Judge Dana M. Sabraw, in the Southern District of California, addressed a motion to dismiss in privacy litigation targeting website tracking technologies. The case centers on the use of TikTok Pixel and Microsoft Bat Bing Tracker on a retailer’s website, which allegedly collected users’ personal identifying information (PII) such as IP addresses, unique identifiers, and browsing data, and shared it with third parties for analytics and advertising purposes. Plaintiffs argued these trackers function as “pen registers” under the California Invasion of Privacy Act (CIPA), requiring a court order for their use.
Jurisdictional and Standing Challenges
- Personal Jurisdiction: The court dismissed one defendant for lack of personal jurisdiction, finding insufficient connection between the company and the website at issue. Plaintiffs failed to show that the dismissed entity owned or operated the website, a critical factor for establishing jurisdiction in California.
- Article III Standing: The court also dismissed the case for lack of standing, holding that plaintiffs did not allege a concrete injury. The decision emphasized that merely alleging a statutory privacy violation is not enough; plaintiffs must show a harm with a close relationship to traditional legal claims, such as intrusion upon seclusion. Here, the court found no reasonable expectation of privacy in IP addresses and similar data, citing extensive case law that such information is routinely shared with third parties and not protected.
Substantive Privacy Claims Under CIPA
Despite dismissing the case on jurisdiction and standing grounds, the court addressed several substantive arguments relevant to businesses deploying website trackers:
- Trackers as Pen Registers: The court agreed with recent case law that software trackers can qualify as “pen registers” under CIPA, rejecting arguments that the statute applies only to telephone surveillance.
- Consent and Scienter: The court found that defendants’ consent to install trackers on their own website did not exempt them from CIPA requirements. It also held that plaintiffs sufficiently alleged intentional conduct in installing the trackers.
- Statutory Standing: The court clarified that statutory standing under CIPA is distinct from Article III standing and does not require a showing of concrete injury.
- Collective Pleading: The court permitted collective pleading against multiple defendants, provided the complaint gives fair notice of the claims.
JUSTIN BRADSHAW, & GUSTAVO LOPEZ, individually & on behalf of all others similarly situated, v. LOWE’S COMPANIES, INC., a N. Carolina corporation, & LOWES HOME CENTERS, LLC, a N. Carolina limited liability company, No. 25CV0742 DMS (MMP), 2025 WL 3171740 (S.D. Cal. Nov. 12, 2025).
