1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 SABER KHAMOOSHI, et al., Case No. 24-cv-07836-SK
8 Plaintiffs, ORDER OF DISMISSAL WITH PREJUDICE FOR LACK OF 9 v. STANDING
10 POLITICO LLC, Regarding Docket No. 63 11 Defendant.
12 This matter comes before the Court upon consideration of the second motion to dismiss 13 filed by Defendant Politico LLC (“Defendant”). (Dkt. No. 63.) The Court determines that the 14 motion is appropriate for disposition without oral argument and, thus, is deemed 15 submitted. See Civ. L.R. 7-1(b). All parties have consented to the jurisdiction of the Undersigned 16 magistrate judge. (Dkt. Nos. 20, 21.) Having carefully considered the parties’ papers, relevant 17 legal authority, and the record in the case, the Court hereby GRANTS Defendant’s motion to 18 dismiss for lack of Article III standing and dismisses WITH PREJUDICE for the reasons set forth 19 below. Because the Court agrees with Defendant that Plaintiffs lack Article III standing, there is 20 no need to reach Defendant’s alternative arguments regarding the sufficiency of Plaintiffs’ 21 claims.1 22 / / / 23
24 1 Defendant requests judicial notice of six documents on file in federal or state court and two California Assembly Bills in conjunction with its arguments that Plaintiffs fail to state a 25 claim. (Dkt. No. 64, 67.) Although these materials may be judicially noticeable, the Court declines the request for judicial notice because these materials are unnecessary to the 26 determination of the present motion. See Von Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2010) (“Judicial notice of legislative facts . . . is unnecessary.”); 27 Lathan v. Ducart, No. 16-16551, 2017 WL 3976705, at *1 (9th Cir. June 16, 2017) (denying 1 BACKGROUND 2 Plaintiffs Saber Khamooshi, Ryan Wu, Brian Carolus and John Deddeh (“Plaintiffs”) bring 3 this putative class action against Defendant, alleging five claims under California law pursuant to: 4 (1) the California Computer Data Access and Fraud Act, Cal. Penal Code § 502; (2) the California 5 Invasion of Privacy Act, Cal. Penal Code § 638.51; (3) the right to privacy, Cal. Const. Art. 1, § 1; 6 (4) unjust enrichment; and (5) the Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et 7 seq. (Dkt. No. 49, ¶¶ 127-204.) Plaintiffs’ claims arise from Defendant’s alleged embedding of 8 third party trackers on its website, www.Politico.com. (Dkt. No. 49.) The trackers allegedly 9 collected Plaintiffs’ information without their consent for use in advertising and analytics. (Id.) 10 This action was originally filed in the Superior Court of California for the County of San 11 Francisco by Khamooshi, Wu, and Carolus on September 26, 2024. (Dkt. No. 1-1, p. 4.) 12 Defendant removed the case to federal court on November 8, 2024, and the parties agreed to 13 consolidate the claims with a later-filed case brought by Deddeh. (Dkt. Nos. 1, 29.) 14 On March 31, 2025, Defendant filed a motion to dismiss Plaintiffs’ First Amended 15 Complaint pursuant to Rules 12(b)(1), 12(b)(6), and 9(b). (Dkt. No. 35.) After full briefing and 16 oral argument, the Court granted Defendant’s motion to dismiss for lack of Article III standing on 17 May 13, 2025. (Dkt. No. 48.) The Court offered Plaintiffs an opportunity to amend their 18 complaint. (Id.) Plaintiffs filed a Second Amended Complaint. (Dkt. No. 49.) Now before the 19 Court is Defendant’s second motion to dismiss the Second Amended Complaint for lack of Article 20 III standing and failure to state a claim. (Dkt. No. 63.) Plaintiffs filed an opposition, and 21 Defendant filed a reply. (Dkt. Nos. 65, 67.) 22 ANALYSIS 23 A. Legal Standard. 