Christine Wiley, et al. v. Universal Music Group, Inc.

Opinion

CHRISTINE WILEY, et al., Case No. 25-cv-03095-PCP

Plaintiffs, ORDER DENYING IN PART, v. GRANTING IN PART MOTION TO DISMISS Re: Dkt. No. 21 Defendant.

In their class action complaint, plaintiffs Christine Wiley and Vishal Shah allege that defendant Universal Music Group, Inc. (UMG) violated their privacy rights by placing certain cookies on their devices even though they had expressly opted out of receiving such cookies. UMG moves to dismiss plaintiffs’ lawsuit for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). UMG also moves to strike several of plaintiffs’ allegations and their class definition. For the reasons stated below, the Court grants in part and denies in part UMG’s motion to dismiss and denies UMG’s motion to strike. UMG is a music company that owns and operates websites where users can get information about artists and merchandise.1 UMG’s websites place cookies—text files that identify users to websites—on users’ browsing devices. Cookies allow websites to recognize individual users because they are sent to a website’s server alongside requests for the website’s content. Generally, a website may store third-party cookies on a user’s device, allowing the third- party to track that user across different websites. Owners of websites can use cookies to analyze users’ behavior, personalize information presented, target advertising, and integrate social media functions. UMG presented users a choice as to how they would be tracked while on UMG websites. UMG’s privacy policy explains that its websites use cookies and that plaintiffs can “make certain choices about cookies through the cookie choices tools … .” UMG’s popup cookie consent banner told users that the sites use cookies for “Online Advertising” on both the site they visit and “another site you may visit in the future.” UMG’s banner also said that the cookies it used for “Performance and Analytics” were meant “to improve our site” and were “[n]ot used for online advertising purposes or by third parties for their own use.” For California consumers, UMG’s popup cookie consent banner gave users the option to change their “Cookie Choices” by opting out of receiving “Online Advertising” and “Performance and Analytics” cookies, including by clicking “Decline All.” In other words, UMG’s popup cookie consent banner told users that the website they were visiting used cookies but appeared to give users some control over how they would be tracked and how their personal data would be used. Plaintiffs allege that, in reality, even if users clicked “Decline All” or opted out of either “Online Advertising” or “Performance and Analytics” cookies, UMG’s websites nonetheless placed third-party cookies on users’ devices and allowed third parties—including Meta Platforms, Inc., Google LLC, ByteDance Ltd. (TikTok), Snap Inc. (SnapChat), and Appreciation Engine Inc.—to use those cookies to track users’ online activities, including, plaintiffs allege, their “browsing history, visit history, website interactions, user input data, demographic information, interests and preferences, shopping behaviors, device information, referring URLs, session information, user identifiers, and/or geolocation data.” Plaintiffs Christine Wiley and Vishal Shah are California residents who say UMG tracked them despite their having expressly opted out of advertising and performance cookies. Wiley says that “during the last four years” she visited arianagrande.com, icespicemusic.com, universalmusic.com, nickiminajofficial.com, theweekend.com, and lilyachtyofficial.com. Wiley says that she read UMG’s popup cookie consent banner and “Decline[d] All” advertising and performance analytics cookies. UMG nonetheless enabled cookies and other tracking technology Plaintiff Shah alleges largely the same facts, contending that he visited postmalone.com and imaginedragonsmusic.com in the last four years “including[] in or around March 2024.” Wiley and Shah bring suit on behalf of a class of similarly situated people, defining the class as “[a]ll persons who browsed the Websites in the State of California after clicking the ‘Cookie Choices’ link and declined cookies in the cookie consent preferences window within the four years preceding the filing of this Complaint.” Plaintiffs bring claims against UMG for invasion of privacy; intrusion upon seclusion; wiretapping in violation of the California Invasion of Privacy Act (CIPA); use of a pen register in violation of CIPA; common law fraud, deceit, or misrepresentation; unjust enrichment; breach of contract; breach of the implied covenant of good faith and fair dealing; and trespass to chattels. Plaintiffs seek injunctive relief, damages, and fees. UMG now moves to dismiss plaintiffs’ complaint for failure to state a claim under Rule 12(b)(6) and moves to strike certain allegations, including plaintiffs’ class allegations. Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include a “short and plain statement of the claim showing that the pleader is entitled to relief.” Federal Rule of Civil Procedure 12(b)(6) allows a defendant to move to dismiss a complaint for failure to state a claim upon which relief can be granted. Dismissal is required if the plaintiff fails to allege facts allowing the Court to “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). In considering a Rule 12(b)(6) motion, the Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable” to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029-30 (9th Cir. 2009). While legal conclusions “can provide the [complaint’s] framework,” the Court will not assume they are correct as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quoting Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)). I. Motion to Dismiss A. Statute of Limitations Wiley alleges that she visited UMG websites “during the last four years” but alleges no specific date on which she visited those websites. Because a portion of the alleged four-year period falls outside the applicable statutes of limitations, UMG argues that Wiley’s invasion of privacy, intrusion upon seclusion, wiretapping, and pen register claims are untimely.2 Because plaintiffs bring state law claims, California’s statutes of limitations apply. See Nev. Power Co. v. Monsanto Co., 955 F.2d 1304, 1306 (9th Cir. 1992). The applicable statutes of limitations range from two years for their invasion of privacy and intrusion upon seclusion claims, Cal. Civ. Proc. Code § 335.1; Brown v. Google LLC, 525 F. Supp. 3d 1049, 1069 (N.D. Cal. 2021), to one year for their CIPA wiretapping and pen register claims, see Cal. Civ. Proc. Code § 340; Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 134 (N.D. Cal. 2020). The statute of limitations is “generally an affirmative defense rather than an element of the plaintiff’s claim.” Turner v. Google LLC, 737 F. Supp. 3d 869, 877 (N.D. Cal. 2024). Affirmative defenses do not provide a basis for dismissal under Rule 12(b)(6) unless the plaintiff has pleaded herself out of a claim by “admit[ing] all the ingredients of an impenetrable defense,” Durnford v. MusclePharm Corp., 907 F.3d 595, 604 n.8 (9th Cir. 2018), meaning that the plaintiff’s pleaded facts demonstrate no “potential factual dispute that could affect whether the defense applies,” Rabin v. Google LLC, 725 F. Supp. 3d 1028, 1031 (N.D. Cal. Mar. 26, 2024). Where the defendant moves to dismiss a claim as untimely under the applicable statute of limitations, the motion can be granted “only when ‘the running of the statute is apparent on the face of the complaint.’” Van Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 969 (9th Cir. 2010) (quoting Huynh v. Chase Manhattan Bank, 465 F.3d 992, 997 (9th Cir. 2006)). Here, plaintiffs’ complaint does not admit the ingredients of an impenetrable statute of limitations defense as to Wiley. “The face of the complaint,” Huynh, 465 F.3d at 997, alleges that “Plaintiff Wiley visited the arianagrande.com, icespicemusic.com, universalmusic.com, nickiminajofficial.com, theweekend.com, and lilyachtyofficial.com Websites to browse information about music and related products on multiple occasions during the last four years.” The “last four years” includes the past two years or one year, so it is entirely possible, from the face of the complaint, that Wiley’s claims are timely. Therefore, plaintiffs have adequately alleged that their claims are timely. B. Invasion of Privacy & Intrusion upon Seclusion UMG argues that plaintiffs have failed to adequately plead the substantive elements of their causes of action for invasion of privacy and intrusion upon seclusion. Because both causes of actions have similar elements, they are considered together. See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020). Both require plausibly alleging, first, that the defendant intruded into a “place, conversation, or matter as to which the plaintiff had a reasonable expectation of privacy” and, second, that the defendant’s intrusion was “highly offensive.” Id.; see also Hammerling v. Google, 615 F. Supp. 3d 1069, 1088 (N.D. Cal. 2022). Reasonable Expectation of Privacy UMG argues that plaintiffs’ allegations do not indicate that they had a reasonable expectation of privacy in the specific browsing information allegedly shared with UMG’s assistance. Whether one has a reasonable expectation of privacy is a mixed question of law and fact, informed by “whether a defendant gained ‘unwanted access to data by electronic or other covert means, in violation of the law or social norms.” See In re Facebook, 956 F.3d at 601–02 (quoting Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 286 (2009)). “To make this determination, courts consider a variety of factors, including the customs, practices, and circumstances surrounding a defendant’s particular activities.” Id. (citing Hill v. NCAA, 7 Cal. 4th 1, 36 (1994)). In support of their privacy claims, plaintiffs allege that UMG told them that it would not Shah thought that they were opting out of tracking that they allege UMG nevertheless facilitated. Plaintiffs allege that the information UMG collected on them included “their browsing history, visit history, website interactions, user input data, demographic information, interests and preferences, shopping behaviors, device information, referring URLs, session information, user identifiers, and/or geolocation data.” UMG is correct that the information at issue, standing alone, may not involve the types of information in which users have an unqualified expectation of