Kiley Krzyzek, et al. v. OpenX Technologies, Inc.

Opinion

KILEY KRZYZEK, et al., Case No. 25-cv-05588-SI

Plaintiffs, ORDER GRANTING IN PART AND v. DENYING IN PART MOTION TO DISMISS Re: Dkt. No. 26 Defendant.

Before the Court is defendant OpenX’s motion to dismiss plaintiffs’ putative class action. Dkt. No. 26. The Court held a hearing on January 16, 2026. After considering the papers and oral argument, the Court GRANTS IN PART and DENIES IN PART defendant’s motion to dismiss. Plaintiffs bring this putative class action against defendant OpenX Technologies, Inc. (“OpenX”). Defendant OpenX is a registered data broker.1 Dkt. No. 23, First Amended Complaint (“FAC”) ¶ 11. OpenX operates the OpenX pixel, which plaintiffs allege “tracks in real time and records indefinitely the personal information and specific web activity of hundreds of millions of Americans.” Id. ¶ 1. This order assumes the reader’s familiarity with defendant’s pixel tracking technology, described in detail in the FAC. Id. ¶¶ 65-173. In addition to its pixel, OpenX sells its tracking services to advertising partners through its “identity resolution tool,” through which OpenX “assigns an ID number to an individual so that the individual is attached to a record of their web and

1 A “data broker” is a “business that knowingly collects and sells to third parties the personal app activity for the purpose of targeted advertising.” Id. ¶¶ 154-158. Plaintiffs are natural persons and citizens of California who OpenX allegedly tracked. Id. ¶¶ 4-5. Specifically, plaintiff Kiley Kyrzek alleges that the OpenX pixel collected information about her device and browser, and “tracked her as she navigated through the [Covered California] website” in 2022 and 2024 to apply for health insurance. Id. ¶¶ 199-203. Plaintiff Christian Calcines alleges that the OpenX pixel tracked him while he navigated through the Bon Appetit website in April 2025 and intercepted his “article selections” and “audience information related to those selections.” Id. ¶¶ 210-217. Calcines also alleges that the OpenX tracker was present on other websites he visited, including Apartmenttherapy.com, Foxnews.com, and BusinessInsider.com. Id. ¶ 221. Each named plaintiff also alleges that OpenX compiled the information it gathered into a profile on plaintiff, and that plaintiffs were unaware of and did not consent to OpenX’s conduct. Id. ¶¶ 205, 207-208, 219, 222-223. Plaintiffs bring five claims against OpenX: intrusion upon seclusion under California common law (Count I); violations of provisions of the California Invasion of Privacy Act (“CIPA”), California Penal Code §§ 631(a) and 638.51 (a) (Counts II and III), unjust enrichment (Count IV), and violation of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2511 (Count V). On November 21, 2025, OpenX moved to dismiss plaintiffs’ first amended complaint for lack of subject matter jurisdiction and failure to state a claim.2 Dkt. No. 26. Plaintiffs filed a response3, and Open X filed a reply. Dkt. Nos. 27, 30. ///

2 Plaintiffs filed their complaint on July 2, 2025. Dkt. No. 1. After defendant filed a motion to dismiss on October 3, 2025, plaintiffs filed their first amended complaint (FAC). Dkt. Nos. 22, 23.

