Kishnani v. Royal Caribbean Cruises Ltd.

• Court: District Court, N.D. California
• Decided: June 24, 2025
• Docket: 5:25-cv-01473
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 KIEREN KISHNANI, Case No. 25-cv-01473-NW

8 Plaintiff, ORDER GRANTING MOTION TO 9 v. DISMISS

10 ROYAL CARIBBEAN CRUISES LTD., Re: ECF No. 16 Defendant. 11

12 13 Before the Court is Defendant Royal Caribbean Cruises Ltd.’s (“Royal Caribbean”) motion 14 to dismiss Plaintiff Kieren Kishnani’s first amended complaint (“FAC”). ECF No. 16. The Court 15 GRANTS THE MOTION WITHOUT LEAVE TO AMEND. 16 Having considered the parties’ briefs and the relevant legal authority, the Court concludes 17 oral argument is not required, see N.D. Cal. Civ. L.R. 7-1(b) and VACATES the hearing set for 18 June 25, 2025. 19 I. BACKGROUND 20 A. Factual Background 21 Plaintiff is a citizen of California residing in this district. See FAC ¶ 4. Royal Caribbean is 22 a Liberian corporation that owns, operates, and/or controls www.celebritycruises.com 23 (“Website”). Id. ¶ 5. Plaintiff alleges that Royal Caribbean installed “certain software on the 24 Website designed by [third party] TikTok to seamlessly cause the extraction and transmission of 25 data from every device that accesses the Website” (“TikTok Software”). Id. ¶ 11. According to 26 Plaintiff, “each person who visits the Website can be personally identified” because the TikTok 27 Software “fingerprint[s]” Website visitors,” allowing the Website to “collect[] as much data as it 1 Software “gathers device and browser information, geographic information, referral tracking, and 2 URL tracking by running codes or ‘scripts’ on the Website that send the visitor’s details to 3 TikTok.” Id. ¶ 13. As part of Defendant’s alleged use of the TikTok software, Royal Caribbean 4 employs “Auto Advanced Matching” technology to collect further visitor information provided by 5 the visitor to the Website. Id. ¶ 14. According to Plaintiff, the TikTok Software automatically 6 runs and sends information to TikTok the moment a visitor makes a connection to the site, without 7 visitors’ consent to the tracking of their web activity. Id. ¶ 16. 8 Plaintiff contends that the TikTok software is a “trap and trace device” under the California 9 Invasion of Privacy Act (“CIPA”). Under CIPA, a “trap and trace device” is defined as “a device 10 or process that captures the incoming electronic or other impulses that identify the originating 11 number or other dialing, routing, addressing, or signaling information reasonably likely to identify 12 the source of a wire or electronic communication, but not the contents of a communication.” Cal. 13 Penal Code § 638.50(c). According to Plaintiff, the TikTok Software is a trap and trace device 14 because its use is to “identify the source of electronic communication by capturing incoming 15 electronic impulses and identifying dialing, routing, addressing, and signaling information 16 generated by users.” Id. ¶ 18. Plaintiff alleges that the Website “is collaborating with the Chinese 17 government to obtain [visitors’] phone number and other identifying information” without the 18 visitors’ knowledge or consent. Id. 19 CIPA imposes civil liability and statutory penalties for the installation of trap and trace 20 devices without a court order. FAC ¶ 22; Cal. Penal Code § 638.51. Plaintiff seeks to certify a 21 class of “[a]ll persons within California whose identifying information was sent to TikTok as a 22 result of visiting the Website.” FAC ¶ 24. 23 B. Procedural Background 24 In this year alone, counsel for Plaintiff, Tauler Smith LLP, has filed at least fifteen 25 substantively identical cases in a California federal district court.1 Plaintiff filed the instant action 26