privacy. But in this case UMG allegedly represented to plaintiffs that it would not collect information for advertising or analytics if they opted out of such collection. A reasonable visitor to UMG’s website who selected “Decline All” would thus reasonably expect UMG not to install performance and analytics cookies on their devices. Because UMG told users that they could opt out of such forms of information collection, users of UMG’s website had a reasonable expectation of privacy with respect to that information. UMG’s alleged affirmative misrepresentation distinguishes its actions from those in the cases it cites. See, e.g., In re Zynga Priv. Litig., 750 F.3d 1098, 1108–09 (9th Cir. 2014); In re Google Location Hist. Litig., 428 F. Supp. 3d 185, 198 (N.D. Cal. 2019); D’Angelo v. FCA US, LLC, 726 F. Supp. 3d 1179, 1206 (S.D. Cal. 2024)). Those cases did not involve an affirmative representation that the defendant would not engage in the information collecting at issue. For example, in D’Angelo v. FCA, plaintiffs sued Dodge for not informing them that Dodge.com allowed Salesforce to intercept and analyze their chats. 726 F. Supp. 3d at 1187–88. In relevant part, the district court held that the data allegedly collected—including “the user’s account name, IP address, geographic location, and site the user previously visited”—were not “sensitive” enough to “give rise to an invasion of privacy.” Id. at 1206. At the same time, the court found it relevant that “Plaintiffs do not allege that Defendant set out an expectation that it would not collect chat conversations….” Id. at 1205. In contrast here, UMG “set out an expectation that it would not collect” plaintiffs’ information from advertising or analytics cookies. Id. D’Angelo and other cases where the website owner did not “set out an expectation that it would not collect” information are therefore inapposite. plaintiffs Wiley and Shah had a reasonable expectation of privacy in the information that was collected by cookies they had attempted to reject. As the California Attorney General’s website explains, the CCPA requires that companies give users the choice to opt out of any collection of personal information for “cross-context behavioral advertising, which is the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s online activity across numerous websites.” California Consumer Privacy Act, Off. of the Attorney General, State of California (Mar. 13, 2024), https://oag.ca.gov/privacy/ccpa. When evaluating Californians’ reasonable privacy expectations, the CCPA’s provisions are highly relevant “customs, practices, and circumstances,” In re Facebook, 956 F.3d at 602, because they provide Californians with the reasonable expectation that they will have some control over their data and necessarily shape users’ expectations about their ability to opt out of websites’ collection of data for profit. Cases decided prior to the 2020 adoption of the CCPA are thus of limited value in considering users’ reasonable post-enactment expectations. See, e.g., In re Zynga Priv. Litig., 750 F.3d 1098; In re Google Location Hist. Litig., 428 F. Supp. 3d at 198; White v. Soc. Sec. Admin., 111 F. Supp. 3d 1041 (N.D. Cal. 2015). Today, when California users visit a website, they can expect to see a popup screen giving them the option to opt out of various types of tracking. Because many of the cases UMG cites do not consider this changed circumstance, they do not persuasively establish the absence of a reasonable expectation of privacy with respect to the forms of post-CCPA data collection at issue here. Considering both UMG’s affirmative representation that users could disable the tracking at issue here as well as the CCPA, the “customs, practices, and circumstances” surrounding plaintiffs’ visits to UMG’s websites gave plaintiffs a reasonable expectation of privacy with respect to the data whose collection UMG allegedly facilitated. In re Facebook, 956 F.3d at 602. Highly Offensive UMG separately argues that even if plaintiffs had a reasonable expectation of privacy, the alleged data collection and dissemination were not “highly offensive.” Whether a particular invasion or intrusion was “highly offensive” presents a mixed question of law and fact, see Hill, 7 questions of law and fact.”), and requires considering the “degree and setting of the intrusion” and “the intruder’s motives and objectives,” Hernandez, 47 Cal. 4th at 295. The “ultimate question of whether … tracking and collection practices could highly offend a reasonable individual is an issue that [often] cannot be resolved at the pleading stage.” See In re Facebook, 956 F.3d at 606. As a result, dismissal under Rule 12(b)(6) is appropriate only if the allegations “show no reasonable expectation of privacy or an insubstantial impact on privacy interests.” Hill, 7 Cal. 4th at 40. “[D]eceit can be a kind of ‘plus’ factor” in determining whether an action is highly offensive. See In re Google Location Hist. Litig., 514 F. Supp. 3d 1147, 1157 (N.D. Cal. 2021) (quoting Heeger v. Facebook, Inc., 2019 WL 7282477, at *4 (N.D. Cal. Dec. 27, 2019); McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022, 1036 (N.D. Cal. 2019)). Here, plaintiffs have pleaded that UMG affirmatively promised not to enable the tracking of