Paul Perez, et al. v. Romantix Online, Inc., et al.

Opinion

1 2 3 6 7 PAUL PEREZ, et al., Case No. 25-cv-02465-NW

8 Plaintiffs, ORDER GRANTING DEFENDANTS’ 9 v. MOTIONS TO DISMISS PLAINTIFF’S FAC WITH PARTIAL LEAVE TO 10 ROMANTIX ONLINE, INC., et al., AMEND 11 Defendants. Re: ECF Nos. 87, 88

12 13 Before the Court are Defendants’ Innov8 Solutions, Inc. and Google LLC motions to 14 dismiss Plaintiff Bradley’s first amended complaint (“FAC”).1 ECF Nos. 75 (FAC), 87 (Google 15 Mot.), 88 (Innov8 Mot.). For the reasons stated below, the Court GRANTS Defendants’ motions 16 with partial leave to amend. 18 As the Court summarized in its previous Order:

19 Defendants Romantix and Innov8 jointly operate Romantix.com, a site that sells adult toys and other adult products. When users visit 20 Romantix.com, trackers in the form of cookies and pixels activate and begin collecting data about users’ activity. The trackers, developed 21 and operated by Defendants Google and NextRoll, are embedded directly in the code of the website, and fire upon a user’s entrance to 22 the site. According to Plaintiffs, the trackers collect information related to user browsing patterns and product interests, which in turn 23 provides insight into a user’s sexual preferences, sexual orientation, sexual practices, and adult product preferences. 24 Upon entering Romantix.com, users are presented with a message 25 notifying users that the website uses cookies. Compl. ¶ 48 . . . The popup clearly states that, “[b]y using [Romantix.com], you consent to 26 all cookies in accordance with our Cookie Policy.” Directly 27 following that pronouncement is a link to “[r]ead more,” which sends 1 users to the site’s Privacy Policy. 2 Order at 1-2, ECF No. 72 (internal footnote omitted). 3 The prior complaint liberally cited the Privacy Policy, see Compl. ¶¶ 20, 24-27, 47-49, 4 125, and explicitly alleged that Plaintiffs’ expectations of privacy “stem[med] from and [were] 5 reinforced by representations in Romantix.com’s Privacy Policy and FAQs.” Compl. ¶ 125. In its 6 previous Order, the Court noted the relevance of the underlying Privacy Policy to the pending 7 claims, explaining that:

8 “[c]ourts consistently hold that terms of service and privacy policies . . . can establish consent.” Silver, 2021 WL 3191752, at *4 (citing 9 Smith, 745 F. App’x at 8). Consequently, if Plaintiffs had awareness of the Privacy Policy at the time that they made their purchases, the 10 content of the policy may be enough to establish that Plaintiffs consented to the disclosure of their personal data. Gray v. 11 Amazon.com, Inc., 653 F. Supp. 3d 847, 860 (W.D. Wash. 2023), aff'd, No. 23-35377, 2024 WL 2206454 (9th Cir. May 16, 2024) 12 (“Plaintiffs’ allegations are made against the backdrop of the terms of the policies to which they assented.”). As this stage in the case, the 13 Court DISMISSES the claims to allow Plaintiffs to provide additional information about what they knew of the policy, when 14 they knew it, and whether that information had any effect on their decisions related to the site. 15 Order at 4 (emphasis added) 16 The FAC, filed on November 17, 2025, did three things that are relevant here: first, it 17 removed causes of action under California’s Unfair Competition Law, leaving only privacy-related 18 and negligence claims; second, it dropped one of the two Plaintiffs, leaving Mr. Bradley as the 19 sole Plaintiff and proposed class representative; and third, it excised every reference to the Privacy 20 Policy that had been in the original complaint. The third change was the most extensive and most 21 perplexing. Indeed, despite the Court’s explicit instructions above, the FAC reads as though 22 Romatix.com never had a Privacy Policy. It was only at oral argument that counsel for Plaintiff 23 admitted that Mr. Bradley “does not recall whether he read” the Privacy Policy.2 Tr. at 24:14-18, 24 ECF No. 126. In the FAC, Plaintiff’s reasonable expectation of privacy now “stems from and is 25 reinforced by representations on the Website” generally. FAC ¶ 127. 26

