SABER KHAMOOSHI, et al., Case No. 24-cv-07836-SK
Plaintiffs, ORDER OF DISMISSAL WITH PREJUDICE FOR LACK OF v. STANDING
Regarding Docket No. 63 Defendant.
This matter comes before the Court upon consideration of the second motion to dismiss filed by Defendant Politico LLC (“Defendant”). (Dkt. No. 63.) The Court determines that the motion is appropriate for disposition without oral argument and, thus, is deemed submitted. See Civ. L.R. 7-1(b). All parties have consented to the jurisdiction of the Undersigned magistrate judge. (Dkt. Nos. 20, 21.) Having carefully considered the parties’ papers, relevant legal authority, and the record in the case, the Court hereby GRANTS Defendant’s motion to dismiss for lack of Article III standing and dismisses WITH PREJUDICE for the reasons set forth below. Because the Court agrees with Defendant that Plaintiffs lack Article III standing, there is no need to reach Defendant’s alternative arguments regarding the sufficiency of Plaintiffs’ claims.1 / / /
1 Defendant requests judicial notice of six documents on file in federal or state court and two California Assembly Bills in conjunction with its arguments that Plaintiffs fail to state a claim. (Dkt. No. 64, 67.) Although these materials may be judicially noticeable, the Court declines the request for judicial notice because these materials are unnecessary to the determination of the present motion. See Von Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2010) (“Judicial notice of legislative facts . . . is unnecessary.”); Lathan v. Ducart, No. 16-16551, 2017 WL 3976705, at *1 (9th Cir. June 16, 2017) (denying Plaintiffs Saber Khamooshi, Ryan Wu, Brian Carolus and John Deddeh (“Plaintiffs”) bring this putative class action against Defendant, alleging five claims under California law pursuant to: (1) the California Computer Data Access and Fraud Act, Cal. Penal Code § 502; (2) the California Invasion of Privacy Act, Cal. Penal Code § 638.51; (3) the right to privacy, Cal. Const. Art. 1, § 1; (4) unjust enrichment; and (5) the Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et seq. (Dkt. No. 49, ¶¶ 127-204.) Plaintiffs’ claims arise from Defendant’s alleged embedding of third party trackers on its website, www.Politico.com. (Dkt. No. 49.) The trackers allegedly collected Plaintiffs’ information without their consent for use in advertising and analytics. (Id.) This action was originally filed in the Superior Court of California for the County of San Francisco by Khamooshi, Wu, and Carolus on September 26, 2024. (Dkt. No. 1-1, p. 4.) Defendant removed the case to federal court on November 8, 2024, and the parties agreed to consolidate the claims with a later-filed case brought by Deddeh. (Dkt. Nos. 1, 29.) On March 31, 2025, Defendant filed a motion to dismiss Plaintiffs’ First Amended Complaint pursuant to Rules 12(b)(1), 12(b)(6), and 9(b). (Dkt. No. 35.) After full briefing and oral argument, the Court granted Defendant’s motion to dismiss for lack of Article III standing on May 13, 2025. (Dkt. No. 48.) The Court offered Plaintiffs an opportunity to amend their complaint. (Id.) Plaintiffs filed a Second Amended Complaint. (Dkt. No. 49.) Now before the Court is Defendant’s second motion to dismiss the Second Amended Complaint for lack of Article III standing and failure to state a claim. (Dkt. No. 63.) Plaintiffs filed an opposition, and Defendant filed a reply. (Dkt. Nos. 65, 67.) A. Legal Standard. The Court evaluates challenges to Article III standing under Rule 12(b)(1), which governs motions to dismiss for lack of subject matter jurisdiction. See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). Where, as here, a defendant brings a facial challenge to standing, the court assesses whether the plaintiff has alleged sufficient facts