Christine Wiley, et al. v. Universal Music Investments, Inc.

Opinion

CHRISTINE WILEY, et al., Case No. 25-cv-03095-PCP

Plaintiffs, ORDER GRANTING DEFENDANT’S v. MOTION TO DISMISS IN PART

UNIVERSAL MUSIC INVESTMENTS, Re: Dkt. Nos. 48, 49, 54 INC., Defendant.

Defendant Universal Music Investments, Inc. (UMI) moves to dismiss Christine Wiley and Vishal Shah’s amended complaint alleging that UMI violated their privacy rights by placing certain cookies on their devices even though they had expressly opted out of receiving such cookies. For the reasons stated below, UMI’s motion to dismiss is granted in part. The Court previously granted in part and denied in part UMI’s motion to dismiss plaintiffs’ first complaint. See Wiley v. Univ. Music Grp., Inc., 826 F. Supp. 3d 1121 (N.D. Cal. 2025).1 The Court held that plaintiffs had stated claims for intrusion upon seclusion, invasion of privacy, and unjust enrichment. The Court held that plaintiffs had not pleaded valid claims for unlawful wiretapping, unlawful use of a pen register, common law fraud, breach of contract, breach of the implied covenant of good faith and fair dealing, or trespass to chattels. Plaintiffs thereafter filed an amended complaint adding facts and re-pleading their claims for invasion of privacy, intrusion upon seclusion, unlawful wiretapping, unlawful use of a pen

1 The Court’s previous order provides further background on the facts of the case. For the register, and unjust enrichment. The amended complaint does not include claims of common law fraud, breach of contract, breach of the implied covenant of good faith and fair dealing, or trespass to chattels. See Dkt. Nos. 42, 42-1. Plaintiffs’ amended complaint alleges that UMI’s websites each “include search bars and other input fields which users enter information” with the “inten[t] to communicate the contents of their search directly to the Websites.” Amended Complaint ¶¶ 39, 41. UMI allegedly “programmed the Websites so that the contents of those communications are intercepted by the Third Parties while the communications are in transit between the user’s browser and the Websites.” Amended Complaint ¶ 42. One such website included the Post Malone website, which allegedly caused users’ data and metadata to be “transmitted to Meta.” Amended Complaint ¶¶ 44, 46–50. Plaintiffs also plead more information about their experiences with defendant’s websites. They allege that Shah browsed postmalone.com and imaginedragonsmusic.com on March 15, 2024, and clicked on links for concert tour dates and merchandise. Amended Complaint ¶¶ 98, 102, 103. They allege that Wiley visited universalmusic.com, nickiminajofficial.com, and icespicemusic.com on five different days in 2021 to 2024.2 Wiley allegedly “interacted with the Websites by searching for and viewing specific content including merchandise,” and she lists specific URLs that she visited, which allegedly “caused the transmission of full string URLs to” third parties. Amended Complaint ¶ 112. Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include a “short and plain statement of the claim showing that the pleader is entitled to relief.” Federal Rule of Civil Procedure 12(b)(6) allows a defendant to move to dismiss a complaint for failure to state a claim upon which relief can be granted. Dismissal is required if the plaintiff fails to allege facts allowing the Court to “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). In considering a Rule 12(b)(6) motion, the Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable” to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029-30 (9th Cir. 2009). While legal conclusions “can provide the [complaint’s] framework,” the Court will not assume they are correct unless adequately “supported by factual allegations.” Iqbal, 556 U.S. at 679. Courts do not “accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quoting Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)). I. Plaintiffs’ claims are timely. UMI argues that plaintiffs, by pleading more specific dates on which they visited UMI’s websites, “have pleaded themselves out of their claims” because those specific dates fall outside of the statute of limitations. Motion to Dismiss at 7. Plaintiff Shah pleads that he visited postmalone.com and imaginedragonsmusic.com “during the last four years, including, in or around March 15, 2024.” Amended Complaint ¶ 98. The statute of limitations for CIPA claims is one year, so Shah needed to file his claim by March 15, 2025. Plaintiffs filed their initial complaint on April 4, 2025. Dkt. No. 1. Therefore, UMI argues, Shah’s CIPA claims are untimely. Motion to Dismiss at 8. UMI also argues that Shah and Wiley’s unjust enrichment claims are untimely because they base their unjust enrichment claims on an alleged violation of CIPA, such that the one-year CIPA statute of limitations applies. In support, UMI cites Al-Ahmed v. Twitter, Inc., 648 F. Supp. 3d 1140, 1155 n.1 (N.D. Cal. 2023), which observed that “[t]he statutes of limitations for unjust enrichment, promissory estoppel, and civil conspiracy are based on the underlying wrong.”3 Finally, UMI argues that plaintiff Wiley’s CIPA, common law privacy, and unjust enrichment claims are untimely because she alleges that she visited universalmusic.com “during the last four years, including on July 15, 2021,” at the earliest, and nickminajofficial.com during the last four years including on December 28, 2023. Motion to Dismiss at 9; Amended Complaint ¶ 108. Thus, UMI argues, Wiley’s CIPA claims had to be filed by July 15, 2022, and December 28, 2024, and her privacy claims expired in 2024 at the latest, all months before plaintiffs filed their initial complaint in April 2025. Because the statute of limitations is “generally an affirmative defense,” statutes of limitations do not provide a basis for dismissal under Rule 12(b)(6) unless plaintiffs have pleaded themselves out of a claim by “admit[ing] all the ingredients of an impenetrable defense.” Id. at 1130–31 (quoting Durnford v. MusclePharm Corp., 907 F.3d 595, 604 n.8 (9th Cir. 2018)). Where the defendant moves to dismiss a claim as untimely under the applicable statute of limitations, the motion can be granted “only when ‘the running of the statute is apparent on the face of the complaint.’” Von Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 969 (9th Cir. 2010) (quoting Huynh v. Chase Manhattan Bank, 465 F.3d 992, 997 (9th Cir. 2006)). Here, as with plaintiffs’ previous complaint, plaintiffs’ complaint does not admit the ingredients of an impenetrable statute of limitations defense. “The face of the complaint,” Huynh, 465 F.3d at 997, establishes that plaintiffs visited the UMI websites in question as some point during the “last four years” which could include the last one or two years, “so it is entirely possible, from the face of the complaint, that Wiley’s claims are timely.” Wiley, 826 F. Supp. 3d at 1131. UMI argues that the broad language about plaintiffs visiting UMI websites within the “last