3 Plaintiffs also filed “Exhibit 1 to Plaintiffs’ Opposition to Defendant’s Motion to Dismiss I. Rule 12(b)(1) Federal Rule of Civil Procedure 12(b)(1) allows a party to challenge a federal court’s jurisdiction over the subject matter of the complaint. As the party invoking the jurisdiction of the federal court, the plaintiff bears the burden of establishing that the court has the requisite subject matter jurisdiction to grant the relief requested. See Kokkonen v. Guardian Life Ins. Co. of America, 511 U.S. 375, 377 (1994) (internal citations omitted). A complaint will be dismissed if, looking at the complaint as a whole, it appears to lack federal jurisdiction either “facially” or “factually.” Thornhill Publ’g Co., Inc. v. General Tel. & Elecs. Corp., 594 F.2d 730, 733 (9th Cir. 1979); Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004) (“A Rule 12(b)(1) jurisdictional attack may be facial or factual.”). When the complaint is challenged for lack of subject matter jurisdiction on its face, all material allegations in the complaint will be taken as true and construed in the light most favorable to the plaintiff. NL Indus. v. Kaplan, 792 F.2d 896, 898 (9th Cir. 1986). II. Rule 12(b)(6) Under Federal Rule of Civil Procedure 12(b)(6), a district court must dismiss a complaint if it fails to state a claim upon which relief can be granted. To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). This “facial plausibility” standard requires the plaintiff to allege facts that add up to “more than a sheer possibility that a defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). While courts do not require “heightened fact pleading of specifics,” a plaintiff must allege facts sufficient to “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555, 570. In deciding whether the plaintiff has stated a claim upon which relief can be granted, the court must assume that the plaintiff’s allegations are true and must draw all reasonable inferences in the plaintiff’s favor. See Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). However, the court is not required to accept as true “allegations that are merely conclusory, 1049, 1055 (9th Cir. 2008). If the Court dismisses the complaint, it must then decide whether to grant leave to amend. The Ninth Circuit has “repeatedly held that a district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000) (citations and internal quotation marks omitted). I. Article III Standing The parties dispute whether plaintiffs have Article III standing to bring their claims against OpenX. OpenX argues that the Court should dismiss plaintiffs’ claims for lack of subject matter jurisdiction because plaintiffs do not allege “highly offensive” privacy injuries sufficient to confer Article III standing. Mot. at 8-11. Plaintiffs respond that they establish an injury in fact because OpenX “compiled detailed profiles by tracking [Plaintiffs’] interactions across many websites, including websites where they disclosed sensitive data and selling that information to any and all interested advertisers.” Opp’n at 2. Federal courts may only hear a case if plaintiffs can show they have standing to sue. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016, revised May 24, 2016). To establish standing to sue, plaintiffs must show an injury, trace that injury to the defendant’s conduct, and prove that courts can provide adequate redress for the injury. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992). The injury “must be concrete, particularized, and actual or imminent.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (internal quotation marks and citation omitted). Intangible harms may constitute concrete injuries if they bear a “close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” TransUnion LLC v. Ramirez, 594 U.S. 413, 425 (2021). “[B]oth the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.” U.S. Dep't of Just. v. Reps. Comm. For Freedom of Press, 489 U.S. 749, 763 (1989). plaintiffs’ claims. See 153 F.4th 784, 791 (9th Cir. 2025). In Popa, the Ninth Circuit affirmed the district court’s dismissal for lack of Article III standing where plaintiff alleged defendant’s session- replay technology captured her information while she browsed for pet supplies on a single website, https://www.petsuppliesplus.com, because the nature of the collected information was not “embarrassing, invasive, or otherwise private.” Id. at 786-87, 791. The information defendant collected allegedly included: the date the user visited the website, the device the user accessed the website on, the type of browser the user accessed the website on, the operating system of the device used to access the website, the country where the user accessed the website from, a user’s mouse movements, a user’s screen swipes, text inputted by the user on the website, and how far down a webpage a user scrolls, the user’s mailing address with the street number and zip code omitted, and the pet supplies products the user clicked on. Id. However, here, plaintiffs allege a more invasive injury. Indeed, plaintiffs allege that OpenX compiled detailed user profiles by tracking plaintiffs’ interactions across many websites, including sensitive browsing activity, without plaintiffs’ knowledge or consent. FAC. ¶¶ 43-44, 53-56, 79, 92-93, 163, 186, 238, 244. Plaintiffs also allege that OpenX tracked plaintiffs’ future web browsing activity across the internet. Id. ¶¶ 174, 185, 206, 220. The collected data allegedly includes “cookies, IP addresses, hashed email addresses4, HTTP headers that specify information such as type of browser, device and operating system information, location information, and other unique identifiers” and “information regarding the users’ activity on the websites and communications with the websites in the form of full-string URLs and button click events.” Id. ¶¶ 89-90. Plaintiffs allege that OpenX collects information on plaintiffs’ “interests and even-sociopolitical views.” Id. ¶¶ 43, 98. Plaintiffs Kyrzek and Calcines allege that, without their knowledge or consent, OpenX loaded its pixel onto websites they visited (Covered California and BonAppetit, respectively), created a new user profile of them or matched them to a pre-existing profile, collected and tracked their browsing activity while on those websites, and then tracked their future web browsing activity across

