Rebeka Rodriguez v. Culligan International Company

Opinion

REBEKA RODRIGUEZ, Case No.: 25-cv-00225-AJB-KSC

Plaintiff, ORDER GRANTING MOTION TO v. DISMISS FIRST AMENDED COMPLAINT

COMPANY, (Doc. No. 16) Defendant.

Before the Court is Defendant Culligan International Company’s (“Culligan”) motion to dismiss Plaintiff Rebeka Rodriguez’s (“Rodriguez”) First Amended Complaint (“FAC”) pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). (Doc. No. 16.) The motion is fully briefed. (Doc. Nos. 16; 18; 20.) For the reasons set forth below, the Court GRANTS Culligan’s motion to dismiss for lack of subject matter jurisdiction. A. Factual Background Rodriguez is “a consumer privacy advocate who works as a ‘tester’ to ensure that companies abide by the privacy obligations imposed by California law.” (Doc. No. 10 ¶ 6.) On an unspecified date in August 2024, Rodriguez visited Culligan’s website, www.culligan.com, using “an Internet-connected computer.” (Doc. No. 10 ¶ 154.) The website installed 35 “tracking beacons” on Rodriguez’s internet browser that collected Rodriguez’s “unique [internet protocol (“IP”)] address, . . . operating system name, operating system version number, browser name, browser version number, browser language, screen resolution, geolocation data, email address, mobile ad IDs, embedded social media identities, customer and/or loyalty IDs, cookies and device signature – as well as the connections between them.” (Id. ¶¶ 44, 156; see also id. ¶¶ 67–149 (identifying specific tracking beacons).) Rodriguez asserts that these tracking beacons are “pen registers” because they “collect information – users’ IP addresses – that identifies the outgoing ‘routing, addressing, or signaling information’ of the user.” (Id. ¶ 44.) Alternatively, the tracking beacons are “trap and trace devices” because they “collect information – users’ IP addresses – that identifies the incoming ‘routing, addressing, or signaling information’ of the user.” (Id.)1 Rodriguez contends that the tracking beacons “do[] not collect the content of [her] communications with the Website.” (Doc. No. 10 ¶ 184.) Rodriguez did not consent to Culligan’s installation of tracking beacons on her internet browser. (Id. ¶¶ 61, 158, 162.) B. Procedural Background On December 18, 2024, Rodriguez initiated this action in the San Diego County Superior Court of California. (Doc. No. 1-2 at 3.) Rodriguez served Culligan with a Summons and Complaint on December 31, 2024. (Doc. No. 4 ¶ 3.) Culligan timely removed the action to this Court. (Doc. No. 1.)