plaintiffs’ browsing behavior. Plaintiffs allege not only that they understood UMG to be promising not to track them using performance or analytics cookies, but also that they “would not have used the Websites” otherwise. UMG thus not only misled users into thinking that their opt outs would be effective but led them to engage in tracked conduct they otherwise would not have undertaken. Given that plaintiffs have alleged both an invasion of their reasonable expectations of privacy and that this invasion was undertaken through deceptive conduct, plaintiffs have pleaded facts sufficient to preclude the Court from concluding, as a matter of law, that UMG’s invasion was not “highly offensive.” In arguing that enabling third-party data collection and disclosure was not “highly offensive,” UMG relies on In re iPhone Application Litig., 844 F. Supp. 2d 1040 (N.D. Cal. 2012), and Hammerling, 615 F. Supp. 3d 1060. But neither case involved a specific promise that users would not be tracked in specific ways. See In re iPhone, 844 F. Supp. 2d at 1049–50; Hammerling, 615 F. Supp. 3d at 1078–79. Likewise, although the court in Morilha v. Alphabet Inc., 2024 WL 5205542 (N.D. Cal. Dec. 23, 2024), concluded that “disclosure of IP addresses and geolocation data is not sufficiently ‘egregious’ to support an invasion of privacy claim,” id. at *4, plaintiffs here allege that a broader set of data was collected and disseminated, including interests and preferences, shopping behaviors, device information, referring URLs, session information, user identifiers, and/or geolocation data.” Similarly, in Jones v. Tonal Sys., Inc., 751 F. Supp. 3d 1025 (S.D. Cal. 2024), the court dismissed plaintiff’s claim because she “only allude[d] to the possibility that chat feature conversations could be ‘private and deeply personal’” and cited an inapposite study. Id. at 1043–44. In contrast here, plaintiffs have identified specific kinds of information that, in the aggregate and drawing all inferences in plaintiffs’ favor, plausibly allege that their tracking and disclosure of the information at issue was “highly offensive.” As UMG notes, the Ninth Circuit recently held in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025), that the plaintiff in that case had not established a concrete injury-in-fact for Article III standing purposes stemming from Microsoft’s “session-replay technology,” which enables businesses to track users’ browsing activity. The panel reasoned that the plaintiff had not established “how the tracking of her interactions … caused her to experience any kind of harm that is remotely similar to the ‘highly offensive’ interferences or disclosures that were actionable at common law.” Id. at 791. The Ninth Circuit suggested that “the kind of harm and not the degree” is relevant for determining whether an alleged injury-in-fact is concrete enough relative to a “specific common-law tort.” Id. Here, plaintiffs have adequately alleged a concrete injury-in-fact under Popa. The website owner in Popa did not indicate to users that it would not track their activities. See id. at 786–87. In contrast, UMG did. Wiley and Shah affirmatively opted out of advertising and analytics cookies, and UMG disregarded those choices. In other words, UMG made a misrepresentation to users about whether they would be tracked. UMG’s misrepresentations make the actions alleged here sufficiently “highly offensive” for an invasion of privacy or intrusion upon seclusion claim at the pleadings stage. The harm is similar to that addressed by the common law public-disclosure-of- private-facts tort, which prohibits the “public disclosure … of a private fact, … which would be offensive and objectionable to the reasonable person, and … which is not of legitimate public concern.” Taus v. Loftus, 40 Cal. 4th 683, 717 (2007). Though the tort has traditionally required that the private information be “publicized,” the specific inquiry into whether a disclosure is Article III injury in fact. Indeed, the Restatement (Second) of Torts, which Popa cited approvingly, see 153 F.4th at 791, explains that misrepresenting how private information will be used can constitute an invasion of privacy, see Restatement (Second) of Torts, § 652D cmt. C, illus. 11. Here, plaintiffs allege that UMG told them that their individual information would not be shared because they could opt out of unnecessary cookies, and yet it was. Plaintiffs have therefore sufficiently pleaded an injury-in-fact for purposes of Article III standing. For the foregoing reasons, UMG’s motion to dismiss plaintiffs’ intrusion upon seclusion and invasion of privacy claims is denied. C. Wiretapping California Penal Code § 631(a) prohibits: 1) “by means of any machine, instrument, or contrivance, or in any other manner, intentionally tap[ping] or mak[ing] any unauthorized connection … with any telegraph or telephone wire, line, cable, or instrument” 2) “willfully and without the consent of all parties to the communication, or in any unauthorized manner, read[ing], or attempt[ing] to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit” 3) “us[ing], or attempt[ing] to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained” and 4) “aid[ing], agree[ing] with, employ[ing], or