networks attribute credit for consumer referrals based on Affiliate IDs, which are tracked via cookies, URL parameters, tracking tags, or server-side functions. Id. ¶ 57. The Affiliate ID is a "custom alphanumeric string that Merchants use to

2

identify the associated Affiliate Marketer." Id. ¶ 58. By clicking on an Affiliate Link, the consumer is redirected to a Merchant's product page and prompted to make a purchase: The Merchant's website also creates a cookie containing the Affiliate ID, which remains stored on the consumer's web browser until the cookie expires or is replaced by a subsequent Affiliate ID. Id. ¶ 59. The Affiliate ID is "read" by the Merchant at checkout and used to attribute sales and assign commissions. Id. ¶ 4.

There are several attribution methods used in the affiliate marketing industry, with the primary goal being "for Merchants to fairly credit the Affiliate Marketer that referred the consumer who made the purchase[] and pay the Affiliate Marketer Affiliate Commissions as earned." SAC ¶ 62. The most used attribution method and the industry standard is "last click attribution," which assigns Affiliate Commissions based on the most recently stored Affiliate ID when a consumer makes a purchase. See id. An important feature of the last click attribution system is that it is all-or-nothing—if multiple Affiliate Marketers advertise the same product to a consumer, only the last-selected affiliate link is credited for a resulting sale. Id. ¶ 100. Plaintiffs are Affiliate Marketers who have entered contracts with Merchants and Affiliate Networks. SAC ¶¶ 2, 15-25. Pursuant to these contracts, Plaintiffs are entitled to Affiliate Commissions when (1) Plaintiffs direct consumers to Merchants' websites through an Affiliate Link and (2) consumers purchase goods and services on the Merchants' websites. Id. ¶ 3. Plaintiffs' contracts with Merchants and Affiliate Networks assign commissions using last click attribution: "[U]nder Plaintiffs' contracts—which are generally representative of what conduct does and does not qualify for Affiliate Commissions—if consumers are directed to Merchants by Plaintiffs' affiliate links and then make a purchase, Plaintiffs will be paid an Affiliate Commission, so long as there has not been an intervening referral to the Merchant by another Affiliate Marketer." Id. ¶ 6. In addition to setting forth the conditions under which Affiliate Marketers may be entitled to Affiliate Commissions, these contracts also set forth prohibitions. Id. ¶ 7. These prohibitions may include a "stand down" protocol, which "prohibit[s] browser extensions . . . from 'popping up' (or otherwise seeking engagement that results in the overwriting of existing Affiliate IDs) when an Affiliate Marketer's Affiliate ID was already present, indicating

3

the Affiliate Marketer had created the referral and thus driven the sale." Id. ¶ 11. The economic relationship between Affiliate Marketers, Merchants, and Affiliate Networks is "commonly understood in the affiliate marketing industry and by PayPal, and set out in Plaintiffs' Merchant and Affiliate Network contracts[.]" Id. ¶ 6.

The Honey Browser Extension ("Honey"), purchased by PayPal for $4 billion in 2020, is a free web browser extension, a piece of software that runs within the consumer's web browser and is used to add functionality to websites visited by the consumer's web browser. SAC ¶ 78. PayPal advertises to consumers that they can install Honey on their web browsers to look for deals, earn rewards, and make purchases using PayPal while shopping at participating Merchants' websites. Id. ¶¶ 9, 26-29. Honey's Privacy Policy States that PayPal "uses cookies . . . to collect some of the data discussed in this Privacy Statement," for such uses as to "identify irregular site behavior, prevent fraudulent activity[,] and improve security," "allow [the consumer] to make use of [Honey's] functions," "assess the performance of [Honey's] websites, applications, services, and tools," and "track [the consumer's] specified preferences, interests, or past items viewed." Id. ¶ 88 (internal quotation marks omitted). A consumer who downloads Honey sees a pop-up window at checkout in advance of making a purchase on the website of a participating Merchant—if the consumer clicks on the pop-up, Honey notifies them if there is a coupon or reward available. Id. ¶¶ 9, 78, 84. Like Plaintiffs, PayPal has entered contracts with a variety of Merchants and Affiliate Networks that entitle PayPal to commissions for qualifying sales when a consumer uses Honey to find available savings or rewards before making a purchase. Id. ¶¶ 84-

85.

Plaintiffs allege that PayPal through Honey has intentionally interfered with their contractual relationships with Merchants and Affiliate Networks and has surreptitiously redirected for itself Affiliate Commissions rightfully owed to Plaintiffs under the contracts by "cookie stuffing," i.e., defrauding Merchants and Affiliate Networks to receive credit for purchases for which it did not actively perform any marketing as set forth by the parties' contracts. SAC ¶¶ 1, 3. According to Plaintiffs, when a consumer interacts with the Honey pop-up at checkout, Honey causes a "Secret Tab—a discrete, hidden pop-under tab—to" load on the consumer's web browser

4

for a couple seconds and overwrite the existing Affiliate ID with Honey's own Affiliate ID, thereby "surreptitiously deceiv[ing] the consumer's browser and the Merchant's website into"

attributing the sale to Honey. Id. ¶¶ 109-12. This process apparently occurs "regardless of whether Honey actually offers consumers any coupons or discounts, cash back rewards, or the option to pay with PayPal," and that, at least until December 2024, "Honey engaged in this cookie stuffing even where it found no coupons, offered no cash back rewards, and even where consumers merely dismissed the pop-up after PayPal did not even purport to search for coupons."

Id. ¶ 118. Plaintiffs additionally allege that PayPal has modified Honey to surreptitiously avoid complying with Affiliate Networks' stand-down protocols by only standing down when Honey detects that the "user" making a purchase is in fact a network tester or network auditor (i.e., not a consumer). Id. ¶ 265.

Plaintiffs initiated this action on December 29, 2024, by filing a complaint alleging state law claims of intentional interference with contractual and prospective economic relations against PayPal. ECF No. 1. Plaintiffs filed the first amended class action complaint on June 20, 2025, alleging violations of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 ("CFAA"), and various state laws arising out of PayPal "stealing . . . Affiliate Commissions that properly belong to [Plaintiffs] . . . . [by] replac[ing] [Plaintiffs'] Affiliate ID with PayPal's own Affiliate ID during the consumer's checkout process." ECF No. 188 ("FAC") ¶ 2. The Court denied PayPal's motion to compel arbitration on November 7, 2025. ECF No. 232.