4 Plaintiffs allege that while OpenX collects “hashed” email addresses and phone numbers, the internet. Id. ¶¶ 199-224. Unlike in Popa, which involved non-sensitive browsing activity on a single pet supply website, here plaintiffs allege that OpenX created or added to detailed user profiles by tracking their interactions across the internet, and that this tracking remains ongoing. Accordingly, this situation is more akin to In re Facebook, Inc., Internet Tracking Litigation, finding Article III standing where plaintiffs “adequately alleged that Facebook’s tracking and collection practices would cause harm or a material risk of harm to their interest in controlling their personal information.” 956 F.3d 589, 596 (9th Cir. 2020).5 As in In re Facebook, OpenX allegedly “gained a cradle-to-grave profile without users’ consent.” See id. at 599 (“As alleged, Facebook’s tracking practices allow it to amass a great degree of personalized information. Facebook’s user profiles would allegedly reveal an individual’s likes, dislikes, interests, and habits over a significant amount of time, without affording users a meaningful opportunity to control or prevent the unauthorized exploration of their private lives.”). The Court is also unpersuaded by OpenX’s argument that plaintiffs lack standing because the personal information OpenX’s pixel collected is anonymous. Mot. at 10-11, Reply at 7. OpenX argues that it collects information tied to “devices – not individuals.” Mot. at 2. Beyond allegations of OpenX’s technology’s capacity to deanonymize data, plaintiffs claim that OpenX products do identify and deanonymize users. For instance, the complaint alleges that defendant effectively deanonymized plaintiffs by using the information it gathers to tie plaintiffs to individual profiles within a broad “identity graph.” FAC ¶¶ 56-57.6 Plaintiffs allege that through this process OpenX 5 Lower courts have recognized that Popa did not set out a new rule of law for Article III standing, but rather applied the same common law rules to the individual circumstances of that case. See Dellasala v. Samba TV, Inc., 2025 WL 3034069, at *2 (N.D. Cal. Oct. 30, 2025); Camplisson v. Adidas Am., Inc., 2025 WL 3228949, at *6 (S.D. Cal. Nov. 18, 2025). Indeed, “Popa confirmed that Facebook remains good law. Specifically, Popa observed that it ‘need not revist’ the continued viability of Facebook, because Facebook’s alleged compilation of ‘personally identifiable browsing history’ demonstrated ‘individual circumstances giving rise to plaintiffs’ alleged injuries’ that satisfied Article III’s standing requirements.” Deivaprakash v. Conde Nast Digital, 2025 WL 2779193, at * 1 (N.D. Cal. Sep. 30, 2025) (internal citation omitted).

