1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 Case No.: 25cv0742 DMS (MMP) JUSTIN BRADSHAW, and GUSTAVO
11 LOPEZ, individually and on behalf of all ORDER GRANTING IN PART AND others similarly situated, 12 DENYING IN PART DEFENDANTS’ Plaintiffs, MOTION TO DISMISS 13 v. 14 LOWE’S COMPANIES, INC., a North 15 Carolina corporation, and LOWES HOME CENTERS, LLC, a North Carolina limited 16 liability company, 17 Defendants. 18 19 20 This case comes before the Court on the motion to dismiss filed by Defendants 21 Lowe’s Companies, Inc. and Lowe’s Home Centers, LLC. Plaintiffs filed an opposition to 22 the motion, and Defendant filed a reply. After the motion was submitted, Defendants filed 23 a notice of supplemental authority citing a then-newly decided Ninth Circuit case, Popa v. 24 Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). Plaintiffs filed a response to that notice, 25 to which Defendants filed a reply. Plaintiffs then filed a notice of supplemental authority 26 citing Rose v. Yelp, Inc., No. CGC-25-623299 (Sept. 16, 2025), a case from the San Diego 27 Superior Court, and Fregosa v. Mashable, Inc., No. 25-cv-01094-CRB, 2025 WL 2886399 28 (N.D. Cal. Oct. 9, 2025). They then filed a second notice of supplemental authority citing 1 Gabrielli v. Haleon US Inc., No. 25-cv-02555-WHO, 2025 WL 2494368 (N.D. Cal. Aug. 2 29, 2025), and Deivaprakash v. Conde Nast Digital, No. 25-cv-04021-RFL, 2025 WL 3 2779193 (N.D. Cal. Sept. 30, 2025). Defendants thereafter filed their own second notice 4 of supplemental authority citing Rodriguez v. Culligan Int’l Co., No. 25cv0225-AJB-KSC, 5 2025 WL 3064113 (S.D. Cal. Nov. 3, 2025), and Wooten v. BioLife Plasma Services L.P., 6 No. 1:25-cv-00099-KES-SKO, 2025 WL 2979619 (E.D. Cal. Oct. 22, 2025), after which 7 Plaintiffs filed a third notice of supplemental authority citing three additional cases from 8 the Northern District of California: Atkins v. Amplitude, Inc., No. 24-cv-04913-RFL, 2025 9 WL 2521732 (N.D. Cal. Sept. 2, 2025), Selby v. Sovrn Holdings, Inc., No. 25-cv-03139- 10 RFL, 2025 WL 2950164 (N.D. Cal. Oct. 17, 2025), and Walsh v. Dollar Tree Stores, Inc., 11 No. 25-cv-01601-SVK, 2025 WL 2939229 (N.D. Cal. Oct. 16, 2025). After reviewing the 12 parties’ briefs, the record, and the relevant legal authority, the Court grants in part and 13 denies in part Defendants’ motion. 14 I. 15 BACKGROUND 16 This case involves Defendants’ use of trackers on its website www.lowes.com. The 17 specific trackers at issue in this case are the TikTok Pixel and the Microsoft Bat Bing 18 Tracker. (First Am. Compl. (“FAC”) ¶¶ 30-54.) According to Plaintiffs, 19 [t]he TikTok Pixel is a piece of code implemented by site owners, such as Lowe’s, onto their websites, which enables website owners to track users’ 20 interactions with the website. … The pixel also collects and reports 21 supplementary metadata, including timestamp (when an action took place), IP address (which can be used to determine the geographic location of the user), 22 unique identifiers (which are assigned to a user’s device or browser session 23 that distinguish one user from another, device details (make, model, operating system), and browser information. 24
25 (Id. ¶ 31.) Plaintiffs also allege the TikTok Pixel “engages in a process known as 26 ‘fingerprinting,’ through which it collects as much information as possible about the 27 Lowe’s Website user and matches that information to the existing data from TikTok’s 28 database that has been gathered from other websites with the TikTok Pixel installed, which 1 includes millions of users.” (Id. ¶ 32.) Once users have been identified by the TikTok 2 Pixel, “website owners such as Lowe’s can use the information for analytics as well as for 3 advertising purposes.” (Id. ¶ 36.) “The Microsoft Bat Bing Tracker places the bat.bing 4 cookie on a user’s browser, which collects information about the user. That information is 5 gathered by Lowe’s and later disclosed to Microsoft.” (Id. ¶ 44.) One piece of information 6 collected by the Microsoft Bat Bing Tracker “is an individual’s Microsoft ID (‘MUID’). 7 An MUID is a unique identifier that Microsoft generates and assigns to a specific browser 8 to track users’ activity across the internet.” (Id. ¶ 45.) 