conspir[ing] with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above….” UMG argues that plaintiffs have inadequately alleged a violation of Clause 2 because that provision applies only when a third party reads “the contents or meaning of any message, report, or communication” and only when it is “in transit.” Further, UMG argues that plaintiffs have failed to adequately plead a violation of Clauses 3 or 4 because a violation of those clauses depends in this case on a violation of Clause 2.3 And UMG argues that, even if plaintiffs have adequately pleaded that third parties violated CIPA, they have not pleaded that UMG aided those third parties because they have not alleged the requisite intent. Clause 2 of California Penal Code Section 631(a) prohibits “willfully and without the consent of all parties to the communication, or in any unauthorized manner, read[ing], or attempt[ing] to read, or to learn the content or meaning of any message, report, or communication while the same is in transit.” UMG argues that “contents” of communications were not intercepted and that, assuming they were, they were not intercepted while those contents were “in transit.” Interpreting a similar provision in the federal Electronic Communications Privacy Act of 1986, the Ninth Circuit has distinguished between the contents of a message—i.e., the “intended message conveyed by the communication” including “any information concerning the substance, purport, or meaning of a communication”—and “record information regarding the characteristics of the message that is generated in the course of the communication.” In re Zynga Priv. Litig., 750 F.3d at 1106–07 (citing 18 U.S.C. §§ 2511(3)(a), 2702(a), 2510(8)). Whether a particular form of information involves the “contents” of a communication as opposed to mere “record information,” depends on context. See id. For example, “a user’s request to a search engine for specific information could constitute a communication such that divulging a URL containing that search term to a third party could amount to disclosure of the contents of a communication.” Id. at 1108– 09; see also Brown v. Google, 685 F. Supp. 3d 909, 936 (N.D. Cal. 2023) (holding that “full-string detailed URLs” that indicate search queries can be “contents” under the Wiretap Act). Plaintiffs allege that third parties intercepted users’ “affirmative decisions, actions, choices, preferences, and activities, … including their browsing history, visit history, website interactions, user input data, demographic information, interests and preferences, shopping behaviors, device information, referring URLs, session information, user identifiers and/or geolocation data.” While many of these categories of information appear to involve record information rather than the contents of users’ communications, the alleged tracking of “website interactions,” “user input data,” “shopping behaviors,” and potentially “referring URLs” could convey, among other things, what users were searching for or what they wanted to do on UMG’s websites. Both types of information would likely entail queries or clicks from users and as a result Recovery Ctr. LLC, 2025 WL 2971090, at *4 (N.D. Cal. Oct. 17, 2025) (concluding that data suffices as content for the purposes of § 631 when it “conveys far more than basic identification and address information”). The problem with plaintiffs’ wiretapping claim, however, is that plaintiffs do not specifically allege that their communications were intercepted by any third parties. Plaintiffs repeatedly allege that UMG enabled third parties to track the information and communications of “Website users.” But with respect to their own interactions with UMG’s websites, plaintiffs allege only that they visited UMG’s websites and chose to “Decline All” advertising and analytics cookies. They do not allege that, in interacting with UMG’s websites, they personally engaged in any communications with the websites whose content could have been intercepted. Cf. Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1077, 1083 (C.D. Cal. 2021); Heerde v. Learfield Commc’ns, LLC, 741 F. Supp. 3d 849, 854–55, 861–62 (C.D. Cal. 2024); Brown v. Google LLC, 685 F. Supp. 3d at 936–39; St. Aubin v. Carbon Health Techs., Inc., 2024 WL 4369675, at *2 (N.D. Cal. Oct. 1, 2024); In re Google RTB Consumer Priv. Litig., 606 F. Supp. 3d 935, 949 (N.D. Cal. 2022). In the absence of any allegation that plaintiffs themselves interacted with the websites in a manner that involved communications whose contents could have been intercepted, they fail to plead the elements of a valid wiretapping claim. That claim will therefore be dismissed with leave to amend. D. Pen Register California Penal Code § 638.51(a) prohibits “install[ing] or us[ing] a pen register” without a court order under specific circumstances. Section 638.50(b) defines a “pen register” as “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” UMG first argues that California’s pen register law only applies to telephones. The text of the statute, however, contains no such limitation. Section 638.50’s definition does not limit “pen registers” to telephones, even though other sections of CIPA are expressly so limited. See Cal. Penal Code §§ 631(a), 632.7). This is a strong indication that UMG’s proposed limitation