6 In its reply brief, OpenX argues that the FAC does not adequately allege OpenX collected hashed emails or hashed phone numbers from plaintiffs Kryzek and Calcines such that their has amassed access to “nearly three-quarters of all Americans’ identities.” Id. ¶¶ 62. Where anonymity is rendered “functionally meaningless,” lower courts have found “pseudonymization” arguments unpersuasive. See, e.g., Riganian v. LiveRamp Holdings Inc., 791 F. Supp. 3d 1075, 1086-87 (N.D. Cal. 2025). The Court finds that, at this stage of the litigation, plaintiffs have adequately pled a “highly offensive” intrusion of privacy that invades a reasonable internet user’s expectation of privacy sufficient to establish standing. See In re Facebook, 956 F.3d at 606 (“The ultimate question of whether Facebook’s tracking and collection practices could highly offend a reasonable individual is an issue that cannot be resolved at the pleading stage.”). Thus, the Court DENIES defendant’s Rule 12(b)(1) motion. II. Intrusion Upon Seclusion (COUNT I) OpenX argues that plaintiffs failed to establish either prong of an intrusion upon seclusion claim. Mot. at 11-15. To state a claim for intrusion upon seclusion under California common law, “[f]irst, the defendant must intentionally intrude into a place, conversation, or matter as to which the plaintiff has a reasonable expectation of privacy, and second, the intrusion must occur in a manner highly offensive to a reasonable person.” Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 (2009). When determining whether a reasonable expectation of privacy exists, courts consider “a variety of factors, including the customs, practices, and circumstances surrounding a defendant’s particular activities.” In re Facebook, 956 F.3d at 601-02. When determining whether an invasion is “highly offensive,” courts consider “the degree and setting of the intrusion,” as well as “the intruder’s motives and objectives.” Hernandez, 47 Cal. 4th at 287. “Under California law, courts must be reluctant to reach a conclusion at the pleading stage about how offensive or serious the privacy intrusion is.” In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 797 (N.D. Cal. 2019). OpenX first argues that plaintiffs cannot reasonably expect privacy while browsing on the internet on websites such as Bon Appetit and Covered California. Mot. at 12. OpenX suggests “[s]hopping on a public website, like shopping in a public store, is not an activity one can reasonably expect to keep private from the retailer.” See Thomas v. Papa Johns Int’l., 2024 WL 2060140, at *2 (S.D. Cal. May 8, 2024). Moreover, OpenX contends that there is no reasonable expectation of privacy in the type of information that OpenX allegedly collected. Mot. at 13. The Court finds that OpenX’s alleged conduct is very different from being observed by a retailer while shopping in a store. Instead, as discussed above, OpenX allegedly tracks, compiles, and sells massive amounts of information on plaintiffs, without their knowledge that an OpenX pixel has been loaded onto a given website. The Court also agrees with various other lower courts that have found that “engag[ing] in unauthorized tracking and data collection, allowing it to compile detailed profile of each [p]laintiff’s online web browsing activity – including highly sensitive browsing activity – tied to their email addresses and other personal identifiers” is actionable. Selby v. Sovrn Holdings, 2025 WL 2950164, at *3 (N.D. Cal. Oct. 17, 2025); see also Riganian, 791 F. Supp. 3d at 1087 (“the Court here cannot conclude at the pleading stage that Plaintiffs had no reasonable expectation of privacy in the information that LiveRamp compiled across hundreds to thousands of disparate online and offline sources and then sold to third parties without their knowledge or consent”). Here, too, defendant allegedly amasses information allowing it to compile detailed profiles to sell to advertisers. OpenX next argues that its conduct collecting user information reflects “routine commercial behavior,” and is not highly offensive. Mot. at 14. However, at this stage, the Court cannot conclude that OpenX’s conduct was not offensive, as “courts must be reluctant to reach a conclusion at the pleading stage about how offensive or serious the privacy intrusion is.” In re Facebook, Inc., 402 F. Supp. at 797; see also Selby 2025 WL 2950164, at *3. Therefore, the Court finds that the plaintiffs’ intrusion on seclusion claim can proceed. III. Violations of CIPA § 631 and ECPA § 2511(1) (COUNTS II and V) California Penal Code section 631 creates four alternative avenues of liability for any person [1] who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or

[2] who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or [3] who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or

[4] who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section . . . .