27 2 Plaintiff’s counsel answer as to why the Privacy Policy was included in the original complaint, 1 Plaintiff’s allegations regarding his own experience with the website are only slightly less 2 scant than those provided in the original complaint. See Order at 2. Plaintiff now alleges that he 3 interacted with the cookie banner, but he provides no temporal specificity. See FAC ¶ 87 (alleging 4 that Plaintiff “made purchases from the Website on multiple occasions before eventually noticing 5 the cookie popup . . . [and] select[ing] the option to “Decline All” cookies.”). Beyond this 6 addition, the FAC adds little to the underlying allegations. 8 Federal Rule of Civil Procedure 12(b)(6) is designed to “test[ ] the legal sufficiency of a 9 claim.” Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). A dismissal under Rule 12(b)(6) for 10 failure to state a claim can be based on either (1) the lack of a cognizable legal theory or (2) 11 insufficient facts to support a cognizable legal claim. Balistreri v. Pacifica Police Dep’t, 901 F.2d 12 696, 699 (9th Cir. 1990). When analyzing a complaint under Rule 12(b)(6), the well-pled factual 13 allegations are taken as true and construed in the light most favorable to the nonmoving party. 14 Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). Legal conclusions couched as factual 15 allegations are not entitled to the assumption of truth, Ashcroft v. Iqbal, 556 U.S. 662, 680 (2009), 16 and are therefore insufficient to defeat a motion to dismiss for failure to state a claim, In re Cutera 17 Sec. Litig., 610 F.3d 1103, 1108 (9th Cir. 2010). 19 In its prior Order, the Court found that Plaintiffs’ failure to allege that they “did not 20 consent to the collection and disclosure of their personal data” doomed the remaining causes of 21 action in the FAC. As previously noted, consent is an element of CIPA and Wiretap Claims, see 22 Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1072 (N.D. Cal. 2016) (user consent is a defense 23 under CIPA) and 18 U.S.C. § 2511(2)(d) (stating that no liability exists where “one of the parties 24 to the communication has given prior consent” to interception), and a total defense to the 25 remaining three claims. See Smith, 262 F. Supp. 3d at 955 (user consent is a defense to the 26 privacy protections under the California Constitution as well as common-law tort claims for 27 intrusion upon seclusion); Cal. Civ. Code § 3515 (“A person who consents to an act is not 1 Plaintiff failed to cure most of the pervasive consent issues in the original complaint. 2 Plaintiff adds just three new, largely conclusory allegations regarding his interaction with 3 Romantix.com.. First, Plaintiff now alleges that he “reasonably believed his messages, reports, 4 and communications . . . were confidential” because of “the nature of the Website . . . and the fact 5 that he accessed the Website in private, where no one could see his shopping behavior.” FAC ¶ 6 85. But Plaintiff points to no controlling authority that the mere act of shopping online, even for 7 intimate products, creates a reasonable expectation of privacy.3 As many courts have found, 8 “[g]enerally, the internet is not a place where users have a reasonable expectation of privacy.” 9 Thomas v. Papa Johns Int’l, Inc., No. 22CV2012 DMS (MSB), 2024 WL 2060140, at *1 (S.D. 10 Cal. May 8, 2024), aff'd, No. 24-3557, 2025 WL 1704437 (9th Cir. June 18, 2025). Second, 11 Plaintiff now alleges that he “did not consent to his messages, reports, or communications on 12 Romantix.com being shared with” third-parties. FAC ¶ 87. But as the Court stated explicitly in 13 its previous Order, “Plaintiff[] must do more than merely assert that [he] did not consent to the 14 tracking devices.” Order at 4. Plaintiff’s current allegation fails to do that. 15 Finally, Plaintiff provides no specificity regarding how frequently and for how long he 16 interacted with Romantix.com, including making purchases, before he elected to decline tracking 17 cookies. According to Plaintiff, “[h]e browsed and made purchases from the Website on multiple 18 occasions before eventually noticing the cookie popup,” at which point he “selected the option to 19 ‘Decline All’ cookies.” FAC ¶ 88. He goes on to allege that, “[n]otwithstanding his selection to 20 ‘Decline All’ cookies, his confidential messages, reports, and communications . . . continued to be 21 intercepted and used for profit by at least Google.” Id. 22 23 3 Without any cases to support his point, Plaintiff urges the Court to rely on a single remark 24 spoken by Judge Donato during a motion to dismiss hearing in a similar, though unrelated, case. See Tatola v. Barnaby Ltd., LLC, 3:24-cv-03789-JD (filed June 25, 2024 N.D. Cal.), Tr. MTD 25 Hrg., ECF No. 66. In that hearing, Judge Donato stated that, “in [his] mind . . . the sexual practices and proclivities communicated by the user to [the website owner] and then to [a third 26 party] are well within our concepts or traditional notions of privacy.” Id. Judge Donato’s comment did not inform his decision as he dismissed the complaint on unrelated grounds. He 27 made no explicit finding reinforcing this point in any order he issued in that case. See Tatola, 1 Making all inferences in Plaintiff’s favor,4 this final allegation demonstrates that Plaintiff 2 revoked his consent when he clicked “Decline All” on the Cookie Popup. At all times before his 3 selection, however, Plaintiff fails to allege that he had a reasonable expectation of privacy or that 4 he did not consent to the collection of his data. As a result, the Court DISMISSES Plaintiff’s 5 claims with prejudice for all conduct preceding Plaintiff’s selection to “Decline All” cookies. 6 Once Plaintiff revoked his consent, the calculus shifts. Even where no freestanding 7 expectation of privacy exists, a website operator may create an expectation of privacy by 8 presenting customers with a choice to reject tracking technology. See Shah v. Politico LLC, No. 9 25-CV-05213-NW, 2026 WL 323269, at *4 (N.D. Cal. Feb. 6, 2026) (finding that website’s 10 presentation of “an option to opt out of certain tracking cookies upon entering the [website]” gave 11 “rise to an expectation of privacy.”); In re Google Location Hist. Litig., 514 F. Supp. 3d 1147, 12 1156 (N.D. Cal. 2021) (finding that “it was reasonable for a user to believe that disabling Location 13 History prevented Google from collecting and storing location data.”). Thus, had Plaintiff alleged 14 that he continued to browse the website after declining cookies, he may have alleged cognizable 15 claims. 16 But Plaintiff doesn’t appear to remember when he made his selection and revoked his 17 consent. The FAC alleges only that he “eventually” noticed the cookie pop-up and subsequently 18 selected the option to “Decline All” cookies. FAC ¶ 88. Critically, Plaintiff does not allege that, 19 after he clicked “Decline All,” he visited even one more page on Romantix.com. And there are 20 only two dates associated with Plaintiff in the FAC: November 30, 2021, the date he made a 21 purchase the Romantix.com, and a date in October 2024, which was the last time he visited the 22