3 Notably, the case Al-Ahmed relied upon as to the unjust enrichment statute of limitations, Duke Gerstel Shearer, LLP v. Pursiano, 2012 WL 4712102, at *5 (Cal Ct. App. Oct. 4, 2012), concluded that the statute of limitations based on a quasi-contract “underlying wrong” was two years, citing Cal. Code of Civ. Proc. § 339(1). Given that unjust enrichment is often thought of as a quasi-contract type of claim, it may well be that plaintiffs’ claim is subject to this two-year four years” should be disregarded in favor of the more specific dates plaintiffs have included. Motion to Dismiss at 7. But UMI does not provide binding authority establishing such a rule for interpreting pleadings, and doing so would be at odds with the liberal pleading standards of the Federal Rules. Even assuming that the more general visit allegation should be discarded, plaintiffs have pleaded an entitlement to tolling under the doctrine of fraudulent concealment. At the pleadings stage, the Court considers “whether the complaint, liberally construed in light of our ‘notice pleading’ system, adequately alleges facts showing the potential applicability of the … tolling doctrine.” Cervantes v. City of San Diego, 5 F.3d 1273, 1277 (9th Cir. 1993). “The doctrine of fraudulent concealment tolls the statute of limitations where a defendant, through deceptive conduct, has caused a claim to grow stale.” Aryeh v. Canon Bus. Sols., Inc., 55 Cal. 4th 1185, 1192 (2013). “A plaintiff alleging fraudulent concealment must establish that its failure to have notice of its claim was the result of affirmative conduct by the defendant.” Conmar Corp. v. Mitsui & Co. (U.S.A.), Inc., 858 F.2d 499, 505 (9th Cir. 1988). UMI argues that the heightened pleading standard of Federal Rule of Civil Procedure 9(b) applies to the fraudulent concealment doctrine. Reply at 5. In support UMI cites Thibodeaux v. Teamsters Local 853, 263 F. Supp. 3d 772, 778 (N.D. Cal. 2017). Thibodeaux in turn relied on the Ninth Circuit’s decision in Conmar Corp. v. Mitsui & Co., 858 F.2d 499. But Conmar did not establish that heightened pleading standards apply to the fraudulent concealment doctrine; indeed, it did not have occasion to address those standards because the case was on appeal from a grant of summary judgment in the defendant’s favor. Id. at 500. Fraudulent concealment is different from a fraud cause of action because the “doctrine of fraudulent concealment applies to any type of case, not just civil actions for fraud ….” Cmty. Cause v. Boatwright, 124 Cal. App. 3d 888 (1981). Because fraudulent concealment is not a standalone cause of action or a component of such a cause of action, Rule 9(b) does not apply. See Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1103–04 (9th Cir. 2003). Here, plaintiffs have pleaded facts that give rise to a plausible inference of fraudulent essential cookies. Based on plaintiffs’ complaint, users of UMI websites would not have had any reason to know they were being misled as to the fact that cookies would be placed on their devices even if they declined non-essential cookies. Both named plaintiffs allege that they do “not know how the [UMI] Websites are programmed, which can change over time, and because [they] do[] not have the technical knowledge necessary to test whether the Websites honor[] users’ requests to decline all cookies and tracking technologies….” Complaint ¶¶ 107, 116. Thus, plaintiffs have not pleaded themselves out of the fraudulent concealment doctrine, and their claims establish a potential entitlement to such tolling. UMI’s motion to dismiss on timeliness grounds is therefore denied. II. Plaintiffs again fail to state a valid CIPA wiretapping claim. UMI moves to dismiss plaintiffs’ wiretapping claim, arguing that plaintiffs again have not plausibly pleaded that third parties violated Clause 2 of Section 631(a), which is a predicate for UMI’s alleged violations of Clauses 3 and 4. Clause 2 of California Penal Code section 631(a) prohibits any person from “read[ing], or attempt[ing] to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit.” “Contents” refers to the