that, taken as true, demonstrate 2023) (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016), cleaned up). A plaintiff must allege facts demonstrating “(i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). Here, the dispute centers on whether Plaintiffs have alleged an injury that is “concrete.” A concrete injury is “real, and not abstract.” Id. at 424 (quoting Spokeo, 578 U.S. at 340). Concrete harms include “traditional tangible harms, such as physical harms and monetary harms.” Id. at 425. Intangible injuries may be concrete if they have a “close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts,” such as “reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. B. Defendant’s Motion. The Court previously dismissed this action for lack of Article III standing because Plaintiffs did not allege a “concrete” injury under the analysis mandated by TransUnion. (Dkt. No. 48.) The Court rejected Plaintiffs’ arguments that they suffered three types of concrete injury: (1) invasion of privacy, (2) unjust enrichment, and (3) heightened risk of future harm. (Id.) First, the Court explained that the information allegedly disclosed—IP addresses, browser and device data, and “other identifying information”—either did not implicate a protectable privacy interest (IP addresses) or were fatally vague (browser and device data, other identifying information). (Id.) Second, the Court explained that Plaintiffs could not establish standing under an unjust enrichment theory because they had not plausibly alleged that the disclosure of their information was unjust. (Id.) Third, the Court explained that Plaintiffs could not base standing on a future risk of harm because they had not alleged any facts indicating that the disclosed information could be used to harm them. (Id.) The Second Amended Complaint alleges that the information disclosed includes IP addresses, browser and device data, and “other identifying information,” as well as browsing activity, geolocation information, device type, browser type, and “device fingerprints.”2 (Dkt. No. 49, ¶¶ 1, 6, 7, 8, 13, 17, 21, 23, 48, 58, 73, 104, 109, 115, 149, 151(b), 155, 156, 169, 178, 179, 194, 200.) Plaintiffs assert Article III standing based on (1) invasion of privacy and (2) economic harm. (Id. at ¶¶ 39-47.) 1. Invasion of Privacy. Plaintiffs’ opposition brief largely recycles arguments rejected in the Court’s prior Order and does not explain how the Second Amended Complaint addresses the deficiencies of the First Amended Complaint. (Dkt. No. 65.) The Court’s prior Order explained why allegations regarding the disclosure of IP addresses, browser and device data, and “other identifying information” were insufficient to support a concrete privacy injury. (Dkt. No. 48.) The Second Amended Complaint adds some new categories of information that Defendant allegedly disclosed: browsing activity, geolocation data, device type, browser type, and “device fingerprints.” (Compare Dkt. No. 33 with Dkt. No. 49.) These new allegations are also insufficient to establish a concrete privacy injury. As the Court explained in its prior Order, to state a concrete privacy injury, plaintiffs must allege a harm analogous to the common-law privacy torts. (Dkt. No. 48); See also TransUnion, 594 U.S. at 424. A harm is analogous to the common-law privacy torts if it involves disclosure of a kind that would be “highly offensive” to a reasonable person. Popa v. Microsoft Corp., __F.4th__, 2025 WL 2448824, *5 (9th Cir. Aug. 26, 2025) (quoting Nayab v. Cap. One Bank (USA), N.A.,
Free access — add to your briefcase to read the full text and ask questions with AI
SABER KHAMOOSHI, et al., Case No. 24-cv-07836-SK
Plaintiffs, ORDER OF DISMISSAL WITH PREJUDICE FOR LACK OF v. STANDING
Regarding Docket No. 63 Defendant.
