Rebeka Rodriguez v. Culligan International Company

• Court: District Court, S.D. California
• Decided: November 3, 2025
• Docket: 3:25-cv-00225
• Status: Unknown

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 REBEKA RODRIGUEZ, Case No.: 25-cv-00225-AJB-KSC

12 Plaintiff, ORDER GRANTING MOTION TO 13 v. DISMISS FIRST AMENDED COMPLAINT 14 CULLIGAN INTERNATIONAL

COMPANY, 15 (Doc. No. 16) Defendant. 16

17 18 Before the Court is Defendant Culligan International Company’s (“Culligan”) 19 motion to dismiss Plaintiff Rebeka Rodriguez’s (“Rodriguez”) First Amended Complaint 20 (“FAC”) pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). (Doc. No. 21 16.) The motion is fully briefed. (Doc. Nos. 16; 18; 20.) 22 For the reasons set forth below, the Court GRANTS Culligan’s motion to dismiss 23 for lack of subject matter jurisdiction. 24 I. BACKGROUND 25 A. Factual Background 26 Rodriguez is “a consumer privacy advocate who works as a ‘tester’ to ensure that 27 companies abide by the privacy obligations imposed by California law.” (Doc. No. 10 ¶ 6.) 28 On an unspecified date in August 2024, Rodriguez visited Culligan’s website, 1 www.culligan.com, using “an Internet-connected computer.” (Doc. No. 10 ¶ 154.) The 2 website installed 35 “tracking beacons” on Rodriguez’s internet browser that collected 3 Rodriguez’s “unique [internet protocol (“IP”)] address, . . . operating system name, 4 operating system version number, browser name, browser version number, browser 5 language, screen resolution, geolocation data, email address, mobile ad IDs, embedded 6 social media identities, customer and/or loyalty IDs, cookies and device signature – as well 7 as the connections between them.” (Id. ¶¶ 44, 156; see also id. ¶¶ 67–149 (identifying 8 specific tracking beacons).) 9 Rodriguez asserts that these tracking beacons are “pen registers” because they 10 “collect information – users’ IP addresses – that identifies the outgoing ‘routing, 11 addressing, or signaling information’ of the user.” (Id. ¶ 44.) Alternatively, the tracking 12 beacons are “trap and trace devices” because they “collect information – users’ IP 13 addresses – that identifies the incoming ‘routing, addressing, or signaling information’ of 14 the user.” (Id.)1 Rodriguez contends that the tracking beacons “do[] not collect the content 15 of [her] communications with the Website.” (Doc. No. 10 ¶ 184.) 16 Rodriguez did not consent to Culligan’s installation of tracking beacons on her 17 internet browser. (Id. ¶¶ 61, 158, 162.) 18 B. Procedural Background 19 On December 18, 2024, Rodriguez initiated this action in the San Diego County 20 Superior Court of California. (Doc. No. 1-2 at 3.) Rodriguez served Culligan with a 21 Summons and Complaint on December 31, 2024. (Doc. No. 4 ¶ 3.) Culligan timely 22 removed the action to this Court. (Doc. No. 1.) 23

