Benjamin Brayfield v. Advanced Hair Restoration LLC

Opinion

O

United States District Court Central District of California

BENJAMIN BRAYFIELD, Case № 2:25-cv-11547-ODW (ASx)

Plaintiff, ORDER GRANTING MOTION TO

v. DISMISS [18]

LLC,

Defendant.

I. INTRODUCTION Plaintiff Benjamin Brayfield brings this putative class action against Defendant Advanced Hair Restoration LLC (“AHR”), asserting violations of federal and state privacy laws. (Compl., Dkt. No. 1.) AHR now moves to dismiss under Federal Rule of Civil Procedure (“Rule” or “Rules”) 12(b)(1) and (6). (Mot. Dismiss (“Motion” or “Mot.”), Dkt. No. 18.) For the reasons stated below, the Court GRANTS AHR’s Motion to Dismiss.1

1 Having carefully considered the papers filed in connection with the Motion, the Court deemed the matter appropriate for decision without oral argument. Fed. R. Civ. P. 78; C.D. Cal. L.R. 7-15. II. BACKGROUND2 In or around November 2022, Brayfield scheduled a hair transplant consultation through AHR’s website. (Compl. ¶ 8.) To schedule his free consultation, Brayfield input his name, email address, phone number, preferred clinic location, and date and time of the appointment into AHR’s online form. (Id. ¶¶ 8, 27.) At the time Brayfield scheduled his appointment, AHR’s website contained a privacy policy (the “Privacy Policy”) that stated AHR “will not share, rent or sell any Personal Information it collects to any third party for third party marketing or solicitation purposes.” (Id. ¶ 25). The Privacy Policy further stated that AHR “may transfer your Personal Information to or share it with a business partner or venture for future marketing or development of Advanced Hair Restoration services and products.” Privacy Policy, Advanced Hair Restoration (Sept. 18, 2019), https://www.advancedhair.com/privacy [https://web.archive.org/web/2019091802144 8/https://www.advancedhair.com/privacy] [hereinafter AHR Privacy Policy].3 Sometime after visiting AHR’s website, Brayfield’s counsel discovered that AHR shared Brayfield’s personally identifiable information (“PII”) with third parties through “tracking technologies” on AHR’s website. (Compl. ¶ 24.) Brayfield alleges that, “[u]nbeknownst to its patients, Defendant systematically discloses sensitive and confidential appointment booking details and PII to Third Parties.” (Id. ¶ 28.) 2 All factual references derive from Brayfield’s Complaint except where otherwise noted, and well-pleaded factual allegations are accepted as true for purposes of this Motion. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). 3 AHR requests the Court take judicial notice of content from the Wayback Machine, specifically, snapshots of the Privacy Policy as it appeared on September 18, 2019, as this snapshot is the closest one available to when Brayfield first accessed the website. (Mot. 4 n.3.) Brayfield does not dispute that the archived page may be judicially noticed, nor that the snapshot is an accurate representation of what was available to Brayfield at the time he accessed AHR’s website, only opposing its use “to prove inquiry notice.” (Opp’n 5, Dkt. No. 21.). As the Privacy Policy “can be accurately and readily determined,” Fed. R. Evid. 201(b)(2), the Court GRANTS AHR’s request and takes judicial notice of Wayback Machine’s snapshot of the Privacy Policy as of September 18, 2019. See J.J. v. Ashlynn Mktg. Grp., LLC, No. 3:24-cv-00311-GPC-MSB, 2026 WL 1157165, at *3 (S.D. Cal. Apr. 28, 2026) (collecting cases and joining “the apparent majority in determining that content from the Wayback Machine is a proper subject of judicial notice”). On December 4, 2025, Brayfield filed this putative class action, predicated on AHR’s alleged sharing of his data with third parties. (Id. ¶¶ 151, 165, 176, 188.) Specifically, Brayfield alleges privacy violations under the Electronic Communications Privacy Act (“ECPA”), the California Invasion of Privacy Act (“CIPA”), and the California Constitution. (Id. ¶¶ 139–97.) AHR now moves to dismiss the Complaint under Rule 12(b)(1) and (6). (Mot. 1–2.) A. Rule 12(b)(1)—Lack of Subject Matter Jurisdiction A court must dismiss a complaint when the court lacks subject matter jurisdiction, which includes when a plaintiff lacks constitutional standing. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000) (“Because standing . . . pertain[s] to a federal court’s subject-matter jurisdiction under Article III, [it is] properly raised in a motion to dismiss under [Rule] 12(b)(1).”). To satisfy Article III standing, a plaintiff must show that (1) he has suffered an injury in fact that is concrete and particularized and actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged actions of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Spokeo, Inc. v. Robins, 578 U.S. 330, 338–39 (2016); Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992). The party attempting to invoke a court’s jurisdiction bears the burden of proof for establishing jurisdiction. See Sopcak v. N. Mountain Helicopter Serv., 52 F.3d 817, 818 (9th Cir. 1995). B. Rule 12(b)(6)—Failure to State a Claim A court may dismiss a complaint under Rule 12(b)(6) for lack of a cognizable legal theory or insufficient facts pleaded to support an otherwise cognizable legal theory. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1988). To survive a dismissal motion, a complaint need only satisfy the minimal notice pleading requirements of Rule 8(a)(2)—a short and plain statement of the claim. Porter v. Jones, 319 F.3d 483, 494 (9th Cir. 2003). The factual “allegations must be enough to raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). That is, the complaint must “contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Iqbal, 556 U.S. at 678 (citation modified). The determination of whether a complaint satisfies the plausibility standard is a “context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Id. at 679. A court is generally limited to the pleadings and must construe all “factual allegations set forth in the complaint . . . as true and . . . in the light most favorable” to the plaintiff. Lee v. City of Los Angeles, 250 F.3d 668, 679 (9th Cir. 2001). However, a court need not blindly accept conclusory allegations, unwarranted deductions of fact, and unreasonable inferences. Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001). Where a district court grants a motion to dismiss, it should generally provide leave to amend unless it is clear the complaint could not be saved by any amendment. See Fed. R. Civ. P. 15(a); Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Leave to amend may be denied when “the court determines that the allegation of other facts consistent with the challenged pleading could not possibly cure the deficiency.” Schreiber Distrib. Co. v. Serv-Well Furniture Co., 806 F.2d 1393, 1401 (9th Cir. 1986). Thus, leave to amend “is properly denied . . . if amendment would be futile.” Carrico v. City & County. of San Francisco, 656 F.3d 1002, 1008 (9th Cir. 2011). AHR moves to dismiss on three grounds: (1) Brayfield lacks Article III standing; (2) Brayfield’s claims are time-barred; and (3) Brayfield fails to state a claim on each cause of action. (Mot. 1–2.) For the following reasons, the Court finds that, although Brayfield adequately pleads Article III standing, his claims are time- barred, and thus the Court must dismiss Brayfield’s complaint. A. Article III Standing The Court first addresses Article III standing as, without it, the Court lacks jurisdiction to reach the merits of this case. Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 94 (1998) (requiring courts to address jurisdictional questions even when “the merits question is more readily resolved” and “the prevailing party on the merits would be the same as the prevailing party were jurisdiction denied”). AHR argues that Brayfield lacks Article III standing because he fails to allege a concrete injury. (Mot. ¶¶ 6–9.) Specifically, AHR argues that Brayfield alleges only a bare statutory violation and the disclosure of routine contact and scheduling information carries no protectable privacy interest and amounts to no concrete harm. (Id.) “Article III standing requires a concrete injury even in the context of a statutory violation.” Spokeo, 578 U.S. at 341; see TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021) (“[A]n injury in law is not an injury in fact.”). Thus, even when a plaintiff adequately pleads a statutory violation, the plaintiff must also demonstrate that he or she “has suffered a harm that has traditionally been actionable in our nation’s legal system.” Popa v. Microsoft Corp., 153 F.4th 784, 791 (9th Cir. 2025) (citing TransUnion, 594 U.S. at 425–34). For example, in a privacy action like this one, a plaintiff could demonstrate concrete injury by analogizing to common law privacy torts. Id. Here, Brayfield alleges that AHR disclosed both his identity and interest in a hair transplant consultation to third parties. (Compl. ¶¶ 8–9, 108.) He analogizes this disclosure to the common law privacy torts of intrusion upon seclusion and public disclosure of private facts. (Opp’n 7.) Public disclosure of private facts, for example, requires a that a “defendant give publicity to a matter that concerns the private life of another, that the information is highly offensive to a reasonable person, and that the information is not of legitimate public concern.” Popa, 153 F.4th at 791 (citation modified). Taking all well-pleaded facts as true, it appears Brayfield adequately alleges a concrete injury because his alleged injury is comparable to the injury that would result from public disclosure of private facts. The fact that Brayfield was seeking a hair transplant is not of legitimate public concern, and a reasonable person could find exposure of such a fact highly offensive. Thus, at the pleading stage, the Court finds that Brayfield sufficiently alleges he suffered a concrete injury to support Article III standing in this action. B. Time-Bar AHR argues that Brayfield’s claims are time-barred. (Mot. 2–5.) Privacy claims brought under the ECPA and California Constitution carry two-year statutes of limitations, and CIPA claims carry a one-year statute of limitations. Doe v. Tenet Healthcare Corp., 789 F. Supp. 3d 814, 852–53 (E.D. Cal. 2025). Generally, a claim accrues when a plaintiff “has reason to suspect an injury and some wrongful cause.” Fox v. Ethicon Endo-Surgery, Inc., 35 Cal. 4th 797, 803 (2005). However, under the delayed discovery rule, accrual may be tolled if a “plaintiff pleads and proves that a reasonable investigation at that time would not have revealed a factual basis for that particular cause of action.” Id. A plaintiff seeking to invoke the delayed discovery rule “must specifically plead facts to show (1) the time and manner of discovery and (2) the inability to have made earlier discovery despite reasonable diligence.” E-Fab, Inc. v. Accountants, Inc. Servs., 153 Cal. App. 4th 1308, 1319 (2007) (citation modified). “[T]he burden is on [the plaintiff] to plead and prove the facts necessary to toll the limitations period once it is established that it would have otherwise commenced.” Sansome Co. v. U.S. Gypsum, 55 F.3d 1402, 1406 (9th Cir. 1995). If a plaintiff meets this burden, “the discovery rule postpones accrual of a claim until ‘the plaintiff discovers, or has reason to discover, the cause of action.’” Clemens v. DaimlerChrysler Corp., 534 F.3d 1017, 1024 (9th Cir. 2008) (quoting Norgart v. Upjohn Co., 21 Cal. 4th 383, 397 (1999)). Here, Brayfield alleges that AHR committed privacy violations in November 2022, over three years before he filed his Complaint. (Compl. ¶¶ 8; 88 (alleging that when a user communicates with AHR’s website, “those communications are simultaneously and contemporaneously duplicated and sent to” a third party).) Thus, unless the delayed discovery rule applies, Brayfield’s claims fall outside all applicable statutes of limitations. Doe, 789 F. Supp. 3d at 852–53. Brayfield cannot, however, invoke the delayed discovery rule because he fails to specifically plead any facts regarding the “time and manner of [his] discovery” of AHR’s privacy violations. E-Fab, 153 Cal. App. 4th at 1319; (see generally Compl.). This failure alone is dispositive of Brayfield’s claims. See Yumul v. Smart Balance, Inc., 733 F. Supp. 2d 1134, 1143–44 (C.D. Cal. 2010) (dismissing a complaint because the plaintiff, who sought to invoke the delayed discovery rule, failed to allege “in any form the manner of her discovery”). Further, leave to amend is inappropriate because Brayfield could have accessed AHR’s Privacy Policy in or around November 2022, the exact time Brayfield navigated AHR’s site and scheduled his consultation. Specifically, the Privacy Policy stated that AHR “may transfer your Personal Information to or share it with a business partner or venture for future marketing or development of Advanced Hair Restoration services and products.” AHR Privacy Policy. The Privacy Policy even states that AHR “uses certain tools provided by Google” to place cookies on a user’s browser. Id. These contemplated disclosures of personal information are the exact alleged privacy violations on which Brayfield predicates his claims. (See Compl. ¶¶ 149, 165, 176, 188 (alleging that AHR disclosed Brayfield’s personal information to third parties, including Google).) As the Privacy Policy disclosed the precise mechanism of the alleged data sharing, Brayfield could have discovered the AHR’s alleged privacy violations in November 2022 by reviewing AHR’s publicly accessible Privacy Policy. Brayfield argues that he was “never presented with [AHR’s] privacy policy during the appointment process.”4 (Opp’n 5.) However, the application of the