9 Plaintiffs allege that when an individual goes to Defendants’ website Defendants 10 secretly collect the individual’s personal identifying information, or PII, through these 11 trackers. (Id. ¶ 2.) Specifically, Plaintiffs allege the trackers collect the individual’s “IP 12 addresses, unique identifiers, and browsing information[,]” and then share that information 13 with TikTok and Microsoft. (Id. ¶ 3.) Defendants then “use[ ] this information to create 14 targeted ads, while TikTok add[s] the data to its database in order for the TikTok Pixel 15 tracker itself to better identify users.” (Id.) 16 Plaintiffs allege these trackers are “pen registers” under the California Invasion of 17 Privacy Act (“CIPA”). California Penal Code § 638.50(b) defines a “pen register” as “a 18 device or process that records or decodes dialing, routing, addressing, or signaling 19 information transmitted by an instrument or facility from which a wire or electronic 20 communication is transmitted, but not the contents of a communication.” Cal. Penal Code 21 § 638.50(b). According to Plaintiffs, the trackers at issue in this case are “pen registers” 22 because “they are ‘device[s] or process[es]’ that ‘capture[d]’ the ‘routing, addressing, or 23 signaling information’—the IP address—from the electronic communications transmitted 24 by Plaintiffs’ and Class members’ computers or smartphones.” (FAC ¶ 70) (quoting Cal. 25 Penal Code § 638.50(b)). Plaintiffs allege Defendants’ use of the trackers without the 26 website user’s “knowledge or consent and without a court order” violates CIPA, 27 specifically California Penal Code § 638.51(a), which states: “Except as provided in 28 subdivision (b), a person may not install or use a pen register or a trap and trace device 1 without first obtaining a court order pursuant to Section 638.52 or 638.53.” Cal. Penal 2 Code § 638.51(a). In response to Plaintiffs’ FAC, Defendants filed the present motion. 3 II. 4 DISCUSSION 5 In the present motion, Defendants ask the Court to dismiss the case against Lowe’s 6 Companies for lack of personal jurisdiction. They also request dismissal of the entire case 7 for lack of standing. On the merits of the claim, Defendants move for dismissal on the 8 grounds the trackers are not “trap and trace” devices, Defendants consented to the use of 9 the trackers on its website, Plaintiffs have failed to allege the required scienter, there is no 10 private right of action under CIPA absent an injury, and Lowe’s Companies is not involved 11 in the Lowe’s website. 12 A. Personal Jurisdiction 13 On a motion to dismiss for lack of personal jurisdiction, the plaintiff bears the burden 14 “to establish the district court’s personal jurisdiction over the defendant.” Harris Rutsky 15 & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122, 1128-29 (9th Cir. 2003). 16 When the court rules on a motion to dismiss without first holding an evidentiary hearing, 17 “the plaintiff need only make a prima facie showing of jurisdiction to avoid the defendant’s 18 motion to dismiss.” Id. at 1129 (citing Doe, I v. Unocal Corp., 248 F.3d 915, 922 (9th Cir. 19 2001) (per curiam)). “Unless directly contravened, [plaintiff’s] version of the facts is taken 20 as true, and ‘conflicts between the facts contained in the parties’ affidavits must be resolved 21 in [the plaintiff’s] favor for purposes of deciding whether a prima facie case for personal 22 jurisdiction exists.’” Id. (quoting Doe, I, 248 F.3d at 922). Because “California’s long- 23 arm statute allows courts to exercise personal jurisdiction over defendants to the extent 24 permitted by the Due Process Clause of the United States Constitution[,]” this Court “need 25 only determine whether personal jurisdiction in this case would meet the requirements of 26 due process.” Id. (citations omitted). “For a court to exercise personal jurisdiction over a 27 nonresident defendant, that defendant must have at least ‘minimum contacts’ with the 28 / / / 1 relevant forum such that the exercise of jurisdiction ‘does not offend traditional notions of 2 fair play and substantial justice.’” Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 3 797, 801 (9th Cir. 2004) (quoting International Shoe Co. v. Washington, 326 U.S. 310, 316 4 (1945)). 5 Here, Plaintiffs allege in the FAC that the Court has both general and specific 6 jurisdiction over Lowe’s Companies. (See FAC ¶ 8) (alleging Defendants carry on 7 “continuous and systematic” business in California and “purposefully direct” their 8 activities to the Southern District of California). However, in their opposition to 9 Defendants’ motion, they address only the test for specific jurisdiction. (See Opp’n to Mot. 10 at 7.) Accordingly, the Court limits its discussion to that issue. 11 The Ninth Circuit has established a three-prong test for determining whether a party 12 is subject to specific personal jurisdiction: 13 “(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform 14 some act by which he purposefully avails himself of the privilege of 15 conducting activities in the forum, thereby invoking the benefits and protections of its laws; 16