On November 21, 2025, the Court granted PayPal's motion to dismiss the FAC pursuant to Federal Rule of Civil Procedure 12(b)(1), agreeing with PayPal that "Plaintiffs' alleged harm (i.e., the lost commissions) is not traceable to Honey but instead to the last-click attribution system, which PayPal does not control" and that "Plaintiffs fail to plead sufficient factual allegations that PayPal received any commissions that Plaintiffs were in fact entitled to under their contracts with the Merchants." FAC Order at 4. Plaintiffs filed the SAC on January 5, 2026, dropping several parties and causes of action and amending the complaint to include specific contractual provisions that allegedly entitled them to Affiliate Commissions surreptitiously redirected to PayPal through Honey. ECF No. 242. The SAC alleges (1) violation of the CFAA; (2) unjust enrichment;

5

(3) intentional interference with prospective economic advantage; (4) intentional interference with contractual relations; (5) violation of the California Comprehensive Computer Data Access and Fraud Act ("CDAFA"), Cal. Penal Code § 502; (6) violation of the California Unfair Competition Law ("UCL"), Cal. Bus. & Prof. Code § 17200; and (7) violation of the Washington Consumer Protection Act ("CPA"), Wash. Rev. Code §§ 19.86.010-19.86.920. See SAC ¶¶ 287-401. PayPal moved to dismiss each claim of the SAC on February 9, 2026. ECF No. 252.

II. LEGAL STANDARD

A party may challenge the Court's subject matter jurisdiction by bringing a motion to dismiss under Federal Rule of Civil Procedure 12(b)(1). "A Rule 12(b)(1) jurisdictional attack may be facial or factual." Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). In a facial attack, like the one here, the movant asserts that the lack of subject matter jurisdiction is apparent from the face of the complaint. Id. "The court need not presume the truthfulness of the plaintiff's allegations." Id. If the moving party presents evidence demonstrating the lack of subject matter jurisdiction, the party opposing the motion must present affidavits or other evidence sufficient to establish subject matter jurisdiction. Id.

A defendant may move to dismiss an action pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to allege "enough facts to state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged. The plausibility standard is not akin to a 'probability requirement,' but it asks for more than a sheer possibility that a defendant has acted unlawfully." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 556). For purposes of ruling on a Rule 12(b)(6) motion, the Court "accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party." Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008).

III. DISCUSSION

A. Whether Plaintiffs Allege Article III Standing

"[T]he 'irreducible constitutional minimum' of standing consists of three elements."

6

Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). The plaintiff bears the burden of establishing that he or she "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Id.; see also FW/PBS, Inc. v. Dallas, 493 U.S. 215, 231 (1990). "To establish injury in fact, a plaintiff must show that he or she suffered 'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.'" Spokeo, 578 U.S. at 339 (quoting Lujan, 504 U.S. at 560). The Court previously found that Plaintiffs failed to establish Article III standing for two related reasons. First, the FAC did "not establish that Plaintiffs were in fact entitled to [the] commissions pursuant to their contracts with the merchants" because it did "not contain any allegations at all about the terms of Plaintiffs' agreements with the merchants." FAC Order at 5. In this respect, the Court found the allegations in the FAC distinguishable from the set of facts before a district court in the Eastern District of Virginia—which found that the plaintiffs in that case had established standing under similar circumstances—because the plaintiffs there

"establish[ed] 'a causal connection between the injury and the conduct claimed of' based on the terms of the contracts." Id. (quoting In re Capital One Fin. Corp., No. 25-cv-00023-AJT, 2025 WL 1570973, at *6 (E.D. Va. June 2, 2025)). Second, the FAC "fail[ed] to plausibly allege that PayPal harmed each of the named Plaintiffs by siphoning commissions away from them,"

instead relying "on a 'highly attenuated chain of possibilities' in place of alleging a concrete and particularized injury." Id. at 6 (quoting Clapper v. Amnesty Int'l USA, 568 U.S. 398, 410 (2013)). PayPal argues that the SAC fails to cure these defects and that Plaintiffs still have not demonstrated that they suffered a concrete injury traceable to PayPal's alleged wrongful conduct. See Mot. at 5-12. The Court disagrees.

First, Plaintiffs have amended the SAC to plead exemplar terms from their contracts with Merchants showing that Plaintiffs are contractually entitled to Affiliate Commissions when consumers make purchases on Merchants' websites after clicking on Plaintiffs' Affiliate Links. Plaintiffs identify terms in these contracts that entitle them to an Affiliate Commission when their Affiliate Link is the final affiliate link clicked by the consumer before making a purchase from a

7

Merchant's website. See, e.g., SAC ¶¶ 69 (agreement with Amazon awarding an Affiliate Commission where "(i) a customer clicks through a Special Link on [Marketer's] Site to an Amazon Site; and (ii) during a single session . . . the customer purchases a Product . . . and (iii) the Product is shipped to[] . . . the customer" (second and third alterations in original)), 70 (agreement with Dell awarding an Affiliate Commission where the Affiliate Marketer's Affiliate Link is "the last link to the Dell Site that a visitor uses during a Session where a sale of a product or a service occurs"), 74 (agreement with Bergdorf Goodman awarding an Affiliate Commission where

"Merchant sells to a visitor to Merchant's site . . . a product or service that is the subject of the Engagement . . . if that Customer has accessed Merchant's site and purchased the product of service via a Qualifying Link"). The SAC further alleges that these contractual provisions "are generally representative of the common understanding of what conduct does and does not qualify for affiliate credit in the Affiliate Marketing industry." Id. ¶ 77. These contractual provisions plausibly allege that Plaintiffs are contractually entitled to the Affiliate Commissions that PayPal allegedly appropriates for itself.

PayPal nonetheless faults Plaintiffs for failing to attach the newly incorporated contracts with Merchants to the SAC and further charges that Plaintiffs "are excluding important context and mischaracterizing the contracts' terms." Mot. at 6-7. In support of this latter contention, PayPal points to two contractual provisions that—PayPal claims—expressly contemplate and authorize browser extensions like Honey to receive commissions that would otherwise be due to Affiliate Marketers under the last click attribution model. PayPal identifies a provision of the Dell Contract providing that a "[m]arketing [p]latform[]" encompasses "any media channel (including, but not limited to, . . . approved ad-supported software) that [is used] to link to the Dell Site," Mot. Ex. A ("Dell Contract") ¶ 2.11, which it suggests shows that Honey "can also generate the last click and earn a commission." Mot. at 7. PayPal also identifies a provision of the Bergdorf Goodman Contract providing that "[a]ll determinations of Qualifying Links and whether a commission is payable will be . . . subject to the Engagement," Mot. Ex. B ("Bergdorf Contract") ¶ 3.4, urging that, because Plaintiffs have not attached the Engagement to the SAC, "Plaintiffs cannot adequately allege that they . . . have a protected interest in commissions from Bergdorf

8

even where Honey is involved in a sale." Mot. at 7. As a preliminary matter, PayPal's resort to such extensive contract parsing is unpersuasive at the motion to dismiss stage, where the Court construes any ambiguous contract terms against the moving party. See, e.g., Hall v. FCA US LLC, No. 21-55895, 2022 WL 1714291, at *1 (9th Cir. May 27, 2022) (nonprecedential). Here, the SAC incorporates provisions of the Dell and Bergdorf Contracts plausibly entitling Plaintiffs to the Affiliate Commissions at issue by specifying that such commissions are assigned to the Affiliate Marketer whose Affiliate Link is the final link "clicked," to wit, the final Affiliate Link used to direct the consumer to the Merchant's webpage before the consumer completes a qualifying purchase. SAC ¶¶ 70, 74; see also id. ¶ 76 (alleging that "the express language of [Plaintiffs'] agreements with Merchants and Affiliate Networks[] . . . [is] consistent with the 'last click' attribution model"). This alone is sufficient at the pleadings stage.²In any event, PayPal fails to explain how the Dell Contract's inclusion of "ad-supported software" as a type of "[m]arketing [p]latform[]" would encompass Honey (let alone sanction Honey's alleged misconduct here) or why the Bergdorf Contract's reference to a separate engagement would contradict the quoted portions of that agreement awarding commissions under a last-click attribution system.