24 The Court evaluates challenges to Article III standing under Rule 12(b)(1), which governs 25 motions to dismiss for lack of subject matter jurisdiction. See Maya v. Centex Corp., 658 F.3d 26 1060, 1067 (9th Cir. 2011). Where, as here, a defendant brings a facial challenge to standing, the 27 court assesses whether the plaintiff has alleged sufficient facts that, taken as true, demonstrate 1 2023) (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016), cleaned up). A plaintiff must 2 allege facts demonstrating “(i) that he suffered an injury in fact that is concrete, particularized, and 3 actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury 4 would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 5 (2021). 6 Here, the dispute centers on whether Plaintiffs have alleged an injury that is “concrete.” A 7 concrete injury is “real, and not abstract.” Id. at 424 (quoting Spokeo, 578 U.S. at 340). Concrete 8 harms include “traditional tangible harms, such as physical harms and monetary harms.” Id. at 9 425. Intangible injuries may be concrete if they have a “close relationship to harms traditionally 10 recognized as providing a basis for lawsuits in American courts,” such as “reputational harms, 11 disclosure of private information, and intrusion upon seclusion.” Id. 12 B. Defendant’s Motion. 13 The Court previously dismissed this action for lack of Article III standing because 14 Plaintiffs did not allege a “concrete” injury under the analysis mandated by TransUnion. (Dkt. 15 No. 48.) The Court rejected Plaintiffs’ arguments that they suffered three types of concrete injury: 16 (1) invasion of privacy, (2) unjust enrichment, and (3) heightened risk of future harm. (Id.) First, 17 the Court explained that the information allegedly disclosed—IP addresses, browser and device 18 data, and “other identifying information”—either did not implicate a protectable privacy interest 19 (IP addresses) or were fatally vague (browser and device data, other identifying information). 20 (Id.) Second, the Court explained that Plaintiffs could not establish standing under an unjust enrichment theory because they had not plausibly alleged that the disclosure of their information 21 was unjust. (Id.) Third, the Court explained that Plaintiffs could not base standing on a future risk 22 of harm because they had not alleged any facts indicating that the disclosed information could be 23 used to harm them. (Id.) 24 The Second Amended Complaint alleges that the information disclosed includes IP 25 addresses, browser and device data, and “other identifying information,” as well as browsing 26 activity, geolocation information, device type, browser type, and “device fingerprints.”2 (Dkt. No. 27 1 49, ¶¶ 1, 6, 7, 8, 13, 17, 21, 23, 48, 58, 73, 104, 109, 115, 149, 151(b), 155, 156, 169, 178, 179, 2 194, 200.) Plaintiffs assert Article III standing based on (1) invasion of privacy and (2) economic 3 harm. (Id. at ¶¶ 39-47.) 4 1. Invasion of Privacy. 5 Plaintiffs’ opposition brief largely recycles arguments rejected in the Court’s prior Order 6 and does not explain how the Second Amended Complaint addresses the deficiencies of the First 7 Amended Complaint. (Dkt. No. 65.) The Court’s prior Order explained why allegations 8 regarding the disclosure of IP addresses, browser and device data, and “other identifying 9 information” were insufficient to support a concrete privacy injury. (Dkt. No. 48.) The Second 10 Amended Complaint adds some new categories of information that Defendant allegedly disclosed: 11 browsing activity, geolocation data, device type, browser type, and “device fingerprints.” 12 (Compare Dkt. No. 33 with Dkt. No. 49.) These new allegations are also insufficient to establish a 13 concrete privacy injury.
Free access — add to your briefcase to read the full text and ask questions with AI
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 SABER KHAMOOSHI, et al., Case No. 24-cv-07836-SK