17 (2) the claim must be one which arises out of or relates to the defendant’s forum-related activities; and 18
19 (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e., it must be reasonable.” 20 21 Schwarzenegger, 374 F.3d at 802 (quoting Lake v. Lake, 817 F.2d 1416, 1421 (9th Cir. 22 1987)). “The plaintiff has the burden of proving the first two prongs.” Picot v. Weston, 23 780 F.3d 1206, 1211 (9th Cir. 2015) (citing CollegeSource, Inc. v. AcademyOne, Inc., 653 24 F.3d 1066, 1076 (9th Cir. 2011)). If the plaintiff meets that burden, “the burden shifts to 25 the defendant to ‘set forth a “compelling case” that the exercise of jurisdiction would not 26 be reasonable.’” Id. at 1212 (quoting CollegeSource, 653 F.3d at 1076). 27 Here, Defendants do not contest the first prong. Instead, they assert Plaintiffs cannot 28 meet their burden on the second prong. Specifically, Defendants contend Plaintiffs’ claim 1 arises out of Plaintiffs’ interactions with the Lowe’s website, which is owned and operated 2 by Lowe’s Home Centers, LLC. (See Decl. of Sara Ash in Supp. of Mot. ¶ 3, ECF No. 17- 3 1.) According to Defendants, Lowe’s Companies neither owns nor operates the website, 4 therefore Plaintiffs’ claim does not arise out of Lowe’s Companies’ forum-related 5 activities. (Id. ¶ 3.) 6 Plaintiffs offer two arguments in response. First, they assert Defendants are alleged 7 to have engaged in the same conduct and the allegations are collective. In support of this 8 assertion, Plaintiffs rely on Mikulsky v. Bloomingdale’s, LLC, Nos. 24-3564, 24-3837, 9 2025 WL 1718225, at *1 (9th Cir. June 20, 2025). In that case, the court stated the district 10 court did not err in exercising “jurisdiction over both Defendants where each was alleged 11 to have engaged in the same conduct and the allegations in the complaint were alleged 12 collectively.” Id. However, the defendants in that case did not raise the argument 13 Defendants raise here, namely, that one of the Defendants neither owns nor operates the 14 website at issue. Therefore, Mikulsky does not advance Plaintiffs’ first argument. 15 Plaintiffs’ second argument ignores the generally accepted test for specific 16 jurisdiction set out above and instead relies on a different test set out by the district court 17 in Autobidmaster, LLC v. Alpine Auto Gallery, LLC, No. 3:14-cv-1083-AC, 2015 WL 18 2381611 (D. Or. May 19, 2015). According to Plaintiffs, that test allows courts to exercise 19 personal jurisdiction over a defendant if it controls or is otherwise affiliated with the 20 website at issue in a case. However, like the defendant in Mikulsky, the defendant in 21 Autobidmaster did not dispute that it controlled or was otherwise affiliated with the website 22 at issue there. That is the crux of Defendants’ argument in this case, and thus 23 Autobidmaster also does not advance Plaintiffs’ position.1 24 / / / 25
26 27 1 Plaintiffs submitted evidence to support their argument under Autobidmaster, to which Defendants filed an objection. Because the Court declines to apply the Autobidmaster test 28 1 Applying the correct test as set out by the Ninth Circuit in Schwarzenegger, Plaintiffs 2 have not met their burden to show the first two elements for specific jurisdiction are 3 satisfied here. Accordingly, the Court grants Defendants’ motion to dismiss Lowe’s 4 Companies for lack of personal jurisdiction. 