Justin Bradshaw and Gustavo Lopez, individual and on behalf of all others similarly situated v. Lowe’s Home Centers, LLC, a North Carolina limited liability company

Opinion

Case No.: 25cv0742 DMS (MMP) JUSTIN BRADSHAW, and GUSTAVO

LOPEZ, individual and on behalf of all ORDER DENYING DEFENDANT’S others similarly situated, Plaintiffs, v.

LOWE’S HOME CENTERS, LLC, a

North Carolina limited liability company, Defendant. This case comes before the Court on the motion to dismiss filed by Defendant Lowe’s Home Centers, LLC. Plaintiffs filed an opposition to the motion, and Defendant filed a reply. The motion came on for hearing on August 18, 2026. Michael Blatchley appeared for Plaintiffs, and Kamran Ahmadian appeared for Defendant. After reviewing the parties’ briefs, the record, the relevant legal authority, and hearing argument from counsel, the Court denies Defendant’s motion. I. This case originated in this Court on March 31, 2025, under the Class Action Fairness Act (CAFA). Named Plaintiffs are Justin Bradshaw and Gustavo Lopez, both California residents who visited Defendant Lowe’s website during the relevant time period. In the original complaint, Plaintiffs named both Lowe’s Home Centers, LLC and Lowe’s Companies, Inc. as defendants. (ECF No. 1.) Plaintiffs alleged Defendants violated Section 638.51 of the California Invasion of Privacy Act (CIPA) by secretly installing various trackers, including TikTok Pixel and Microsoft Bing (“Trackers”), on users’ internet browsers. They alleged these Trackers collected users’ IP addresses, unique identifiers, and browsing information, and then shared the information with TikTok and Microsoft without users’ consent. After meeting and conferring with this Court, Plaintiffs filed a First Amended Complaint on June 10, 2025. (ECF No. 14.) Defendants then filed a Motion to Dismiss for lack of personal jurisdiction, lack of Article III standing, and failure to state a claim. (ECF No. 17.) This Court denied Defendants’ motion to dismiss for failure to state a claim but granted Defendants’ motion to dismiss for lack of personal jurisdiction and lack of Article III standing. (ECF No. 39.) On the standing issue, this Court found Plaintiffs had not shown that unique identifiers, device information, and browsing information fit within the scope of Section 638.50(b). This left only Plaintiffs’ claim concerning the capture of their IP addresses. Case law supported that Plaintiffs had no reasonable expectation of privacy in their IP addresses. Therefore, the Court found Plaintiffs had failed to plead the requisite injury for Article III standing. The Court granted Plaintiffs leave to amend their Complaint to address this pleading deficiency, and in accordance therewith, Plaintiffs filed a Second Amended Complaint (SAC) on November 19, 2025. In their SAC, Plaintiffs removed Lowe’s Companies, Inc. as a defendant, leaving Lowe’s Home Centers, LLC as the singular remaining defendant. Plaintiffs expanded their SAC to include allegations that Defendant tracked their online behavior not only while they were on Defendant’s website, but also after they left Defendant’s website and began to browse the internet. They allege that the data from Trackers on Defendant’s website allows TikTok and Microsoft to create “cradle-to-grave” profiles, including information about who visitors were, what visitors were doing and why, where a user was when they visited the website, and how a user made their way to Defendant’s website. They further allege that Defendant collects the “full destination URL” of the page requested on Defendant’s website. They allege Defendant then leveraged this data for targeted advertising. Plaintiffs also added information regarding the value and sensitivity of their data and Plaintiffs’ use of the Lowe’s website. Furthermore, to satisfy Article III standing requirements, Plaintiffs analogize the harm they suffered to an intrusion upon seclusion claim, pleading that they had both a reasonable expectation of privacy in the data collected and that Defendant’s use of the Trackers was highly offensive. Lastly, they argue Defendant’s use of the Trackers caused Plaintiffs to suffer a concrete economic injury by misappropriating Plaintiffs’ data without compensation and through unjust enrichment. In the present motion, Defendant moves to dismiss the case for lack of Article III standing. Specifically, Defendant argues Plaintiffs have failed again to plead they suffered an Article III injury. II. Federal Rule of Civil Procedure 12(b)(1) permits challenges to federal courts’ subject matter jurisdiction, including for lack of Article III standing. Fed. R. Civ. P. 12(b)(1). Federal courts are of limited jurisdiction, “[possessing] only that power authorized by Constitution and statute, which is not to be expanded by judicial decree.” Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994) (citations omitted). Among the limits on that jurisdiction is the requirement of Article III standing. See Bender v. Williamsport Area Sch. Dist., 475 U.S. 534, 531–42 (1986). “[T]he irreducible constitutional minimum of standing” requires plaintiff to prove (1) injury in fact, which must be (a) concrete and particularized, and (b) actual or imminent; (2) a causal connection between the injury and defendant’s conduct; and (3) that the injury is likely to be redressed by a favorable decision. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992). Where these requirements are not met, “a federal court without jurisdiction over certain claims has no choice but to dismiss them regardless of their gravity or potential validity.” Fed. Election Comm’n v. Adams, 558 F. Supp. 2d 982, 986 (C.D. Cal. 2008). “The party asserting federal subject matter jurisdiction bears the burden of proving its existence.” Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir. 2010). Defendant’s first argument is that Plaintiffs fail to allege facts about their own visits to the website, and that Plaintiffs’ allegations are hypothetical and conclusory. (Mot. to Dismiss 8–9.) In both their Motion to Dismiss and oral argument, Defendant argued that Plaintiffs’ allegations lack specificity and require additional details about which pages on Defendant’s website they accessed and which sensitive products they viewed. Defendant likened Plaintiffs here to the plaintiff in Popa v. Microsoft Corporation, who did not identify any “embarrassing, invasive, or otherwise private information collected” by trackers. 153 F.4th 784, 791 (9th Cir. 2025). However, unlike the plaintiff in Popa, Plaintiffs here allege that their browsing information could reveal “sensitive demographic data” and “users’ financial and socioeconomic statuses.” (SAC §§ 10, 97.) Popa specifically considers disclosure of financial information as sensitive private information. Popa, 153 F.4th at 791 (finding a privacy interest in “sensitive medical or financial information”). Furthermore, Plaintiffs include a section within their SAC that addresses Plaintiffs’ experiences with the website. (SAC §§ 82–87.) At the pleading stage, without the benefit of discovery, Plaintiffs are not required to provide the depth of detail that Defendant demands. See Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (requiring courts to draw all reasonable inferences in favor of plaintiffs when considering a motion to dismiss for lack of Article III standing). This Court finds Plaintiffs’ allegations are sufficiently concrete and specific as not to be merely “conjectural” or “hypothetical.” See Lujan, 504 U.S. at 560. Second, Defendant argues Plaintiffs have failed both pleading elements of an intrusion upon seclusion claim. (Mot. to Dismiss 15–18.) The substantive elements of an intrusion upon seclusion claim are that the defendant intruded into a “place, conversation, or matter as to which the plaintiff has a reasonable expectation of privacy” and second, that the defendant’s intrusion was “highly offensive.” See In re Facebook Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020). Defendant argues Plaintiffs have no reasonable expectation of privacy in the information allegedly collected. They argue the website does not handle particularly sensitive data, and Plaintiffs have failed to identify any personal information captured by the Trackers. They also argue the SAC asserts website tracking is ubiquitous and, therefore, internet users have a diminished expectation of privacy in information collected and shared by third parties. Plaintiffs argue courts have consistently found a reasonable expectation of privacy in the kind of “detailed URLs” and browsing history that Plaintiffs allege were collected. (Opp’n 13–14.) Additionally, they argue their expectation of privacy was shaped by Defendants’ Privacy Statement, which allegedly stated it would share information with third parties only “with [visitor’s] consent.” (Id. 14–15.) Whether one has a reasonable expectation of privacy is a mixed question of law and fact, informed by “whether a defendant gained ‘unwanted access to data by electronic or other covert means, in violation of the law or social norms.” See Facebook Internet Tracking, 956 F.3d at 603. As stated in the Court’s previous order, there is no reasonable expectation of privacy in one’s IP address. However, courts in this Circuit have consistently found a reasonable expectation of privacy in cases where browsing history is collected surreptitiously and used to create extensive consumer profiles. See id. (“[T]he allegations that