Ethan Allison v. PHH Mortgage

Opinion

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA

ETHAN ALLISON, Case No. 25-cv-05323-RFL

Plaintiff, AMENDED ORDER GRANTING IN v. PART MOTION TO DISMISS

PHH MORTGAGE, Re: Dkt. No. 18 Defendant.

I. INTRODUCTION Plaintiff Ethan Allison brought this putative class action against Defendant PHH Mortgage, alleging that PHH secretly configured and implemented code-based tracking devices into its website that disclosed his and other users’ personal and financial information without their knowledge or consent. Allison’s complaint asserts eleven claims under federal and state law. (Dkt. No. 1 (“Compl.”).) PHH now moves to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (Dkt. No. 18.) For the reasons that follow, PHH’s motion to dismiss is GRANTED IN PART AND DENIED IN PART with leave to amend. II. BACKGROUND The facts detailed below are based on the allegations contained in the complaint, the truth of which the Court accepts for purposes of resolving the motion to dismiss. See Boquist v. Courtney, 32 F.4th 764, 772 (9th Cir. 2022). A. phhmortgage.com PHH, a subsidiary of Onity Group Inc.,1 is a mortgage lender and servicer that “offers industry-leading mortgage solutions for the entire mortgage lifestyle including correspondent lending, MSR/Co-Issue, subservicing, commercial servicing, reverse mortgages and portfolio retention.” (Compl. ¶¶ 17, 23.) PHH provides services both in the United States and globally via its website, https://www.phhmortgage.com. (Compl. ¶ 2.) The website “allows users to explore various services relating to their mortgages and home loans, including refinancing, home purchasing, applying for pre-approval, loan applications and loan approval.” (Compl. ¶ 26.) On the website, “customers can, among other things, apply for loans, use an online loan calculator, request callbacks from PHH to apply for a loan, and navigate to libertyreversemortgage.com . . . to learn about and apply for reverse mortgages.” (Compl. ¶ 2.) B. PHH’s Alleged Collection and Sharing of User Data PHH allegedly installed trackers on its website “purposely and secretly . . . to gather and share information about Customers.” (Compl. ¶ 28.) These are “code-based tracking devices” made by third parties such as Google, HotJar, Microsoft, Yahoo, and Blend/Sentry.io. (Compl. ¶¶ 3, 28, 39, 49.) “When an individual accesses a webpage containing online tracking technology . . . the trackers instantaneously and surreptitiously duplicate communications with that webpage and send the[m] to the Third party. The information travels directly from both the user’s browser and the webpage owner’s server and then on to the Third Party’s server, based off instructions from the Third Party’s tracker.” (Compl. ¶ 32.) Crucially, the trackers “may not be deleted from an individual’s device” because “they are built into a webpage,” over which a customer does not have control. (Compl. ¶ 33.) By way of example, PHH allegedly shares users’ pre-approval application activities with Google and Blend/Sentry, a third-party application processor that PHH uses to process pre-

1 At the time the complaint was filed, PHH had announced that it was changing its name to Onity Mortgage, which was to be established as a “doing business as” of PHH Mortgage. (Compl. ¶ 17 n.7.) The Court takes judicial notice of the fact that in line with its prior announcement, PHH has since changed its name to Onity Mortgage. See Fed. R. Evid. 201. This order continues to refer to Defendant as “PHH” to avoid confusion. approval loan applications. (Compl. ¶¶ 43, 58, 62.) First, PHH informs Google when a user is starting a pre-approval application. “PHH sends events to Google informing it that [a] user is on a page entitled ‘Get Pre-Approved | PHH Mortgage’” and then “sends another set of events informing it that the user is on a page with the URL, ‘https://www.phhmortgage.com/Get- started.’” (Compl. ¶ 60.) PHH also “discloses users’ scrolling details on the ‘Get-started’ page,” for example, revealing that a user scrolled a certain percentage of the way through the page. (Compl. ¶ 61.) And PHH discloses to Blend/Sentry when user is creating an account on PHH, whether they have a coborrower, whether they own real estate, and whether they are applying for a purchase rather than a refinance. (Compl. ¶¶ 63–64.) As another example, PHH allegedly discloses information to third parties such as Google concerning customers’ equity and refinancing loan applications, including the fact that they applied for these types of loans. (Compl. ¶ 65.) PHH informs Google when users are on the page for “Get Cash Out of Your Equity | PHH Mortgage” and when the user navigates to the page for PHH’s cash out refinancing product.” (Compl. ¶¶ 67–68.) PHH also reports to Google when users start filling out the form to begin an equity loan or cash-out refinancing loan application and that users have submitted their applications for these loans. (Compl. ¶ 70–72.) As a result of the trackers PHH installed on its website, PHH has “transmitted Customers’ communications with PHH’s website and thus their Personal and Financial Information to . . . Third Parties without Customers’ knowledge or authorization. This information included their browsing activities including the pages they viewed and the buttons they clicked; the user’s status as a customer; the user’s browsing activities, including that