8 Plaintiffs, ORDER OF DISMISSAL WITH PREJUDICE FOR LACK OF 9 v. STANDING
10 POLITICO LLC, Regarding Docket No. 63 11 Defendant.
12 This matter comes before the Court upon consideration of the second motion to dismiss 13 filed by Defendant Politico LLC (“Defendant”). (Dkt. No. 63.) The Court determines that the 14 motion is appropriate for disposition without oral argument and, thus, is deemed 15 submitted. See Civ. L.R. 7-1(b). All parties have consented to the jurisdiction of the Undersigned 16 magistrate judge. (Dkt. Nos. 20, 21.) Having carefully considered the parties’ papers, relevant 17 legal authority, and the record in the case, the Court hereby GRANTS Defendant’s motion to 18 dismiss for lack of Article III standing and dismisses WITH PREJUDICE for the reasons set forth 19 below. Because the Court agrees with Defendant that Plaintiffs lack Article III standing, there is 20 no need to reach Defendant’s alternative arguments regarding the sufficiency of Plaintiffs’ 21 claims.1 22 / / / 23
24 1 Defendant requests judicial notice of six documents on file in federal or state court and two California Assembly Bills in conjunction with its arguments that Plaintiffs fail to state a 25 claim. (Dkt. No. 64, 67.) Although these materials may be judicially noticeable, the Court declines the request for judicial notice because these materials are unnecessary to the 26 determination of the present motion. See Von Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2010) (“Judicial notice of legislative facts . . . is unnecessary.”); 27 Lathan v. Ducart, No. 16-16551, 2017 WL 3976705, at *1 (9th Cir. June 16, 2017) (denying 1 BACKGROUND 2 Plaintiffs Saber Khamooshi, Ryan Wu, Brian Carolus and John Deddeh (“Plaintiffs”) bring 3 this putative class action against Defendant, alleging five claims under California law pursuant to: 4 (1) the California Computer Data Access and Fraud Act, Cal. Penal Code § 502; (2) the California 5 Invasion of Privacy Act, Cal. Penal Code § 638.51; (3) the right to privacy, Cal. Const. Art. 1, § 1; 6 (4) unjust enrichment; and (5) the Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et 7 seq. (Dkt. No. 49, ¶¶ 127-204.) Plaintiffs’ claims arise from Defendant’s alleged embedding of 8 third party trackers on its website, www.Politico.com. (Dkt. No. 49.) The trackers allegedly 9 collected Plaintiffs’ information without their consent for use in advertising and analytics. (Id.) 10 This action was originally filed in the Superior Court of California for the County of San 11 Francisco by Khamooshi, Wu, and Carolus on September 26, 2024. (Dkt. No. 1-1, p. 4.) 12 Defendant removed the case to federal court on November 8, 2024, and the parties agreed to 13 consolidate the claims with a later-filed case brought by Deddeh. (Dkt. Nos. 1, 29.) 14 On March 31, 2025, Defendant filed a motion to dismiss Plaintiffs’ First Amended 15 Complaint pursuant to Rules 12(b)(1), 12(b)(6), and 9(b). (Dkt. No. 35.) After full briefing and 16 oral argument, the Court granted Defendant’s motion to dismiss for lack of Article III standing on 17 May 13, 2025. (Dkt. No. 48.) The Court offered Plaintiffs an opportunity to amend their 18 complaint. (Id.) Plaintiffs filed a Second Amended Complaint. (Dkt. No. 49.) Now before the 19 Court is Defendant’s second motion to dismiss the Second Amended Complaint for lack of Article 20 III standing and failure to state a claim. (Dkt. No. 63.) Plaintiffs filed an opposition, and 21 Defendant filed a reply. (Dkt. Nos. 65, 67.) 22 ANALYSIS 23 A. Legal Standard. 24 The Court evaluates challenges to Article III standing under Rule 12(b)(1), which governs 25 motions to dismiss for lack of subject matter jurisdiction. See Maya v. Centex Corp., 658 F.3d 26 1060, 1067 (9th Cir. 2011). Where, as here, a defendant brings a facial challenge to standing, the 27 court assesses whether the plaintiff has alleged sufficient facts that, taken as true, demonstrate 1 2023) (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016), cleaned up). A plaintiff must 2 allege facts demonstrating “(i) that he suffered an injury in fact that is concrete, particularized, and 3 actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury 4 would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 5 (2021). 6 Here, the dispute centers on whether Plaintiffs have alleged an injury that is “concrete.” A 7 concrete injury is “real, and not abstract.” Id. at 424 (quoting Spokeo, 578 U.S. at 340). Concrete 8 harms include “traditional tangible harms, such as physical harms and monetary harms.” Id. at 9 425. Intangible injuries may be concrete if they have a “close relationship to harms traditionally 10 recognized as providing a basis for lawsuits in American courts,” such as “reputational harms, 11 disclosure of private information, and intrusion upon seclusion.” Id. 12 B. Defendant’s Motion. 