Judge Anthony J. Battaglia, in the Southern District of California, dismissed a claim alleging unlawful data collection by a website operator, finding that the plaintiff failed to demonstrate a concrete injury as required under Article III.
Plaintiff, a self-described consumer privacy advocate, alleged that after visiting the defendant’s website, her internet browser was subjected to the installation of 35 tracking beacons. These beacons collected a range of data, including her IP address, device and browser information, geolocation data, email address, and various identifiers. The plaintiff claimed that these tracking mechanisms constituted either “pen registers” or “trap and trace devices” under California law, and that their use without her consent violated her statutory privacy rights.
[Plaintiff] is “a consumer privacy advocate who works as a ‘tester’ to ensure that companies abide by the privacy obligations imposed by California law.”
The defendant moved to dismiss the complaint, arguing, among other grounds, that the plaintiff lacked standing because she had not suffered a concrete injury.
The court’s analysis focused on the threshold issue of Article III standing. To proceed in federal court, a plaintiff must show an “injury in fact” that is concrete, particularized, and actual or imminent. The court found that the plaintiff’s allegations did not meet this standard for several reasons:
- No Concrete Injury: The plaintiff failed to demonstrate that the alleged data collection resulted in a harm that is “real, and not abstract.” The court emphasized that a statutory violation alone is insufficient to establish standing; there must be a close relationship between the alleged injury and a harm traditionally recognized by American courts, such as intrusion upon seclusion or appropriation of likeness. The plaintiff did not make this connection.
- No Reasonable Expectation of Privacy: The court noted that courts have consistently held that internet users do not have a reasonable expectation of privacy in their IP addresses or in other metadata that is routinely exchanged to facilitate online communication. The court cited precedent holding that such information is voluntarily provided to internet service providers and website operators as part of the normal functioning of the internet.
- Insufficient Allegations of Harm: The plaintiff’s assertions that the collection of her data was “highly offensive” and constituted an invasion of privacy were deemed conclusory and unsupported by specific facts showing actual harm.
REBEKA RODRIGUEZ, v. CULLIGAN INTERNATIONAL COMPANY, No. 25-CV-00225-AJB-KSC, 2025 WL 3064113 (S.D. Cal. Nov. 3, 2025).