the user clicked certain buttons and what URLs or webpages they led to; loan application activities, such as that a user is applying for a loan or mortgage; Customers’ use of PHH’s online loan calculator; when a Customer requested a callback from PHH to apply for a loan; and disclosures about users’ activities on the Liberty Website when users browse pages about reverse mortgages.” (Compl. ¶ 46.) The trackers also allow PHH to track and share data capable of identifying a particular user and tracking them across websites, such as “users’ IP addresses, cookies, and ‘browser fingerprints.’” (Compl. ¶ 38.) PHH allegedly uses “the information it collect[s] to market its services and bolster its profits by surreptitiously diverting the information to Third Parties like Google and Facebook.” (Compl. ¶ 29.) By collecting and sharing user information with third parties, PHH is able to “save costs on its marketing campaigns, improve its data analytics, attract new customers, and generate sales.” (Compl. ¶ 4.) Armed with this information, third parties can “more effectively create, manage and grow high-impact digital marketing campaigns.” (Compl. ¶ 38.) Third parties also “act as data brokers, meaning they collect data, compile it into datasets, and sell it to” other parties—i.e., fourth parties—who can in turn use the information for their own purposes. (Compl. ¶ 114.) Thus, third parties are not only able to use PHH users’ information for their own benefit, but they are also able to share this data to “benefit fourth parties who are even further removed from the Customers.” (Compl. ¶ 30.) C. PHH’s Privacy Representations PHH’s privacy representations are contained in a group of “Privacy Contracts” comprising Onity Group’s Privacy and Security Policy, California Consumer Privacy Act (“CCPA”) Disclosure, Terms & Conditions, and Privacy Notice. (Compl. ¶ 90.)2 The Privacy Contracts, which are contained on various sections of Onity Group’s website, explain Onity and its subsidiaries’ practices for “collecting, using, maintaining, protecting, and disclosing” user information, as well as users’ rights regarding their data. (Compl. ¶¶ 91–96.) Privacy and Security Policy. Per its own characterization, the Privacy and Security Policy “describes the types of information PHH . . . may collect from [users] offline or when [they] visit [PHH’s] websites . . . and [PHH’s] practices for collecting, using, maintaining, protecting, and disclosing that information.” (Dkt. No. 1-1 at 3.)3

2 Because the Privacy Contracts are attached to the complaint and incorporated by reference in the complaint, they are properly considered when deciding PHH’s motion to dismiss. See UFCW Loc. 1500 Pension Fund v. Mayer, 895 F.3d 695, 698 (9th Cir. 2018). 3 All references to page numbers in documents on the docket refer to ECF pagination. With regard to data collection, the Privacy and Security Policy discloses that PHH collects “several types of information from and about” its users, including (a) information provided by users such as “name, address, email address, telephone number, social security number, education, employment, financial information, . . . assets and liabilities, income, username/password, . . . internet protocol address, and other personally identifying information”; (b) information provided by “affiliates” such as users’ “loan approval amount[s], loan balance[s], payment histor[ies] and other loan account information from businesses within the PHH Mortgage Corporation Family”; and (c) “[i]nformation collected automatically as [users] navigate through the Website[, including] . . . usage details . . . and inforamtion [sic] collected through cookies for advertisements.” (Dkt. No. 1-1 at 3–4.) With regard to data use, the Privacy and Security Policy states that PHH uses the information it collects or receives to, among other things, “work with marketing partners to provide [users] with products or services that may be of interest” and “to report aggregated information to [its] advertisers and to audit use of the Website.” (Dkt. No. 1-1 at 4.) The Policy also indicates that PHH may disclose the information it collects or receives to “contractors, service providers, and other third parties [PHH] use[s] to support [its] business” and “to retailers and other third parties to market to [users]” subject to PHH’s Privacy Notice. (Dkt. No. 1-1 at 4– 5.) Privacy Notice. Onity’s Privacy Notice provides additional explanation to users regarding what PHH does with their personal information. (Dkt. No. 1-4.) The Privacy Notice discloses that PHH can share users’ personal information for various purposes including “for non-affiliates to market to [them],” and defines non-affiliates as financial and nonfinancial “[c]ompanies not related by common ownership or control.” (Dkt. No. 1-4 at 2, 4.) CCPA Disclosure. Onity’s CCPA Disclosure “applies solely to California residents” who are not “consumer[s] or customer[s] of personal, household, or family financial products or services,” and “explains how Onity Group Inc. and its subsidiaries and affiliates, including PHH Mortgage Corporation and its subsidiaries and affiliates (collectively ‘PHH’, ‘us’, ‘our’, or ‘we’) collect, use, disclose, and/or retain personal information (‘Information Practices’) subject to the California Consumer Privacy Act (‘CCPA’).” (Dkt. No. 1-2 at 2.) The CCPA Disclosure contains a “Notice at Collection” that “identifies the categories of personal information to be collected from [users] and the purposes for which the personal information will be used.” (Dkt. No. 1-2 at 2.) Among the categories of “General Personal Information” that are identified is “Internet or Other Similar Network Activity,” which includes “information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.” (Dkt. No. 1-2 at 4.) The Notice does not disclose that this information is being collected for marketing purposes. (Dkt. No. 1-2 at 4.) The CCPA Disclosure also contains a “California Privacy Policy” which describes “online and offline practices” regarding user information and users’ “rights as they related to . . . collection and use of . . . personal information.” (Dkt. No. 1-2 at 6.) While the California Privacy Policy lists categories user information disclosed to third parties, it does not indicate that users’ “Internet or Other Similar Network Activity” is disclosed to any third parties. (Dkt. No. 1-2 at 6–7.) The CCPA Disclosure further clarifies that the “General Personal Information” and “Sensitive Personal Information” listed within it are collected from users directly, internet service providers, and operating systems and platforms. (Dkt. No. 1-2 at 8–9.) It also states explicitly, “We do not sell or share personal information for cross-context behavioral advertising. We do not sell or share sensitive personal information.” (Dkt. No. 1-2 at 9.) Terms & Conditions. The Terms & Conditions contain the terms and conditions governing PHH’s website and other Onity websites. (Dkt. No. 1-3.) Regarding information gathering, the Terms & Conditions state:

Our website does not covertly capture information regarding the specific activities of any particular user. Our website does, however, produce reports that permit us to view your activity on our website in anonymous or aggregated form. The only personal information that we capture has been specifically submitted to us through our email information request function, or data specifically input by users into predetermined input forms and webpages programmed throughout our website. (Dkt. No. 1-3 at 3–4.) D. Allison’s Experiences Allison used PHH’s website to apply for a mortgage in or around 2020 or 2021. (Compl. ¶ 131.) He “regularly used PHH’s Website for managing his mortgage, checking his balance, making payments including setting autopay, and accessing tax forms.” (Compl ¶ 131.) Allison alleges that through PHH’s “use of Third Party Trackers on its Website” and the “systematic data sharing process” described above, PHH “disclosed to Third Parties information [he] provided to PHH . . . including [his]: Existing user or Customer status; Browsing activities, including the pages and content [he] viewed; Coborrower information; Real estate ownership information; The type of loan [he] applied for; Identity, including via his IP address; and Information collected through an Internet ‘cookie’ (or information collecting device from a web server).” (Compl. ¶¶ 141–42.) Allison states that he did not expect his personal information to be transmitted to third parties who were uninvolved in providing mortgage services. (Compl. ¶¶ 136–38.) He represents that he “would not have submitted his information to PHH if [he] had known it would be shared with Third Parties and further sold to fourth parties for purposes of marketing Third and fourth party products.” (Compl. ¶ 144.) III. LEGAL STANDARD To survive challenge under Rule 12(b)(6), a plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim “has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The complaint must allege “more than a sheer possibility that a defendant has acted unlawfully.” Id. When ruling on a motion to dismiss, a court may consider only “the complaint, materials incorporated into the complaint by reference, and matters [subject to] judicial notice.” See UFCW Loc. 1500 Pension Fund v. Mayer, 895 F.3d 695, 698 (9th Cir. 2018) (citation omitted). A court must also presume the truth of a plaintiff’s allegations and draw all reasonable inferences in their favor. See Boquist, 32 F.4th at 773. However, a court need not accept as true “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” See Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1008 (9th Cir. 2018) (citation omitted). IV. DISCUSSION Allison’s complaint comprises eleven claims: (1) negligence, (2) negligence per se, (3) violation of the Comprehensive Computer Data Access and Fraud Act (“CDAFA”), (4) violation of California’s Consumer Protection Law (“UCL”), (5) violation of the California Consumer Privacy Act (“CCPA”), (6) breach of express and implied contract, (7) unjust enrichment, (8) declaratory judgment, (9) breach of confidence, (10) violation of the Invasion of Privacy Act (“CIPA”), and (11) violation of the Electronic Communications Privacy Act. A. Consent to PHH’s Information Sharing PHH’s overarching argument is that Allison’s complaint should be dismissed because he was notified of PHH’s collecting and sharing of his personal and financial information and expressly agreed to it. (Dkt. No. 18 at 12.) To be sure, “[c]onsent generally defeats privacy claims.” Javier v. Assurance IQ, LLC, No. 20-cv-02860-JSW, 2021 WL 940319, at *2 (N.D. Cal. Mar. 9, 2021). Allison admits to agreeing to the Privacy Contracts. (Compl. ¶ 242.) PHH contends that the complaint never “alleges any sharing of