Second, Plaintiffs have amended the SAC to include two test purchases demonstrating how a named plaintiff loses an Affiliate Commission that would otherwise be earned when a consumer interacts with Honey at the point of sale. In the first test purchase, the SAC alleges that Plaintiffs' expert clicked Plaintiff Justin Tech Tips's Dell Affiliate Link and completed a purchase without engaging Honey and that Justin Tech Tips subsequently received an Affiliate Commission. SAC ¶¶ 125-31. In the second test purchase—which was identical in all respects except that the expert engaged Honey—the SAC alleges that Justin Tech Tips's Affiliate ID was overwritten and that

9

Justin Tech Tips did not receive an Affiliate Commission. Id. ¶¶ 132-40. The SAC further alleges how the same diversion occurred for all named plaintiffs, see id. ¶¶ 142, 156-230, and that, based on the volume of these transactions, a Monte Carlo statistical simulation predicts a 100% likelihood of such diversion, see id. ¶¶ 230-36. The combination of test purchases and statistical evidence set forth in the SAC is nearly identical to the allegations that the district court in Capital One found to "plausibly establish that [the defendant's] conduct is fairly traceable to each of the Plaintiff's injuries." 2025 WL 1570973, at *6.

PayPal makes two arguments why the allegations in the SAC are still too attenuated to plausibly suggest that each named plaintiff would have earned at least one Affiliate Commission but for PayPal's alleged misconduct, neither of which is persuasive. PayPal first points out that there are "plenty of reasons that a Plaintiff might not receive a commission that have nothing to do with Honey," urging that Plaintiffs overlook the many transactions that would not have occurred in the first place but for the coupons and rewards Honey offers to consumers. Mot. at 10-11. While that may very well be the case, this is simply not relevant to the threshold issue whether each named plaintiff has suffered at least one lost Affiliate Commission fairly traceable to Honey—at most, discovery showing any number of purchases would not have been consummated but for the availability of coupons and rewards through Honey would go to the issue of damages. PayPal also argues that Plaintiffs should not be permitted to extrapolate, based on their statistical evidence alone, the test purchases showing a diverted commission from Justin Tech Tips to the other ten named plaintiffs. Mot. at 11 (quoting Murthy v. Missouri, 603 U.S. 43, 61 (2024) ("Standing is not dispensed in gross.")). PayPal cursorily alludes to prior Supreme Court decisions for the basic propositions that "[t]he law of averages is not a substitute for standing,"

and that "a mere 'statistical probability' of injury . . . does not suffice." Id. at 12 (first quoting Valley Forge Christian Coll. v. Am. United for Separation of Church & State, Inc., 454 U.S. 464, 489 (1982) (alteration in original) (internal quotation marks omitted), then quoting Summers

v. Earth Island Inst., 555 U.S. 488, 497-99 (2009)). PayPal urges conclusions far beyond the scope of those decisions.

To the extent that PayPal argues that under Murphy, the expert test purchases could at most

10

establish standing for Justin Tech Tips, the Court disagrees with PayPal's interpretation of that case. In that "sprawling suit," the Supreme Court concluded that the Fifth Circuit "erred by treating the defendants, plaintiffs, and platforms each as a unified whole" in an action challenging

"speech restrictions on different platforms, about different topics, at different times." 603 U.S. at 61. Here, by contrast, Plaintiffs allege uniform conduct by a single actor (Honey) causing the same injury (diverted Affiliate Commissions) to each named plaintiff through the same mechanism (overwriting of the Affiliate ID). SAC ¶¶ 142-230. Similarly, PayPal's citations to Valley Forge and Summers do not "foreclose[] Plaintiffs' approach[] . . . because none of those plaintiffs used statistical analysis in the way Plaintiffs do here." In re RetailMeNot Browser Extension Litig., No. 25-cv-00783-JLR, 2026 WL 820585, at *5 (S.D.N.Y. Mar. 25, 2026) (rejecting a similar challenge to statistical evidence in an affiliate marketer putative class action). Those cases were both about the likelihood of future harm based on the plaintiffs' vague intention to engage in some type of conduct, see Summers, 555 U.S. at 495-96; Valley Forge, 454 U.S. at 485-86, not past injury and damages based on specific transactions. In sum, the SAC remedies both of the defects in the FAC previously identified by the Court by plausibly alleging that each named plaintiff lost out on Affiliate Commissions to which they were contractually entitled because of PayPal's alleged misconduct. The Court accordingly turns to PayPal's Rule 12(b)(6) motion.

B. Whether Plaintiffs Plausibly Allege a Claim

Turning to the merits, the Parties group together the SAC's seven causes of action into four categories: (1) computer fraud (count 1 CFAA violation and count 5 CDAFA violation),

(2) business torts (count 3 intentional interference with prospective economic advantage and count 4 intentional interference with contractual relations), (3) unjust enrichment (count 2), and

(4) state law consumer protection statutes (count 6 UCL violation and count 7 CPA violation). The Court considers each group of claims in turn.

1. Computer Fraud

"The CFAA prohibits a number of different computer crimes, the majority of which involve accessing computers without authorization or in excess of authorization, and then taking

11

specified forbidden actions, ranging from obtaining information to damaging a computer or computer data." LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1131 (9th Cir. 2009). The CFAA makes the following activities unlawful:

• To "knowingly and with intent to defraud, access[] a protected consumer without authorization, or exceed[] authorized access, and by means of such conduct further[] the intended fraud and obtain[] anything of value." 18 U.S.C. § 1030(a)(4) (emphasis added).

• To "intentionally access[] a protected computer, and as a result of such conduct, cause[] damage and loss." 18 U.S.C. § 1030(a)(5)(C) (emphasis added).

• To "knowingly cause[] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally cause[] damage without authorization, to a protected computer." 18 U.S.C. § 1030(a)(5)(A) (emphasis added).