Facebook allegedly compiled highly personalized profiles from sensitive browsing histories and habits prevent us from concluding that the Plaintiffs have no reasonable expectation of privacy.”); Griffith v. TikTok, Inc., 697 F. Supp. 3d 963, 972 (C.D. Cal. 2023) (same); Katz-Lacabe v. Oracle Am., Inc., 668 F. Supp. 3d 928, 942 (N.D. Cal. 2023) (same); Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1089 (N.D. Cal. 2022) (same). Therefore, Plaintiffs have adequately alleged a reasonable expectation of privacy in their browsing data. Defendant also argues their conduct was not highly offensive. They cite case law supporting their argument that collecting IP addresses, zip codes, device identifiers, and general browsing information on a public, unauthenticated website is not highly offensive. Plaintiffs argue the highly offensive prong is satisfied by Defendant’s surreptitious collection of their data and that the collected data allowed third parties to associate Plaintiffs’ browsing habits with their identity. (Opp’n 17–18.) Determining whether a defendant's actions were “highly offensive to a reasonable person” requires a “holistic consideration of factors such as the likelihood of serious harm to the victim, the degree and setting of the intrusion, the intruder's motives and objectives, and whether countervailing interests or social norms render the intrusion inoffensive.” Facebook Internet Tracking, 956 F.3d at 606 (citation omitted). At the pleading stage, some courts have been reluctant to conclude that conduct was “highly offensive.” Briskin v. Shopify, Inc., No. 21-cv-06269-PJH, 2026 WL 161441, at *8 (N.D. Cal. Jan. 21, 2026); see Facebook Internet Tracking, 956 F.3d at 606 (“The ultimate question of whether Facebook’s tracking and collection practices could highly offend a reasonable individual is an issue that cannot be resolved at the pleading stage.”). However, other courts have found, as a matter of law, that certain data-sharing practices constitute highly offensive conduct because of the data's sensitive nature or because the defendant engaged in “secret or deceptive data collection.” See In re Ambry Genetics Data Breach Litig., 567 F. Supp. 3d 1130, 1143 (C.D. Cal. 2021); Hubbard v. Google LLC, No. 19-cv-07016-SVK, 2024 WL 3302066, at *7 (N.D. Cal. July 1, 2024); Tsering v. Meta Platforms, Inc., No. 25-cv- 01611-RFL, 2026 WL 89320, at *7 (N.D. Cal. Jan. 12, 2026). Here, Plaintiffs allege the Privacy Statement represented it would only share personal information with third parties “with [users’] consent,” and Plaintiffs never consented. (SAC ¶ 94.) They further allege that, after Plaintiffs filed this lawsuit, Defendant amended their Privacy Statement “to strike the provision promising to secure consent. . . in effect conceding that their prior actions were done in violation of their own policy.” (Id. ¶ 100.) Therefore, this Court declines to find that Defendant’s data collection was not highly offensive as a matter of law. See Brown v. Google LLC, 685 F. Supp. 3d 909, 941 (N.D. Cal. 2023). Accordingly, Plaintiffs have adequately alleged the elements of an intrusion upon seclusion claim. Finally, Defendant argues Plaintiffs have not suffered monetary harm. (Mot. to Dismiss 18.) They argue the SAC omits factual allegations, such as the potential monetary value of each type of information collected, how Defendant’s collection diminished the value, and Plaintiffs’ intention to sell the data. They also argue the ubiquitous nature of website tracking undermines the claim of financial harm. Plaintiffs argue California law requires disgorgement of unjustly earned profits regardless of whether a plaintiff expended their financial resources. (Opp’n 22.) Additionally, Plaintiffs argue Defendant deprived Plaintiffs of their right to exclude, the benefit of their bargain, and the right to control their personal information. The Ninth Circuit has established that California law requires disgorgement of unjustly earned profits regardless of whether a defendant’s actions caused a plaintiff to expend his or her own financial resources directly or whether a defendant’s actions directly caused the plaintiff’s property to become less valuable. . . this stake in unjustly earned profits exists regardless of whether an individual planned to sell his or her data or whether the individual’s data is made less valuable. Facebook Internet Tracking, 956 F.3d at 600. Therefore, Plaintiffs have adequately pleaded monetary harm sufficient to satisfy Article III. / / / / / / / / / / / / / / / / / / / / / / / / IV. For the reasons set out above, the Court denies Defendant’s motion to dismiss the case for lack of Article III standing. Dated: August 26, 2026

Hon. Dana M. Sabraw United States District Judge