13 The Court previously dismissed this action for lack of Article III standing because 14 Plaintiffs did not allege a “concrete” injury under the analysis mandated by TransUnion. (Dkt. 15 No. 48.) The Court rejected Plaintiffs’ arguments that they suffered three types of concrete injury: 16 (1) invasion of privacy, (2) unjust enrichment, and (3) heightened risk of future harm. (Id.) First, 17 the Court explained that the information allegedly disclosed—IP addresses, browser and device 18 data, and “other identifying information”—either did not implicate a protectable privacy interest 19 (IP addresses) or were fatally vague (browser and device data, other identifying information). 20 (Id.) Second, the Court explained that Plaintiffs could not establish standing under an unjust enrichment theory because they had not plausibly alleged that the disclosure of their information 21 was unjust. (Id.) Third, the Court explained that Plaintiffs could not base standing on a future risk 22 of harm because they had not alleged any facts indicating that the disclosed information could be 23 used to harm them. (Id.) 24 The Second Amended Complaint alleges that the information disclosed includes IP 25 addresses, browser and device data, and “other identifying information,” as well as browsing 26 activity, geolocation information, device type, browser type, and “device fingerprints.”2 (Dkt. No. 27 1 49, ¶¶ 1, 6, 7, 8, 13, 17, 21, 23, 48, 58, 73, 104, 109, 115, 149, 151(b), 155, 156, 169, 178, 179, 2 194, 200.) Plaintiffs assert Article III standing based on (1) invasion of privacy and (2) economic 3 harm. (Id. at ¶¶ 39-47.) 4 1. Invasion of Privacy. 5 Plaintiffs’ opposition brief largely recycles arguments rejected in the Court’s prior Order 6 and does not explain how the Second Amended Complaint addresses the deficiencies of the First 7 Amended Complaint. (Dkt. No. 65.) The Court’s prior Order explained why allegations 8 regarding the disclosure of IP addresses, browser and device data, and “other identifying 9 information” were insufficient to support a concrete privacy injury. (Dkt. No. 48.) The Second 10 Amended Complaint adds some new categories of information that Defendant allegedly disclosed: 11 browsing activity, geolocation data, device type, browser type, and “device fingerprints.” 12 (Compare Dkt. No. 33 with Dkt. No. 49.) These new allegations are also insufficient to establish a 13 concrete privacy injury. 14 As the Court explained in its prior Order, to state a concrete privacy injury, plaintiffs must 15 allege a harm analogous to the common-law privacy torts. (Dkt. No. 48); See also TransUnion, 16 594 U.S. at 424. A harm is analogous to the common-law privacy torts if it involves disclosure of 17 a kind that would be “highly offensive” to a reasonable person. Popa v. Microsoft Corp., 18 __F.4th__, 2025 WL 2448824, *5 (9th Cir. Aug. 26, 2025) (quoting Nayab v. Cap. One Bank 19 (USA), N.A., 942 F.3d 480, 491 (9th Cir. 2019) and Restatement (Second) of Torts § 652D). 20 Because the injury depends on the nature of the information at issue, plaintiffs must identify the 21 specific information allegedly disclosed. I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034, 1050 (N.D. 22 Cal. 2022); see also Mikulsky v. Noom, Inc., 682 F. Supp. 3d 855, 864 (S.D. Cal. 2023) 23 In Popa, which was decided on August 26, 2025, after the Court issued the order 24 dismissing the First Amended Complaint on May 13, 2025, the Ninth Circuit considered 25 allegations that the defendant had allegedly disclosed “over 30 different categories of information 26 including: the date a user visited the website, the device the user accessed the website on, the type 27 1 of browser the user accessed the website on, the operating system of the device used to access the 2 website, the country where the user accessed the website from, a user’s mouse movements, a 3 user’s screen swipes, text inputted by the user on the website, and how far down a webpage a user 4 scrolls,” the user’s mailing address with the street number and zip code omitted, and the pet 5 supplies products that interested the user. 2025 WL 2448824, at *2. The court concluded that this 6 information did not give rise to a concrete privacy because the plaintiff “identifie[d] no 7 embarrassing, invasive, or otherwise private information collected.” Id. at *5. 