1 Pursuant to California Penal Code section 638.50(b), a pen register is “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Meanwhile, a trap and trace device is “a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.” Cal. Penal Code § 638.50(c). On March 20, 2025, Culligan moved to dismiss Rodriguez’s initial complaint. (Doc. No. 8.) On April 4, 2024, Rodriguez filed the operative FAC. (Doc. No. 10.) The FAC presents a single cause of action alleging that Culligan violated California Penal Code § 638.51 by installing either a pen register or a trap and trace device on her internet browser. (Id. ¶¶ 177–88.) On May 2, 2025, Culligan moved to dismiss the FAC after receiving an extension to submit a responsive filing. (Doc. Nos. 13; 16.) The parties completed briefing on the motion to dismiss on May 27, 2025. (Doc. Nos. 18; 20.) The parties subsequently submitted four notices of supplemental authority. (Doc. Nos. 22–25.) A. Federal Rule of Civil Procedure 12(b)(1) A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) tests whether the court has subject matter jurisdiction. Lack of Article III standing requires dismissal for want of subject matter jurisdiction under Rule 12(b)(1). See Nw. Requirements Utils. v. FERC, 798 F.3d 796, 807 n.9 (9th Cir. 2015). “A Rule 12(b)(1) jurisdictional attack may be facial or factual.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction.” Id. The Court “resolves a facial attack as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff’s allegations as true and drawing all reasonable inferences in the plaintiff’s favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court’s jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). “[I]n a factual attack,” on the other hand, “the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air, 373 F.3d at 1039. In resolving such an attack, unlike a motion to dismiss under Rule 12(b)(6), a court “may review evidence beyond the complaint without converting the motion to dismiss into a motion for summary judgment.” Id. Moreover, the court “need not presume the truthfulness of the plaintiff’s allegations.” Id. Once the defendant has moved to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1), the plaintiff bears the burden of establishing the court’s jurisdiction. See Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir. 2010). B. Federal Rule of Civil Procedure 12(b)(6) A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the pleadings’ legal sufficiency and allows a court to dismiss a complaint if the court finds the plaintiff has failed to state a claim upon which relief may be granted. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). As a matter of law, the court may dismiss the complaint for either a lack of a cognizable legal theory or insufficient facts under a cognizable legal claim. SmileCare Dental Grp. v. Delta Dental Plan of Cal., 88 F.3d 780, 783 (9th Cir. 1996) (citation omitted). However, a complaint survives a motion to dismiss if it contains “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). Notwithstanding such deference, the reviewing court need not accept legal conclusions as true. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Furthermore, it is improper for the court to assume “the [plaintiff] can prove facts that [she] has not alleged.” Associated Gen. Contractors of Cal., Inc. v. Cal. State Council of Carpenters, 459 U.S. 519, 526 (1983). However, “[w]hen there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief.” Iqbal, 556 U.S. at 679. The court only reviews the complaint’s contents and accepts all factual allegations as true, while drawing all reasonable inferences in favor of the nonmoving party. Thompson v. Davis, 295 F.3d 890, 895 (9th Cir. 2002). Culligan raises five bases for dismissing this action. Culligan argues pursuant to Rule 12(b)(1) that (1) Rodriguez lacks standing. (Doc. No. 16 at 6–12; Doc. No. 20 at 2– 6.) Additionally, Culligan asserts pursuant to Rule 12(b)(6) that there is no claim on which relief can be granted because (2) the tracking beacons are not pen registers or trap and trace devices; (3) there is no violation of California Penal Code section 638.51 because Culligan consented to the use of any trap and trace devices; (4) Culligan lacked any necessary criminal intent; and (5) the California Invasion of Privacy Act requires Rodriguez to allege an actual injury, which Rodriguez has failed to do. (Doc. No. 16 at 12–22; Doc. No. 20 at 6–10.) The Court goes no further than Culligan’s first basis because Rodriguez lacks standing to bring the present action. “To establish standing, a ‘[p]laintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.’” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 597 (9th Cir. 2020) (quoting Spokeo Inc. v. Robins, 578 U.S. 330, 338 (2016)). The injury must be both “concrete and particularized” and “actual or imminent.” Popa v. Microsoft Corp., 153 F.4th 784, 788 (9th Cir. 2025) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)). “A ‘concrete’ injury ‘must actually exist’; put differently, it must be ‘real, and not abstract.’” Id. (quoting Spokeo, 578 U.S. at 340)). Additionally, history is “the touchstone for concreteness.” Id. at 789. Courts must therefore “assess whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American Courts.” TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021) (quoting Spokeo, 578 U.S. at 341). Rodriguez makes no effort to establish a close relationship between her purported injury and a traditional harm. “TransUnion requires a court to assess whether an individual plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal system.” Popa, 153 F.4th at 791. At common law, there were “four discrete torts that protected specific kinds of privacy-related harms”: “intrusion upon seclusion, appropriation of another person’s name or likeness, publicity given to another person’s private life, and publicity that places one in a false light.” Id. at 792 (quoting Nabozny v. Optio Sols. LLC, 84 F.4th 731, 735 (7th Cir. 2023)). Rodriguez does not analogize her purported injury to any of these harms. (See generally Doc. No. 18.) Instead of pointing to any specific tort, Rodriguez broadly contends that any invasion of a statutorily recognized privacy interest is sufficient to constitute an Article III injury. (Id. at 2 (quoting Friddle v. Epstein, 16 Cal. App. 4th 1649, 1660–61 (Cal. Ct. App. 1993)); see also Doc. No. 18 at 7–14.) This is not enough. Rodriguez’s contention and her accompanying analyses “revert[] to a pre-TransUnion (even pre-Spokeo) approach that favors a legislative body’s views in the aggregate over a plaintiff’s individual circumstances.” Popa, 153 F.4th at 792. But current Ninth Circuit precedent “requires a plaintiff to demonstrate more than just a statutory violation when evaluating whether a plaintiff has alleged a concrete injury.” Id. at 793. Rodriguez’s failure to demonstrate anything more than an alleged statutory violation is consequently fatal to her claim. See id. Even if Rodriguez had done more, the Court finds that Rodriguez lacks a privacy interest in the data at issue. Again, the collected data consists of Rodriguez’s “IP address, [her computer’s] operating system name, operating system version number, browser name, browser version number, browser language, screen resolution, geolocation data, email address, mobile ad IDs, embedded social media identities, customer and/or loyalty IDs, cookies and device signature – as well as the connections between them.” (Doc. No. 10 ¶ 156.) Rodriguez cursorily asserts that she “has a reasonable expectation of privacy in the IP address of her devices, which is currently statutorily protected in California.” (Doc. No. 18 at 7.) Rodriguez adds that “[d]enying [her] right to control the dissemination of [her] IP address and the other data linked to her IP address captured by third party spyware vendors for marketing purposes is highly offensive and constitutes an invasion of privacy.” (Id. at 12.) Courts have consistently held that internet users have no expectation of privacy in their IP addresses. For instance, the Ninth Circuit explained in United States v. Forrester that “e-mail and Internet users have no expectation of privacy in . . . the IP addresses of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information.” 512 F.3d 500, 510 (9th Cir. 2008); see also, e.g., United States v. Ulbricht, 858 F.3d 71, 97 (2d Cir. 2017), abrogation on other grounds recognized by United States v. Zodhiates, 901 F.3d 137, 143–44 (2d Cir. 2018); United States v. Caira, 833 F.3d 803, 806 (7th Cir. 2016). Rodriguez’s largely undeveloped attempts to distinguish Forrester are unavailing. (See generally Doc. No. 18 at 12–14.2) Rodriguez primarily claims that “Forrester had no occasion to consider whether an Internet user has a reasonable expectation of privacy as to the user’s IP address on the user’s devices.” (Id. at 12.) Although it is true that Forrester focused on the IP addresses of the websites a person visited, Forrester’s rationale applies equally to the user’s IP address. It is still information that “is provided to and used . . . for the specific purpose of directing the routing of information.” Forrester, 512 F.3d at 510; see also, e.g., Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174, 1179 (N.D. Cal. 2025) (“When internet users visit a website, their devices automatically send their IP addresses to the website’s server as part of the communication process.”). Rodriguez’s remaining distinctions are equally inapt. For instance, Rodriguez points out that “Forrester was decided in 2008, well before the [California Electronic Communications Privacy Act, Cal. Penal Code sections 1546, et seq.,] and [California Consumer Privacy Act of 2018, Cal. Civil Code sections 1798.100, et seq.,] were enacted into law” and “before the identity resolution industry existed and before tracking software embedded into websites as ‘cookies’ to track the specific webpages visited by Internet users became technically feasible amongst websites.” (Doc. No. 18 at 12.) On the first point, as discussed above, Rodriguez’s reliance on potential statutory violations is insufficient to

