Case No.: 25cv0742 DMS (MMP) JUSTIN BRADSHAW, and GUSTAVO
LOPEZ, individually and on behalf of all ORDER GRANTING IN PART AND others similarly situated, DENYING IN PART DEFENDANTS’ Plaintiffs, MOTION TO DISMISS v. LOWE’S COMPANIES, INC., a North Carolina corporation, and LOWES HOME CENTERS, LLC, a North Carolina limited liability company, Defendants. This case comes before the Court on the motion to dismiss filed by Defendants Lowe’s Companies, Inc. and Lowe’s Home Centers, LLC. Plaintiffs filed an opposition to the motion, and Defendant filed a reply. After the motion was submitted, Defendants filed a notice of supplemental authority citing a then-newly decided Ninth Circuit case, Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). Plaintiffs filed a response to that notice, to which Defendants filed a reply. Plaintiffs then filed a notice of supplemental authority citing Rose v. Yelp, Inc., No. CGC-25-623299 (Sept. 16, 2025), a case from the San Diego Superior Court, and Fregosa v. Mashable, Inc., No. 25-cv-01094-CRB, 2025 WL 2886399 (N.D. Cal. Oct. 9, 2025). They then filed a second notice of supplemental authority citing Gabrielli v. Haleon US Inc., No. 25-cv-02555-WHO, 2025 WL 2494368 (N.D. Cal. Aug. 29, 2025), and Deivaprakash v. Conde Nast Digital, No. 25-cv-04021-RFL, 2025 WL 2779193 (N.D. Cal. Sept. 30, 2025). Defendants thereafter filed their own second notice of supplemental authority citing Rodriguez v. Culligan Int’l Co., No. 25cv0225-AJB-KSC, 2025 WL 3064113 (S.D. Cal. Nov. 3, 2025), and Wooten v. BioLife Plasma Services L.P., No. 1:25-cv-00099-KES-SKO, 2025 WL 2979619 (E.D. Cal. Oct. 22, 2025), after which Plaintiffs filed a third notice of supplemental authority citing three additional cases from the Northern District of California: Atkins v. Amplitude, Inc., No. 24-cv-04913-RFL, 2025 WL 2521732 (N.D. Cal. Sept. 2, 2025), Selby v. Sovrn Holdings, Inc., No. 25-cv-03139- RFL, 2025 WL 2950164 (N.D. Cal. Oct. 17, 2025), and Walsh v. Dollar Tree Stores, Inc., No. 25-cv-01601-SVK, 2025 WL 2939229 (N.D. Cal. Oct. 16, 2025). After reviewing the parties’ briefs, the record, and the relevant legal authority, the Court grants in part and denies in part Defendants’ motion. I. This case involves Defendants’ use of trackers on its website www.lowes.com. The specific trackers at issue in this case are the TikTok Pixel and the Microsoft Bat Bing Tracker. (First Am. Compl. (“FAC”) ¶¶ 30-54.) According to Plaintiffs, [t]he TikTok Pixel is a piece of code implemented by site owners, such as Lowe’s, onto their websites, which enables website owners to track users’ interactions with the website. … The pixel also collects and reports supplementary metadata, including timestamp (when an action took place), IP address (which can be used to determine the geographic location of the user), unique identifiers (which are assigned to a user’s device or browser session that distinguish one user from another, device details (make, model, operating system), and browser information.