"Any person who suffers damage or loss by reason of a violation of [the CFAA] may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief." 18 U.S.C. § 1030(g). "'[D]amage' means any impairment to the integrity or availability of data, a program, a system, or information." Id. § 1030(e)(8). "'[L]oss' means any reasonable cost[,] . . . including the cost of responding to an offense, restoring the data, program, system, or information to its [prior] condition[,] . . . and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service[.]" Id. § 1030(e)(11). CDAFA "is an anti-hacking statute intended to protect Californians' 'computers, computer systems, and data.'" In re Zoom Video Commc'ns Inc. Privacy Litig., 525 F. Supp. 3d 1017, 1043 (N.D. Cal. 2021) (quoting Cal. Pen. Code § 502(a)). "CDAFA claims generally rise or fall with . . . CFAA claims because the necessary elements of [California Penal Code] Section 502 do not differ materially from the necessary elements of the CFAA." Meta Platforms, Inc.

v. BrandTotal Ltd., 605 F. Supp. 3d 1218, 1260 (N.D. Cal. 2022); see also NovelPoster v. Javitch Canfield Grp., 140 F. Supp. 3d 938, 951 (N.D. Cal. 2014) (applying CFAA's definitions of

"damage" and "loss" to CDAFA claim).

12

Count 1 of the SAC alleges violation of the CFAA. SAC ¶¶ 287-317. Plaintiffs allege that PayPal "caused damage through[] . . . the impairment of the integrity and availability of Plaintiffs' . . . Affiliate IDs[,]" that PayPal "caused loss through an interruption of service constituted by[] . . . overwriting Affiliate IDs and redirecting communications within the Affiliate Marketing attribution system[,]" and that PayPal's "actions [were] without authorization[] or in excess of authorization." Id. ¶ 295. Plaintiffs allege that PayPal's misconduct caused damage or loss within the meaning of the CFAA both by unlawfully accessing consumers' computers in violation of CFAA sections (a)(4) and (a)(5)(C) and causing the transmission of damaging software to consumers' computers in violation of CFAA section (a)(5)(A). Id. ¶¶ 296-317. As to access, the SAC alleges that PayPal "accessed . . . the browsers and computers of consumers that downloaded [Honey] to further [their] cookie stuffing schemes, to destroy Plaintiffs' Affiliate IDs, and wrongfully obtain Plaintiffs' . . . Affiliate Commissions." Id. ¶ 303. As to transmission, the SAC alleges that PayPal "knowingly caused the transmission of [Honey] [to] intentionally cause[] damage to Plaintiff . . . Affiliate IDs without authorization . . . [and] circumvent stand down, which intentionally caused damage." Id. ¶¶ 304-05.

Count 5 of the SAC alleges violation of the CDAFA. SAC ¶¶ 357-71. Plaintiffs allege that "PayPal uses [Honey] to knowingly access and without permission alter, damage, delete, and/or destroy Plaintiffs and California Subclass members' tracking code data, in order to both

(a) execute its unlawful and fraudulent scheme and (b) wrongfully control or obtain money, property, or data through the diversion of Affiliate Commissions that rightfully belong to Plaintiffs." Id. ¶ 362.

PayPal argues that Plaintiffs' computer fraud claims are subject to dismissal because

(1) any alleged wrongdoing was authorized by consumers when they downloaded Honey, and

(2) the SAC fails to allege "damage" or "loss" within the meaning of the CFAA. Mot. at 12-15. PayPal's primary argument is that Plaintiffs have "remove[d] their admissions [in the FAC] that users grant 'extensive permissions' when installing Honey," which it contends nevertheless

"constitute binding 'judicial admissions'" that Plaintiffs have failed to explain. Mot. at 12-13

13

(quoting Sicor Ltd. v. Cetus Corp., 51 F.3d 848, 859 (9th Cir. 1995)).³PayPal further contends that, although "Plaintiffs allege that any permissions were fraudulently obtained[,] . . . . Plaintiffs have not even attempted to plead several of the elements required for fraudulent inducement." Id. at 13. Plaintiffs respond that the SAC pleads unauthorized access by plausibly alleging that

"(i) consumers did not authorize PayPal to surreptitiously overwrite Plaintiffs' Affiliate IDs,

(ii) any purported authorization was predicated on deception that went to the essential character of the access, and (iii) PayPal exceeded any purportedly authorized access because Honey used its access to alter information it was not entitled to alter." Opp. at 12. To begin with, the Court declines to treat the allegations in the FAC as conclusive judicial admissions barring the computer fraud claims in the SAC because Plaintiffs' explanation for their amendments appears eminently reasonable. While the Court will not turn a blind eye to the factual allegations contained in the FAC, the Court also accords "due weight" to Plaintiffs' explanation for the modifications implemented in the SAC. Sicor, 51 F.3d at 859-60. Here, that explanation is clear: "Plaintiffs removed the word 'permissions' from the complaint to avoid conflation of their initial, colloquial use of the word with the term of art used in CDAFA." Opp. at 12-13. In any case, PayPal's vague invocation of the instances of the term "permissions" in the FAC does nothing to shed light on what technical permissions may have been granted at the point of download or whether those permissions would sanction the damage to data contemplated by the SAC. The Court accordingly turns to the issue properly before it: whether the SAC contains allegations from which the factfinder could plausibly infer that PayPal exceeded its authorized access to consumers' web browsers or caused damage without authorization in overwriting Plaintiffs' Affiliate IDs whenever consumers interacted with Honey.

14

"'Authorization' is an affirmative notion indicating that access is restricted to those specially recognized or admitted." hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195-96 (9th Cir. 2022). Access "without authorization" means access "without permission." United States v. Nosal, 844 F.3d 1024, 1028 (9th Cir. 2016), cert. denied, 583 U.S. 915 (2017). The CFAA defines the term "exceeds authorized access" as using computer access to "alter information . . . the accessor is not entitled to . . . alter." 18 U.S.C. § 1030(e)(6). The Supreme Court has instructed that under the CFAA, liability for unauthorized access "stems from a gates- up-or-down inquiry—one either can or cannot access a computer system, and one either can or cannot access certain areas within the system." Van Buren v. United States, 593 U.S. 374, 390 (2021). Stated differently, whether access is authorized within the meaning of the CFAA is based on the scope of the permissions granted, not the defendant's subjective purpose in using those permissions. See id. at 391.