Cal. Pen. Code § 631(a) (subdivisions added for clarity); Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 897 (N.D. Cal. 2023). The third clause requires proving a violation of the first or second clauses. See In re Google Assistant Priv. Litig., 457 F. Supp. 3d 797, 827 (N.D. Cal. 2020). Otherwise, these clauses are independent bases for liability and a section 631 claim survives if a plaintiff plausibly alleges a defendant committed any of the prohibited actions. Here, plaintiffs allege violations of the last three clauses of the statute. FAC. ¶¶ 246-260.7 Plaintiffs also allege a violation of the ECPA, which provides a cause of action against any person who “intentionally intercepts, endeavors to intercept, or procurers any other person to

7 In a footnote and during the hearing, defendant argued that “to the extent Plaintiffs’ vague allegations that Open X ‘enables Partner Trackers to identify the user behind any specific communication’ is intended to invoke a claim under subsection (iv) aiding and abetting, that allegation is plainly insufficient.” Mot. at 15, n.3. Plaintiffs did not address this argument in their opposition brief. When questioned by the Court at the hearing, plaintiffs directed the Court to FAC ¶ 257, which states: “Further, Defendant ‘[a]ids, agrees with, employs, or conspires with’ each Partner Tracker that it provides identity resolution to and who intercepts Plaintiffs’ and California Subclass Members’ confidential communications, in that Defendant enables these Partner Trackers to identify the user behind any specific communication.” The Court finds aiding and abetting intercept or endeavor to intercept, any wire, oral, or electronic communication.” FAC ¶¶ 286-306; 18 U.S.C § 2511(1).8 The parties dispute whether defendant intercepted the “contents” of plaintiffs’ communications; whether defendant is a third party subject to the law or a party to the conversation exempt from the law; whether defendant intercepted communications “in transit,” and whether the crime-tort exception to the ECPA applies. See Mot. at 15-21; Opp’n at 8-14. The Court considers each argument in turn. A. Contents of Communications Open X argues that “information about [users’] devices, browsers, visits to Bon Appetit and Covered California websites (though not any specific URLs), and unspecified ‘future browsing activity’” do not constitute “contents” of a communication. Mot. at. 16. “Contents” are defined as the “substance, purport, or meaning” of a communication. 18 U.S.C. § 2510(8); see U.S. v. Reed, 575 F.3d 900, 917 (9th Cir. 2009).9 The Ninth Circuit has explained that “record information regarding the characteristics of the message that is generated in the course of the communication” is not “content.” In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014). Notwithstanding OpenX’s contention to the contrary, plaintiffs’ complaint adequately alleges that OpenX intercepts more than just “record information.” Plaintiffs allege that OpenX collects users’ “communications with [partner] websites in the form of full-string URLs and button click events.” Id. ¶ 90. Plaintiffs allege that OpenX’s pixel intercepts the “detailed, full-string URLS” from each page of a website that the user visits, “thereby intercepting the user’s communications with the website regarding which articles they want to view.” Id. ¶ 170. The complaint explains that those full-string URLs include the full title of articles users’ view, which 8 Courts analyze violations of 18 U.S.C. § 2511(1) and CIPA § 631(a) under the same standards. See, e.g., Cline v. Reetz-Laiolo, 329 F. Supp. 3d 1000, 1051 (N.D. Cal. 2018).