24 1 Pursuant to California Penal Code section 638.50(b), a pen register is “a device or process that records 25 or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility 26 from which a wire or electronic communication is transmitted, but not the contents of a communication.” Meanwhile, a trap and trace device is “a device or process that captures the incoming electronic or other 27 impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the 28 contents of a communication.” Cal. Penal Code § 638.50(c). 1 On March 20, 2025, Culligan moved to dismiss Rodriguez’s initial complaint. (Doc. 2 No. 8.) 3 On April 4, 2024, Rodriguez filed the operative FAC. (Doc. No. 10.) The FAC 4 presents a single cause of action alleging that Culligan violated California Penal Code 5 § 638.51 by installing either a pen register or a trap and trace device on her internet browser. 6 (Id. ¶¶ 177–88.) 7 On May 2, 2025, Culligan moved to dismiss the FAC after receiving an extension to 8 submit a responsive filing. (Doc. Nos. 13; 16.) The parties completed briefing on the 9 motion to dismiss on May 27, 2025. (Doc. Nos. 18; 20.) The parties subsequently submitted 10 four notices of supplemental authority. (Doc. Nos. 22–25.) 11 II. LEGAL STANDARD 12 A. Federal Rule of Civil Procedure 12(b)(1) 13 A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) tests 14 whether the court has subject matter jurisdiction. Lack of Article III standing requires 15 dismissal for want of subject matter jurisdiction under Rule 12(b)(1). See Nw. 16 Requirements Utils. v. FERC, 798 F.3d 796, 807 n.9 (9th Cir. 2015). 17 “A Rule 12(b)(1) jurisdictional attack may be facial or factual.” Safe Air for 18 Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). “In a facial attack, the challenger 19 asserts that the allegations contained in a complaint are insufficient on their face to invoke 20 federal jurisdiction.” Id. The Court “resolves a facial attack as it would a motion to dismiss 21 under Rule 12(b)(6): Accepting the plaintiff’s allegations as true and drawing all 22 reasonable inferences in the plaintiff’s favor, the court determines whether the allegations 23 are sufficient as a legal matter to invoke the court’s jurisdiction.” Leite v. Crane Co., 749 24 F.3d 1117, 1121 (9th Cir. 2014). 25 “[I]n a factual attack,” on the other hand, “the challenger disputes the truth of the 26 allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air, 373 27 F.3d at 1039. In resolving such an attack, unlike a motion to dismiss under Rule 12(b)(6), 28 a court “may review evidence beyond the complaint without converting the motion to 1 dismiss into a motion for summary judgment.” Id. Moreover, the court “need not presume 2 the truthfulness of the plaintiff’s allegations.” Id. Once the defendant has moved to dismiss 3 for lack of subject matter jurisdiction under Rule 12(b)(1), the plaintiff bears the burden of 4 establishing the court’s jurisdiction. See Chandler v. State Farm Mut. Auto. Ins. Co., 598 5 F.3d 1115, 1122 (9th Cir. 2010). 6 B. Federal Rule of Civil Procedure 12(b)(6) 7 A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the 8 pleadings’ legal sufficiency and allows a court to dismiss a complaint if the court finds the 9 plaintiff has failed to state a claim upon which relief may be granted. Navarro v. Block, 10 250 F.3d 729, 732 (9th Cir. 2001). As a matter of law, the court may dismiss the complaint 11 for either a lack of a cognizable legal theory or insufficient facts under a cognizable legal 12 claim. SmileCare Dental Grp. v. Delta Dental Plan of Cal., 88 F.3d 780, 783 (9th Cir. 13 1996) (citation omitted). However, a complaint survives a motion to dismiss if it contains 14 “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. 15 Twombly, 550 U.S. 544, 570 (2007). Notwithstanding such deference, the reviewing court 16 need not accept legal conclusions as true. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). 17 Furthermore, it is improper for the court to assume “the [plaintiff] can prove facts that [she] 18 has not alleged.” Associated Gen. Contractors of Cal., Inc. v. Cal. State Council of 19 Carpenters, 459 U.S. 519, 526 (1983). However, “[w]hen there are well-pleaded factual 20 allegations, a court should assume their veracity and then determine whether they plausibly 21 give rise to an entitlement to relief.” Iqbal, 556 U.S. at 679. The court only reviews the 22 complaint’s contents and accepts all factual allegations as true, while drawing all 23 reasonable inferences in favor of the nonmoving party. Thompson v. Davis, 295 F.3d 890, 24 895 (9th Cir. 2002). 25 III. DISCUSSION 26 Culligan raises five bases for dismissing this action. Culligan argues pursuant to 27 Rule 12(b)(1) that (1) Rodriguez lacks standing. (Doc. No. 16 at 6–12; Doc. No. 20 at 2– 28 6.) Additionally, Culligan asserts pursuant to Rule 12(b)(6) that there is no claim on which 1 relief can be granted because (2) the tracking beacons are not pen registers or trap and trace 2 devices; (3) there is no violation of California Penal Code section 638.51 because Culligan 3 consented to the use of any trap and trace devices; (4) Culligan lacked any necessary 4 criminal intent; and (5) the California Invasion of Privacy Act requires Rodriguez to allege 5 an actual injury, which Rodriguez has failed to do. (Doc. No. 16 at 12–22; Doc. No. 20 at 6 6–10.) 7 The Court goes no further than Culligan’s first basis because Rodriguez lacks 8 standing to bring the present action. 9 “To establish standing, a ‘[p]laintiff must have (1) suffered an injury in fact, (2) that 10 is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be 11 redressed by a favorable judicial decision.’” In re Facebook, Inc. Internet Tracking Litig., 12 956 F.3d 589, 597 (9th Cir. 2020) (quoting Spokeo Inc. v. Robins, 578 U.S. 330, 338 13 (2016)). The injury must be both “concrete and particularized” and “actual or imminent.” 