On August 6, 2025, Judge Noel Wise, in the Northern District of California, granted CuriosityStream Inc.’s motion to dismiss a putative class action alleging that the company’s use of TikTok’s third-party tracking software on its website violated the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 638.50–638.51. The court dismissed the case with prejudice and without leave to amend, finding that the plaintiff lacked Article III standing and that the software at issue did not qualify as a “trap and trace device” under CIPA.
Background
Plaintiff Christopher Mitchener alleged that CuriosityStream installed TikTok-designed software on its website that “seamlessly cause[d] the extraction and transmission of data from every device that accesses the Website.” Specifically, the complaint alleged the software gathered “device and browser information, geographic information, referral tracking, and URL tracking” and transmitted that data to TikTok, where it was matched against TikTok’s own data to “conclusively identif[y]” otherwise anonymous website visitors. The complaint further alleged that CuriosityStream employed TikTok’s “Auto Advanced Matching” technology to scan website pages for additional visitor information “such as name, date of birth, and address.” Mitchener contended this software constituted a “trap and trace device” installed without a court order in violation of CIPA.
The court noted that this case was one in a series of substantially identical actions filed by Plaintiff’s counsel, Tauler Smith LLP, against website operators using TikTok tracking software, and that the same judge had previously dismissed a substantively identical complaint in Kishnani v. Royal Caribbean Cruises Ltd., No. 25-CV-01473-NW (N.D. Cal. June 24, 2025).
The Court’s Analysis
Failure to Allege a Concrete Injury. The court held that Mitchener failed to allege an injury in fact sufficient for Article III standing. To survive a motion to dismiss a privacy claim, a plaintiff must “identify the specific personal information she disclosed that implicates a protectable privacy interest.” Mitchener’s complaint offered only generalized allegations that CuriosityStream collected his “data” and “information,” without alleging how many times he visited the website, what information was captured, whether he was de-anonymized, or whether the website collected his biographical information. The court emphasized that “general allegations of unlawful conduct are, in themselves, insufficient alone to confer standing.”
Furthermore, the court found that even if the allegations were sufficiently concrete, Mitchener failed to allege the invasion of a legally protected right. The court observed that the collection of basic contact information and IP addresses does not constitute a concrete harm, as “there is no legally protected privacy interest in IP addresses.” While Mitchener alleged that CuriosityStream could gain biographical information such as name, date of birth, and address, he did not allege that his own biographical information was actually collected, failing to “convert that hypothetical into concrete harm to him.”
TikTok Software Is Not a “Trap and Trace Device.” The court also held that the TikTok software could not constitute a “trap and trace device” under CIPA as a matter of law. Under CIPA, a trap and trace device captures identifying information about a communication, such as “dialing, routing, addressing, or signaling information,” but expressly excludes “the contents of a communication.” The court reasoned that the TikTok software, as described in the complaint, allegedly captured biographical content — names, dates of birth, and addresses — which constitutes the content of a communication, not mere metadata about a communication.
The court articulated a clear framework: if the software only collects communication metadata (e.g., IP addresses and general geographic location), then no reasonable expectation of privacy is implicated; if the software instead collects content information (e.g., biographical details provided by the visitor), then it falls outside the statutory definition of a trap and trace device and CIPA § 638.51 does not apply. This inherent tension, the court concluded, rendered any amendment futile, warranting dismissal with prejudice.
Mitchener v. CuriosityStream, Inc., No. 25-cv-01471-NW (N.D. Cal. Aug. 6, 2025).
