Suellen Crano v. Sojern, Inc.

Opinion

SUELLEN CRANO, Case No. 3:25-cv-02600-JSC

Plaintiff, ORDER RE: MOTION TO DISMISS v. SECOND AMENDED COMPLAINT

SOJERN, INC., Re: Dkt. No. 60 Defendant.

Suellen Crano (“Plaintiff”) filed this putative class action against Sojern, Inc. (“Sojern”) alleging it illicitly tracked her information in violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2511, and various California laws when she booked hotel rooms on the Hilton and Marriott websites. The Court previously granted Sojern’s motion to dismiss for failure to state a claim. (Dkt. No. 42. 1) Plaintiff thereafter filed her Second Amended Complaint which Sojern again moves to dismiss. (Dkt. Nos. 44, 60.) At oral argument, the Court raised the issue of Article III standing and allowed the parties to submit supplemental briefing. Having considered the briefs, including the supplemental submissions, and having had the benefit of oral argument on April 14, 2026, the Court DISMISSES this action with leave to amend. Plaintiff has failed to allege a concrete injury for purposes of Article III standing. // // // A. Second Amended Complaint Allegations Plaintiff visited the Hilton.com website in April 2024 and the Marriott.com website in August 2023 to search for and book hotels. (Dkt. No. 44 ¶ 4.) Unbeknownst to her, both Hilton and Marriott had installed Sojern’s tracking technology on their websites to collect information contained in her communications with the hotel’s websites and provide, among other things, targeted advertising. (Id. ¶¶ 4, 30.) The information collected included “unique identifying numbers associated with Plaintiff Crano alongside information that identified the relevant hotel ID, hotel name/location, hotel room price, number of rooms, check in date, check out date, and the fact that Plaintiff Crano completed her reservations.” (Id. ¶ 4.) The “unique identifying numbers” include “the hotel website and a cookie ID, mobile advertising ID (MAID), TV identifier, email address, and other persistent alpha-numerical unique identifiers […] such as IP address, device type, browser type, date and time stamp of clicks and web visits, detailed referrer URLs, and other technical information.” (Id. ¶ 33.) Sojern pairs the web interaction data “with a user’s identity using various unique IDs, including IDs referred to as a cid, apnid, ttdid, adfid, ccid, uid2.0, and, when supplied by the travel company, an email address.” (Id. ¶ 56.) Sojern collected this information without Plaintiff’s consent. (Id. ¶ 4) B. Procedural History Plaintiff originally filed this action in March 2025 bringing claims on behalf of a class of California consumers who had their “personal information collected by Sojern while booking an inn, hotel, motel, or lodginghouse.” (Dkt. No. 1 ¶ 78.) The Court denied Sojern’s motion to transfer to the District Court for the Eastern District of Virginia pursuant to 28 U.S.C. § 1404(a) based on a purported forum selection clause. (Dkt. No. 42.) The Court granted, with leave to amend, Sojern’s motion to dismiss Plaintiff’s First Amended Complaint (“FAC”), and ordered Plaintiff to request further leave of Court before adding new defendants or claims. (Id.) About one month later, Plaintiff filed the now operative Second Amended Complaint (“SAC”), adding allegations about Sojern’s collection of information from her browser and pleading claims for: (1) intrusion upon seclusion and invasion of privacy under the California Constitution; (3) violation of the Electronic Communications and Privacy Act, 18 U.S.C. § 2511(1) et seq.; (4) violation of California’s Unfair Competition Law (“UCL”), Bus. & Prof. Code §§ 17200 et seq.; and (5) unjust enrichment. (Dkt. No. 44.) Although Plaintiff added claims for intrusion upon seclusion and violation of Section 632 without requesting leave of Court, the Court later granted Plaintiff’s motion for leave to add these additional claims. (Dkt. No. 56.) Sojern now moves to dismiss Plaintiff’s SAC under Rule 12(b)(6) for failure to state a claim. (Dkt. No. 60.) In advance of oral argument, the Court raised the issue of standing under Article III and allowed supplemental briefing following the hearing. (Dkt. Nos. 68, 72, 73.) A. Article III Standing Federal courts are courts of “limited jurisdiction” which “possess only that power authorized by Constitution and statute.” Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). Article III of the United States Constitution “confines the federal judicial power to the resolution of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). “For there to be a case or controversy under Article III, the plaintiff must have a ‘personal stake’ in the case—in other words, standing.” Id. (citations omitted). To establish standing sufficient to satisfy constitutional requirements, “a plaintiff must show (i) that [s]he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Id. (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–561 (1992)). Article III standing can be raised any time including sua sponte by the court. City of Los Angeles v. Cnty. of Kern, 581 F.3d 841, 845 (9th Cir. 2009). Plaintiff insists she has Article III standing based on tangible economic injury and intangible privacy injuries. Neither argument is persuasive. 