Judge Consuelo B. Marshall, in the Central District of California, denied a motion to dismiss and a motion to transfer venue in a case alleging violations of federal and state privacy laws, finding that the defendant’s website activities established personal jurisdiction and that the plaintiff’s claims were sufficiently pleaded to proceed.
Personal Jurisdiction: Website Targeting California Residents
The court’s analysis focused on whether Six Flags Entertainment Corporation, operating an interactive website, could be subject to personal jurisdiction in California. Although the company is incorporated in Delaware and headquartered in North Carolina, the court found specific jurisdiction was proper. Defendant’s website was not merely passively accessible nationwide; it actively targeted California residents by selling tickets and referencing California privacy laws. The court applied the “Calder effects” test, concluding that the defendant’s intentional acts were expressly aimed at California and caused harm the defendant knew would be suffered in the state. This approach aligns with recent Ninth Circuit precedent, which holds that a company’s internet activity may subject it to jurisdiction if it exploits a customer base in the forum state for commercial gain.
Under the third prong of the Calder effects test, the Court must analyze whether Defendant’s conduct caused harm it knew was likely to be suffered in the forum state. Here, the FAC alleges Defendant “engaged in intentional acts by operating its Website … causing both intangible injuries and economic harm to California residents that Defendant knew would be likely to be suffered in California,” “Defendant falsely told Website users that it respected their privacy and that they could avoid tracking and data sharing when they browsed the Website,” “[d]espite receiving notice of consumers’ express declination of consent, Defendant defied it and violated state statutes, and tort duties,” and “Defendant knew, or should have known, how the Website functioned, including the Third Party’s resources it installed on the Website and the third-party cookies in use on the Website, through testing the Website, evaluating their performance metrics by means of its accounts with the Third Parties, or otherwise, and knew, or should have known, that the Website’s programming allowed the third-party cookies to be placed on users’—including Plaintiff’s—browsers and devices and/or transmitted to the Third Parties along with users’ Private Communications even after users attempted to ‘Deny Non-Essential’ cookies, which Defendant promised its users they could do. Defendant’s misrepresentations and omissions concerned material facts that were essential to the analysis undertaken by Plaintiff as to whether to use the Website.” (FAC ¶¶ 5, 11, 210.) Accepting these allegations as true, the FAC sufficiently alleges Defendant’s conduct caused harm Defendant knew was likely to be suffered in California to satisfy the third prong of the Calder effects test. See Briskin, 135 F.4th at 755-56 (citing
Will Co. v. Lee, 47 F.4th 917, 926 (9th Cir. 2022), overruled on other grounds by Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025)); Gabrielli v. Motorola Mobility LLC, 2025 WL 1939957, at *7.
Venue Transfer Denied
Defendant’s alternative request to transfer the case to the Northern District of Ohio was rejected. The court found that, because it had jurisdiction, the statutory basis for transfer did not apply.
Sufficiency of Privacy and Wiretap Claims
Plaintiff alleged seven causes of action, including violations of the Federal Wiretap Act, California’s Invasion of Privacy Act (CIPA), and other state privacy statutes, as well as common law claims for fraud and unjust enrichment. The court found the following:
- Federal Wiretap Act: The complaint sufficiently alleged that the defendant intercepted “content” information, such as search queries and browsing habits, not just non-actionable record information.
- Intrusion Upon Seclusion and Invasion of Privacy: The plaintiff pleaded a reasonable expectation of privacy in personal data collected via third-party cookies, and the alleged surreptitious tracking was deemed potentially “highly offensive.”
- California Invasion of Privacy Act (Cal. Pen. Code § 631(a)): While the statute’s first clause applies to telephonic communications, the second clause covers internet communications. The complaint adequately alleged that the defendant aided third parties in intercepting electronic communications.
- Trap and Trace Device Claims (Cal. Pen. Code § 638.51): The court interpreted the statute to apply to electronic communications, not just telephonic ones, and found the complaint sufficiently alleged the use of tracking technologies as “trap and trace” devices.
- Standing: The plaintiff’s allegations of personal data collection and privacy violations were sufficient to establish standing under California law.
- Unjust Enrichment and Fraud: The court found the complaint adequately alleged that the defendant was unjustly enriched by its conduct and that the fraud claim was pleaded with sufficient particularity.
Casillas v. Six Flags Ent. Corp., No. 2:25-CV-6824-CBM-PD, 2025 WL 3684543 (C.D. Cal. Dec. 15, 2025).