9 Courts have determined that “the ‘contents’ of a communication under the ECPA and CIPA reveals the users’ interests (e.g. “htpps://www.bonappetit.com/gallery/taylor-swift-travis-kelce- pop-tarts”). Id. ¶ 120. “URLs which disclose search terms that reveal website users’ personal interests, queries, and habits are ‘contents’ of communications under CIPA and ECPA.” R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 902 (C.D. Cal. 2024); see also, Selby., 2025 WL 2950164, at *3. Open X disputes plaintiffs’ contention that collecting the specific web pages users visit discloses “personal interests, queries, and habits.” Opp’n at 9; Reply at 10. Further, Open X contends that Selby, R.C., and other authority plaintiffs cite to are inapposite because in those cases the defendants allegedly intercepted users’ “search terms” or “search queries,” whereas here the complaint alleges OpenX intercepts URLs. Reply at 10. But, as these cases acknowledge, URLs can also reveal website users’ personal interests, queries, and habits, particularly when aggregated into comprehensive user profiles. OpenX also argues that the complaint is deficient because plaintiffs do not identify which specific URLs they visited while using the websites that OpenX purportedly tracked. Mot. at 17. The Court disagrees. Plaintiffs have adequately alleged that OpenX intercepts not only the websites visited, but also URLS including specific articles or pages the plaintiffs viewed. See, e.g., Gilligan v. Experian Data Corp. 2026 WL 32259, *3 (N.D. Cal. Jan. 6, 2026). The Court acknowledges that lower courts have sometimes found similar complaints deficient where a plaintiff does not identify with specificity what searches they conducted or what webpages they viewed. See, e.g., King Hard Rock Café International Café Int’l (USA), Inc., 2025 WL 1635419, *4 (E.D. Cal. June 9, 2025); Lewis v. Magnite, Inc. 2025 WL 3687546 *12 (C.D. Cal. Dec. 4, 2025). However, the Court finds that here plaintiffs have sufficiently alleged that OpenX intercepted the contents of their communications while they navigated through various websites, including Bon Appetit and Covered California, such that OpenX has adequate notice of plaintiffs’ claims. B. Third Party OpenX argues that that it is a “party” to plaintiffs’ alleged communications, and therefore knowingly transmitted data to the website operators. Mot. at 17. OpenX suggests it is merely, “an extension” of the website operators rather than an outsider “who presses up against a door to listen to a conversation.” Id. (quoting Graham v. Noon, Inc. (Graham I), 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021)). Plaintiffs counter that the “extension approach” is the incorrect standard to apply, but that even applying that outdated approach, OpenX would qualify as a third party. Opp’n at 12. The Court finds that OpenX is a “third party” under CIPA § 631 because it “ha[s] the capability of using its recording for another purpose.” See e.g. Turner v. Nuance Communications, Inc., 735 F. Supp. 3d 1169, 1184 (N.D. Cal. 2024) (collecting cases applying the “capability approach”). Plaintiffs may voluntarily visit the websites in question, but plaintiffs allege they did not voluntarily or knowingly visit websites that intercepted and compiled their every search via unannounced OpenX pixel. Therefore, while OpenX argues that it did not use any data for any reason other than to facilitate sales of advertising impressions for its website partners, this is not the question the third party analysis turns on. See Taylor v. ConverseNow Techs., Inc., 2025 WL 2308483, * 4 (N.D. Cal. Aug. 11, 2025). Instead, what matters is that the privacy concerns here are akin to “having an unannounced second auditor listening in[.]” Turner, 735 F. Supp. 3d at 1182. Accordingly, the Court rejects OpenX’s contention that it is exempt from liability on this basis. C. Interception in Transit The second clause of Section 631 requires that the defendant intercept a communication when it is “in transit.” Cal. Pen. Code § 631(a). The “in transit” element has the same meaning under the ECPA. To determine whether an interception has occurred, courts will look at “cases analyzing the Wiretap Act as informative of section 631(a).” Licea v. Am. Eagle Outfitters, Inc., 659 F. Supp. 3d 1072, 1084 (C.D. Cal. 2023). The Ninth Circuit analyzed 18 U.S.C. § 2511(1) to determine that interception “with respect to wire communications” is “acquisition contemporaneous with transmission.” Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 2002). Defendant argues that plaintiffs’ interactions with websites are not intercepted while “in transit” because any interception “occurs after any communications arrived at their intended communications in real-time. The complaint includes detailed descriptions of how OpenX’s pixel technology purportedly works. FAC ¶ ¶ 124-162. The complaint adequately alleges that after the OpenX pixel is loaded onto a user’s browser, then it “intercepts the detailed, full-string URL from each page” of a website a user visits, “thereby intercepting the user’s communications with the website regarding which articles they want to view.” FAC ¶ 170. This process allegedly occurs in “transit,” and begins “within seconds” of the user reaching a partner website. Id. ¶ ¶ 168, 255. OpenX suggests that, like in NovelPoster v. Javitch Canfield Grp., its purported conduct is “analogous to collecting information about emails after they are received.” Mot. at 19; see 140 F. Supp. 3d 938, 951-52 (N.D. Cal. 2014) (“There is only a narrow window during which an E-mail interception may occur—the seconds or milli-seconds before which a newly composed message is saved to any temporary location following a send command.”). But, unlike in NovelPoster where emails were accessed in accounts after they were received, here the complaint alleges that OpenX’s “interceptions” occurred while users communicated with websites through their browsing activities. While OpenX may be able to show that it does not actually intercept any communications in transit, that factual dispute is not appropriately resolved here. The Court therefore finds that plaintiffs have plausibly alleged interception in transit. D. Crime-Tort Exception OpenX argues that plaintiffs’ ECPA claim fails because Bon Appetit and, allegedly, Covered California10 consented to install the OpenX pixel on their websites, and thus there is no liability under the ECPA. Mot. at 19-20. Plaintiffs contend that any consent is negated by the crime-tort exception to the ECPA. Opp’n at 13-14. Where “one of the parties to the communication has given prior consent to such interception,” there can be no violation of ECPA. 18 U.S.C. § 2511(d); see also, In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1026 (N.D. Cal. 2014) (“The consent of one party is a complete defense