1. Intangible Privacy Injuries In Popa v. Microsoft Corp, 153 F.4th 784 (9th Cir. 2025), the plaintiff alleged a privacy violation based on the defendant’s session-replay technology which captured her information while she browsed for pet supplies on a pet supply website. The Ninth Circuit held plaintiff did not allege a “concrete” injury sufficient to establish Article III injury-in-fact because the plaintiff did not explain how a website’s conduct in tracking web interactions caused “any kind of harm that is remotely similar to the ‘highly offensive’ interferences or disclosures that were actionable at common law.” 153 F.4th at 791 (citing Spokeo Inc. v. Robins, 578 U.S. 330, 340 (2017); Transunion, 594 U.S. at 424). “[A]n ‘exact duplicate’ is not required, and many courts require a match only in the kind of harm and not degree[,]” but the plaintiff “identifie[d] no embarrassing, invasive, or otherwise private information collected[.]” Popa, 153 F.4th at 791. The Ninth Circuit rejected the plaintiff’s argument an alleged violation of a statute protecting a substantive privacy right, without more, satisfies Article III. Id. at 792-93. Concreteness requires “something beyond retention alone that resulted in an injury of the sort recognized by the Supreme Court, such as a material risk of future tangible harm, a violation of the common law right to privacy, or a cognizable constitutional violation.” Id. at 793 (emphasis, quotation marks, and citations omitted). “Session-replay” data—i.e., data reflecting a user’s interactions with a website—which revealed “nothing more than the products that interested … Popa,” was “not the type of private information that the law has historically protected.” Id. at 786-87. Plaintiff insists the tracking at issue here is “far more invasive than that alleged in Popa” because Sojern collected “personally identif[ying] information,” which it used to “create rich, deep profiles on individual travelers, including to identify those individuals’ intended purchases and where they will be and when,” so that Sojern could “sell [its] marketing services to other travel companies that want to market products to the same highly specific audiences” and “create granular audience segments that reflect actual traveler intent.” (Dkt. No. 73 at 5-6.) Plaintiff maintains these allegations implicate the following common law privacy interests: (1) “right to be free from trespass on one’s property interests”; (2) “right to be free from intrusion upon 3-4.) Plaintiff’s arguments fail to persuade. First, Popa held there is “no free-roaming privacy right at common law but rather four discrete torts that protected specific kinds of privacy-related harms” which are “intrusion upon seclusion, appropriation of another person’s name or likeness, publicity given to another person’s private life, and publicity that places one in a false light.” Popa, 153 F.4th 792. Neither trespass nor the right to control information concerning his or her person are among those identified by Popa. 2 Leaving this aside, Plaintiff’s right to control information theory is essentially a recast of her intrusion upon seclusion argument and will be addressed below. And, even if the Court were to look to trespass to chattels as a common law analog to Plaintiff’s trespass claim, Plaintiff has not adequately alleged facts which support a claim of trespass to chattels. “Under California law, trespass to chattels ‘lies where an intentional interference with the possession of personal property has proximately caused injury.’” In re Apple Inc. Device Performance Litig., 347 F. Supp. 3d 434, 455 (N.D. Cal. 2018) (quoting Thrifty-Tel, Inc. v. Bezenek, 46 Cal. App. 4th 1559, 1566 (1996)). “[T]o prevail on a claim for trespass based on accessing a computer system, the plaintiff must establish: (1) defendant intentionally and without authorization interfered with plaintiff’s possessory interest in the computer system; and (2) defendant’s unauthorized use proximately resulted in damage to plaintiff.” eBay, Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058, 1069-70 (N.D. Cal. 2000) (citing Thrify-Tel, Inc., 46 Cal. App. 4th at 1566). A plaintiff may satisfy the damages element by pleading the trespass “impaired the condition, quality, or value of the personal property.” Fields v. Wise Media, LLC, No. 12-05160 WHA, 2013 WL 5340490, at *4 (N.D. Cal. Sept. 24, 2013) (citing Intel Corp. v. Hamidi, 30 Cal. 4th 1342, 1356 (2003)). Even accepting as true that Sojern’s tracking pixel—unlike other tracking pixels—works by installing itself on Plaintiff’s computer rather than the browser, Plaintiff has not 2 Plaintiff’s argument that Popa “recogoniz[ed] that trespass could form the basis for Article III standing where online tracking technology ‘operate[d]’ on ‘an individual’s computer’” misstates Popa’s reasoning. (Dkt. No. 73 at 6.) Popa noted in a footnote that the plaintiff had “mention[ed] trespass as a potential common-law analog twice in her opening brief” but did not consider the alleged damage to or impaired functioning of her computer.3 Plaintiff has thus not pled a privacy interest based on a claim of trespass. Second, to establish intrusion upon seclusion, a plaintiff must show “an intentional interference with his interest in solitude or seclusion, either as to his person or as to his private affairs or concerns, of a kind that would be highly offensive to a reasonable man.” Popa, 153 F.4th at 791 (emphasis in original) (quoting Nayab v. Cap. One Bank (USA), N.A., 942 F.3d 480, 491 (9th Cir. 2019)). Plaintiff, however, “identifies no embarrassing, invasive, or otherwise private information collected by [Sojern].” Popa, 153 F.4th at 791. Critically, the SAC does not allege the tracking pixel actually collected Plaintiff’s personal information. Rather, it collected “unique identifying numbers associated with Plaintiff Crano alongside information that identified the relevant hotel ID, hotel name/location, hotel room price, number of rooms, check in date, check out date, and the fact that Plaintiff Crano completed her Reservations.” (Dkt. No. 44 at ¶ 4.) Elsewhere, the SAC alleges generally that the tracking pixel collects “a cookie ID, mobile advertising ID (MAID), TV identifier, email address, and other persistent alpha-numerical unique identifiers, … IP address, device type, browser type, date and time stamp of clicks and web visits, detailed referrer URLs, and other technical information.” (Id. at ¶ 33.) This information is akin to the information Popa held did not give rise to a concrete privacy interest. Popa, 153 F.4th at 786 (discussing collection of “over 30 different categories of information including” the visit date, device type of browser, operating system, country of origin, mouse movements, screen swipes, text inputted, scrolling activity, and “the user’s mailing address with the street number and zip code omitted, and the pet supplies products that interested the user.”). Courts in the Ninth Circuit have consistently concluded “disclosure of one’s email address