information by PHH that was inconsistent with or went beyond what was described in the Privacy Contracts,” which it asserts is fatal to Allison’s claims. (Dkt. No. 18 at 12.) However, as further explained below, the Privacy Contracts do not clearly disclose that PHH collects and shares information about a particular user’s activity on its website with third parties. Accordingly, it cannot be concluded as a matter of law that Allison or other PHH website users consented to that use of their data. “On a motion to dismiss, the burden of proof to show consent rests with defendants.” Doe v. FullStory, Inc., 712 F. Supp. 3d 1244, 1253 (N.D. Cal. 2024). Consent is “generally limited to the specific conduct authorized.” Javier, 2021 WL 940319, at *2. Thus, courts have required that privacy policies “explicitly notify” users “of the practice at issue” to establish consent. M.D. v. Google LLC, No. 24-cv-06369-AMO, 2025 WL 2710095, at *4 (N.D. Cal. Sept. 23, 2025) (citation omitted). If a reasonable user “could have plausibly interpreted the contract language as not disclosing that [PHH] would engage in particular conduct, then [PHH] cannot obtain dismissal of a claim about that conduct . . . based on the issue of consent.” In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 789–90 (N.D. Cal. 2019). As described above, the complaint alleges that PHH collects individual users’ activities on its website and discloses that information to third parties along with other information capable of identifying those users and linking them to other online accounts. PHH argues that the Privacy Contracts expressly permit this sort of information sharing. It points to the Consumer Privacy Notice, which states that PHH may share customers’ personal information with non- affiliates such as the third parties the complaint identifies for the non-affiliates to market to PHH’s users. (See Dkt. No. 1-4 at 2, 4.) PHH also references the Privacy and Security Policy, which provides that PHH may disclose the information it collects to “service providers” it “use[s] to support [its] business” and to “marketing partners,” including unaffiliated “retailers and other third parties,” to use the information to “market to [users].” (See Dkt. No. 1-1 at 4–5.) But PHH’s interpretation of the Privacy Contracts is not the only reasonable interpretation of those documents. Indeed, a reasonable user could interpret the Privacy Contracts in their entirety as disclosing only that PHH collects and shares user information in the aggregate but not information organized by particular users—for instance, that a particular user has started filling out a pre-approval loan application. While PHH points to several provisions in the Privacy Contracts permitting it to share users’ personal information with third parties, the Privacy Contracts also contain conflicting provisions that appear to disavow any collection of website activity at the individual level. Under the heading “Information Gathering,” the Terms & Conditions expressly provide that PHH’s website “does not covertly capture information regarding the specific activities of any particular user.” (Dkt. No. 1-3 at 3 (emphasis added).) Instead, the website “produce[s] reports that permit [PHH] to view [user] activity on [its] website in anonymous or aggregated form. The only personal information that [PHH] capture[s] has been specifically submitted to [it] through [its] email information request function, or data specifically input by users into predetermined input forms and webpages programmed throughout [its] website.” (Dkt. No. 1-3 at 3–4 (emphasis added).) Based on these representations, a reasonable user could interpret the Privacy Contracts in their entirety as disclosing only that PHH collects and shares user information in the aggregate but not information organized by particular users. This interpretation is underscored by provisions in the Privacy and Security Policy stating (a) that PHH uses information it collects about users or that users provide it “to report aggregated information to [its] advertisers” and (b) that “PHH may disclose aggregated information about [its] users, and information that does not identify an individual.” (Dkt. No. 1-1 at 4, 6.) At the hearing, PHH contended that its disclosures could be read as describing collection and disclosure of information about individual users, as long as PHH did not disclose those users’ names, email addresses, or similar identifying information. That reading, however, appears directly at odds with the representation in the Terms & Conditions that the PHH website does not “capture” information about “any particular user,” which can be plausibly understood as a promise not to keep individualized data, and thus not to provide it to third parties. Therefore, to the extent that the Privacy Contracts disclose that PHH collects user data and shares it with third parties, it does not disclose that the data collected is individualized. The provisions PHH points to in the Privacy Contracts confirm this fact, as they disclose only that PHH shares information with third parties for marketing purposes but does not clarify whether that information is individualized or aggregated. (E.g., Dkt. No. 1-4 at 2 (“All financial companies need to share customers’ personal information to run their everyday business.”).) Accordingly, the Court cannot conclude as a matter of law that Allison and