(Id. ¶ 31.) Plaintiffs also allege the TikTok Pixel “engages in a process known as ‘fingerprinting,’ through which it collects as much information as possible about the Lowe’s Website user and matches that information to the existing data from TikTok’s database that has been gathered from other websites with the TikTok Pixel installed, which includes millions of users.” (Id. ¶ 32.) Once users have been identified by the TikTok Pixel, “website owners such as Lowe’s can use the information for analytics as well as for advertising purposes.” (Id. ¶ 36.) “The Microsoft Bat Bing Tracker places the bat.bing cookie on a user’s browser, which collects information about the user. That information is gathered by Lowe’s and later disclosed to Microsoft.” (Id. ¶ 44.) One piece of information collected by the Microsoft Bat Bing Tracker “is an individual’s Microsoft ID (‘MUID’). An MUID is a unique identifier that Microsoft generates and assigns to a specific browser to track users’ activity across the internet.” (Id. ¶ 45.) Plaintiffs allege that when an individual goes to Defendants’ website Defendants secretly collect the individual’s personal identifying information, or PII, through these trackers. (Id. ¶ 2.) Specifically, Plaintiffs allege the trackers collect the individual’s “IP addresses, unique identifiers, and browsing information[,]” and then share that information with TikTok and Microsoft. (Id. ¶ 3.) Defendants then “use[ ] this information to create targeted ads, while TikTok add[s] the data to its database in order for the TikTok Pixel tracker itself to better identify users.” (Id.) Plaintiffs allege these trackers are “pen registers” under the California Invasion of Privacy Act (“CIPA”). California Penal Code § 638.50(b) defines a “pen register” as “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Cal. Penal Code § 638.50(b). According to Plaintiffs, the trackers at issue in this case are “pen registers” because “they are ‘device[s] or process[es]’ that ‘capture[d]’ the ‘routing, addressing, or signaling information’—the IP address—from the electronic communications transmitted by Plaintiffs’ and Class members’ computers or smartphones.” (FAC ¶ 70) (quoting Cal. Penal Code § 638.50(b)). Plaintiffs allege Defendants’ use of the trackers without the website user’s “knowledge or consent and without a court order” violates CIPA, specifically California Penal Code § 638.51(a), which states: “Except as provided in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order pursuant to Section 638.52 or 638.53.” Cal. Penal Code § 638.51(a). In response to Plaintiffs’ FAC, Defendants filed the present motion. II. In the present motion, Defendants ask the Court to dismiss the case against Lowe’s Companies for lack of personal jurisdiction. They also request dismissal of the entire case for lack of standing. On the merits of the claim, Defendants move for dismissal on the grounds the trackers are not “trap and trace” devices, Defendants consented to the use of the trackers on its website, Plaintiffs have failed to allege the required scienter, there is no private right of action under CIPA absent an injury, and Lowe’s Companies is not involved in the Lowe’s website. A. Personal Jurisdiction On a motion to dismiss for lack of personal jurisdiction, the plaintiff bears the burden “to establish the district court’s personal jurisdiction over the defendant.” Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122, 1128-29 (9th Cir. 2003). When the court rules on a motion to dismiss without first holding an evidentiary hearing, “the plaintiff need only make a prima facie showing of jurisdiction to avoid the defendant’s motion to dismiss.” Id. at 1129 (citing Doe, I v. Unocal Corp., 248 F.3d 915, 922 (9th Cir. 2001) (per curiam)). “Unless directly contravened, [plaintiff’s] version of the facts is taken as true, and ‘conflicts between the facts contained in the parties’ affidavits must be resolved in [the plaintiff’s] favor for purposes of deciding whether a prima facie case for personal jurisdiction exists.’” Id. (quoting Doe, I, 248 F.3d at 922). Because “California’s long- arm statute allows courts to exercise personal jurisdiction over defendants to the extent permitted by the Due Process Clause of the United States Constitution[,]” this Court “need only determine whether personal jurisdiction in this case would meet the requirements of due process.” Id. (citations omitted). “For a court to exercise personal jurisdiction over a nonresident defendant, that defendant must have at least ‘minimum contacts’ with the / / / relevant forum such that the exercise of jurisdiction ‘does not offend traditional notions of fair play and substantial justice.’” Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 801 (9th Cir. 2004) (quoting International Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). Here, Plaintiffs allege in the FAC that the Court has both general and specific jurisdiction over Lowe’s Companies. (See FAC ¶ 8) (alleging Defendants carry on “continuous and systematic” business in California and “purposefully direct” their activities to the Southern District of California). However, in their opposition to Defendants’ motion, they address only the test for specific jurisdiction. (See Opp’n to Mot. at 7.) Accordingly, the Court limits its discussion to that issue. The Ninth Circuit has established a three-prong test for determining whether a party is subject to specific personal jurisdiction: “(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws;