5 B. Standing 6 Defendants’ second argument in support of their motion is that Plaintiffs lack Article 7 III standing to bring their claim. Article III of the Constitution requires courts to adjudicate 8 only actual cases or controversies. See U.S. Const. art. III, § 2, cl. 1. “A suit brought by a 9 plaintiff without Article III standing is not a ‘case or controversy,’ and an Article III federal 10 court therefore lacks subject matter jurisdiction over the suit.” Cetacean Cmty. v. Bush, 11 386 F.3d 1169, 1174 (9th Cir. 2004). To establish Article III standing, “a plaintiff must 12 show (i) that he suffered an injury in fact that is concrete, particularized, and actual or 13 imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury 14 would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 15 423 (2021). 16 Here, Defendants argue Plaintiffs have not sufficiently alleged they suffered a 17 concrete injury. “A ‘concrete’ injury ‘must actually exist’; put differently, it must be ‘real, 18 and not abstract.’” Popa, 153 F.4th at 788 (quoting Spokeo v. Robins, 578 U.S. 330, 338 19 (2016)). History is “the touchstone for concreteness.” Id. Specifically, when considering 20 whether an injury is concrete, courts “’should assess whether the alleged injury to the 21 plaintiff has a close relationship’ to a harm traditionally recognized as providing a basis for 22 a lawsuit in American courts.’” Id. (quoting TransUnion, 594 U.S. at 424) (quotation 23 marks omitted). “That inquiry asks whether plaintiffs have identified a close historical or 24 common-law analogue for their asserted injury.” TransUnion, 594 U.S. at 424. In other 25 words, courts must “assess whether an individual plaintiff has suffered a harm that has 26 traditionally been actionable in our nation’s legal system.” Popa, 153 F.4th at 791. 27 / / / 28 / / / 1 In response to Defendants’ citation to Popa, Plaintiffs assert the harm they suffered 2 at the hands of Defendants most closely aligns with a claim for intrusion upon seclusion. 3 (Pls.’ Resp. to Notice of Supp. Auth. at 3.) 4 To state a claim for intrusion upon seclusion under California common law, a plaintiff must plead that (1) a defendant “intentionally intrude[d] into a place, 5 conversation, or matter as to which the plaintiff has a reasonable expectation 6 of privacy[,]” and (2) the intrusion “occur[red] in a manner highly offensive to a reasonable person.” 7
8 In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020) (quoting 9 Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 286 (2009)). See also Thomas v. Papa Johns 10 Int’l, Inc., No. 22cv2012 DMS (MSB), 2024 WL 2060140 (S.D. Cal. May 8, 2024), 11 affirmed, 2025 WL 1704437 (9th Cir. June 18, 2025) (granting motion to dismiss intrusion 12 upon seclusion claim). 13 Plaintiffs do not address either of these elements in their briefing. Instead, they focus 14 on the type of information allegedly captured by the trackers, i.e., their personal identifying 15 information, which appears to be their IP addresses, unique identifiers, MUIDs, 16 timestamps, and device and browser information. (FAC ¶¶ 3, 31.) Plaintiffs’ claim 17 however, is limited to the capture of their IP addresses. (Id. ¶¶ 70-71.)2 This information 18 appears to fall within the type of information covered by California Penal Code § 19 638.50(b), but that does not relieve Plaintiffs of the burden to show they had a reasonable 20 expectation of privacy in this information. 21 / / / 22
23 2 In their opposition to Defendants’ motion, Plaintiffs state their claim does “not rest on the 24 collection of IP addresses alone as the sum total of Defendants’ violation of CIPA.” (Opp’n 25 at 19, ECF No. 19.) However, the FAC belies that statement. (See FAC ¶¶ 70-71.) This limitation is also consistent with the statute, which defines a “pen register” as “a device or 26 process that records or decodes dialing, routing, addressing, or signaling information 27 transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Cal. Penal Code § 638.50(b) 28 1 On that question, Defendants argue there is no reasonable expectation of privacy in 2 one’s IP address, and the case law overwhelmingly supports that argument. See United 3 States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (stating “Internet users have no 4 expectation of privacy in … the IP addresses of the websites they visit because they should 5 know that this information is provided to and used by Internet service providers for the 6 specific purpose of directing the routing of information.”); United States v. Morel, 922 F.3d 7 1, 9 (1st Cir. 2019) (stating defendant “did not have a reasonable expectation of privacy” 8 in IP address information); United