Judge Rita F. Lin, in the Northern District of California, addressed the pleading sufficiency of each website tracking claim on a motion to dismiss the putative class action. The court granted in part and denied the motion in part. Plaintiff was given leave to amend.
Background. Plaintiff alleged that Defendant used and embedded website trackers to collect and disclose his personal and financial information to third parties. His complaint asserted negligence, CCPA, CDAFA, contract, UCL, CIPA, and federal wiretap claims.
The Court’s Analysis. The court concluded that Defendant’s privacy disclosures could reasonably be understood to promise only aggregated reporting, rather than disclosure of individualized user activity. Consent therefore couldn’t be resolved in Defendant’s favor at the pleading stage. The court allowed several claims to proceed, including negligence, the CCPA claim, portions of the CDAFA claim, a CIPA Section 632 claim, and federal wiretap claims. The court dismissed the CIPA section 631 claim because the complaint did not plausibly allege that the trackers intercepted the contents of communications.
Allison’s complaint states a claim under the CCPA. PHH argues only that Allison lacks standing under the CCPA because the statute’s private right of action is limited to data breaches. (Dkt. No. 18 at 18.) However, the CCPA provides a private right of action to any “consumer whose nonencrypted and nonredacted personal information … is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices.” Cal. Civ. Code § 1798.150(a)(1) (emphasis added). Nothing in the plain language of the provision limits its application to data breaches by third parties. By its own terms, the language covers unauthorized disclosure of private information that was to be kept secure and confidential, regardless of whether the disclosure was intentional or merely negligent, and regardless of whether the disclosure was made by a third party or agents of the defendant. See Shah, 768 F. Supp. 3d at 1048–49 (allowing CCPA claim to proceed where “the plaintiff does not allege a data breach” but that “ ‘defendants disclosed plaintiff’s personal information without his consent’ ” (quoting M.G. v. Therapymatch, Inc., No. 23-cv-04422-AMO, 2024 WL 4219992, at *7 (N.D. Cal. Sept. 16, 2024))). The Legislature may have been focused principally on third-party security breaches, as reflected in the section’s title of “Personal Information Security Breaches,” but the language of the statute is not limited to that scenario. PHH cites no case law or legislative history counseling a contrary result. Accordingly, given Allison’s allegations that PHH disclosed his personal information without his consent due to its failure to ensure it sent only aggregated user information, the motion to dismiss this claim is denied.
Significance. The decision shows how ambiguous privacy-policy language can weaken a consent defense in tracking-pixel litigation. Courts are skeptical when website privacy disclosures do not clearly distinguish between aggregated analytics and individualized third-party data sharing.
Allison v. PHH Mortg., No. 25-CV-05323-RFL, 2026 WL 1353827 (N.D. Cal. May 14, 2026).