27 1 See (1) Mitchener v. PRN Health Services, LLC, Case No. 5:25-cv-00013 (N.D. Cal. Jan 02, 2025); (2) 1 February 12, 2025, and Defendant moved to dismiss on March 14, 2025. ECF Nos. 1, 11. Instead 2 of opposing, Plaintiff filed the FAC on April 4, 2025. ECF No. 13. Defendant timely moved to 3 dismiss on April 18, 2025. Mot., ECF No. 16. 4 II. LEGAL STANDARD 5 “In the absence of standing, a federal court lacks subject matter jurisdiction over the suit.” 6 Righthaven LLC v. Hoehn, 716 F.3d 1166, 1172 (9th Cir. 2013) (quotations omitted). To 7 demonstrate Article III standing, a plaintiff must show an injury, trace that injury to the 8 defendants’ conduct, and prove that courts can provide adequate redress for the injury. Lujan v. 9 Defs. of Wildlife, 504 U.S. 555, 560-61 (1992). A plaintiff must show that he suffered “an 10 invasion of a legally protected interest” that is “concrete and particularized” and “actual or 11 imminent, not conjectural or hypothetical.” Id. at 560. For an injury to be particularized, it “must 12 affect the plaintiff in a personal and individual way.” Sopeko, Inc. v. Robins, 578 U.S. 330, 339 13 (2016). 14 “[A]n injury in law is not an injury in fact. Only those plaintiffs who have been concretely 15 harmed by a defendant’s statutory violation may sue that private defendant over that violation in 16 federal court.” TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021) (emphasis added). In other 17 words, the legislature’s creation of a statutory prohibition or obligation and a cause of action does 18 not relieve courts of the responsibility to independently decide whether a plaintiff has suffered a 19 concrete harm under Article III. Id. In the privacy context, “[u]nless the retention of unlawfully 20 obtained or created information amounts to the type of concrete injury recognized by the Supreme 21 22 York Life Insurance Company, Case No. 5:25-cv-00179 (N.D. Cal. Jan 06, 2025); (4) Schallert v. Super 23 ATV, LLC, Case No. 2:25-cv-00108 (C.D. Cal. Jan 06, 2025); (5) Conohan v. Rad Power Bikes, Inc., Case No. 2:25-cv-00106 (C.D. Cal. Jan 06, 2025); (6) Kishnani v. Blue Nile, Inc., Case No. 2:25-cv-00105 (C.D. 24 Cal. Jan 06, 2025); (7) Schallert v. SonderMind Inc., Case No. 2:25-cv-00383 (C.D. Cal. Jan 15, 2025); (8) Mitchener v. Universal Pictures Home Entertainment LLC, Case No. 5:25-cv-00592 (N.D. Cal. Jan 16, 25 2025); (9) Deol v. Z Gallerie Home LLC, Case No. 2:25-cv-00605 (C.D. Cal. Jan 23, 2025); (10) Hassid v. Alex and Ani, LLC, Case No. 2:25-cv-00679 (C.D. Cal. Jan 27, 2025); (11) Hassid v. Bohme LLC, Case No. 26 2:25-cv-02492 (C.D. Cal. Mar 20, 2025); (12) Haviland v. Avant Healthcare Professionals, LLC, Case No. 2:25-at-00421 (E.D. Cal. Mar 31, 2025); (13) Haviland v. Avant Healthcare Professionals, LLC, Case No. 27 2:25-cv-00987 (E.D. Cal. Mar 31, 2025); (14) Orr v. Prime Time Healthcare LLC, Case No. 2:25-cv-02871 1 Court, it is insufficient to establish standing.” Phillips v. U.S. Customs & Border Prot., 74 F.4th 2 986, 993 (9th Cir. 2023). 3 As a result, general allegations of unlawful conduct are, in themselves, insufficient alone to 4 confer standing. Lee v. Biden, 876 F.2d 897 (9th Cir. 1989) (citing Allen v. Wright, 468 U.S. 737, 5 754–57 (1984)); Daghaly v. Bloomingdales.com, LLC, No. 23-4122, 2024 WL 5134350, at *1 (9th 6 Cir. Dec. 17, 2024) (Plaintiff fails to allege an injury in fact if he relies only on “general 7 allegations about how [Defendant] intercepts website visitors’ communications and monitors their 8 actions” while “allegations about [Plaintiff’s] own interactions with [the website] are sparse.”); see 9 also Moore v. United Parcel Serv., Inc., No. 18-cv-07600-VC, 2019 WL 2172706, at *1 (N.D. 10 Cal. May 13, 2019) (“[A] reference to invaded ‘privacy and statutory rights’ . . . [is] insufficient to 11 describe a concrete and particularized harm.”); Parker v. Salvation Army, No. 20-CV-08585-JSW, 12 2021 WL 6618584, at *2 (N.D. Cal. Apr. 16, 2021) (same). 13 And though in certain circumstances “[i]ntrusion on privacy alone can be a concrete 14 injury,” Patel v. Facebook Inc., 290 F. Supp. 3d 948, 954 (N.D. Cal. 2018), the nature of the 15 injury turns on whether a plaintiff has a legitimate expectation of privacy. Kumandan v. Google 16 LLC, No. 19-CV-04286-BLF, 2023 WL 8587625, at *13 (N.D. Cal. Dec. 11, 2023) (violation of 17 CIPA requires showing “that class members had a reasonable expectation of privacy in intercepted 18 communications.”); Rodriguez v. Autotrader.com, Inc., No. 2:24-CV-08735-RGK-JC, 2025 WL 19 1122387, at *3 (C.D. Cal. Mar. 14, 2025) (“[A]n invasion of privacy requires a reasonable 20 expectation of privacy to have been violated.”). 21 III. DISCUSSION 22 A. Plaintiff Fails to Allege an Injury in Fact 23 To sufficiently allege an injury in fact and “survive a motion to dismiss, a plaintiff must 24 identify the ‘specific personal information she disclosed that implicates a protectable privacy 25 interest.’” Khamooshi v. Politico LLC, No. 24-CV-07836-SK, 2025 WL 1408896, at *2 (N.D. Cal. 26 May 13, 2025) (quoting Mikulsky v. Noom, Inc., 682 F. Supp. 3d 855, 864 (S.D. Cal. 2023)). 27 Because Plaintiff did not, he lacks Standing to bring his claim. See Hughes v. Vivint, Inc., No. CV 1 3081-GW-KSX, 2024 WL 5179917 (C.D. Cal. Aug. 5, 2024) (“As Plaintiff does not clearly allege 2 what personalized information of hers was actually collected, she does not identify any harm to 3 her privacy.”); Mikulsky, 682 F. Supp. at 864 (no injury in fact because “the Court is unable to 4 determine whether the ‘personal information’ Plaintiff inputted is protected or whether it was 5 merely information akin to basic contact information that would not trigger a protectable privacy 6 interest.”). 7 Plaintiff made four general allegations about how Defendant caused Plaintiff’s alleged 8 injury: 9 1) The Defendant’s Website software “cause[s] the extraction and transmission of data . . . so 10 that each person who visits the Website can be personally identified.” FAC ¶ 10 11 2) The Defendant’s Website software “collects as much data as it can . . . and matches it with 12 existing data that TikTok has acquired.” Id. ¶ 12. 13 3) The Defendant’s Website software “gathers device and browser information, geographic 14 information, referral tracking, and URL tracking . . . ultimately sent to TikTok.” Id. ¶ 13. 15 4) The Defendant’s Website software “scans every page of the Website visited for additional 16 information about the visitor, such as name, date of birth, and address.” Id. ¶ 14. 17 Taken together, Plaintiff alleges only that Defendant invaded his privacy by impermissibly 18 collecting Plaintiff’s “data” and “information.” A court considering a near identical complaint 19 (see supra n.1) found the allegations insufficient to confer Article III standing because:

