Judge Haywood S. Gilliam, Jr., of the Northern District of California, dismissed a putative class action alleging that a retailer’s use of tracking pixels and unique URLs in marketing emails violated California privacy laws, finding the claims lacked sufficient factual and legal support. The dismissal was with prejudice.
Plaintiff alleged that the retailer, through a third-party vendor, embedded invisible pixels and unique URLs in marketing emails. When recipients clicked on links, data such as which images or text were clicked, email addresses, and engagement metrics were transmitted to the vendor, which aggregated this information to create detailed customer profiles. The plaintiff asserted that this conduct violated the California Invasion of Privacy Act (CIPA), constituted statutory larceny, and was an unfair business practice under the California Unfair Competition Law (UCL).
CIPA Claims
A party to the communication cannot be held liable under § 631(a). See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020) (citing Warden v. Kahn, 99 Cal. App. 3d 805, 811, 160 Cal. Rptr. 471 (Cal. Ct. App. 1979)). Although Plaintiff appears to ground the FAC on a theory that Defendant “aided and abetted” Bluecore’s wiretapping, see FAC at ¶ 1, the opposition to the motion to dismiss outlines two theories of direct liability against Defendant. See Dkt. No. 51 at 3-4. The Court finds both theories confusing and unsupported by the FAC.
First, Plaintiff suggests that Defendant tapped “the private communications between Plaintiff and the Class Members (on the one hand) and their respective email providers (on the other)” by tracking when a Class Member opened one of Defendant’s marketing emails. Dkt. No. 51 at 3. This theory is not alleged in the FAC, and Plaintiff’s attempt to rewrite this allegation [*7] in the opposition is improper. See, e.g., FAC at ¶ 3 (“Bluecore wiretaps and intercepts Plaintiff’s and Class Members’ email communications with Defendant.”) (emphasis added). But even if Plaintiff had adequately alleged this theory, the Court does not find it plausible. As the Court previously explained, email open rates are not content. See Dkt. No. 40 at 8-9. Plaintiff’s theory, if accepted, would transform the routine routing of emails into standalone communications between email providers and their users. Plaintiff has offered no support for stretching CIPA so far.
Second, Plaintiff suggests that Defendant tapped third-party emails whenever a Class Member forwarded one of Defendant’s marketing emails to another person. See Dkt. No. 51 at 4. In the order granting the first motion to dismiss, the Court suggested that Plaintiff may be able to allege a plausible claim giving rise to direct liability under § 631(a) if Plaintiff could show that Bluecore’s software allowed Defendant to view “information about third-party emails in Plaintiff’s inbox, and not just those from Defendant.” Dkt. No. 40 at 4 (emphasis in original). In his opposition, Plaintiff contends that this occurs when “a Class [*8] Member forwards one of the Emails containing the Bluecore spyware to a friend.” Dkt. No. 51 at 4. But the FAC does not contain any allegations that such forwarding ever occurred.2 And even if it did, Plaintiff has not explained how this would transform a marketing email from Defendant into a third-party email. The Court further rejects Plaintiff’s suggestion that he is somehow entitled to discovery to augment his complaint and theories of liability. See id. Plaintiff cannot cycle through theories of liability with the hope of stumbling upon one that can withstand a motion to dismiss.…
The Court followed its prior motion to dismiss ruling and again held that the first clause of CIPA § 631(a) does not apply to internet communications, including emails.
Addressing clauses two and three of CIPA § 631(a),
as best as the Court can discern, Plaintiff contends that (1) a user’s “click” on a URL contained within Defendant’s marketing emails is itself content; and (2) the URLs reveal the content of Defendant’s marketing emails such that Bluecore can somehow “read” the actual marketing emails. The Court is not persuaded by either theory.…
as the Court previously explained, the URLs appear to serve a tracking or routing function. See Dkt. No. 40 at 10. Under Plaintiff’s new theory, however, any “click” on a URL would be a communication that the user is interested in the information linked in the URL. But the Ninth Circuit has not drawn such sweeping conclusions.
Based on the Court’s finding that there was no interception of protected content, the claim for violation of CIPA § 635 was dismissed.
Statutory Larceny Claims
- The plaintiff’s claim that personal information was “stolen” failed because the data at issue was not shown to be property capable of exclusive possession or control, a requirement under California law.
- The court found the plaintiff’s arguments unsupported by the facts and lacking legal authority.
Unfair Competition Law (UCL) Claims
- The UCL claim was derivative of the failed CIPA and larceny claims. The court found no independent basis for an unfair business practice and dismissed this claim as well.
Ramos v. GAP, Inc., No. 23-cv-04715-HSG, 2025 U.S. Dist. LEXIS 145510 (N.D. Cal. July 29, 2025).