(2) the claim must be one which arises out of or relates to the defendant’s forum-related activities; and
(3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e., it must be reasonable.” Schwarzenegger, 374 F.3d at 802 (quoting Lake v. Lake, 817 F.2d 1416, 1421 (9th Cir. 1987)). “The plaintiff has the burden of proving the first two prongs.” Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015) (citing CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1076 (9th Cir. 2011)). If the plaintiff meets that burden, “the burden shifts to the defendant to ‘set forth a “compelling case” that the exercise of jurisdiction would not be reasonable.’” Id. at 1212 (quoting CollegeSource, 653 F.3d at 1076). Here, Defendants do not contest the first prong. Instead, they assert Plaintiffs cannot meet their burden on the second prong. Specifically, Defendants contend Plaintiffs’ claim arises out of Plaintiffs’ interactions with the Lowe’s website, which is owned and operated by Lowe’s Home Centers, LLC. (See Decl. of Sara Ash in Supp. of Mot. ¶ 3, ECF No. 17- 1.) According to Defendants, Lowe’s Companies neither owns nor operates the website, therefore Plaintiffs’ claim does not arise out of Lowe’s Companies’ forum-related activities. (Id. ¶ 3.) Plaintiffs offer two arguments in response. First, they assert Defendants are alleged to have engaged in the same conduct and the allegations are collective. In support of this assertion, Plaintiffs rely on Mikulsky v. Bloomingdale’s, LLC, Nos. 24-3564, 24-3837, 2025 WL 1718225, at *1 (9th Cir. June 20, 2025). In that case, the court stated the district court did not err in exercising “jurisdiction over both Defendants where each was alleged to have engaged in the same conduct and the allegations in the complaint were alleged collectively.” Id. However, the defendants in that case did not raise the argument Defendants raise here, namely, that one of the Defendants neither owns nor operates the website at issue. Therefore, Mikulsky does not advance Plaintiffs’ first argument. Plaintiffs’ second argument ignores the generally accepted test for specific jurisdiction set out above and instead relies on a different test set out by the district court in Autobidmaster, LLC v. Alpine Auto Gallery, LLC, No. 3:14-cv-1083-AC, 2015 WL 2381611 (D. Or. May 19, 2015). According to Plaintiffs, that test allows courts to exercise personal jurisdiction over a defendant if it controls or is otherwise affiliated with the website at issue in a case. However, like the defendant in Mikulsky, the defendant in Autobidmaster did not dispute that it controlled or was otherwise affiliated with the website at issue there. That is the crux of Defendants’ argument in this case, and thus Autobidmaster also does not advance Plaintiffs’ position.1 / / /
1 Plaintiffs submitted evidence to support their argument under Autobidmaster, to which Defendants filed an objection. Because the Court declines to apply the Autobidmaster test Applying the correct test as set out by the Ninth Circuit in Schwarzenegger, Plaintiffs have not met their burden to show the first two elements for specific jurisdiction are satisfied here. Accordingly, the Court grants Defendants’ motion to dismiss Lowe’s Companies for lack of personal jurisdiction. B. Standing Defendants’ second argument in support of their motion is that Plaintiffs lack Article III standing to bring their claim. Article III of the Constitution requires courts to adjudicate only actual cases or controversies. See U.S. Const. art. III, § 2, cl. 1. “A suit brought by a plaintiff without Article III standing is not a ‘case or controversy,’ and an Article III federal court therefore lacks subject matter jurisdiction over the suit.” Cetacean Cmty. v. Bush, 386 F.3d 1169, 1174 (9th Cir. 2004). To establish Article III standing, “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). Here, Defendants argue Plaintiffs have not sufficiently alleged they suffered a concrete injury. “A ‘concrete’ injury ‘must actually exist’; put differently, it must be ‘real, and not abstract.’” Popa, 153 F.4th at 788 (quoting Spokeo v. Robins, 578 U.S. 330, 338 (2016)). History is “the touchstone for concreteness.” Id. Specifically, when considering whether an injury is concrete, courts “’should assess whether the alleged injury to the plaintiff has a close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts.’” Id. (quoting TransUnion, 594 U.S. at 424) (quotation marks omitted). “That inquiry asks whether plaintiffs have identified a close historical or common-law analogue for their asserted injury.” TransUnion, 594 U.S. at 424. In other words, courts must “assess whether an individual plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal system.” Popa, 153 F.4th at 791. / / / / / / In response to Defendants’ citation to Popa, Plaintiffs assert the harm they suffered at the hands of Defendants most closely aligns with a claim for intrusion upon seclusion. (Pls.’ Resp. to Notice of Supp. Auth. at 3.) To state a claim for intrusion upon seclusion under California common law, a plaintiff must plead that (1) a defendant “intentionally intrude[d] into a place, conversation, or matter as to which the plaintiff has a reasonable expectation of privacy[,]” and (2) the intrusion “occur[red] in a manner highly offensive to a reasonable person.”