misconstrues the statute. UMG’s construction is also inconsistent with the California Legislature’s purpose in enacting CIPA. Given ambiguity in construing California state law, “California courts ‘determine the Legislature’s intent so as to effectuate the law’s purpose.’” In re Meta Pixel Tax Filing Cases, 793 F. Supp. 3d 1147, 1153 (N.D. Cal. 2025) (quoting Skidgel v. Cal. Unemp. Ins. Appeals Bd., 12 Cal. 5th 1, 14 (2021)). The California Legislature enacted CIPA and prohibited pen registers to “protect the right of privacy of the people of this state from what it perceived as a serious threat to the free exercise of personal liberties that cannot be tolerated in a free and civilized society,” as the California Supreme Court observed. Flanagan v. Flanagan, 27 Cal. 4th 766, 775 (2002) (cleaned up). CIPA’s purpose of protecting individuals’ privacy would be ill-served by limiting Section 638.51 to telephones in the absence of a strong textual basis for that limitation. In support of its argument that pen register claims only apply to telephones, UMG points to different statutory text and to CIPA’s legislative history. UMG notes that section 638.52(d), which establishes the required content of any judicial order permitting use of a pen register, requires specifying the “number and, if known, physical location of the telephone line to which the pen register … is to be attached….” Cal. Penal Code. § 638.52(d)(3). In UMG’s view, these references to telephone line-specific features demonstrate that the entire pen register statute applies only to telephones. This limited textual provision suggesting that pen registers generally involve telephones cannot trump the express statutory definition of pen register, which is not so limited. To the contrary, a fair reading of Section 638.52(d) would allow an officer seeking a judicial order for an online pen register to provide the equivalent of a “number” for the online device. The broader, more capacious definition of Section 638.50 applies to more devices than the later statutory sections might envision. The legislative history UMG cites also does not prove that pen register claims must involve telephones. While specific portions of the legislative history show that members of calls,” the language that it chose was not so limited. Again, if California sought to limit pen register claims to telephones, it knew how to do so and in fact did so in other sections of the statute. UMG also argues that because California law prohibits pen registers that record information “but not the contents of a communication,” the law cannot apply to devices that also collect the contents of a communication. This Court recently considered that argument and rejected it in In re Meta Pixel Tax Filing Cases, 793 F. Supp. 3d at 1152–55. UMG does not offer any arguments that lead the Court to reach a different conclusion here. For these reasons, plaintiffs have sufficiently pleaded that the cookies placed on certain users’ devices could amount to an unauthorized pen register. Once again, however, the problem with plaintiffs’ pen register claim is that they have not alleged that they ever communicated with the website. In the absence of any allegation that they communicated with the websites, they cannot allege that the “dialing, routing, addressing, or signaling information” relating to any such communication was unlawfully tracked. As with plaintiffs’ wiretapping claim, UMG’s motion to dismiss plaintiffs’ pen register claim is granted with leave to amend. Should plaintiffs choose to amend this claim, they must identify not only their communications with UMG’s websites but also the specific “dialing, routing, addressing, or signaling information” for outgoing communications that was tracked. E. Common law fraud, deceit, or misrepresentation UMG argues that plaintiffs’ common law fraud, deceit, or misrepresentation claim should be dismissed because plaintiffs fail to plead with requisite specificity the manner in which they were harmed by UMG’s allegedly fraudulent conduct. Common law fraud in California requires “(a) misrepresentation (false representation, concealment, or nondisclosure); (b) knowledge of falsity (or ‘scienter’); (c) intent to defraud, i.e., to induce reliance; (d) justifiable reliance; and (e) resulting damage.” Kearns v. Ford Motor Co., 567 F.3d 1120, 1126 (9th Cir. 2009) (emphasis removed). A state law fraud claim being pursued in federal court must also satisfy Federal Rule of Civil Procedure 9(b)’s particularity requirement by pleading “the who, what, when, where, and Rule 9(b) is to “provide defendants with adequate notice to allow them to defend the charge and deter plaintiffs from the filing of complaints as a pretext for the discovery of unknown wrongs.” Id. at 1125 (internal quotation marks omitted).4 Here, plaintiffs have inadequately pleaded the “when … of the misconduct alleged.” Id. at 1126. Plaintiffs allege only that they visited specific UMG websites at some unspecified point in the last four years and that, despite opting out of some cookies, UMG “nonetheless caused cookies and tracking technologies … to be placed on [plaintiffs’] device[s] and/or transmitted to the Third Parties along with user data, without [plaintiffs’] knowledge.” This level of generality