States v. Caira, 833 F.3d 803, 809 (7th Cir. 2016) 9 (finding defendant had no reasonable expectation of privacy in IP addresses); United States 10 v. Wheelock, 772 F.3d 825, 828-29 (8th Cir. 2014) (same); United States v. Christie, 624 11 F.3d 558, 574 (3d Cir. 2010) (stating “no reasonable expectation of privacy exists in an IP 12 address, because that information is … conveyed to and, indeed, from third parties, 13 including ISPs.”); Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174, 1179 (N.D. Cal. 14 2025) (citing Forrester, 512 F.3d at 510) (stating “no reasonable expectation of privacy 15 attaches to IP addresses.”); Heeger v. Facebook, Inc., 509 F. Supp. 3d 1182, 1190 (N.D. 16 Cal. 2020) (“There is no legally protected privacy interest in IP addresses alone[.]”) 17 Plaintiffs do not cite any case law to the contrary. Instead, they again point to the 18 other kinds of PII captured by Defendants’ trackers and their allegations that Microsoft and 19 TikTok combine this information with data from other sources to generate user profiles. 20 (Opp’n to Mot. at 19.) It is unclear, however, whether that other PII, specifically, the user’s 21 MUID, device information, and browser information, constitutes “dialing, routing, 22 addressing, or signaling information” as set out in section 638.50, and therefore falls within 23 the scope of section 638.51. Absent a showing that information is covered by the statute, 24 any injury Plaintiffs may have suffered from Defendants’ use of that information would 25 not be caused by a violation of section 638.51(a). In sum, neither of these arguments 26 demonstrates Plaintiffs have suffered a concrete injury sufficient to show Article III 27 standing to bring the present claim. 28 / / / 1 Plaintiffs argue they need not show “an independent injury” in any event because a 2 violation of their right to privacy is inherent in their alleged violation of CIPA. But the 3 Ninth Circuit rejected that argument in Popa. There, the plaintiff argued “that because the 4 Pennsylvania legislature enacted a statute protecting a substantive privacy right, any 5 plaintiff alleging a violation of that statute will satisfy Article III.” 153 F.4th at 792. The 6 Ninth Circuit was not persuaded. It stated that “analysis reverts to a pre-TransUnion (even 7 pre-Spokeo) approach that favors a legislative body’s views in the aggregate over a 8 plaintiff’s individual circumstances.” Id. The court also rejected the plaintiff’s argument 9 that Ninth Circuit case law decided before and after TransUnion supported her position. 10 Specifically, the court found its post-TransUnion case law “approve[d] of an approach … 11 that requires a plaintiff to demonstrate more than just a statutory violation when evaluating 12 whether a plaintiff has alleged a concrete injury[,]” id. at 793, as did the court’s pre- 13 TransUnion case law. Id. at 794 (stating pre-TransUnion cases “still accounted for the 14 individual circumstances giving rise to the plaintiffs’ alleged injuries rather than simply 15 greenlighting a per se rule for privacy statutes.”) 16 Plaintiffs attempt to get out from under the Popa umbrella with three new arguments. 17 First, they assert they suffered monetary harm in the form of lost compensation for 18 Defendants’ use of their PII, and that monetary harm constitutes a concrete injury. (Pls.’ 19 Resp. to Notice of Supp. Authority at 1-2, ECF No. 25.) The problem with this argument, 20 however, is Plaintiffs did not plead this kind of injury in the FAC, nor did they mention it 21 in their initial opposition to Defendants’ motion. Absent that allegation, Plaintiffs’ 22 argument does not show Plaintiffs have standing. 23 Second, Plaintiffs contend the privacy violation alleged in this case is analogous to 24 a claim for intrusion upon seclusion, and that kind of conduct results in a concrete injury. 25 (Id. at 2-3.) But this argument misapprehends the legal test. Whether the conduct at issue 26 has a historical analog does not answer the question of whether the plaintiff has suffered a 27 concrete injury. Rather, the answer to that question depends on “whether an individual 28 plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal 1 system[,]” Popa, 153 F.4th at 791 (emphasis added), and for the reasons discussed above, 2 Plaintiffs have not made that showing here. 3 Third, Plaintiffs analogize the harm suffered here to the harm suffered in Facebook, 4 and argue the same result should apply, namely, this Court should find Plaintiffs have 5 suffered a concrete injury. But Plaintiffs’ analogy is inapt for two reasons. First, in 6 Facebook, the defendant “continued to collect [the plaintiffs’] data after they had logged 7 off the social media platform, in order to receive and compile their personally identifiable 8 browsing history.” 