This matter comes before the Court upon consideration of the second motion to dismiss filed by Defendant Politico LLC (“Defendant”). (Dkt. No. 63.) The Court determines that the motion is appropriate for disposition without oral argument and, thus, is deemed submitted. See Civ. L.R. 7-1(b). All parties have consented to the jurisdiction of the Undersigned magistrate judge. (Dkt. Nos. 20, 21.) Having carefully considered the parties’ papers, relevant legal authority, and the record in the case, the Court hereby GRANTS Defendant’s motion to dismiss for lack of Article III standing and dismisses WITH PREJUDICE for the reasons set forth below. Because the Court agrees with Defendant that Plaintiffs lack Article III standing, there is no need to reach Defendant’s alternative arguments regarding the sufficiency of Plaintiffs’ claims.1 / / /
1 Defendant requests judicial notice of six documents on file in federal or state court and two California Assembly Bills in conjunction with its arguments that Plaintiffs fail to state a claim. (Dkt. No. 64, 67.) Although these materials may be judicially noticeable, the Court declines the request for judicial notice because these materials are unnecessary to the determination of the present motion. See Von Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2010) (“Judicial notice of legislative facts . . . is unnecessary.”); Lathan v. Ducart, No. 16-16551, 2017 WL 3976705, at *1 (9th Cir. June 16, 2017) (denying Plaintiffs Saber Khamooshi, Ryan Wu, Brian Carolus and John Deddeh (“Plaintiffs”) bring this putative class action against Defendant, alleging five claims under California law pursuant to: (1) the California Computer Data Access and Fraud Act, Cal. Penal Code § 502; (2) the California Invasion of Privacy Act, Cal. Penal Code § 638.51; (3) the right to privacy, Cal. Const. Art. 1, § 1; (4) unjust enrichment; and (5) the Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et seq. (Dkt. No. 49, ¶¶ 127-204.) Plaintiffs’ claims arise from Defendant’s alleged embedding of third party trackers on its website, www.Politico.com. (Dkt. No. 49.) The trackers allegedly collected Plaintiffs’ information without their consent for use in advertising and analytics. (Id.) This action was originally filed in the Superior Court of California for the County of San Francisco by Khamooshi, Wu, and Carolus on September 26, 2024. (Dkt. No. 1-1, p. 4.) Defendant removed the case to federal court on November 8, 2024, and the parties agreed to consolidate the claims with a later-filed case brought by Deddeh. (Dkt. Nos. 1, 29.) On March 31, 2025, Defendant filed a motion to dismiss Plaintiffs’ First Amended Complaint pursuant to Rules 12(b)(1), 12(b)(6), and 9(b). (Dkt. No. 35.) After full briefing and oral argument, the Court granted Defendant’s motion to dismiss for lack of Article III standing on May 13, 2025. (Dkt. No. 48.) The Court offered Plaintiffs an opportunity to amend their complaint. (Id.) Plaintiffs filed a Second Amended Complaint. (Dkt. No. 49.) Now before the Court is Defendant’s second motion to dismiss the Second Amended Complaint for lack of Article III standing and failure to state a claim. (Dkt. No. 63.) Plaintiffs filed an opposition, and Defendant filed a reply. (Dkt. Nos. 65, 67.) A. Legal Standard. The Court evaluates challenges to Article III standing under Rule 12(b)(1), which governs motions to dismiss for lack of subject matter jurisdiction. See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). Where, as here, a defendant brings a facial challenge to standing, the court assesses whether the plaintiff has alleged sufficient facts that, taken as true, demonstrate 2023) (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016), cleaned up). A plaintiff must allege facts demonstrating “(i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). Here, the dispute centers on whether Plaintiffs have alleged an injury that is “concrete.” A concrete injury is “real, and not abstract.” Id. at 424 (quoting Spokeo, 578 U.S. at 340). Concrete harms include “traditional tangible harms, such as physical harms and monetary harms.” Id. at 425. Intangible injuries may be concrete if they have a “close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts,” such as “reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. B. Defendant’s Motion. The Court previously dismissed this action for lack of Article III standing because Plaintiffs did not allege a “concrete” injury under the analysis mandated by TransUnion. (Dkt. No. 48.) The Court rejected Plaintiffs’ arguments