fails to provide UMG with notice of the misconduct alleged. UMG cannot, for example, determine what specific representations regarding cookies were made on UMG websites on the specific dates that Shah and Wiley visited those websites or determine how the websites were using any cookies placed on users’ devices on those specific dates. See, e.g., Kearns, 567 F.3d at 1126 (concluding that the plaintiff had not satisfied Rule 9(b) when he failed to plead “when he was exposed to” the television advertisements at issue or to “specify … when [an allegedly fraudulent] statement was made”). Because plaintiffs’ allegations do not satisfy Rule 9(b), UMG’s motion to dismiss plaintiffs’ common law fraud, deceit, or misrepresentation claim is granted with leave to amend. F. Unjust enrichment UMG argues that plaintiffs’ unjust enrichment claim fails because unjust enrichment is not a standalone cause of action, because such a remedy only applies in the absence of a contract (which plaintiffs argue exists), and because there was no misrepresentation or omission. On each of these arguments, UMG is incorrect. First, while California does not have a standalone cause of action called “unjust 4 As UMG notes, if a party alleges a “unified course of fraudulent conduct and rel[ies] entirely on that course of conduct as the basis” for their claim, the “pleading … as a whole must satisfy the particularity requirement of Rule 9(b).” Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir. 2009). Contrary to UMG’s argument, however, Rule 9(b) does not apply to plaintiffs’ “pleading as a whole.” Id. While plaintiffs’ suit is based in part on UMG’s allegedly false promise not to enable third parties to track users, none of their claims other than their fraud claim rely “entirely” upon that course of conduct. Id. Instead, the other claims focus primarily on privacy-related harms resulting from the information gathering that was enabled by the cookies placed on plaintiffs’ enrichment,” “[w]hen a plaintiff alleges unjust enrichment, a court may construe the cause of action as a quasi-contract claim seeking restitution.” Astiana v. Hain Celestial Grp., Inc., 783 F.3d 753, 762 (9th Cir. 2015) (cleaned up); see also Hartford Cas. Ins. Co. v. J.R. Mktg., L.L.C., 61 Cal. 4th 988, 998 (2015). Second, though plaintiffs allege contractual claims, plaintiffs have not plausibly pleaded the existence of a contract, for the reasons explained below. And third, plaintiffs have plausibly pleaded the existence of a misrepresentation or omission because plaintiffs allege that UMG’s “representations that consumers could ‘Decline All’ or toggle off all ‘Online Advertising’ and ‘Performance Analytics’ cookies while Plaintiff Shah and users browsed the Websites, or at least those involved in providing personalized content, advertising, and analytics services, were untrue.” A defendant who unjustly enriches itself “may be required to make restitution[.]” Hartford Cas. Ins., 61 Cal. 4th at 998. “[T]he obligation arises when the enrichment obtained lacks any adequate legal basis and thus ‘cannot conscientiously be retained.’” Id. (quoting Restatement (3d), Restitution and Unjust Enrichment, § 1 cmt. B, p. 6). Plaintiffs have alleged that UMG misled them as to the effect of opting out of certain cookies and that the resulting data collection was valuable because it enabled UMG to better market artists, better target advertisements, and better profit from its understanding of users’ behaviors. Because plaintiffs have thus adequately alleged a cause of action for unjust enrichment, UMG’s motion to dismiss that claim is denied. G. Breach of Contract UMG argues that plaintiffs’ breach of contract claim should be dismissed because plaintiffs did not form a contract with UMG. All enforceable contracts require consideration, which means “[a]ny benefit conferred, or agreed to be conferred, upon the promisor, by any other person, to which the promisor is not lawfully entitled, or any prejudice suffered, or agreed to be suffered, by such person other than such as he is at the time of consent lawfully bound to suffer,” Cal. Civ. Code § 1605; see Godun v. JustAnswer LLC, 135 F.4th 699, 708 (9th Cir. 2025) (“Because contract formation is a question of state law, we first look to the appropriate state that a party must “confer (or agree to confer) a benefit or must suffer (or agree to suffer) prejudice,” and, second, that the benefit or prejudice “must have induced the promisor’s promise.” Steiner v. Thexton, 48 Cal. 4th 411, 420–21 (2010). Plaintiffs have not adequately alleged the existence of a contract because they have not pleaded that there was a bargained-for exchange. Plaintiffs argue that the benefit they conferred on UMG was “surrender[ing] more data than they bargained for and that such data is valuable.” But plaintiffs do not allege that they “bargained” for less tracking as opposed to having merely indicated their preference for less tracking. To the contrary, plaintiffs received the same access to UMG’s website whether or not they consented to additional cookies. While plaintiffs may have alleged that UMG broke a promise, they have not alleged that the benefit plaintiffs conferred on UMG induced UMG’s promise. Because plaintiffs have not adequately alleged