956 F.3d at 598. There is no similar allegation here. Rather, Plaintiffs 9 allege the trackers at issue in this case only collect information from Defendants’ website, 10 (FAC ¶ 31 (stating TikTok Pixel enables Defendants “to track users’ interactions with the 11 website”) (emphasis added)), not other websites. Second, the nature of the information 12 collected in Facebook is different from the information allegedly collected in this case. In 13 Facebook, the defendant collected the plaintiffs’ browsing histories, no matter how 14 sensitive or personal, and combined that information with the information collected from 15 Facebook, including the plaintiffs’ employment histories, political and religious 16 affiliations, likes, dislikes, interests, and habits. Id. at 598-99. Here, by contrast, Plaintiffs 17 allege the trackers have collected their “IP addresses,” undefined “unique identifiers,” and 18 “browsing information” while they are on Defendants’ website. (FAC ¶ 25.) These are 19 significant differences that result in fundamentally different harms and take this case 20 outside the holding of Facebook. 21 Considering the allegations in the FAC, the parties’ arguments, the record, and the 22 relevant legal authority, Plaintiffs have failed to show they suffered a concrete injury 23 sufficient to confer standing to bring the present case. Accordingly, the Court grants 24 Defendants’ motion to dismiss for lack of standing. See Rodriguez, 2025 WL 3064113 25 (granting defendant’s motion to dismiss section 638.51 claim for lack of standing); Wooten 26 v. BioLife Plasma Services L.P., No. 1:25-CV-00099-KES-SKO, 2025 WL 2979619, at *4 27 (E.D. Cal. Oct. 22, 2025) (relying on Popa to find plaintiffs “failed to establish standing 28 / / / 1 under Article III” for their claim under CIPA section 638.51); Khamooshi v. Politico LLC, 2 No. 24-CV-07836-SK, 2025 WL 2822879, at *4 (N.D. Cal. Oct. 2, 2025) (same). 3 C. Failure to State a Claim 4 Turning to Plaintiffs’ substantive claim, Defendants raise a number of arguments as 5 to why the claim is not pleaded sufficiently and should therefore be dismissed. First, they 6 argue the trackers are not pen registers or trap and trace devices under the CIPA. Second, 7 they assert Defendants consented to use of the trackers on the website. Third, Defendants 8 contend Plaintiffs have failed to allege facts to support the requisite scienter. Fourth, 9 Defendants claim Plaintiffs do not have a right of action under CIPA because they have 10 not suffered any injury. Fifth, Defendant argues Plaintiffs’ claim relies on a collective 11 pleading theory, which does not satisfy Federal Rule of Civil Procedure 8. 12 1. Trackers as Pen Registers or Trap and Trace Devices 13 Defendants’ first argument is the trackers are neither pen registers nor trap and trace 14 devices under CIPA. In support of this argument, Defendants rely on the statutory 15 language and legislative history, and raise a public policy argument. The reliance on these 16 sources is understandable as the case law is not in Defendants’ favor. Indeed, it uniformly 17 supports the opposite outcome. See Greenley v. Kochava, Inc., 684 F.Supp.3d 1024 (S.D. 18 Cal. 2023) (finding software constitutes “pen register” under section 638.50(b)). See also 19 Garon v. Keleops USA, Inc., No. 25-cv-02124-DMR, 2025 WL 2522374, at *3 (N.D. Cal. 20 Sept. 2, 2025); Gabrielli v. Haleon US Inc., 2025 WL 2494368, at *11; Gabrielli v. 21 Motorola Mobility LLC, No. 24-cv-09533-JST, 2025 WL 1939957, at *12 (N.D. Cal. July 22 14, 2025); Conohan v. Rad Power Bikes Inc., No. CV 25-0106 PVC, 2025 WL 1111246, 23 at *6-7 (C.D. Cal. Apr. 3, 2025); Mirmalek v. Los Angeles Times Communications LLC, 24 No. 24-cv-01797-CRB, 2024 WL 5102709, at *3 (N.D. Cal. Dec. 12, 2024); Shah v. 25 Fandom, Inc., 754 F.Supp.3d 924, 930 (N.D. Cal. 2024). This Court agrees with these 26 decisions, and rejects Defendants’ argument that section 638.51 applies only to telephone 27 surveillance. 