that they suffered three types of concrete injury: (1) invasion of privacy, (2) unjust enrichment, and (3) heightened risk of future harm. (Id.) First, the Court explained that the information allegedly disclosed—IP addresses, browser and device data, and “other identifying information”—either did not implicate a protectable privacy interest (IP addresses) or were fatally vague (browser and device data, other identifying information). (Id.) Second, the Court explained that Plaintiffs could not establish standing under an unjust enrichment theory because they had not plausibly alleged that the disclosure of their information was unjust. (Id.) Third, the Court explained that Plaintiffs could not base standing on a future risk of harm because they had not alleged any facts indicating that the disclosed information could be used to harm them. (Id.) The Second Amended Complaint alleges that the information disclosed includes IP addresses, browser and device data, and “other identifying information,” as well as browsing activity, geolocation information, device type, browser type, and “device fingerprints.”2 (Dkt. No. 49, ¶¶ 1, 6, 7, 8, 13, 17, 21, 23, 48, 58, 73, 104, 109, 115, 149, 151(b), 155, 156, 169, 178, 179, 194, 200.) Plaintiffs assert Article III standing based on (1) invasion of privacy and (2) economic harm. (Id. at ¶¶ 39-47.) 1. Invasion of Privacy. Plaintiffs’ opposition brief largely recycles arguments rejected in the Court’s prior Order and does not explain how the Second Amended Complaint addresses the deficiencies of the First Amended Complaint. (Dkt. No. 65.) The Court’s prior Order explained why allegations regarding the disclosure of IP addresses, browser and device data, and “other identifying information” were insufficient to support a concrete privacy injury. (Dkt. No. 48.) The Second Amended Complaint adds some new categories of information that Defendant allegedly disclosed: browsing activity, geolocation data, device type, browser type, and “device fingerprints.” (Compare Dkt. No. 33 with Dkt. No. 49.) These new allegations are also insufficient to establish a concrete privacy injury. As the Court explained in its prior Order, to state a concrete privacy injury, plaintiffs must allege a harm analogous to the common-law privacy torts. (Dkt. No. 48); See also TransUnion, 594 U.S. at 424. A harm is analogous to the common-law privacy torts if it involves disclosure of a kind that would be “highly offensive” to a reasonable person. Popa v. Microsoft Corp., __F.4th__, 2025 WL 2448824, *5 (9th Cir. Aug. 26, 2025) (quoting Nayab v. Cap. One Bank (USA), N.A., 942 F.3d 480, 491 (9th Cir. 2019) and Restatement (Second) of Torts § 652D). Because the injury depends on the nature of the information at issue, plaintiffs must identify the specific information allegedly disclosed. I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034, 1050 (N.D. Cal. 2022); see also Mikulsky v. Noom, Inc., 682 F. Supp. 3d 855, 864 (S.D. Cal. 2023) In Popa, which was decided on August 26, 2025, after the Court issued the order dismissing the First Amended Complaint on May 13, 2025, the Ninth Circuit considered allegations that the defendant had allegedly disclosed “over 30 different categories of information including: the date a user visited the website, the device the user accessed the website on, the type of browser the user accessed the website on, the operating system of the device used to access the website, the country where the user accessed the website from, a user’s mouse movements, a user’s screen swipes, text inputted by the user on the website, and how far down a webpage a user scrolls,” the user’s mailing address with the street number and zip code omitted, and the pet supplies products that interested the user. 2025 WL 2448824, at *2. The court concluded that this information did not give rise to a concrete privacy because the plaintiff “identifie[d] no embarrassing, invasive, or otherwise private information collected.” Id. at *5. Popa controls the analysis in this case. As in Popa, Plaintiff identifies “no embarrassing, invasive, or otherwise private information collected.” See id. at *5. Plaintiffs’ allegations regarding device type, browser type, and “device fingerprints” are even less specific that the 30 different categories of information alleged in Popa¸ which also included the device type, browser type, and metadata akin to fingerprinting. See also Kishnani v. Royal Caribbean Cruises Ltd., No. 25-CV-01473-NW, 2025 WL 1745726, at *5 (N.D. Cal. June 24, 2025) (“If [d]efendant only