2 Rodriguez’s most-developed argument—pertaining to Forrester’s alleged reliance on Smith v. Maryland, 442 U.S. 735 (1979)—focuses on whether a tracking beacon can constitute a pen register, not whether a person has a reasonable expectation of privacy in their IP address. (Id. at 13–14.) establish an Article III injury. On the second, the fact that a website may be able to track the specific pages an internet user visits does not overcome Forrester’s rationale that internet users lack a privacy interest in their IP address because they voluntarily hand over their IP address. Lastly, Rodriguez speculates that the Forrester court may have reached a different decision “[i]f the government could ‘know the particular pages on the websites the person viewed’ by learning the ‘IP addresses of websites visited.’” (Id. (quoting Forrester, 512 F.3d at 510 & n.6).) The Court declines to join in Rodriguez’s speculation. Internet users also have no expectation of privacy in the other data that Culligan allegedly collects. For instance, courts have rejected the idea that an internet user’s contact information that is “designed to be exchanged to facilitate communication”—such as their email address or webpage username—constitutes private information. See, e.g., I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034, 1049 (N.D. Cal. 2022). Courts have similarly concluded that internet users have no right to privacy in the metadata of their communication. See, e.g., Mitchener v. CuriosityStream, Inc., No. 25-cv-01471-NW, 2025 WL 2272413, at *5 (N.D. Cal. Aug. 6, 2025). The other data that Culligan allegedly collects appears to be designed to be exchanged to facilitate communication and/or to constitute metadata. Accordingly, Rodriguez lacks an expectation of privacy in the data at issue. The Court lacks subject matter jurisdiction over this action because Rodriguez has failed to demonstrate that she has suffered an injury cognizable under Article III of the Constitution. Accordingly, the Court GRANTS IN PART and DENIES IN PART Culligan’s motion to dismiss the FAC. (Doc. No. 16.) Specifically, the Court GRANTS Culligan’s motion to dismiss for lack of subject matter jurisdiction pursuant to Federal Rule of Civil Procedure 12(b)(1). The Court DENIES AS MOOT Culligan’s motion to dismiss for failure to state a claim on which relief can be granted pursuant to Federal Rule of Civil Procedure 12(b)(6). Rodriguez may file a second amended complaint for the limited purpose of curing her lack of standing within 14 days of this Order. Pursuant to Local Civil Rule 15.1.c, any }amendment “must be accompanied by a version of thle FAC] that shows — through redlining, underlining, strikeouts, or other similarly effective typographic methods — how that pleading differs from the [FAC].” Dated: November 3, 2025 © Hon. Anthony J. attaglia United States District Judge