28 / / / 1 2. Consent 2 Next, Defendants argue they are the “users” of the “electronic or wire 3 communication service,” and they consented to installation of the trackers on the website, 4 see Cal Penal Code § 638.51(b)(5). Notably, Defendants fail to cite any authority to 5 support this interpretation of the statute. They also fail to cite Moody v. C2 Educational 6 Systems Inc., 742 F.Supp.3d 1072, 1077 (C.D. Cal. 2024), wherein the court rejected this 7 same argument. In light of Moody, and absent any authority to the contrary, this argument 8 does not support dismissal of Plaintiffs’ claim. 9 3. Scienter 10 Defendants’ next argue Plaintiffs have failed to allege facts to support the scienter 11 requirement of their claim. According to Defendants, a claim under section 638.51 requires 12 a showing of knowing and intentional conduct, specifically, knowing and intentional 13 installation of a tracker without a court order. Plaintiffs dispute this is the appropriate 14 standard for a claim under section 638.51, but argue even if it is, they have set forth 15 sufficient facts to meet that standard. The Court agrees with Plaintiffs. Although there are 16 no specific allegations that Defendants engaged in knowing and intentional conduct, the 17 Complaint in its entirety makes clear that Defendants’ installation of the trackers on their 18 website was not an accident. Accordingly, Defendants’ scienter argument does not warrant 19 dismissal of Plaintiffs’ claim. 20 4. No Injury 21 Next, Defendants argue Plaintiffs lack statutory standing to bring their claim because 22 they have not suffered any injury. Defendants rely on their Article III standing arguments 23 to support their statutory standing argument, but “Article III standing is different from, and 24 not to be measured by, statutory standing.” Khamooshi, 786 F.Supp.3d at 1182 n.5 25 (quoting In re Capacitors Antitrust Litig., 154 F.Supp.3d 918, 925 (N.D. Cal. 2015)). 26 Furthermore, Defendants’ Article III standing argument was not that Plaintiffs failed to 27 allege an injury. Rather, Defendants argued Plaintiffs failed to allege a concrete injury, 28 / / / 1 which is not a requirement for statutory standing. Thus, Defendants’ statutory standing 2 argument does not warrant dismissal of Plaintiffs’ claim. 3 5. Collective Pleading3 4 Defendants’ final argument is Plaintiffs’ claim against Lowe’s Companies should be 5 dismissed because Plaintiffs failed to allege any facts to support Lowe’s Companies’ 6 involvement with the website. However, Plaintiffs’ have alleged a factual basis for their 7 claim against both Defendants. Specifically, Plaintiffs allege Defendants, collectively, 8 “own[ ] and operate the Lowe’s Website, which users can use to browse and to purchase 9 Lowes products.” (FAC ¶ 22.) Plaintiffs further allege Defendants “secretly utilized 10 various trackers, including the TikTok Pixel and Microsoft Bing … to collect their IP 11 addresses, unique identifiers, and browsing information.” (Id. ¶ 3.) Defendants complain 12 about Plaintiffs’ collective pleading approach, but Ninth Circuit “precedent does not 13 prohibit collective pleading so long as the complaint gives defendants fair notice of the 14 claims against them.” Briskin v. Shopify, Inc., 135 F.4th 739, 762 (9th Cir. 2025). The 15 FAC satisfies that standard, and thus this argument does not warrant dismissal of Plaintiffs’ 16 claim. 17 III. 18 CONCLUSION 19 For the reasons set out above, the Court grants Defendants’ motion to dismiss 20 Lowe’s Companies for lack of personal jurisdiction and grants Defendants’ motion to 21 dismiss the case for lack of Article III standing. The remainder of Defendants’ arguments 22 are rejected. In accordance with their request, Plaintiffs are granted leave to file a Second 23 / / / 24 / / / 25
26 27 3 In light of the Court’s ruling on the personal jurisdiction issue, this argument is technically moot. However, because the Court is granting Plaintiffs leave to amend, the 28 1 |} Amended Complaint that cures the pleading deficiencies set out above. Their Second 2 || Amended Complaint shall be filed no later than November 19, 2025. 3 IT IS SO ORDERED. 4 Dated: November 12, 2025
6 Hon. Dana M. Sabraw United States District Judge 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28