14 Popa v. Microsoft Corp., 153 F.4th 784, 788 (9th Cir. 2025) (quoting Lujan v. Defs. of 15 Wildlife, 504 U.S. 555, 560–61 (1992)). “A ‘concrete’ injury ‘must actually exist’; put 16 differently, it must be ‘real, and not abstract.’” Id. (quoting Spokeo, 578 U.S. at 340)). 17 Additionally, history is “the touchstone for concreteness.” Id. at 789. Courts must therefore 18 “assess whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm 19 ‘traditionally’ recognized as providing a basis for a lawsuit in American Courts.” 20 TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021) (quoting Spokeo, 578 U.S. at 341). 21 Rodriguez makes no effort to establish a close relationship between her purported 22 injury and a traditional harm. “TransUnion requires a court to assess whether an individual 23 plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal 24 system.” Popa, 153 F.4th at 791. At common law, there were “four discrete torts that 25 protected specific kinds of privacy-related harms”: “intrusion upon seclusion, 26 appropriation of another person’s name or likeness, publicity given to another person’s 27 private life, and publicity that places one in a false light.” Id. at 792 (quoting Nabozny v. 28 1 Optio Sols. LLC, 84 F.4th 731, 735 (7th Cir. 2023)). Rodriguez does not analogize her 2 purported injury to any of these harms. (See generally Doc. No. 18.) 3 Instead of pointing to any specific tort, Rodriguez broadly contends that any invasion 4 of a statutorily recognized privacy interest is sufficient to constitute an Article III injury. 5 (Id. at 2 (quoting Friddle v. Epstein, 16 Cal. App. 4th 1649, 1660–61 (Cal. Ct. App. 1993)); 6 see also Doc. No. 18 at 7–14.) This is not enough. Rodriguez’s contention and her 7 accompanying analyses “revert[] to a pre-TransUnion (even pre-Spokeo) approach that 8 favors a legislative body’s views in the aggregate over a plaintiff’s individual 9 circumstances.” Popa, 153 F.4th at 792. But current Ninth Circuit precedent “requires a 10 plaintiff to demonstrate more than just a statutory violation when evaluating whether a 11 plaintiff has alleged a concrete injury.” Id. at 793. Rodriguez’s failure to demonstrate 12 anything more than an alleged statutory violation is consequently fatal to her claim. See id. 13 Even if Rodriguez had done more, the Court finds that Rodriguez lacks a privacy 14 interest in the data at issue. Again, the collected data consists of Rodriguez’s “IP address, 15 [her computer’s] operating system name, operating system version number, browser name, 16 browser version number, browser language, screen resolution, geolocation data, email 17 address, mobile ad IDs, embedded social media identities, customer and/or loyalty IDs, 18 cookies and device signature – as well as the connections between them.” (Doc. No. 10 19 ¶ 156.) 20 Rodriguez cursorily asserts that she “has a reasonable expectation of privacy in the 21 IP address of her devices, which is currently statutorily protected in California.” (Doc. No. 22 18 at 7.) Rodriguez adds that “[d]enying [her] right to control the dissemination of [her] IP 23 address and the other data linked to her IP address captured by third party spyware 24 vendors for marketing purposes is highly offensive and constitutes an invasion of privacy.” 25 (Id. at 12.) 26 Courts have consistently held that internet users have no expectation of privacy in 27 their IP addresses. For instance, the Ninth Circuit explained in United States v. Forrester 28 that “e-mail and Internet users have no expectation of privacy in . . . the IP addresses of the 1 websites they visit because they should know that this information is provided to and used 2 by Internet service providers for the specific purpose of directing the routing of 3 information.” 512 F.3d 500, 510 (9th Cir. 2008); see also, e.g., United States v. Ulbricht, 4 858 F.3d 71, 97 (2d Cir. 2017), abrogation on other grounds recognized by United States 5 v. Zodhiates, 901 F.3d 137, 143–44 (2d Cir. 2018); United States v. Caira, 833 F.3d 803, 6 806 (7th Cir. 2016). 7 Rodriguez’s largely undeveloped attempts to distinguish Forrester are unavailing. 8 (See generally Doc. No. 18 at 12–14.2) Rodriguez primarily claims that “Forrester had no 9 occasion to consider whether an Internet user has a reasonable expectation of privacy as to 10 the user’s IP address on the user’s devices.” (Id. at 12.) Although it is true that Forrester 11 focused on the IP addresses of the websites a person visited, Forrester’s rationale applies 12 equally to the user’s IP address. It is still information that “is provided to and used . . . for 13 the specific purpose of directing the routing of information.” Forrester, 512 F.3d at 510; 14 see also, e.g., Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174, 1179 (N.D. Cal. 2025) 15 (“When internet users visit a website, their devices automatically send their IP addresses 16 to the website’s server as part of the communication process.”). 17 Rodriguez’s remaining distinctions are equally inapt. For instance, Rodriguez points 18 out that “Forrester was decided in 2008, well before the [California Electronic 19 Communications Privacy Act, Cal. Penal Code sections 1546, et seq.,] and [California 20 Consumer Privacy Act of 2018, Cal. Civil Code sections 1798.100, et seq.,] were enacted 21 into law” and “before the identity resolution industry existed and before tracking software 22 embedded into websites as ‘cookies’ to track the specific webpages visited by Internet users 23 became technically feasible amongst websites.” (Doc. No. 18 at 12.) On the first point, as 24 discussed above, Rodriguez’s reliance on potential statutory violations is insufficient to 25