that they formed a contract with UMG, UMG’s motion to dismiss that claim is granted with leave to amend. H. Breach of the Implied Covenant of Good Faith and Fair Dealing The implied covenant of good faith and fair dealing exists in every contract and requires “that no party to the contract will do anything that would deprive another party of the benefits of the contract” and functions to “protect[] the reasonable expectations of the contracting parties based on their mutual promises.” Digerati Holdings, LLC v. Young Money Ent., LLC, 194 Cal. App. 4th 873, 885 (2011) (citing, among other cases, Wilson v. 21st Century Ins. Co., 42 Cal. 4th 713, 720 (2007), and Carma Developers (Cal.), Inc. v. Marathon Dev. Cal., Inc., 2 Cal. 4th 342, 373–74 (1992)). The implied covenant, however, applies only to existing contracts. See Guz v. Bechtel Nat’l Inc., 24 Cal. 4th 317, 349–50 (2000). Because plaintiffs did not form a contract with UMG, plaintiffs cannot plead a breach of the implied covenant of good faith and fair dealing. UMG’s motion to dismiss the breach of the implied covenant of good faith and fair dealing is therefore granted with leave to amend. I. Trespass to Chattels Finally, UMG argues that plaintiffs have failed to state a claim for trespass to chattels because they have not plausibly alleged damage to their property. Under California law, a interfere[] with plaintiff’s possessory interest,” and the trespass “proximately resulted in damage” that “impaired the condition, quality, or value of the personal property.” Bui-Ford v. Tesla, Inc., 2024 WL 694485, at *7 (N.D. Cal. Feb. 20, 2024) (citing California state decisions). Plaintiffs have failed to plausibly allege the second requirement—that UMG “impaired the condition, quality, or value of [their] personal property.” Plaintiffs argue that the cookies impaired their devices by damaging their security and “by taking up storage space.” In Intel Corp. v. Hamidi, 30 Cal. 4th 1342 (2003), however, the California Supreme Court said that a trespass-to- chattels plaintiff must “demonstrate some measurable loss from the use of [their] computer system,” observing as relevant whether a defendant caused “any physical or functional harm or disruption.” Id. at 1357, 1360. Here, plaintiffs have not plausibly alleged physical, functional, or other “measurable loss” from the involuntary placement of cookies on their devices. UMG’s motion to dismiss the trespass-to-chattels claim is therefore granted with leave to amend. II. Motion to Strike Federal Rule of Civil Procedure 12(f) allows striking “any redundant, immaterial, impertinent, or scandalous matter.” Matter is “immaterial” if it “has no essential or important relationship to the claim for relief or the defenses being pleaded” and is “impertinent” if it “consists of statements that do not pertain, and are not necessary, to the issues in question.” Fantasy, Inc. v. Fogerty, 984 F.2d 1524, 1527 (9th Cir. 1993) (quoting 5 Charles A. Wright & Arthur R. Miller, Fed. Prac. & Proc. § 1382, at 706–07, 711 (1990)), rev’d on other grounds, 510 U.S. 517 (1994). UMG moves to strike certain screenshots plaintiff included in their complaint as well as the multiple UMG websites they have listed. Those allegations, however, are not immaterial or impertinent. The screenshots satisfy Rule 12(f) because, if properly authenticated, they show that UMG continued to track users after users opted out of advertising or analytics cookies. The list of websites identifies other UMG websites that may track users in similar ways because of UMG’s actions. While UMG points out that plaintiffs do not say that the undated screenshots in question are from plaintiffs’ own devices or experiences, the screenshots could later be verified as 1 an illustration of what happened when plaintiffs attempted to opt out of tracking. 2 UMG also argues that plaintiffs’ class allegations should be stricken because plaintiffs’ 3 pleadings are inappropriately broad and untimely. Class allegations can be evaluated at the 4 pleading stage, but their deficiencies should be “plain enough from the pleadings.” See Gen. Tel. 5 Co. of the Sw. v. Falcon, 457 U.S. 147, 160 (1982). UMG’s criticisms of plaintiffs’ class pleadings 6 and class definition are not so plain as to warrant striking them at this stage. UMG may raise its 7 arguments about plaintiffs’ proposed class definition at a later stage. 8 Accordingly, UMG’s motion to strike is denied in its entirety. 10 For the foregoing reasons, UMG’s motion to dismiss is denied in part and granted in part. 11 UMG’s motion to dismiss plaintiffs’ intrusion upon seclusion, invasion of privacy, and unjust a 12 enrichment claims is denied. UMG’s motion to dismiss plaintiffs’ CIPA wiretapping, CIPA pen 13 register, common law fraud, breach of contract, breach of the implied covenant of good faith and S 14 || fair dealing, and trespass to chattels claims is granted with leave to amend. Plaintiffs must file any 3 15 amended complaint within 28 days. Failure to file an amended complaint will result in the 16 dismissal with prejudice of the claims dismissed in this order. UMG’s motion to strike is denied. IT IS SO ORDERED. 5 1g || Dated: December 17, 2025 19 20 Maybe P. Casey Pitts 21 United States District Judge 22 23 24 25 26 27 28