collects information regarding the “metadata” of the communication, [p]laintiff’s right to privacy is not invaded because he has no expectation of privacy as to that type of data (e.g., his IP address or general geographic location.”). While some types of browsing activity implicate protectable privacy interests, others do not. Compare Popa, 2025 WL 2448824, at *5 (no protectable privacy interest in browsing activity on a pet supply website) with In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 599 (9th Cir. 2020) (protectable privacy interest in “cradle-to-grave profile” of users’ browsing activity across third-party websites combined with their Facebook profiles). The same is true for geolocation information. Compare In re Google Location Hist. Litig., 428 F. Supp. 3d 185, 198 (N.D. Cal. 2019) (no protectable privacy interest in “bits and pieces” of plaintiffs’ movements captured only when plaintiffs used defendant’s services) with Carpenter v. United States, 585 U.S. 296, 310 (2018) (protectible privacy interest in comprehensive record of physical movements as captured by cell-site location information). Absent specific allegations about the type of browsing and geolocation information disclosed, these categories of information are insufficient to support a concrete privacy injury. Article III standing. 2. Economic Harm. Plaintiffs argue that they have alleged economic harm sufficient for standing because Defendant unjustly profited from the use of their data and because their data carries financial value. (Dkt. No. 65, p. 13.) As to the unjust enrichment theory, the Court previously explained that the First Amended Complaint failed to allege plausible facts suggesting that Defendant was unjustly enriched. (Dkt. No. 48.) The Second Amended Complaint does not cure this deficiency, as it adds no new allegations that plausibly support this theory. (Dkt. No. 49.) Moreover, Plaintiffs do not meaningfully address this claim in their opposition, devoting less than a full paragraph to it. (Dkt. No. 65.) As to the financial value theory, Plaintiffs allege only that “user data carries financial value.” (Dkt. No. 49, ¶ 44.) “[A]lthough it’s true that each user’s information is worth a certain amount of money to [Defendant], it does not follow that the same information, when not disclosed, has independent economic value to an individual user.” In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 784 (N.D. Cal. 2019). Plaintiffs point to studies offering to pay users to observe their behavior browsing the web. (Dkt. No. 49, ¶ 44, 49.) However, Plaintiffs do not allege that their web browsing behavior was disclosed, or that Defendant’s actions diminished their opportunity to get paid for such studies. See In re Facebook Internet Tracking Litig., 140 F. Supp. 3d 922, 932 (N.D. Cal. 2015) (“That programs may exist to compensate internet users with $5 gift cards in exchange for monitoring their browsing activity is a fact of little assistance to [p]laintiffs when they have not also alleged an inability to participate in these programs after [Defendant] collected their information.”). Plaintiffs have failed to allege an economic injury sufficient to establish Article III standing.3 3 The Second Amended Complaint includes new allegations that Defendant’s technology slows Plaintiffs’ browsers and devices and increases their device costs. (Dkt. No. 49, ¶¶ 79, 157.) 2 Plaintiffs have not alleged a concrete injury, and thus have not met their burden of 3 demonstrating Article III standing. The Court therefore GRANTS Defendant’s motion to dismiss. 4 The Court has already allowed Plaintiffs one opportunity to amend their complaint, and Plaintiffs 5 have done little to supplement their allegations supporting standing. Accordingly, the Court finds 6 that further amendment would be futile and dismissal for lack of standing shall be WITH 7 PREJUDICE. As this Court lacks subject matter jurisdiction over the claims, all of which are 8 based on state law, IT IS HEREBY ORDERED that this case shall be remanded to the Superior 9 Court of California for the County of San Francisco. The clerk is instructed to transfer the file. 10 See Polo v. Innoventions Int'l, LLC, 833 F.3d 1193, 1196 (9th Cir. 2016); Walker v. Kroger Co., 11 No. 22-CV-00261-JST, 2022 WL 20208929, at *2 (N.D. Cal. June 21, 2022). 13 Dated: October 2, 2025 ® la .
United States Magistrate Judge 16
18 19 20 21 22 23 24 25 26 27 28 standing in their opposition brief. Accordingly, the Court does not consider these allegations as a basis for Article HII standing.