other PHH users consented to the information collection and sharing that is challenged here. See Allison v. United Wholesale Mortg., No. 25-cv-05377-WHO, 2025 WL 3702863, at *5 (N.D. Cal. Dec. 21, 2025) (granting motion to dismiss based on consent because plaintiffs insufficiently alleged that defendant’s use of data “goes beyond the scope of what is agreed upon by [defendant’s] Terms of Services or Privacy Policy.”). B. Negligence and Negligence Per Se Claims Allison’s complaint states a claim against PHH for negligence. To state a negligence claim under California law, a plaintiff “must establish four required elements: (1) duty; (2) breach; (3) causation; and (4) damages.” Wells Fargo Bank, N.A. v. Renz, 795 F. Supp. 2d 898, 924 (N.D. Cal. 2011) (citation omitted). As to the first two elements, the complaint contains allegations that PHH did not take proper care when disclosing individualized user information to third parties that could be used to deduce the users’ identities: namely, it failed to ensure that the information was not being shared or used in violation of their privacy disclosures and in violation of prevailing industry standards. See Shah v. Cap. One Fin. Corp., 768 F. Supp. 3d 1033, 1046 (N.D. Cal. 2025) (“Plaintiffs therefore alleged a valid duty of care by alleging that they placed trust in Defendant to protect their personal information, which Defendant then disclosed.”). (See Compl. ¶ 171.) Allison has also adequately alleged that PHH caused him injury by collecting his information and sharing it with third parties, and that Allison suffered not just mere “economic loss” but “actual loss” giving rise to negligence recovery. (Dkt. No. 18 at 16–17.) Indeed, Allison alleges that PHH disclosed, among other things, the type of loan(s) for which he applied (Compl. ¶¶ 71–72, 142), which qualifies as sensitive financial information that, if disclosed, can give rise to “a non-economic privacy injury traditionally recognized under the law.” Toy v. Life Line Screening of Am. Ltd., No. 23-cv-04651-RFL, 2024 WL 1701263, at *4 (N.D. Cal. Mar. 19, 2024); see also Greenley v. Avis Budget Grp. Inc., No. 19-cv-00421-GPC-AHG, 2020 WL 1493618, at *13 (S.D. Cal. Mar. 27, 2020). Allison also alleges that he lost time trying “to mitigate and remediate the effects of the use of [his] information” (Compl. ¶ 179), which is not a pure economic loss. Shah, 768 F. Supp. 3d at 1046; see also Gerber v. Twitter, Inc., No. 23-cv- 00186-KAW, 2024 WL 1354449, at *6 (N.D. Cal. Mar. 29, 2024) (recognizing lost time as a non-economic injury when prompted by the need to mitigate disclosure of highly sensitive information). Accordingly, the motion to dismiss Allison’s negligence claim is denied. However, Allison’s complaint does not state a claim for negligence per se. “The doctrine of negligence per se is not a separate cause of action, but creates an evidentiary presumption that affects the standard of care in a cause of action for negligence.” Dent v. Nat’l Football League, 968 F.3d 1126, 1130 (9th Cir. 2020) (cleaned up). Allison concedes that the two statutes he relies on, the Federal Trade Commission and Gramm-Leach-Bliley Acts, do not provide private rights of action. (Dkt. No. 18 at 15–16 (citing Hall v. Equifax Info. Servs., No. 21-cv-01979 JAM, 2021 WL 5566746, at *1 (E.D. Cal. Nov. 29, 2021), report and recommendation adopted, No. 21-cv-01979 JAM, 2022 WL 397556 (E.D. Cal. Feb. 9, 2022)); Dkt. No. 27 at 12–14.) Accordingly, the motion to dismiss Allison’s negligence per se claim is dismissed without leave to amend because amendment would be futile. “The dismissal, however, ‘should not be construed as ruling on the viability of [Allison’s] ability to employ the concept of negligence per se in establishing [his] negligence claim.’” Toy, 2024 WL 1701263, at *5 (quoting Medoff v. Minka Lighting, LLC, No. 22-cv-08885-SVW-PVC, 2023 WL 4291973, at *10 n.11 (C.D. Cal. May 8, 2023)). C. UCL and CDAFA Claims PHH’s motion to dismiss the UCL claim is denied. PHH’s motion to dismiss the CDAFA claims is granted as to the claims under Sections 502(c)(2) and (8) but denied as to the claim under Section 502(c)(1)(B). PHH argues that Allison lacks standing under both statutes. Allison has standing under the UCL. For a plaintiff to allege standing under the UCL, they must have (a) suffered an injury in fact and (b) lost money or property as a result of the alleged unfair competition. Hahn v. Select Portfolio Servicing, Inc., No. 18-cv-05629-JSC, 2018 WL 6046463, at *4 (N.D. Cal. Nov. 19, 2018). Allison alleges that as a result of PHH collecting and transmitting his data, he “[l]ost [the] benefit of his bargain with PHH, as [he] did not receive the reasonable privacy and data security protections for which he paid.” (Compl. ¶ 145(f).) This supports a plausible inference that Allison had a mortgage with PHH and made payments on it, and that Allison would have been willing to pay less for his mortgage if he had known that his data would be collected by PHH and transmitted to third parties. That is sufficient to establish standing under the UCL. Accordingly, the motion to dismiss the UCL claim is denied. As to the CDAFA claims, Allison lacks standing to bring his claims under Sections 502(c)(2) and (8) but has standing to bring his Section 502(c)(1)(B) claim. Section 502(c)(2) prohibits “[k]nowingly access[ing] and without permission tak[ing], cop[ying], or