10 OpenX acknowledges that Bon Appetit installed OpenX’s pixel on its website, but states to a Wiretap Act claim.”). However, the ECPA provides an exception (“the crime-tort exception”) whereby there is a violation even with consent if the “communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or any state.” 18 U.S.C. § 2511(d); see Katz-Lacabe v. Oracle America, Inc. 668 F. Supp. 3d 928 (N.D. Cal. 2023); In re Google Inc. Gmail Litig., 2014 WL 1102660, at *18 n.3 (N.D. Cal. Mar. 18, 2014) (“Alleged interceptions fall within the tort or crime exception only where the ‘primary motivation or a determining factor in [the interceptor’s] actions has been to injure plaintiffs tortiously.’”) (quoting In re Double Click Inc. Privacy Litig., 154 F. Supp. 2d 497, 518 (S.D.N.Y 2001). Courts have held that “the association of Plaintiffs’ data with preexisting user profiles is a further use of Plaintiffs’ data that satisfies this exception.” See Brown v. Google LLC, 525 F. Supp. 3d 1049, 1067 (N.D. Cal. 2021); see also Planned Parenthood Fed’n of Am., Inc., v. Ctr. for Med. Progress, 214 F. Supp. 3d 808, 828 (N.D. Cal. 2016). OpenX argues that ECPA’s crime-tort exception is inapplicable because OpenX’s primary motivation in collecting data was to profit, or “routine commercial behavior,” rather than to injure plaintiffs tortiously or criminally. Mot. at 20. The Court is not persuaded by the authorities OpenX’s cites to argue financial motives cannot constitute tortious motive. See Lakes v. Ubisoft, Inc., 777 F. Supp. 3d 1047 (N.D. Cal. 2025), appeal docketed, No. 25-2857 (9th Cir. May 2, 2025); Roe v. Amgen Inc, 2024 WL 2873482, at *6 (C.D. Cal. June 5, 2024). As numerous lower courts have found, being primarily motivated by profit does not render the crime-tort exception inapplicable. See, e.g., R.C., 733 F. Supp. 3d at 902 (C.D. Cal. 2024) (collecting cases); Riganian, 791 F. Supp. 3d at 1090-91 (“Put simply, committing a tort and seeking a profit are not mutually exclusive (if anything, the latter is often the reason for the former)”). Where, as here, plaintiffs adequately alleged invasion of privacy, the Court is not convinced that ECPA’s crime-tort exception does not apply. Therefore, the Court declines to dismiss plaintiffs’ ECPA claim. E. Conclusion as to CIPA § 631 and ECPA § 2511 Liability OpenX’s arguments that plaintiffs have failed to state claims under CIPA § 631 and ECPA third, and fourth clauses of Section 631. The Court therefore DENIES OpenX’s motion to dismiss plaintiffs’ claims under CIPA § 631 and ECPA § 2511. IV. Violation of CIPA § 638.51 (COUNT III) Under Section 638.51(a) of the California Penal Code, “a person may not install or use a pen register ... without first obtaining a court order[.]” A pen register is a “device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Cal. Penal Code. § 638.50(b). OpenX argues that pixels do not meet the definition of a “pen register” under CIPA for three primary reasons. Mot. at 21. First, defendant argues that its pixel is not a pen register because it records a user’s own information, and