26 27 2 Rodriguez’s most-developed argument—pertaining to Forrester’s alleged reliance on Smith v. Maryland, 442 U.S. 735 (1979)—focuses on whether a tracking beacon can constitute a pen register, not 28 whether a person has a reasonable expectation of privacy in their IP address. (Id. at 13–14.) 1 establish an Article III injury. On the second, the fact that a website may be able to track 2 the specific pages an internet user visits does not overcome Forrester’s rationale that 3 internet users lack a privacy interest in their IP address because they voluntarily hand over 4 their IP address. Lastly, Rodriguez speculates that the Forrester court may have reached a 5 different decision “[i]f the government could ‘know the particular pages on the websites 6 the person viewed’ by learning the ‘IP addresses of websites visited.’” (Id. (quoting 7 Forrester, 512 F.3d at 510 & n.6).) The Court declines to join in Rodriguez’s speculation. 8 Internet users also have no expectation of privacy in the other data that Culligan 9 allegedly collects. For instance, courts have rejected the idea that an internet user’s contact 10 information that is “designed to be exchanged to facilitate communication”—such as their 11 email address or webpage username—constitutes private information. See, e.g., I.C. v. 12 Zynga, Inc., 600 F. Supp. 3d 1034, 1049 (N.D. Cal. 2022). Courts have similarly concluded 13 that internet users have no right to privacy in the metadata of their communication. See, 14 e.g., Mitchener v. CuriosityStream, Inc., No. 25-cv-01471-NW, 2025 WL 2272413, at *5 15 (N.D. Cal. Aug. 6, 2025). The other data that Culligan allegedly collects appears to be 16 designed to be exchanged to facilitate communication and/or to constitute metadata. 17 Accordingly, Rodriguez lacks an expectation of privacy in the data at issue. 18 IV. CONCLUSION 19 The Court lacks subject matter jurisdiction over this action because Rodriguez has 20 failed to demonstrate that she has suffered an injury cognizable under Article III of the 21 Constitution. 22 Accordingly, the Court GRANTS IN PART and DENIES IN PART Culligan’s 23 motion to dismiss the FAC. (Doc. No. 16.) Specifically, the Court GRANTS Culligan’s 24 motion to dismiss for lack of subject matter jurisdiction pursuant to Federal Rule of Civil 25 Procedure 12(b)(1). The Court DENIES AS MOOT Culligan’s motion to dismiss for 26 failure to state a claim on which relief can be granted pursuant to Federal Rule of Civil 27 Procedure 12(b)(6). 28 1 Rodriguez may file a second amended complaint for the limited purpose of curing 2 || her lack of standing within 14 days of this Order. Pursuant to Local Civil Rule 15.1.c, any 3 |}amendment “must be accompanied by a version of thle FAC] that shows — through 4 ||redlining, underlining, strikeouts, or other similarly effective typographic methods — how 5 || that pleading differs from the [FAC].” 6 IT IS SO ORDERED. 7 ||Dated: November 3, 2025 © 8 Hon. Anthony J. attaglia 9 United States District Judge 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28