PayPal argues that Plaintiffs' computer fraud claims improperly "seek to broaden the statutes to cover ordinary competition," Mot. at 13, urging that the claims must be dismissed because consumers grant PayPal broad permissions that do not differentiate which cookies Honey may modify and that such permissions were not fraudulently procured merely by PayPal failing to disclose precisely how the cookies would be used. Reply at 6-7. Plaintiffs respond that PayPal exceeded the scope of the access granted to Honey by consumers and, to the extent that such access was granted, it was procured by "deceiving consumers about Honey's nature and core value proposition." Opp. at 12-13. While the Parties' moving papers largely treat the authorization issue similarly for the purpose of Plaintiffs' access and transmission claims, the Court notes that

"[t]he phrase 'without authorization' modifies different actions in § 1030(a)(5)(A) [i.e., causing damage] and (C) [i.e., accessing the computer]," and that distinction is often "crucial." In re Apple Inc. Device Performance Litig., 347 F. Supp. 3d 434, 451 (N.D. Cal. 2018), on reconsideration in part, 386 F. Supp. 3d 1155 (N.D. Cal. 2019). As to Plaintiffs' section 1030(a)(5)(A) transmission claim, the SAC alleges that PayPal knowingly caused the transmission of the "Honey Browser Extension and associated software"

and "its technological mechanism to circumvent stand down and associated software" to

15

"intentionally cause[] damage to Plaintiff . . . Affiliate IDs without authorization to cause such damage." SAC ¶¶ 304-05. The allegations set forth in the SAC are sufficient to plausibly support the inference that PayPal caused this damage without authorization, since Plaintiffs allege that PayPal promises customers that Honey will "automatically test[] every coupon code on the internet and appl[y] the best one to [the customer's] cart" but instead diverts Affiliate Commissions for itself by destroying Plaintiffs' Affiliate IDs. Id. ¶¶ 301, 303 (internal quotation marks omitted). That is sufficient to allege damage without authorization. See, e.g., Apple,

347 F. Supp. 3d at 451-52; San Miguel v. HP Inc., 317 F. Supp. 3d 1075, 1086 (N.D. Cal. 2018) (upholding § 1030(a)(5)(A) transmission claim where complaint alleged that plaintiffs authorized only a software update, not the alleged damage to their devices).

As to Plaintiffs' section (a)(4) and (a)(5)(C) access claims, PayPal is correct that Plaintiffs cannot state a claim for a CFAA violation merely on the ground that PayPal "did not disclose to consumers precisely what it would do with the permissions granted." Reply at 7. Because

"without authorization" in those provisions refers to the "access" rather than "damage," Plaintiffs cannot circumvent this requirement merely by alleging that such authorization would be vitiated by "deceiving consumers about Honey's nature and core value proposition," and the cases Plaintiffs cite do not support their argument that "[c]ourts routinely find allegations of deception sufficient to state a claim" under these provisions. Opp. at 13; see, e.g., Apple, 347 F. Supp. 3d at 452-53 (dismissing access claim because plaintiffs "do not, for example, allege that [the defendant] posed as someone else or blatantly misdescribed the nature of the [service] in order to gain access to Plaintiffs' [devices]"). That said, the Court accepts Plaintiffs' fallback argument that the SAC sufficiently alleges that PayPal did not possess the threshold authorization to modify the Affiliate IDs in the first place—that is, that the gate to the Affiliate ID was never lifted to begin with. See SAC ¶ 311 ("PayPal did not request or receive from consumers the access that is necessary to destroy Plaintiffs' Affiliate IDs[,] [since] consumers themselves do not have the access or authority to overwrite tracking codes."). The Court accordingly declines to dismiss Plaintiffs' access claims at this time to the extent that Plaintiffs allege that the "broad" permissions consumers granted to Honey did not include access to modifying the Affiliate IDs.

16

PayPal's invocation of a recent decision by a district court in the Southern District of New York that dismissed computer fraud claims on the ground that "a browser extension that a consumer willingly downloads, grants permissions to, and chooses to use during a transaction does not 'exceed[] [its] authority to access consumers' computers'" does not change the analysis. Reply at 6 (alterations in original) (quoting RetailMeNot, 2026 WL 820585, at *15). In RetailMeNot, the court concluded that a defendant browser extension's overwriting of the plaintiffs' affiliate tracking codes was authorized because the complaint itself acknowledged that

"consumers must 'actively engage with the browser extension' to 'facilitate [its] technical capability' to initiate the overwrite process," and, consequently, "the [c]omplaint alleges that consumers are granting this permission not only as an initial matter upon downloading the browser extension, but also in real time during the transactions at issue." 2026 WL 820585, at *13 (first alteration in original) (citation omitted). No analogous real-time consent is alleged here, and, on the contrary, the SAC alleges that PayPal (1) "surreptitiously injected a Secret Tab into the consumer's browser" even when a user interacted with Honey "to just dismiss it," SAC ¶ 298, and

(2) "used . . . techniques . . . to circumvent the technical restrictions in place to . . . 'trick' the consumer's browser," id. ¶ 312.

PayPal also argues that the computer fraud claims are subject to dismissal for failure to allege technological "damage" or "loss." As to "damage," PayPal argues that the Plaintiffs' Affiliate IDs "have no independent value as data" and are merely "short strings of numbers or letters." Mot. at 14. As to "loss," PayPal argues that the SAC fails to identify any revenue lost due to an interruption of service because overwriting Affiliate IDs constitutes "[a]t most, [a] change[] [in] the outcome" of the Merchant's commission attribution service. Id. at 15. Plaintiffs respond that the injuries alleged in the SAC constitute technological harms directly attributable to the impairment of the availability of data (i.e., Plaintiffs' Affiliate IDs) and an interruption in service (i.e., disrupting the Affiliate Commission transaction that would take place but for the overwriting of Plaintiffs' Affiliate IDs). Opp. at 11-12, 14-16.

"Damage" and "loss" under the CFAA are statutory terms limited to "technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems

17

and data." Van Buren, 593 U.S. at 391-92. "[A]ny theory of loss must conform to the limited parameters of the CFAA's definition." Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1263 (9th Cir. 2019); accord Nowak v. Xapo, Inc., No. 20-cv-03643-BLF, 2020 WL 6822888, at *5 (N.D. Cal. Nov. 20, 2020). "It is sufficient to show that there has been an impairment to the integrity of data, as when an intruder retrieves password information from a computer and the rightful computer owner must take corrective measures . . . . Costs associated with investigating intrusions into a computer network and taking subsequent remedial measures are losses within the meaning of the statute." Multiven, Inc. v. Cisco Sys., Inc., 725 F. Supp. 2d 887, 895 (N.D. Cal.

2010).

The SAC sufficiently pleads technological damage in the form of the destruction of Plaintiffs' Affiliate IDs. See SAC ¶ 303. The overwriting of these alphanumeric strings stored on consumers' web browsers clearly constitutes an impairment to the availability of the data stored thereon and fits comfortably within the CFAA's "scheme 'aimed at preventing the typical consequences of hacking.'" Van Buren, 593 U.S. at 392 (quoting Royal Truck & Trailer Sales & Serv., Inc. v. Kraft, 974 F.3d 756, 760 (6th Cir. 2020)). PayPal's quibble that the Affiliate IDs are only "short strings of numbers or letters," Mot. at 14, is tautological and does not further its case—physical currency could just as readily be characterized as "letters and symbols printed on paper." The point is that those Affiliate IDs are unique, readily identifiable digital tokens that are exchanged for money. PayPal's attempts to analogize this case to Doe v. County of Santa Clara, No. 23-cv-04411-WHO, 2024 WL 3346257 (N.D. Cal. July 8, 2024), and Cottle v. Plaid Inc.,

536 F. Supp. 3d 461 (N.D. Cal. 2021), are readily disposed of because those cases involved the loss of control over data that had no monetary value. In Cottle, the court dismissed the plaintiffs' CFAA claim arising from the defendants' alleged sale of their financial data because they alleged only that they "suffered loss of use and control . . . of their own sensitive financial information"

and "d[id] not explain how to value the alleged 'loss of use and control' of their financial information." 536 F. Supp. at 486 (citations omitted). Based on Cottle, the court in Doe held that the plaintiffs did not plead damage based on "[s]ensitive and confidential information that [the plaintiffs] intended to remain private . . . no longer [being] private." 2024 WL 3346257, at *9.