substance or “intended message conveyed” by a communication, rather than “record” or routing information associated with the communication. Cf. In re Zynga Priv. Litig., 750 F.3d 1098, 1106, 1108–09 (9th Cir. 2014) (distinguishing the “contents” of a communication from record information and explaining that a URL containing a search term may constitute content, whereas one that “includes only basic identification and address information” does not); Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1082–83 (C.D. Cal. 2021) (finding that Section 631(a) protects the substantive content of communications, not routine identifying information such as “keystrokes, mouse clicks, pages viewed, and shipping and billing information . . . [and] the date and time of the visit, the duration of the visit, Plaintiff’s IP address, her location at the time of the visit, her browser type, and the operating system on her device”). Plaintiffs’ amended complaint, unlike their original complaint, adequately alleges that after selecting a Post Malone tour date and browsing merchandise, third parties received descriptive full-string URLs reflecting the webpages he visited along with “session information, user identifiers, device information, button interactions and events, referring and clicked full-string URLs, and geolocation data.” FAC ¶¶ 102–03. Plaintiffs further allege that third parties intercepted “full string URLs and buttons indicative of specific interests” associated with Shah. FAC ¶ 105. Wiley similarly alleges that, after clicking merchandise links, third parties received “full string URLs” identifying the merchandise and topics she viewed, together with “session information, user identifiers, device information, button interactions and events, referring and clicked full-string URLs, and geolocation data.” FAC ¶ 112. Plaintiffs further allege that the websites transmitted “communications” containing “the specific URLs requested and the information encoded within them,” and they identify as examples URLs corresponding to merchandise pages and event pages. FAC ¶¶ 160–61. Having adequately alleged that their activity was intercepted, plaintiffs still fail to plead that the “contents” of any of their “communications” with the websites were intercepted. Plaintiffs expressly exclude user-input search queries from the allegedly intercepted information and instead identify descriptive full-string URLs corresponding to webpages they visited. FAC ¶ 105. The amended complaint’s examples of the allegedly intercepted communications consist of URLs identifying product pages and event pages, together with “session information, user identifiers, device information, button interactions and events, referring and clicked full-string URLs, and geolocation data.” FAC ¶¶ 102–03, 112, 160–61. Although plaintiffs repeatedly characterize those URLs as “content-bearing communications,” the factual allegations identify webpage addresses and associated browsing information, not any communication between a plaintiff and the website. In the Court’s previous order, the Court acknowledged that tracking and sharing “what users were searching for or what they wanted to do on UMG’s websites” could involve the contents of communications. 826 F. Supp. 3d at 1135–36. But plaintiffs have only alleged that they visited particular websites, not that they communicated anything in particular to those websites. Plaintiffs therefore fail to plausibly allege interception of the “contents or meaning of any message, report, 5:25-cv-03085-PCP, 2026 WL 2653811, at *3 (N.D. Cal. Sept. 8, 2026) (finding allegations regarding interception of plaintiffs’ search inquiries sufficient to state claim). UMI’s motion to dismiss plaintiffs’ CIPA claim is therefore granted. III. Plaintiffs fail to state a claim for unlawful use of a pen register. California Penal Code § 638.51(a) prohibits “install[ing] or us[ing] a pen register” without a court order under specific circumstances. Section 638.50(b) defines a “pen register” as “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” As with their wiretapping claim, plaintiffs’ pen register claims fail to allege that any “dialing, routing, addressing, or signaling information” associated with a “communication” was recorded or decoded. As noted above, plaintiffs do not allege that they were communicating an express or implied message to the websites they visited. Instead, they allege primarily that their visits and browsing activity of clicking links and other buttons for merchandise or tickets constituted “communications.” See Amended Complaint ¶¶ 102, 103, 112, 161. While recording users’ visits to websites may provide a close analogy to a physical pen register, mere browsing activity is not analogous to a phone call because phone calls are communicative actions while browsing, absent further allegations establishing dialogic communications, generally is not. Accordingly, the Court again grants UMI’s motion to dismiss plaintiffs’ pen register claim. IV. Plaintiffs have alleged Article III standing. Finally, UMI for the second time moves to dismiss plaintiffs’ amended complaint for lack of Article III standing, again invoking the Ninth Circuit’s recent decision in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). Motion to Dismiss at 16–19. UMI argues that Popa requires the Court to look at the “nature,” or “type,” of the data collected and determine “whether it plausibly gives rise to a cognizable privacy injury.” Motion to Dismiss at 17. Popa, UMI argues, concluded that the plaintiff there failed to plead standing because he did not allege “embarrassing, invasive, or otherwise private information [was] collected.” 153 F.4th at 791. UMI argues that collected.” Id. As the Court noted in its previous order, see 826 F. Supp. 3d at 1133, whether a particular invasion or intrusion of privacy was “highly offensive” is a mixed question of law and fact, see Hill v. NCAA, 7 Cal. 4th 1, 40 (1994), that often “cannot be resolved at the pleading stage,” see In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 606 (9th Cir. 2020). “Deceit can be a kind of ‘plus’ factor” in determining whether an action is highly offensive.” See In re Google Location Hist. Litig., 514 F. Supp. 3d 1147, 1157 (N.D. Cal. 2021) (quoting Heeger v. Facebook, Inc., 2019 WL 7282477, at *4 (N.D. Cal. Dec. 27, 2019); McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022, 1036 (N.D. Cal. 2019)). As the Court concluded previously, plaintiffs have adequately alleged Article III standing by pleading that UMI’s invasion was “highly offensive” because it both involved the disclosure of personal browsing information that could indeed be “embarrassing, invasive, or otherwise private” and involved deceit. Popa, 153 F.4th at 791; Wiley, 826 F. Supp. 3d at 1134 (noting that the “website owner in Popa did not [affirmatively] indicate to users that it would not track their activities”) (citing Popa, 153 F.4th at 786–87). Accordingly, UMI’s motion to dismiss for lack of standing is again denied. V. Requests for Judicial Notice UMI requests judicial notice of two documents under Federal Rule of Evidence 201: Universal Music Group’s Privacy Policy, and excerpts of a transcript of a California Assembly Public Safety Committee Meeting. Dkt. Nos. 49, 54. UMI argues that these documents are judicially noticeable because they are available publicly and not subject to reasonable dispute. The Court takes notice of the existence and contents of these documents but will not draw other conclusions or inferences from them. For the reasons stated above, the Court concludes that plaintiffs have alleged Article III standing and their claims may be timely. The Court therefore denies the motion to dismiss plaintiffs’ invasion of privacy, intrusion upon seclusion claims, and unjust enrichment claims on ] with prejudice and without further leave to amend because the plaintiffs have already been 2 provided with one opportunity to amend those claims and have nonetheless failed to state valid 3 CIPA claims. UMI’s requests for judicial notice are granted. 4 5 7 Dated: September 14, 2026 8

P. Casey Pitts 10 United States District Judge 11 a 12

13 14

15 16

Z 18 19 20 21 22 23 24 25 26 27 28