Judge Rita F. Lin, in the Northern District of California, denies defendant’s request to transfer venue in a putative class action alleging privacy violations by an advertising technology company. Plaintiffs claim that defendant’s tracking software unlawfully collects and stores detailed personal information and web activity, raising significant questions under California and federal privacy laws.
Venue Challenge Denied
Defendant sought to transfer the case to Colorado, arguing that the relevant conduct and most employees were based there. The court rejected this argument, finding venue proper in California because several plaintiffs reside in the district and alleged that the privacy harms occurred there. The court emphasized that, for privacy torts, the location where the harm is felt is a substantial factor in the venue analysis. The court also declined to transfer the case for convenience, noting that the plaintiffs’ choice of forum, the district’s interest in protecting residents, and the court’s familiarity with California law outweighed any marginal convenience to the defendant.
Motion to Dismiss: Most Claims Survive
Defendant moved to dismiss all claims, contending that the alleged data collection was not sufficiently “offensive” to constitute a privacy violation and that the information collected did not qualify as protected “content” under the relevant statutes.
- Intrusion Upon Seclusion and CIPA Claims: The court found that the plaintiffs adequately alleged a highly offensive privacy intrusion under California law, citing the scope and sensitivity of the data collected—including full-string URLs and personal identifiers. The court also held that the allegations were sufficient to state claims under the California Invasion of Privacy Act (CIPA), including claims for eavesdropping and use of a “pen register,” finding that modern internet tracking technologies can fall within the statute’s scope.
Plaintiffs have alleged that, among other things, Sovrn collects “full-string URLs” that reflect not only the website visited, but also, for example, search queries and specific items Plaintiffs viewed. (See, e.g., CAC ¶¶ 111–113, 132, 168–69.) This information constitutes content of communications under CIPA and the ECPA. See Smith v. Rack Room Shoes, Inc., No. 24-cv-06709-RFL, 2025 WL 1085169, at *4 (N.D. Cal. Apr. 4, 2025); see also In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 605 (9th Cir. 2020) (explaining that full-string URLs can include “search terms inputted” and can “divulge a user’s personal interests [and] queries”). Plaintiffs have adequately alleged that the content of their communications was collected.
…
Sovrn argues that pixels do not meet the definition of a “penregister” under the meaning of CIPA because they involve internet technology, not telephone lines. (Dkt. No. 23 at 14–15.) However, the Court has previously found that similar internet tracking technology qualifies as a penregister. See Shah v. Fandom, Inc., 754 F. Supp. 3d 924, 930 (N.D. Cal. 2024) (explaining that “CIPA was passed in part because ‘the development of new devices and techniques for the purpose of eavesdropping upon private communications … has created a serious threat to the free exercise of personal liberties’ ” and quoting Cal. Penal Code § 630). The reasoning in Shah is equally applicable here. Id. Sovrn’s motion to dismiss the Section 638.51(a) claim is denied.
- Electronic Communications Privacy Act (ECPA): The court determined that the collection of full-string URLs and related data could constitute the interception of the “contents” of communications under federal law, allowing these claims to proceed.
- Unjust Enrichment: The court dismissed the unjust enrichment claim, but granted plaintiffs leave to amend. The dismissal was based on the plaintiffs’ failure to allege that legal remedies would be inadequate, as required for equitable claims.
MICHAEL SELBY, et al., v. SOVRN HOLDINGS, INC., No. 25-CV-03139-RFL, 2025 WL 2950164 (N.D. Cal. Oct. 17, 2025).