18

Here, by contrast, the substitution of Plaintiffs' Affiliate IDs for PayPal's ID has a one-to-one correspondence with the diversion of Affiliate Commissions from Plaintiffs to PayPal. See SAC ¶¶ 303, 315.

The SAC also sufficiently pleads loss within the meaning of the CFAA in the form of the revenue lost when PayPal "disrupted the affiliate commission attribution system, including communications between or among the Affiliate Marketer, consumers, the Merchant website, the Affiliate Networks, and Affiliate Network or Merchant servers that otherwise would have attributed the sale to [Plaintiffs] instead of PayPal." SAC ¶¶ 315-16. PayPal is simply wrong when it urges that "Plaintiffs do not, in fact, allege that PayPal 'redirects' communications." Mot. at 15; see also Reply at 9. That is precisely what is alleged to occur here: Plaintiffs allege that PayPal "redirected the consumer's browser to a distinct URL and altered network traffic without the consumer's knowledge" to "artificially simulate an affiliate referral," with the effect of interrupting a transaction that would otherwise occur between the Merchant and Affiliate Marketer and diverting that Affiliate Commission to PayPal. SAC ¶¶ 298, 316.

Plaintiffs have sufficiently pleaded loss caused by an interruption in service by alleging that they are the intended recipients of network traffic (i.e., the payment of an Affiliate Commission based on the Merchant website's readout of the Affiliate ID) and that PayPal has redirected that traffic to its own benefit. SAC ¶ 309. The Court agrees with the Capital One court's analysis under analogous circumstances that "swap[ping] Plaintiffs' tracking codes for [PayPal's] code [and] causing merchants to credit the purchases solely to [PayPal]" constitutes "a loss in the form of diverted commissions that Plaintiffs now seek to recover." Cap. One, 2025 WL 1570973, at *12; see also id. ("[T]he common denominator in these cases is that the defendants are alleged to have used their programming prowess to alter the recipient field in order to redirect the information being communicated through computer traffic for their own financial benefit, amounting to an 'interruption of a service.'").

Because the SAC plausibly alleges unauthorized "access" in violation of 18 U.S.C. § 1030(a)(4) and § (a)(5)(C), unauthorized "damage" in violation of 18 U.S.C. § 1030(a)(5)(A), and "damage" or "loss" as required by 18 U.S.C. § 1030(g), Plaintiffs' claim for violation of the

19

CFAA survives PayPal's Rule 12(b)(6) motion. For the same reasons, Plaintiffs' claim for violation of the CDAFA survives PayPal's Rule 12(b)(6) motion.

2. Business Torts

To state a claim for intentional interference with prospective economic advantage under California law, Plaintiffs must plead (1) an economic relationship between Plaintiffs and Merchants; (2) PayPal's knowledge of those relationships; (3) PayPal's intentional acts designed to disrupt those relationships; (4) actual disruption of those relationships; and (5) resulting damages. See Korea Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134, 1153 (2003). The elements for an intentional interference with contractual relations claim are substantially similar:

Plaintiffs must plead (1) a valid contract between Plaintiffs and Merchants; (2) PayPal's knowledge of those contracts; (3) PayPal's intentional acts designed to induce a breach of the contracts or disruption of the contractual relationships; (4) actual breach of the contracts or disruption of the contractual relationships; and (5) resulting damages. See Pac. Gas & Elec. Co.

v. Bear Stearns & Co., 50 Cal. 3d 1118, 1126 (1990).⁴ Count 3 of the SAC alleges intentional interference with prospective economic advantage. SAC ¶¶ 334-48. Plaintiffs allege that they are "engaged in ongoing economic relationships with Merchants to promote products and services to consumers in exchange for commissions," that PayPal knew of these economic relationships, and that PayPal knew that its conduct "was certain or substantially certain to interfere" with these relationships. Id. ¶¶ 335, 338-39. Plaintiffs allege that their economic relationships with Merchants were actually disrupted when, "[t]hrough the use of [Honey], [PayPal] divert[ed] Affiliate Commissions from Plaintiffs . . . who promoted and shared affiliate links and generated referrals and sales of a Merchant's product or service"

"because such conduct deprived Plaintiffs . . . of the monies that they rightfully earned as the true

20

originators of sales arising from their affiliate links." Id. ¶¶ 340, 343. Count 4 of the SAC alleges intentional interference with contractual relations. SAC ¶¶ 349-56. Plaintiffs allege that they entered valid contractual relationships with Merchants—of which PayPal was aware—whereby "Plaintiffs . . . promote Merchants' products and services and provide affiliate links to refer consumers" in exchange for "an Affiliate Commission payment if a consumer completes a transaction on the Merchant's website." Id. ¶¶ 350-51. Plaintiffs allege that PayPal's conduct was calculated to divert Plaintiffs' commissions for itself and "caused Merchants to breach their agreements with Plaintiffs . . . by paying [PayPal,] instead of Plaintiffs[,] . . . the monies that [they] rightfully earned as the true originators of sales arising from their affiliate links." Id. ¶ 353-54.

PayPal argues that Plaintiffs' business tort claims are subject to dismissal because they fail to allege (1) contractual entitlement to the diverted commissions, (2) conduct intended to disrupt contractual and prospective economic relations and actual disruption thereof, and

(3) independently wrongful conduct. Mot. at 15-19. PayPal's first and third arguments are easily dispensed with. The Court previously admonished Plaintiffs that, "[i]n addition to depriving them of Article III standing, Plaintiffs' failure to allege any of the terms of their contracts with their Merchants is also fatal to their . . . claims for tortious interference with contracts or economic advantage" because "the FAC does not allege that PayPal actually received any commissions from Merchants that were otherwise due to Plaintiffs." FAC Order at 10. Because the SAC remedies this defect by alleging that PayPal received commissions "that were otherwise due to Plaintiffs,"

PayPal's first argument necessarily fails. See supra § III.A. Relatedly, because Plaintiffs' consumer fraud claims survive PayPal's Rule 12(b)(6) motion, see supra III.B.1, Plaintiffs have satisfied the independent wrongfulness element.