is therefore not akin to the numbers dialed on a telephone. Id. Second, defendant argues that CIPA’s legislative history demonstrates that it does not apply to web pixels. Id. at 22. Third, defendant argues that reading CIPA’s definition of pen registers to encompass web pixels would create conflict between the California Penal Code and the California Consumer Privacy Act (CCPA). Id. at 23. OpenX relies on various state court decisions to support its interpretation. Numerous courts in this district and elsewhere have already found pixels to be “pen registers” at the pleading stage, and OpenX’s arguments tread no new ground. See Fregosa v. Mashable Inc., 2025 WL 2886399, at *2 (“Several judges in this district, including Judges Lin, Orrick, Pitts, Ryu, Tigar, and [Breyer], have held that such allegations suffice at the pleading stage.”); see also Bradshaw v. Lowe’s Companies, Inc., 2025 WL 3171740, at *7 (S.D. Cal Nov. 12, 2025) (“[T]he case law is not in Defendants’ favor. Indeed, it uniformly supports the opposite outcome”). Another court in this district recently determined OpenX’s pixel to be a pen register at the pleading stage. See Echeverria-Corzan v. Fox Corp., No. 2025 WL 3128194, at *1 (N.D. Cal. Nov. 7, 2025). For the same reasons these earlier courts have stated, the Court finds that plaintiffs’ CIPA § 638.51 claim can proceed. ] V. Unjust Enrichment (COUNT IV) 2 Finally, defendant argues that the Court should dismiss plaintiffs’ unjust enrichment claim 3 because plaintiffs do not plead that they lack an adequate remedy at law. Mot. at 23. Plaintiffs 4 contend that they bring their unjust enrichment claim in the alternative, which is sufficient at the 5 pleading stage. Opp’n at 21. 6 In Sonner v. Premier Nutrition Corp., the Ninth Circuit held that a plaintiff could not pursue 7 equitable relief unless there is no adequate remedy at law. 971 F.3d 834, 844 (9th Cir. 2020). The 8 Court finds that plaintiffs’ unjust enrichment claim must be dismissed with leave to amend, because 9 plaintiffs have not alleged that they lack an adequate remedy at law. See Jn Re Apple Processor 10 Litig., 2023 WL 5950622, at * 2 (9th Cir. Sept. 13, 2023) (“[p]laintiffs were obliged to allege that 11 they had no adequate legal remedy in order to state a claim for equitable relief); see also Selby, 2025 12 WL 2950164, at *4 (failing to allege “how the money they seek through restitution is any different 13 than the money they seek as damages”); Gilligan, 2026 WL 32259, at *4 (“Nothing in the Complaint 14 indicates that the plaintiffs’ legal remedies are insufficient.”). Therefore, the Court GRANTS 15 OpenX’s motion as to Count IV, with leave to amend.

Zz 18 For the foregoing reasons and for good cause shown, the Court hereby GRANTS defendant’s 19 motion to dismiss with leave to amend as to Count IV only. To the extent plaintiffs wish to amend 20 their complaint, they must do so by February 5, 2026. The Court DENIES the remainder of 21 defendant’s motion to dismiss. 22 24 Dated: January 27, 2026 Site WU tee 25 SUSAN ILLSTON 26 United States District Judge 27 28