mak[ing] use of any data from a computer, computer system, or computer network”; and Section 502(c)(8) prohibits knowingly introducing “any computer contaminant into any computer, computer system, or computer network.” Cal Penal Code § 502(c)(2), (8). Allison lacks standing to bring his claims under these sections because he was not subjected to the relevant proscribed conduct, namely, alleged access of his computer without permission or introduction of a computer contaminant into his computer. The complaint alleges only that PHH installed trackers on its website such that a user could not avoid the trackers with their device. (E.g., Compl. ¶ 33 (“Online tracking technologies may not be deleted from an individual’s device; they are built into a webpage, and a webpage Customer has no control or warning over their presence or data collection.”).) But there are no allegations that the trackers were ever introduced into Allison’s computer or that they accessed data from his computer. The complaint instead appears to allege that PHH’s trackers collected and transmitted data that Allison generated by engaging with PHH’s website. (E.g., Compl. ¶ 46.) Accordingly, Allison does not have standing to bring a claim under Sections 502(c)(2) or (8). This argument does not preclude standing under Section 502(c)(1)(B), which prohibits “[k]nowingly access[ing] and without permission . . . us[ing] any data, computer, computer system, or computer network in order to . . . wrongfully control or obtain money, property, or data.” As discussed above, the complaint contains allegations that PHH knowingly accessed Allison’s data. PHH argues that Allison nonetheless lacks standing because he has not demonstrated that he suffered economic harm or loss caused by damage to his computer system, network, program, or data. (Dkt. No. 18 at 18.) However, PHH’s alleged unjust profit from the use of Allison’s personal information “can plausibly constitute a ‘damage or loss’ under CDAFA,” as CDAFA does not limit those terms to “expenditures to determine whether a computer system or data was damaged” or “the costs of damaged computer systems or data.” Tsering v. Meta Platforms, Inc., No. 25-cv-01611-RFL, 2026 WL 89320, at *5 (N.D. Cal. Jan. 12, 2026) (quoting Smith v. Rack Room Shoes, Inc., No. 24-cv-06709-RFL, 2025 WL 2210002, at *3 (N.D. Cal. Aug. 4, 2025)). Allison therefore has demonstrated he has standing to bring his claim under Section 502(c)(1)(B). Accordingly, the motion to dismiss Allison’s CDAFA claims is granted as to the claims under Sections 502(c)(2) and (8) and denied as to the claim under Section 502(c)(1)(B). Dismissal is with leave to amend because the Court cannot conclude on the current record that amendment would be futile. D. CCPA Claim Allison’s complaint states a claim under the CCPA. PHH argues only that Allison lacks standing under the CCPA because the statute’s private right of action is limited to data breaches. (Dkt. No. 18 at 18.) However, the CCPA provides a private right of action to any “consumer whose nonencrypted and nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices.” Cal. Civ. Code § 1798.150(a)(1) (emphasis added). Nothing in the plain language of the provision limits its application to data breaches by third parties. By its own terms, the language covers unauthorized disclosure of private information that was to be kept secure and confidential, regardless of whether the disclosure was intentional or merely negligent, and regardless of whether the disclosure was made by a third party or agents of the defendant. See Shah, 768 F. Supp. 3d at 1048–49 (allowing CCPA claim to proceed where “the plaintiff does not allege a data breach” but that “‘defendants disclosed plaintiff’s personal information without his consent’” (quoting M.G. v. Therapymatch, Inc., No. 23-cv-04422-AMO, 2024 WL 4219992, at *7 (N.D. Cal. Sept. 16, 2024))). The Legislature may have been focused principally on third-party security breaches, as reflected in the section’s title of “Personal Information Security Breaches,” but the language of the statute is not limited to that scenario. PHH cites no case law or legislative history counseling a contrary result. Accordingly, given Allison’s allegations that PHH disclosed his personal information without his consent due to its failure to ensure it sent only aggregated user information, the motion to dismiss this claim is denied.4 E. Breach of Express and Implied Contract Claims Allison’s complaint states a breach of express contract claim. Although the Privacy Contracts disclose that PHH may share user data with third parties for their own purposes, Allison adequately alleges that PHH breached provisions of the Privacy Contracts stating that PHH would not collect and disclose individualized user data. As detailed above, Allison has plausibly alleged a violation of the provision of the Terms & Conditions stating that PHH’s website “does not covertly capture information regarding the specific activities of any particular user.” These allegations plausibly allege the existence of an obligation that PHH breached by collecting and disclosing individualized user data that was covertly collected while users were browsing its site. See Young v. Facebook, Inc., 790 F. Supp. 2d 1110, 1117 (N.D. Cal. 2011) (dismissing a breach of contract claim in the absence of such allegations). Accordingly, the motion to dismiss Allison’s breach of express contract claim is denied. However, Allison’s complaint fails to state a claim for breach of implied contract. “[A]n implied contract cannot exist when there is an express contract between parties covering the same subject.” Doe I v. Google LLC, 741 F. Supp. 3d 828, 848 (N.D. Cal. 2024). To plead breach of express and implied contract claims in the alternative, a plaintiff must allege that the provisions relied on in the express contract claim are alternatively unenforceable. See