Plaintiffs sufficiently allege conduct calculated to interfere with contractual and prospective economic relations and actual disruption thereof because the SAC alleges that PayPal understood that Honey "causes any existing Affiliate IDs to be overwritten with PayPal's Affiliate ID," SAC ¶ 353, that PayPal "knew that when a consumer navigated to a specific Merchant's website using an online marketer's affiliate link and had [Honey] activated, [Honey] would

21

overwrite the existing online marketer's Affiliate ID with Defendants' Affiliate ID, resulting in Merchants breaching their agreements with Plaintiffs . . . by paying Defendants, instead of Plaintiffs[,] . . . the monies that Plaintiffs" earned under their contracts with the Merchants, and that "[t]here is no technical reason for this hidden redirect and use of the Secret Tab apart from stealing" Affiliate Commissions. Id. ¶¶ 114, 353-54.

These allegations are sufficient to support an inference that disruption of the contracts would be "certain or substantially certain," Quelimane Co. v. Stewart Title Guar. Co., 19 Cal. 4th 26, 54 (1998), and that overwriting Plaintiffs' Affiliate IDs and redirecting contractually earned Affiliate Commissions actually disrupts Plaintiffs' contractual relations with Merchants. See Cisco Sys., Inc. v. STMicroelectronics, Inc., No. 14-cv-03236-RMW, 2015 WL 3488923, at *7 (N.D. Cal. June 2, 2015) (explaining that alleging "intentional acts by the defendant result[ing] in cancellations of existing orders" was sufficient to plead actual disruption). Plaintiffs also sufficiently allege that, as a result of intentionally diverting Plaintiffs' Affiliate Commissions by surreptitiously overwriting their Affiliate IDs, Plaintiffs' "future relationship[s] with [Merchants] w[ere] jeopardized and . . . still not recovered." WeBoost Media S.R.L. v. LookSmart Ltd., No. 13- cv-05304-SC, 2014 WL 2621465, at *7 (N.D. Cal. June 12, 2014).

Because the SAC plausibly alleges acts calculated to disrupt Plaintiffs' contractual and prospective economic relations with Merchants and actual disruption thereof, and that as a result of such acts, Plaintiffs lost out on commissions they were otherwise owed, Plaintiffs' business tort claims survive PayPal's Rule 12(b)(6) motion.

3. Unjust Enrichment

"The theory of unjust enrichment requires one who acquires a benefit which may not justly be retained, to return either the thing or its equivalent to the aggrieved party so as not to be unjustly enriched." Prakashpalan v. Engstrom, Lipscomb & Lack, 223 Cal. App. 4th 1105, 1132, (2014) (quoting Otworth v. S. Pac. Transp. Co., 166 Cal. App. 3d 452, 460 (1985)). To plead unjust enrichment as an independent cause of action, Plaintiffs must allege that PayPal has received and unjustly retained a benefit at their expense. ESG Cap. Partners, LP v. Stratos,

828 F.3d 1023, 1038 (9th Cir. 2016).

22

Count 2 of the SAC alleges unjust enrichment "[i]n the alternative to those claims . . . seeking damages." SAC ¶¶ 318-33. Plaintiffs allege that they "have an equitable interest in the Affiliate Commissions that PayPal improperly diverted to itself through the Honey Browser Extension," that Plaintiffs "conferred a benefit on Defendants[] [by] . . . unwittingly dr[i]v[ing] their followers to PayPal when Plaintiffs . . . sent those followers to Merchants' webpages," and that Plaintiffs "lack an adequate remedy at law to recover the amounts that Defendants received from their wrongful conduct, including to the extent that Plaintiffs cannot recover the amounts that Defendants received from their wrongful conduct through their legal claims or it is determined that such a recovery under Plaintiffs' legal claims would be less prompt or certain than a recovery pursuant to equitable relief." Id. ¶¶ 320-21, 332. Plaintiffs seek, inter alia, nonrestitutionary disgorgement of PayPal's profits "[i]n the alternative to their legal damages, and in the case that legal damages are inadequate to remedy Plaintiffs' . . . harm." Id. ¶ 333. PayPal argues that Plaintiffs' unjust enrichment claim is subject to dismissal because

(1) the "SAC does nothing more than restate its conclusory allegations regarding the lack of an adequate remedy at law" and (2) Plaintiffs cannot proceed on a theory of unjust enrichment where they allege elsewhere that "both Plaintiffs and PayPal have contractual relationships with third party Merchants and Affiliate Networks that govern when commissions are due." Mot. at 20. Neither of these summary attacks is persuasive.

First, while PayPal correctly points out that Plaintiffs must establish that they "lack[] an adequate remedy at law" before seeking to invoke the Court's equitable jurisdiction, see Sonner

v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 2020), PayPal simply does not address the fact that the SAC seeks nonrestitutionary disgorgement of PayPal's profits, which is not available under Plaintiffs' legal claims. See SAC ¶ 333. Nonrestitutionary disgorgement is "a remedy for unjust enrichment claims '[w]here a benefit has been received by the defendant but the plaintiff has not suffered a corresponding loss or, in some cases, any loss, but nevertheless the enrichment of the defendant would be unjust.'" In re Cal. Gasoline Spot Mkt. Antitrust Litig., No. 20-cv- 03131-JSC, 2021 WL 1176645, at *8 (N.D. Cal. Mar. 29, 2021) (alteration in original) (quoting Meister v. Mensinger, 230 Cal. App. 4th 381, 398 (2014)). On this ground alone the Court finds

23

that Plaintiffs sufficiently allege inadequate remedies at law. In any event, Plaintiffs also allege that they possess an equitable right that is separate from their contractual entitlement to Affiliate Commissions because "industry standards and fairness dictate that Plaintiffs . . . are entitled to credit for . . . sales [referred to the Merchants] and it would be inequitable for Defendants . . . to receive credit for these sales." SAC ¶ 332. The Court accordingly finds that Plaintiffs "do allege that legal remedies are inadequate, and no more is required at th[e] [pleadings] stage." In re Meta Pixel Tax Filing Cases, 724 F. Supp. 3d 987, 1008 (N.D. Cal. 2024).

Second, PayPal again begins with a correct statement of the law that a plaintiff generally cannot plead an unjust enrichment claim when doing so would be derivative of its contractual claims against that party. In its prior order, the Court expressed its concern, "closely intertwined with [Plaintiffs'] lack of standing," that "from the face of the FAC it appears that the subject matter of the claim is governed by Plaintiffs' relationships with third-party Merchants." FAC Order at 9. But because the SAC now plausibly alleges injury traceable to PayPal's conduct alone—and does not allege that its causes of action against PayPal derive from its contracts with the third-party Merchants and Affiliate Networks—the existence of those contracts does not bar Plaintiffs' unjust enrichment claim at the pleadings stage.

Because the SAC alleges inadequate remedies at law and an equitable entitlement to nonrestitutionary disgorgement of profits, Plaintiffs' unjust enrichment claim survives PayPal's Rule 12(b)(6) motion.