4 Brayfield also argues that the Court may not use judicially noticed documents for the purpose of establishing inquiry notice. (Opp’n 5.) This assertion has no basis in case law. Von Saher v. Norton Simon Musum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2010) (“Courts may take judicial notice of publications introduced to indicate what was in the public realm at the time, not whether delayed discovery rule evaluates reasonable diligence, not a plaintiff’s subjective awareness. See Al-Ahmed v. Twitter, Inc., 648 F. Supp. 3d 1140, 1155 (N.D. Cal. 2023) (stating that the delayed discovery rule sets an objective, not subjective, standard of whether a reasonable investigation would have revealed the factual basis of the claim). Brayfield could have discovered AHR’s alleged privacy violations as early as November 2022. Therefore, Brayfield’s claims must have accrued no later than November 2022, when he accessed AHR’s website and booked his consultation, and when AHR allegedly disclosed Brayfield’s information to third parties. (See, e.g., Compl. ¶ 88.) In sum, Brayfield was required to bring his CIPA claim by November 2023, and his constitutional and ECPA claims by November 2024. Doe, 789 F. Supp. 3d at 852– 53. Given that Brayfield did not file his complaint until December 4, 2025, each of his claims is time-barred. Id. Further, as the public availability of the privacy policy in 2022 is an undisputed fact that permanently precludes the application of the delayed discovery rule, leave to amend would be futile and “could not possibly cure” the deficiency in the complaint. Schreiber, 806 F.2d at 1401. \\ \\ \\ \\ \\ \\ \\ \\ \\

the contents of those articles were in fact true.” (citation modified)); see In re Wells Fargo Mortg.-Backed Certificates Litig., 712 F. Supp. 2d 958, 965 n.2 (N.D. Cal. 2010) (granting judicial notice for the purpose of determining inquiry notice). Vv. CONCLUSION For the reasons discussed above, the Court GRANTS AHR’s Motion to Dismiss, (Dkt. No. 18), and DISMISSES the Complaint WITHOUT LEAVE TO AMEND and WITH PREJUDICE. The Court will issue Judgment. July 24, 2026 ; □□ Weg OTIS D. wai II b UNITED STATES DISTRICT JUDGE