23 4 Though less conclusory than Plaintiff’s other allegations, Plaintiff’s claim that Google intercepted his information after he clicked “Decline All” appears to be based on circumstantial 24 evidence gathered by counsel. As counsel explained during the hearing, Plaintiff’s allegations arise from counsel’s own investigation into the workings of Romantix.com sometime after 25 Plaintiff interacted with the site. Plaintiff alleges that, when counsel conducted its investigation, Google cookies continued to fire even after counsel selected “Decline All” cookies. Plaintiff 26 admits that he doesn’t have a record of what happened when he clicked “Decline All.” Instead, he assumes, and asks the Court to assume, that the behavior of Google’s cookies has remained 27 unchanged between the date he selected “Decline All” (whenever that date was) and the date ] site. FAC 4 81. In other words, there are more than four years within which Plaintiff may have 2 || clicked “Decline All.” Defendants cannot properly be on notice of Plaintiff's claim without at 3 least a general timeframe of when the revocation of consent occurred, and Plaintiff cannot allege 4 || an injury if he is uncertain that he browsed the site after he clicked “Decline All.” 5 Given that Plaintiff has twice been unable to allege sufficient facts to put Defendants on 6 || notice of Plaintiffs injury, it seems unlikely that Plaintiff will be able to do so if given the 7 || opportunity to amend the complaint a third time. Nevertheless, under the Ninth Circuit’s “extreme 8 liberality” standard governing amendment, the Court grants Plaintiff leave to amend on all counts 9 || only for the timeframe following Plaintiff clicking “Decline All” on the cookie banner. The Court 10 || reminds Plaintiff and his counsel of their obligations under Rule 11; if Plaintiff cannot, in good 11 faith, allege enough facts to provide Defendants sufficient notice of the alleged injury, he is 12 || prohibited from bringing these counts before this Court in an amended complaint. Further, if 13 Plaintiff amends his complaint, he may not add any new claims. 14 |) Iv. CONCLUSION 3 15 For the reasons stated, Defendants’ motions to dismiss are GRANTED WITH a 16 PREJUDICE as to the time before Plaintiff selected to “Decline All” cookies, and GRANTED 2 17 || WITH LEAVE TO AMEND as to the time after Plaintiff made that selection. Any amended Z 18 complaint shall be filed within 21 days of this Order. 20 || Dated: June 23, 2026 □

Noél Wise 22 United States District Judge 23 24 25 26 27 28