In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020) (quoting Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 286 (2009)). See also Thomas v. Papa Johns Int’l, Inc., No. 22cv2012 DMS (MSB), 2024 WL 2060140 (S.D. Cal. May 8, 2024), affirmed, 2025 WL 1704437 (9th Cir. June 18, 2025) (granting motion to dismiss intrusion upon seclusion claim). Plaintiffs do not address either of these elements in their briefing. Instead, they focus on the type of information allegedly captured by the trackers, i.e., their personal identifying information, which appears to be their IP addresses, unique identifiers, MUIDs, timestamps, and device and browser information. (FAC ¶¶ 3, 31.) Plaintiffs’ claim however, is limited to the capture of their IP addresses. (Id. ¶¶ 70-71.)2 This information appears to fall within the type of information covered by California Penal Code § 638.50(b), but that does not relieve Plaintiffs of the burden to show they had a reasonable expectation of privacy in this information. / / /
2 In their opposition to Defendants’ motion, Plaintiffs state their claim does “not rest on the collection of IP addresses alone as the sum total of Defendants’ violation of CIPA.” (Opp’n at 19, ECF No. 19.) However, the FAC belies that statement. (See FAC ¶¶ 70-71.) This limitation is also consistent with the statute, which defines a “pen register” as “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Cal. Penal Code § 638.50(b) On that question, Defendants argue there is no reasonable expectation of privacy in one’s IP address, and the case law overwhelmingly supports that argument. See United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (stating “Internet users have no expectation of privacy in … the IP addresses of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information.”); United States v. Morel, 922 F.3d 1, 9 (1st Cir. 2019) (stating defendant “did not have a reasonable expectation of privacy” in IP address information); United States v. Caira, 833 F.3d 803, 809 (7th Cir. 2016) (finding defendant had no reasonable expectation of privacy in IP addresses); United States v. Wheelock, 772 F.3d 825, 828-29 (8th Cir. 2014) (same); United States v. Christie, 624 F.3d 558, 574 (3d Cir. 2010) (stating “no reasonable expectation of privacy exists in an IP address, because that information is … conveyed to and, indeed, from third parties, including ISPs.”); Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174, 1179 (N.D. Cal. 2025) (citing Forrester, 512 F.3d at 510) (stating “no reasonable expectation of privacy attaches to IP addresses.”); Heeger v. Facebook, Inc., 509 F. Supp. 3d 1182, 1190 (N.D. Cal. 2020) (“There is no legally protected privacy interest in IP addresses alone[.]”) Plaintiffs do not cite any case law to the contrary. Instead, they again point to the other kinds of PII captured by Defendants’ trackers and their allegations that Microsoft and TikTok combine this information with data from other sources to generate user profiles. (Opp’n to Mot. at 19.) It is unclear, however, whether that other PII, specifically, the user’s MUID, device information, and browser information, constitutes “dialing, routing, addressing, or signaling information” as set out in section 638.50, and therefore falls within the scope of section 638.51. Absent a showing that information is covered by the statute, any injury Plaintiffs may have suffered from Defendants’ use of that information would not be caused by a violation of section 638.51(a). In sum, neither of these arguments demonstrates Plaintiffs have suffered a concrete injury sufficient to show Article III standing to bring the present claim. / / / Plaintiffs argue they need not show “an independent injury” in any event because a violation of their right to privacy is inherent in their alleged violation of CIPA. But the Ninth Circuit rejected that argument in Popa. There, the plaintiff argued “that because the Pennsylvania legislature enacted a statute protecting a substantive privacy right, any plaintiff alleging a violation of that statute will satisfy Article III.” 153 F.4th at 792. The Ninth Circuit was not persuaded. It stated that “analysis reverts to a pre-TransUnion (even pre-Spokeo) approach that favors a legislative body’s views in the aggregate over a plaintiff’s individual circumstances.” Id. The court also rejected the plaintiff’s argument that Ninth Circuit case law decided before and after TransUnion supported her position. Specifically, the court found its post-TransUnion case law “approve[d] of an approach … that requires a plaintiff to demonstrate more than just a statutory violation when evaluating whether a plaintiff has alleged a concrete injury[,]” id. at 793, as did the court’s pre- TransUnion case law. Id. at 794 (stating pre-TransUnion cases “still accounted for the individual circumstances giving rise to the plaintiffs’ alleged injuries rather than simply greenlighting a per se rule for privacy statutes.”) Plaintiffs attempt to get out from under the Popa umbrella with three new arguments. First, they assert they suffered monetary harm in the form of lost compensation for Defendants’ use of their PII, and that monetary harm constitutes a concrete injury. (Pls.’ Resp. to Notice of Supp. Authority at 1-2, ECF No. 25.) The problem with this argument, however, is Plaintiffs did not plead this kind of injury in the FAC, nor did they mention it in their initial opposition to Defendants’ motion. Absent that allegation, Plaintiffs’ argument does not show Plaintiffs have standing. Second, Plaintiffs contend the privacy violation alleged in this case is analogous to a claim for intrusion upon seclusion, and that kind of conduct results in a concrete injury. (Id. at 2-3.) But this argument misapprehends the legal test. Whether the conduct at issue has a historical analog does not answer the question of whether the plaintiff has suffered a concrete injury. Rather, the answer to that question depends on “whether an individual plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal system[,]” Popa, 153 F.4th at 791 (emphasis added), and for the reasons discussed above, Plaintiffs have not made that showing here. Third, Plaintiffs analogize the harm suffered here to the harm suffered in Facebook, and argue the same result should apply, namely, this Court should find Plaintiffs have suffered a concrete injury. But Plaintiffs’ analogy is inapt for two reasons. First, in Facebook, the defendant “continued to collect [the plaintiffs’] data after they had logged off the social media platform, in order to receive and compile their personally identifiable browsing history.” 956 F.3d at 598. There is no similar allegation here. Rather, Plaintiffs allege the trackers at issue in this case only collect information from Defendants’ website, (FAC ¶ 31 (stating TikTok Pixel enables Defendants “to track users’ interactions with the website”) (emphasis added)), not other websites. Second, the nature of the information collected in Facebook is different from the information allegedly collected in this case. In Facebook, the defendant collected the plaintiffs’ browsing histories, no matter how sensitive or personal, and combined that information with the information collected from Facebook, including the plaintiffs’ employment histories, political and religious affiliations, likes, dislikes, interests, and habits. Id. at 598-99. Here, by contrast, Plaintiffs allege the trackers have collected their “IP addresses,” undefined “unique identifiers,” and “browsing information” while they are on Defendants’ website. (FAC ¶ 25.) These are significant differences that result in fundamentally different harms and take this case outside the holding of Facebook. Considering the allegations in the FAC, the parties’ arguments, the record, and the relevant legal authority, Plaintiffs have failed to show they suffered a concrete injury sufficient to confer standing to bring the present case. Accordingly, the Court grants Defendants’ motion to dismiss for lack of standing. See Rodriguez, 2025 WL 3064113 (granting defendant’s motion to dismiss section 638.51 claim for lack of standing); Wooten v. BioLife Plasma Services L.P., No. 1:25-CV-00099-KES-SKO, 2025 WL 2979619, at *4 (E.D. Cal. Oct. 22, 2025) (relying on Popa to find plaintiffs “failed to establish standing / / / under Article III” for their claim under CIPA section 638.51); Khamooshi v. Politico LLC, No. 24-CV-07836-SK, 2025 WL 2822879, at *4 (N.D. Cal. Oct. 2, 2025) (same). C. Failure to State a Claim Turning to Plaintiffs’ substantive claim, Defendants raise a number of arguments as to why the claim is not pleaded sufficiently and should therefore be dismissed. First, they argue the trackers are not pen registers or trap and trace devices under the CIPA. Second, they assert Defendants consented to use of the trackers on the website. Third, Defendants contend Plaintiffs have failed to allege facts to support the requisite scienter. Fourth, Defendants claim Plaintiffs do not have a right of action under CIPA because they have not suffered any injury. Fifth, Defendant argues Plaintiffs’ claim relies on a collective pleading theory, which does not satisfy Federal Rule of Civil Procedure 8. 