4 The Court declines to rule on PHH’s argument that Allison’s failure to provide written notice to PHH precludes him from seeking statutory damages, which is only raised in a footnote (Dkt. No. 18 at 19 n.7). See Est. of Saunders v. Comm’r, 745 F.3d 953, 962 n.8 (9th Cir. 2014) (“Arguments raised only in footnotes, or only on reply, are generally deemed waived.”). In any event, a motion to dismiss must be directed to a claim, not a particular form of damages. See Farella Braun + Martel LLP v. Fed. Deposit Ins. Corp., No. 24-cv-01306-SI, 2024 WL 3972992, at *6 (N.D. Cal. Aug. 28, 2024). Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1096 n.13 (N.D. Cal. 2022). Allison’s complaint contains no such allegations, instead intertwining the breach of express and implied contract claims. (Compl. ¶¶ 241–47.) Accordingly, the motion to dismiss Allison’s breach of implied contract claim is granted. Dismissal is with leave to amend because the Court cannot conclude on the current record that amendment would be futile. F. Unjust Enrichment Claim Allison’s complaint fails to state a claim for unjust enrichment. “A claim for unjust enrichment is essentially a claim for restitution, the elements of which are that the defendant received and unjustly retained a benefit at the plaintiff’s expense.” See Lau v. Gen Digital Inc., No. 22-cv-08981-RFL, 2024 WL 1880161, at *5 (N.D. Cal. Apr. 3, 2024) (citing Durell v. Sharp Healthcare, 183 Cal. App. 4th 1350, 1370 (Cal. Ct. App. 2010)), aff’d sub nom. Karwowski v. Gen Digital, Inc., No. 24-7213, 2025 WL 3002610 (9th Cir. Oct. 27, 2025). However, an unjust enrichment claim “cannot lie where there exists between the parties a valid express contract covering the same subject matter.” Barrett v. Apple Inc., 523 F. Supp. 3d 1132, 1156 (N.D. Cal. 2021) (quoting Lance Camper Mfg. Corp. v. Republic Indem. Co., 44 Cal. App. 4th 194, 203 (Cal. Ct. App. 1996)). Accordingly, a restitution claim “cannot survive a motion to dismiss unless the proponent adequately pleads that no legal remedy exists”—e.g., that that the terms of the alleged express contract are “invalid or are in any way unenforceable.” Id. at 1157. As discussed above regarding Allison’s implied contract claim, Allison’s complaint contains no allegations that the relevant provisions in the Privacy Contracts are invalid or otherwise unenforceable. Thus, the motion to dismiss Allison’s unjust enrichment claim is granted with leave to amend. G. Breach of Confidence Claim Allison’s complaint fails to state a breach of confidence claim. Breach of confidence claims, like other implied and quasi-contract claims, “must be based on an implied obligation or contract—not an express contract.” Huynh v. Quora, Inc., No. 18-cv-07597-BLF, 2019 WL 11502875, at *8 (N.D. Cal. Dec. 19, 2019). As previously discussed with regard to Allison’s implied contract and unjust enrichment claims, Allison’s complaint contains no allegations that the Privacy Contracts are invalid or unenforceable. Instead, Allison’s “breach of confidence claim is based on an express contract”—i.e., the Privacy Contracts. Id. Accordingly, the motion to dismiss the breach of confidence claim is granted with leave to amend. H. CIPA Claims Allison’s complaint brings two claims under CIPA: (1) violation of Section 631(a) , which prohibits persons from “aid[ing], agree[ing] with, employ[ing], or conspir[ing] with” a third party to “read[], or attempt[] to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained” “by means of any machine, instrument, or contrivance, or in any other manner”; and (2) violation of Section 632(a), which prohibits persons from intentionally recording confidential communications without consent of all parties to the communication. See Cal. Penal Code §§ 631(a), 632(a). While Allison’s complaint states a claim under Section 632(a), it fails to state a claim under Section 631(a). Section 631(a) applies only to “the contents or meaning of any message.” Cal. Penal Code § 631(a). Accordingly, to state a claim under Section 631(a), a plaintiff must “identify the contents of any communication that” the defendant “allegedly intercepted,” that is, “any information concerning the substance, purport, or meaning of that communication.” Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020) (quoting 18 U.S.C. § 2510). “The analysis for a violation of CIPA is the same as that under the federal Wiretap Act.” Id. (citation omitted). In the context of federal wiretap law, the Ninth Circuit has held that “the ‘contents’ of an online communication . . . ‘refers to the intended message conveyed by the communication, and does not include record information regarding the characteristics of the message that is generated in the course of the communication.’” Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1082 (C.D. Cal. 2021) (quoting In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014)). The complaint contains no allegations that the personal and financial information PHH allegedly shared with third parties were the “contents” of any communications between users and PHH’s website. For instance, while Allison alleges that PHH shares with third parties whether a user started and ultimately completed an equity loan form, Allison does not allege that PHH shares any of the user’s actual inputs when filling out that form. Nor does Allison allege that PHH is intercepting another communication from the user’s computer to the PHH website, such as a GET request. Indeed, it is unclear from the allegations presently in the complaint whether the trackers work by recording information about a user’s session on the website, intercepting a communication attempting to convey the precise user information PHH is alleged to have collected, or using some other method. Without allegations regarding the manner in which the trackers operate, Allison does not plausibly allege that PHH aided and abetted third parties in learning the contents of any communication as opposed to simply record or session information. See In re Zynga Priv. Litig., 750 F.3d at 1104; Yoon, 549 F. Supp. 3d at 1082. The motion to dismiss is therefore granted with regard to Allison’s claim under Section 631(a). Dismissal is with leave to amend because the Court cannot conclude on the current record that amendment would be futile. However, Allison states a claim under Section 632(a). PHH argues only that PHH consented to PHH’s recording of user information. (Dkt. No. 18 at 21.) But for the reasons previously described, a reasonable user could have understood the Privacy Contracts as not permitting PHH to collect individualized information from its users. Thus, Allison and other PHH users did not consent to the collection of that sort of user information. Accordingly, the motion to dismiss Allison’s Section 632(a) claim is denied. I. Federal Wiretap Act Claim PHH also moves to dismiss the federal Wiretap Act claim on the basis of consent. Consent of any “party to the communication” is a complete defense to a Wiretap Act claim unless the “communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” 18 U.S.C. § 2511(2)(d). PHH argues that Allison’s Wiretap Act claim fails because, at the very least, PHH consented to any alleged interception, and the complaint does not allege facts showing that PHH committed the tort that Allison identifies in his complaint, invasion of privacy. (Dkt. No. 18 at 21.) However, the complaint alleges that PHH collected and disclosed users’ sensitive financial information, such as whether a particular user was applying for a certain type of loan, in addition to collecting and disclosing IP addresses and other information capable of identifying a particular user. The complaint also alleges that PHH collected and disclosed this information while representing in its Privacy Contracts that it did not do so. Combined, that is sufficient to allege invasion of privacy under California law. Brown v. Google LLC, 525 F. Supp. 3d 1049, 1075 (N.D. Cal. 2021). Allison also plausibly alleges that PHH acted with the purpose of committing an invasion of privacy tort. (See Dkt. No. 18 at 21.) The complaint alleges that PHH installed trackers on its website to trade customers’ sensitive financial information to reduce the cost of marketing services. (See, e.g., Compl. ¶ 4.) That is sufficient to allege a purpose to invade privacy for PHH’s profit, which triggers the crime-tort exception. Riganian v. LiveRamp Holdings, Inc., 791 F. Supp. 3d 1075, 1091 (N.D. Cal. 2025) (rejecting the notion that a financial motive removes a claim from the crime-tort exception). The motion to dismiss Allison’s Wiretap Act claim is denied.5 J. Declaratory Judgment Allison’s complaint states a declaratory judgment claim. PHH argues only that dismissal is appropriate because all of Allison’s substantive claims fail. (Dkt. No. 18 at 21.) Because

5 Although, as discussed above, CIPA and federal wiretap claims are subject to the same analysis, PHH’s motion to dismiss argues only (a) that PHH consented to any alleged interception and (b) that the crime-tort exception does not apply. (Dkt. No. 18 at 21.) Accordingly, the Court does not reach any other bases upon which Allison’s federal wiretap claim might be dismissed. PHH’s motion to dismiss has been denied as to several of Allison’s claims, the motion to dismiss Allison’s declaratory judgment claim is too denied. V. CONCLUSION For the foregoing reasons, the Court GRANTS IN PART and DENIES IN PART PHH’s motion to dismiss. The Court GRANTS PHH’s motion to dismiss the negligence per se claim without leave to amend. The Court GRANTS PHH’s motion to dismiss the CDAFA Section 502(c)(2) and (8) claims, breach of implied contract claim, unjust enrichment claim, breach of confidence claim, and CIPA Section 631(a) claim with leave to amend. The Court DENIES the remainder of PHH’s motion to dismiss. If Allison wishes to file an amended complaint correcting the deficiencies identified above, he shall do so by June 4, 2026. Allison may not add new claims or parties without leave of the Court or stipulation by the parties pursuant to Federal Rule of Civil Procedure 15. Ifno such amended complaint is filed by that date, the claims that were dismissed in this Order will remain dismissed with prejudice. IT IS SO ORDERED. Dated: May 14, 2026

United States District Judge