4. State Law Consumer Protection Statutes a. Violation of the UCL

The UCL proscribes "any unlawful, unfair or fraudulent business act or practice." Cal. Bus. & Prof. Code § 17200. Each prong of the UCL establishes a separate and distinct theory of liability. Lozano v. AT & T Wireless Servs., Inc., 504 F.3d 718, 731 (9th Cir. 2007); Berryman

v. Merit Prop. Mgmt., Inc., 152 Cal. App. 4th 1544, 1554 (2007). The "unlawful" prong of the UCL permits a plaintiff to "borrow" violations of other laws and treat them as unfair competition that is independently actionable. Cel-Tech Commcn's, Inc. v. Los Angeles Cellular Tel. Co.,

20 Cal. 4th 163, 180 (1999).

24

Count 6 of the SAC alleges violation of the UCL. SAC ¶¶ 372-87. Plaintiffs allege that PayPal's business acts and practices are unlawful because they violate the CFAA and CDAFA and unfair because overwriting Plaintiffs' Affiliate IDs "violates California's public policy against interfering with another's prospective economic advantage." Id. ¶¶ 377-79. Plaintiffs allege that they "lack an adequate remedy at law to recover the amounts that Defendants received from their UCL violations to the extent it is determined that Plaintiffs . . . did not have a contractual entitlement, or other legal entitlement[,] . . . to the Affiliate Commissions" and seek injunctive relief. Id. ¶¶ 385-86.

PayPal argues that Plaintiffs' UCL claim is subject to dismissal because Plaintiffs fail to allege (1) any conduct in violation of the UCL's "unlawful" or "unfair" prong and (2) lack of adequate alternative remedies at law. Mot. at 21-23. Not so. Based on the Court's determination that Plaintiffs state a claim for violation of the CFAA and CDAFA, see supra III.B.1, the Court finds that Plaintiffs also state a claim under the UCL's "unlawful" prong and need not consider whether such conduct would also satisfy the "unfair" prong. Plaintiffs sufficiently invoke the Court's equitable jurisdiction by requesting injunctive relief on the ground that available legal remedies "can only provide something less than Defendants completely ceasing their misconduct."

SAC ¶ 387. Because "the injunctive relief sought is not completely duplicative" of Plaintiffs' legal claims, Plaintiffs' UCL claim may proceed. Steen v. Am. Nat'l Ins. Co., 609 F. Supp. 3d 1066, 1075-76 (C.D. Cal. 2022).

Because the SAC states claims for violations of the computer fraud statutes and plausibly seeks nonduplicative injunctive relief, Plaintiffs' UCL claim survives PayPal's Rule 12(b)(6) motion.

b. Violation of the CPA

The CPA proscribes "[u]nfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce." Wash. Rev. Code § 19.86.020. "Any person who is injured in his or her business or property by a violation of RCW 19.86.020[] . . . may bring a civil action." Id. § 19.86.090. "In a private action in which an unfair or deceptive act or practice is alleged under RCW 19.86.020, a claimant may establish that the act or practice is injurious to

25

the public interest because it[] . . . (a) [i]njured other persons; (b) had the capacity to injure other persons; or (c) has the capacity to injure other persons." Id. § 19.86.093(3). To state a claim under the CPA, Plaintiffs must allege "(1) an unfair or deceptive act or practice; (2) occurring in trade or commerce; (3) that impacts the public interest; (4) causes injury to [Plaintiffs'] business or property; and (5) that injury is causally linked to the unfair or deceptive act." Ten Bridges, LLC

v. Midas Mulligan, LLC, 522 F. Supp. 3d 856, 872 (W.D. Wash. 2021); see also Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 105 Wash. 2d 778, 785-94 (1986). Count 7 of the SAC alleges violation of the CPA. SAC ¶¶ 388-401. Plaintiffs allege that PayPal "engaged in unfair acts that affect the public interest by maintaining and operating [Honey] in such a manner as to appropriate Affiliate Commissions to which Affiliate Marketers are rightfully entitled by overwriting and replacing their Affiliate IDs" and that PayPal's conduct is

"unfair and affects public policy because it contravenes existing standards in norms in the Affiliate Marketing industry that prohibit the use of cookie stuffing to divert Affiliate Commissions." Id. ¶ 394. Plaintiffs allege that PayPal's unfair conduct "directly and substantially impacted consumers and the public at large" because it prevented "consumers from achieving their goal of paying Affiliate Marketers when they use their affiliate links to complete a purchase." Id. ¶ 394-

95.

PayPal argues that Plaintiffs' CPA claim is subject to dismissal because Plaintiffs fail to allege (1) any wrongful conduct within the meaning of the CPA and (2) substantial consumer or public interest harm. Mot. at 23-24. PayPal's argument as to wrongful conduct rises and falls with its arguments as to Plaintiffs' other claims because it is based on Plaintiffs' "intentional interference . . . [claims] fall[ing] short" and PayPal's argument that Plaintiffs have failed to allege contractual entitlement to the Affiliate Commissions. Id. at 23. Based on the Court's finding that Plaintiffs sufficiently allege standing, see supra § III.A, and plead claims for intentional interference with prospective economic advantage and intentional interference with contractual relations, see supra § III.B.2, this argument necessarily fails.

PayPal argues that Plaintiffs fail to allege substantial consumer or public-interest harm because they have not shown "how consumers were actually harmed by any such deception" and

26

because "the alleged harm to [Plaintiffs] far outweighs any incidental harm to the public at large."

Mot. at 24 (alteration in original) (quoting Cap. One, 2025 WL 1570973, at *15). But Plaintiffs have alleged consumer harm in the form of thwarting consumers' goal to "pay[] Affiliate Marketers when they use their affiliate links to complete a purchase" to reward the Affiliate Marketers for providing "trusted information about products and Merchants" with "expertise and authenticity." SAC ¶¶ 46-47, 395. Whether discovery will show that consumers actually cared whether Affiliate Marketers were compensated when consumers made their purchases is immaterial at this stage in the proceedings; it has been alleged. This harm has sufficiently been pleaded to impact the public interest because it is alleged to be committed in the course of defendant's business," or "part of a pattern or generalized course of conduct." Hunt v. Medtronic USA, Inc., 627 F. Supp. 3d 1188, 1196 (W.D. Wash. 2022) (quoting Hangman, 105 Wash. 2d at 790). And, unlike the situation before the court in Capital One, see 2025 WL 1570973, at *15, Plaintiffs here allege that "consumers . . . are never told or advised that Honey will surreptitiously use a Secret Tab to steal Affiliate Commissions." SAC ¶ 88.

Because the SAC alleges conduct in violation of state and federal law that plausibly affected consumers during PayPal's ordinary course of business in Washington, Plaintiffs' CPA claim survives PayPal's Rule 12(b)(6) motion.

IV. ORDER

For the foregoing reasons, IT IS HEREBY ORDERED that:

(1) PayPal's motion to dismiss the SAC is DENIED.

(2) This order terminates ECF No. 252. Dated: June 22, 2026

______________________________________

BETH LABSON FREEMAN

United States District Judge

27