20 Plaintiff fails to allege any basic facts from which the Court could infer a concrete injury, like when and how many times she visited the 21 site, what information she provided, what information Defendant captured, whether she was aware of Defendant’s tracking practices, 22 or if she has any reason to believe that she was indeed de-anonymized. 23 Heiting v. FKA Distrib. Co., No. 2:24-CV-07314-HDV-AGR, 2025 WL 736594, at *3 (C.D. Cal. 24 Feb. 3, 2025) (internal citation omitted). “Plaintiff cannot establish constitutional standing based 25 on conclusory statements.” Steinmeyer v. Am. Ass’n of Blood Banks, 715 F. Supp. 3d 1302, 1318 26 (S.D. Cal. 2024). 27 Likewise, even if Plaintiff’s allegations were sufficiently concrete and particularized (they 1 560. The mere “collection of basic contact information by . . . software[,] or where the plaintiffs 2 merely visited the website[,] are not concrete harms.” Smidga v. Spirit Airlines, Inc., No. 2:22- 3 CV-1578-MJH, 2024 WL 1485853, at *4 (W.D. Pa. Apr. 5, 2024) (collecting cases); Carolus v. 4 Nexstar Media Inc., No. 24-CV-07790-VC, 2025 WL 1338193, at *1 (N.D. Cal. Apr. 9, 2025) 5 (refusing so find an injury in fact where plaintiffs alleged only that defendant tracked “browser 6 and device data” and “other identifying information” alongside IP addresses). IP addresses, for 7 example, can provide “device and browser information” and “geographic information” the 8 collection of which purportedly invaded Plaintiff’s privacy in the instant case, FAC ¶ 13, but it is 9 well established in the Ninth Circuit that “there is no legally protected privacy interest in IP 10 addresses.” Heeger v. Facebook, Inc., 509 F. Supp. 3d 1182, 1189 (N.D. Cal. 2020); United 11 States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (“Internet users have no expectation of 12 privacy in . . . the IP addresses of the websites they visit.”); Carolus, 2025 WL 1338193, at *1 (no 13 injury in fact where plaintiff alleges only “that a given device visited [Defendant’s] website and 14 the general location of that device, including what zip code it’s in.”). 15 And though Plaintiff alleges that Defendants could gain “additional information about [a] 16 visitor such as name, date of birth, and address,” and that allegation could intrude on Plaintiff’s 17 right to privacy, he fails to convert that hypothetical into concrete harm to him. FAC ¶ 14. 18 Plaintiff does not allege that the Website collected his biographical information, and a “class 19 representative must be a part of the class and . . . suffer the same injury as the class members.” 20 Falcon, 457 U.S. at 156. A plaintiff does not have standing to bring a claim on behalf of a class if 21 he does not have standing to bring it for himself. Hawkins v. Comparet–Cassani, 251 F.3d 1230, 22 1238 (9th Cir.2001) (citing O’Shea, 414 U.S. at 493–94). 23 Without standing, the Court is without subject matter jurisdiction. Defendant’s motion is 24 GRANTED. 25 B. The TikTok Software is Not a Track and Trace Device 26 Even if Plaintiff did allege that additional information about him was collected by the 27 Website, the FAC still fails because, if that type of information is collected, the statute ceases to 1 constitute a “trap and trace device” as defined by Cal. Penal Code § 638.50(c) and penalized by 2 § 638.51. By definition, a “trap and trace device” captures identifying information about a 3 communication “but not the contents of a communication.” § 638.50(c) (emphasis added). 4 As the Superior Court of Los Angeles County explained when a substantively identical 5 claim (see supra n.1) came before it: 6 the crucial distinction from other devices is that . . . “trap and trace devices” are designed to capture information about the 7 communication, but not the content of the communication itself. Indeed, other devices accomplish that, and a host of statutes and 8 caselaw are directed at those other devices too. For purposes of Section 638.51, “trap and trace devices” by definition are tools which 9 provide information about the “who,” “when,” and “where” of communications—but not the “what.” 10 11 Price v. Headspace, Inc., No. 24STCV19921, 2025 WL 1237977, at *3 (Cal. Super. Apr. 12 01, 2025). The FAC alleges that the TikTok Software “fingerprint[s]” Website visitors to 13 “collect[] as much data as it can about a normally [sic] and otherwise anonymous Website visitor.” 14 FAC ¶ 12. Even more intrusive, Plaintiff claims, is the “Auto Advanced Matching” technology 15 which deploys the TikTok Software to “scan[] every page of the Website visited for additional 16 information about the visitor, such as name, date of birth, and address.” Id. ¶ 14.2 Any 17 “fingerprint” that reveals biographical information is “the content” of any communication between 18 visitor and Website,3 and thus, the claim and the case cannot survive. 19 * * * 20 Though neither party discusses the distinction between information about a 21 communication versus information within a communication, it crystalizes the futility of Plaintiff’s 22 suit (and the myriad identical cases Plaintiff’s counsel has filed in both federal and state courts). If 23