1. Trackers as Pen Registers or Trap and Trace Devices Defendants’ first argument is the trackers are neither pen registers nor trap and trace devices under CIPA. In support of this argument, Defendants rely on the statutory language and legislative history, and raise a public policy argument. The reliance on these sources is understandable as the case law is not in Defendants’ favor. Indeed, it uniformly supports the opposite outcome. See Greenley v. Kochava, Inc., 684 F.Supp.3d 1024 (S.D. Cal. 2023) (finding software constitutes “pen register” under section 638.50(b)). See also Garon v. Keleops USA, Inc., No. 25-cv-02124-DMR, 2025 WL 2522374, at *3 (N.D. Cal. Sept. 2, 2025); Gabrielli v. Haleon US Inc., 2025 WL 2494368, at *11; Gabrielli v. Motorola Mobility LLC, No. 24-cv-09533-JST, 2025 WL 1939957, at *12 (N.D. Cal. July 14, 2025); Conohan v. Rad Power Bikes Inc., No. CV 25-0106 PVC, 2025 WL 1111246, at *6-7 (C.D. Cal. Apr. 3, 2025); Mirmalek v. Los Angeles Times Communications LLC, No. 24-cv-01797-CRB, 2024 WL 5102709, at *3 (N.D. Cal. Dec. 12, 2024); Shah v. Fandom, Inc., 754 F.Supp.3d 924, 930 (N.D. Cal. 2024). This Court agrees with these decisions, and rejects Defendants’ argument that section 638.51 applies only to telephone surveillance. / / / 2. Consent Next, Defendants argue they are the “users” of the “electronic or wire communication service,” and they consented to installation of the trackers on the website, see Cal Penal Code § 638.51(b)(5). Notably, Defendants fail to cite any authority to support this interpretation of the statute. They also fail to cite Moody v. C2 Educational Systems Inc., 742 F.Supp.3d 1072, 1077 (C.D. Cal. 2024), wherein the court rejected this same argument. In light of Moody, and absent any authority to the contrary, this argument does not support dismissal of Plaintiffs’ claim. 3. Scienter Defendants’ next argue Plaintiffs have failed to allege facts to support the scienter requirement of their claim. According to Defendants, a claim under section 638.51 requires a showing of knowing and intentional conduct, specifically, knowing and intentional installation of a tracker without a court order. Plaintiffs dispute this is the appropriate standard for a claim under section 638.51, but argue even if it is, they have set forth sufficient facts to meet that standard. The Court agrees with Plaintiffs. Although there are no specific allegations that Defendants engaged in knowing and intentional conduct, the Complaint in its entirety makes clear that Defendants’ installation of the trackers on their website was not an accident. Accordingly, Defendants’ scienter argument does not warrant dismissal of Plaintiffs’ claim. 4. No Injury Next, Defendants argue Plaintiffs lack statutory standing to bring their claim because they have not suffered any injury. Defendants rely on their Article III standing arguments to support their statutory standing argument, but “Article III standing is different from, and not to be measured by, statutory standing.” Khamooshi, 786 F.Supp.3d at 1182 n.5 (quoting In re Capacitors Antitrust Litig., 154 F.Supp.3d 918, 925 (N.D. Cal. 2015)). Furthermore, Defendants’ Article III standing argument was not that Plaintiffs failed to allege an injury. Rather, Defendants argued Plaintiffs failed to allege a concrete injury, / / / which is not a requirement for statutory standing. Thus, Defendants’ statutory standing argument does not warrant dismissal of Plaintiffs’ claim. 5. Collective Pleading3 Defendants’ final argument is Plaintiffs’ claim against Lowe’s Companies should be dismissed because Plaintiffs failed to allege any facts to support Lowe’s Companies’ involvement with the website. However, Plaintiffs’ have alleged a factual basis for their claim against both Defendants. Specifically, Plaintiffs allege Defendants, collectively, “own[ ] and operate the Lowe’s Website, which users can use to browse and to purchase Lowes products.” (FAC ¶ 22.) Plaintiffs further allege Defendants “secretly utilized various trackers, including the TikTok Pixel and Microsoft Bing … to collect their IP addresses, unique identifiers, and browsing information.” (Id. ¶ 3.) Defendants complain about Plaintiffs’ collective pleading approach, but Ninth Circuit “precedent does not prohibit collective pleading so long as the complaint gives defendants fair notice of the claims against them.” Briskin v. Shopify, Inc., 135 F.4th 739, 762 (9th Cir. 2025). The FAC satisfies that standard, and thus this argument does not warrant dismissal of Plaintiffs’ claim. For the reasons set out above, the Court grants Defendants’ motion to dismiss Lowe’s Companies for lack of personal jurisdiction and grants Defendants’ motion to dismiss the case for lack of Article III standing. The remainder of Defendants’ arguments are rejected. In accordance with their request, Plaintiffs are granted leave to file a Second / / / / / /
3 In light of the Court’s ruling on the personal jurisdiction issue, this argument is technically moot. However, because the Court is granting Plaintiffs leave to amend, the } Amended Complaint that cures the pleading deficiencies set out above. Their Second Amended Complaint shall be filed no later than November 19, 2025. Dated: November 12, 2025
Hon. Dana M. Sabraw United States District Judge