8 Popa controls the analysis in this case. As in Popa, Plaintiff identifies “no embarrassing, 9 invasive, or otherwise private information collected.” See id. at *5. Plaintiffs’ allegations 10 regarding device type, browser type, and “device fingerprints” are even less specific that the 30 11 different categories of information alleged in Popa¸ which also included the device type, browser 12 type, and metadata akin to fingerprinting. See also Kishnani v. Royal Caribbean Cruises Ltd., No. 13 25-CV-01473-NW, 2025 WL 1745726, at *5 (N.D. Cal. June 24, 2025) (“If [d]efendant only 14 collects information regarding the “metadata” of the communication, [p]laintiff’s right to privacy 15 is not invaded because he has no expectation of privacy as to that type of data (e.g., his IP address 16 or general geographic location.”). While some types of browsing activity implicate protectable 17 privacy interests, others do not. Compare Popa, 2025 WL 2448824, at *5 (no protectable privacy 18 interest in browsing activity on a pet supply website) with In re Facebook, Inc. Internet Tracking 19 Litig., 956 F.3d 589, 599 (9th Cir. 2020) (protectable privacy interest in “cradle-to-grave profile” 20 of users’ browsing activity across third-party websites combined with their Facebook profiles). 21 The same is true for geolocation information. Compare In re Google Location Hist. Litig., 428 F. 22 Supp. 3d 185, 198 (N.D. Cal. 2019) (no protectable privacy interest in “bits and pieces” of 23 plaintiffs’ movements captured only when plaintiffs used defendant’s services) with Carpenter v. 24 United States, 585 U.S. 296, 310 (2018) (protectible privacy interest in comprehensive record of 25 physical movements as captured by cell-site location information). Absent specific allegations 26 about the type of browsing and geolocation information disclosed, these categories of information 27 are insufficient to support a concrete privacy injury. 1 Article III standing. 2 2. Economic Harm. 3 Plaintiffs argue that they have alleged economic harm sufficient for standing because 4 Defendant unjustly profited from the use of their data and because their data carries financial 5 value. (Dkt. No. 65, p. 13.) 6 As to the unjust enrichment theory, the Court previously explained that the First Amended 7 Complaint failed to allege plausible facts suggesting that Defendant was unjustly enriched. (Dkt. 8 No. 48.) The Second Amended Complaint does not cure this deficiency, as it adds no new 9 allegations that plausibly support this theory. (Dkt. No. 49.) Moreover, Plaintiffs do not 10 meaningfully address this claim in their opposition, devoting less than a full paragraph to it. (Dkt. 11 No. 65.) 12 As to the financial value theory, Plaintiffs allege only that “user data carries financial 13 value.” (Dkt. No. 49, ¶ 44.) “[A]lthough it’s true that each user’s information is worth a certain 14 amount of money to [Defendant], it does not follow that the same information, when not 15 disclosed, has independent economic value to an individual user.” In re Facebook, Inc., 16 Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 784 (N.D. Cal. 2019). Plaintiffs point to 17 studies offering to pay users to observe their behavior browsing the web. (Dkt. No. 49, ¶ 44, 49.) 18 However, Plaintiffs do not allege that their web browsing behavior was disclosed, or that 19 Defendant’s actions diminished their opportunity to get paid for such studies. See In re Facebook 20 Internet Tracking Litig., 140 F. Supp. 3d 922, 932 (N.D. Cal. 2015) (“That programs may exist to 21 compensate internet users with $5 gift cards in exchange for monitoring their browsing activity is 22 a fact of little assistance to [p]laintiffs when they have not also alleged an inability to participate in 23 these programs after [Defendant] collected their information.”). 24 Plaintiffs have failed to allege an economic injury sufficient to establish Article III 25 standing.3 26 3 The Second Amended Complaint includes new allegations that Defendant’s technology 27 slows Plaintiffs’ browsers and devices and increases their device costs. (Dkt. No. 49, ¶¶ 79, 157.) 1 CONCLUSION 2 Plaintiffs have not alleged a concrete injury, and thus have not met their burden of 3 demonstrating Article III standing. The Court therefore GRANTS Defendant’s motion to dismiss. 4 || The Court has already allowed Plaintiffs one opportunity to amend their complaint, and Plaintiffs 5 have done little to supplement their allegations supporting standing. Accordingly, the Court finds 6 || that further amendment would be futile and dismissal for lack of standing shall be WITH 7 PREJUDICE. As this Court lacks subject matter jurisdiction over the claims, all of which are 8 based on state law, IT IS HEREBY ORDERED that this case shall be remanded to the Superior 9 Court of California for the County of San Francisco. The clerk is instructed to transfer the file. 10 See Polo v. Innoventions Int'l, LLC, 833 F.3d 1193, 1196 (9th Cir. 2016); Walker v. Kroger Co., 11 No. 22-CV-00261-JST, 2022 WL 20208929, at *2 (N.D. Cal. June 21, 2022). 12 IT IS SO ORDERED. 5 13 Dated: October 2, 2025 ® la .
5 SALLIE United States Magistrate Judge 16
18 19 20 21 22 23 24 25 26 27 28 standing in their opposition brief. Accordingly, the Court does not consider these allegations as a basis for Article HII standing.