24 2 As discussed above, Plaintiff failed to allege that his “additional information” was gathered by 25 Defendant. The analysis that follows presumes Plaintiff could allege such a thing if given leave to amend or a class member who suffered such an injury becomes lead. 26 3 The FAC is vague as to how a visitor’s biographical information could appear on a “page of the Website” for Defendant’s collection. The only circumstance the Court can conceive for such 27 information to be available on a commercial website is that the visitor input that information ] Defendant only collects information regarding the “metadata” of the communication, □□□□□□□□□□ 2 || right to privacy is not invaded because he has no expectation of privacy as to that type of data 3 (e.g., his IP address or general geographic location). If Defendant instead collects content 4 || information from communication between the parties (e.g., information provided from Plaintiff to 5 || Defendant directly), then the TikTok software is not a trap and trace device and § 638.50 does not 6 || apply. 7 For this reason, any amendment to the FAC cannot cure Plaintiff's lack of standing to 8 || bring suit. Defendant’s motion is GRANTED without leave to amend. Plaintiff's FAC is 9 || dismissed with prejudice. 10 1] IT IS SO ORDERED. 12 || Dated: June 24, 2025 MQ ZL; 13 3 Noél Wise 14 United States District Judge

Oo Z 18 19 20 21 22 23 24 25 26 27 28