Judge William H. Orrick, in the Northern District of California, granted a lender’s motion to dismiss the complaint, but allowed plaintiffs the opportunity to amend their claims. Plaintiffs alleged improper sharing of nonpublic personal financial information with third parties via online tracking technologies.
The plaintiffs, customers of a mortgage lender, claimed that the company used online tracking technologies (such as Meta Pixel and other cookies) on its website to collect and share users’ personal and financial information with third parties, including technology companies like Google and Meta. Plaintiffs asserted that these practices occurred without proper disclosure or consent, in violation of privacy laws such as the Gramm-Leach-Bliley Act (GLBA), the California Consumer Privacy Act (CCPA), several section of the California Invasion of Privacy Act (CIPA), and various contractual obligations.
The lender’s website was governed by Terms of Use and a Privacy Policy, which plaintiffs acknowledged accepting. The Privacy Policy disclosed certain uses of personal information, including sharing with third parties for business purposes, but plaintiffs argued it did not specifically inform users that their financial information would be shared with technology companies for the benefit of those companies and other downstream parties.
Consent and Disclosure
The central issue was whether plaintiffs consented to the sharing of their information by agreeing to the lender’s Terms of Use and Privacy Policy. The court found that the complaint did not adequately address this consent, as plaintiffs admitted to entering into these agreements but did not allege that they disagreed with their contents. The court noted that, while consent is often a factual issue not typically resolved at the motion to dismiss stage, the plaintiffs failed to provide sufficient factual allegations that the lender’s data sharing exceeded the scope of the disclosed policies.
The court also highlighted that the Privacy Policy described the use of cookies and referenced third-party links and social media, advising users to review third-party privacy policies. However, the court found that the plaintiffs’ allegations lacked the necessary specificity to plausibly claim that the lender’s disclosures were inadequate or that the data sharing went beyond what was consented to.
ETHAN ALLISON, et al., v. UNITED WHOLESALE MORTGAGE, No. 25-CV-05377-WHO, 2025 WL 3702863 (N.D. Cal. Dec. 21, 2025).