3 Plaintiff’s allegations as to how the tracking pixel works are also internally inconsistent as Plaintiff elsewhere alleges the tracking pixel “intercepts” the user’s communications and “[t]he relevant parts of the communication are then transmitted from the user’s browser to Sojern’s servers, where it is then further processed and analyzed and used, in this case, for targeted advertising” and the “transmission is initiated by a tracking tool’s code that lives on the user’s browser and concurrent with the communications with the host website. (Dkt. No. 44 at ¶¶ 24-25 (emphasis added); see also ¶ 50 (“Sojern has caused to be placed the Sojern Tracking Pixel and IP address, without more, does not bear similarity to the ‘highly offensive’ interferences or disclosures that were actionable at common law.” Wooten v. BioLife Plasma Servs. L.P., 807 F. Supp. 3d 1139, 1144 (E.D. Cal. 2025) (collecting cases similarly reasoning); see also Carolus v. Nexstar Media Inc., No. 24-CV-07790-VC, 2025 WL 1338193, at *1 (N.D. Cal. Apr. 9, 2025) (rejecting theory of concrete injury based on a privacy interest in controlling one’s personal information when the plaintiffs alleged collection of their IP address because that “only disclose[s] the fact that a given device visited [the] website and the general location of that device, including what zip code it’s in …[defendant’s] acquisition of that information does not cause the kind of harm that can be vindicated in federal court.”). Third, Plaintiff’s oral argument contention this case is distinguishable from the session- replay technology at issue in Popa because Sojern sells Plaintiff’s data to third parties without consent is unsupported by the SAC’s factual allegations. Plaintiff insisted Paragraph 36 supports this theory. That paragraph states:

36. Sojern is, in essence, a data business. It sources data directly from users’ communications with hotels and other travel businesses (e.g., airlines, travel and leisure companies, etc) and uses that data to create rich, deep profiles on individual travelers, including to identify those individuals’ intended purchases and where they will be and when. It then uses that data to sell Sojern’s marketing services to other travel companies that want to market products to the same highly specific audiences. So, for example, the communications Sojern intercepts related to hotel booking will tell Sojern where an individual traveler is heading and when, and Sojern then uses that information for other marketing clients who wish to sell that consumer other products at that specific location. (Dkt. No. 44 at ¶ 36 (emphasis added).) These allegations do not support a plausible inference Sojern is selling the data; rather, as the Court indicated at oral argument, they allege Sojern is using the data to improve its ability to market its clients’ products. Drawing all inferences in Sojern’s favor, Sojern alleges it uses the data to make its services more marketable, but not that it mines users’ data to sell to third-parties. In that sense, it is no different than the session-replay technology at issue in Popa. Popa, 153 F.4th at 786 (“A business utilizing this technology can then access useful consumer data, including “detailed heatmaps of a website that provide information about which elements of a website have high user engagement, how far website users scrolled on the website, and the total clicks within a given area on the website.” In essence, session-replay technology helps a business to determine which parts of its website are effective with customers and which are not.”). To the extent Plaintiff argues California’s Guest Records Statute, Civil Code Section 53.5, gives rise to a privacy interest, the Court rejected that argument in its prior Order and nothing in Plaintiff’s SAC persuades the Court otherwise. (Dkt. No. 42 at 12-14.) Regardless, Plaintiff must have personal standing. TransUnion, 594 U.S. at 423 (to invoke Article III of the Constitution, a “plaintiff must have a ‘personal stake’ in the case”). That is, Plaintiff must allege Sojern collected her private information and used that information to create a profile about her which it then provided to or used on behalf of third-party marketing clients. The SAC includes a single paragraph of allegations as to Plaintiff and a plethora of allegations as to how Sojern’s technology theoretically works, but no allegations it employed her data as part of its marketing enterprise. (Compare Dkt. No. 44 at ¶ 4 (allegations as to Plaintiff) with ¶¶ 34-42 (describing Sojern’s “curation business”). Plaintiff has not alleged actual injury to herself and instead alleges the “trackers have the capability to use these pieces of information ..which could then result in targeted advertising and could contribute to defendants’ marketing, advertising, and data analytics efforts” but Plaintiff does “not allege that defendant[] themselves took any such actions [or] that [she was] subject to any such targeted advertising.” Wooten v. BioLife Plasma Servs. L.P., 807 F. Supp. 3d 1139, 1145–46 (E.D. Cal. 2025) (citing Doe I v. Google LLC, 741 F. Supp. 3d 828, 839 (N.D. Cal. 2024) (“[I]nstead of offering factual allegations about how the plaintiffs’ various providers are actually using Google’s products, the plaintiffs allege hypothetical examples—based on the generic product descriptions—of how various product features could be used in ways that could result in privacy violations.”); Xu v. Reuters News & Media Inc., No. 24 CIV. 2466 (PAE), 2025 WL 488501, at *3 (S.D.N.Y. Feb. 13, 2025) (“[T]he complaint does not allege that [plaintiff] received any targeted advertising or was otherwise affected, much less that [plaintiff] was concretely harmed by any such advertising.”)). “Unless the retention of unlawfully obtained or created information amounts to the type of concrete injury recognized by the Supreme F.4th 986, 993 (9th Cir. 2023) (“Where we have held that the retention of illegally obtained records resulted in a concrete injury, we have always identified something beyond retention alone that resulted in an injury of the sort recognized by the Supreme Court, such as ... a violation of the common law right to privacy.”). So, the SAC’s allegations do not support a plausible inference Plaintiff suffered an intangible privacy injury. 2. Tangible Financial Injury Economic injury can provide a basis for Article III standing. See Cent. Arizona Water Conservation Dist. v. U.S. E.P.A., 990 F.2d 1531, 1537 (9th Cir. 1993). Plaintiff’s theory of economic loss is predicated on an unjust enrichment theory. (Dkt. No. 73 at 2.) To establish standing under this theory, plaintiffs “must allege they retain a stake in the profits garnered from their [IP addresses] because ‘the circumstances are such that, as between the two parties, it is unjust for [Defendant] to retain it.’” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 600 (9th Cir. 2020) (quoting McBride v. Boughton, 123 Cal. App. 4th 379, 389 (2004) (emphasis in original)). “Plaintiffs must allege that (1) Defendant’s actions were unjust, and (2) as a result, Defendant was enriched.” Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174, 1182 (N.D. Cal. 2025). Plaintiff’s allegations fail to support a plausible inference Sojern’s collection of her hotel booking data for its marketing enterprise was unjust. In Facebook Internet Tracking, the Ninth Circuit concluded the plaintiffs adequately alleged an injury in unjustly earned profits by alleging Facebook “charges users by acquiring the users’ sensitive and valuable personal information and selling it to advertisers for a profit.” 956 F.3d at 601 (internal quotation marks omitted). That is, the holding turned on the “sensitive” and “personal” nature of the information at issue. As discussed above, Plaintiff has not alleged facts that support an inference of a privacy interest in the information collected about Plaintiff; indeed, Plaintiff has not alleged any particular information about her was collected. See also Torres v. SeatGeek, No. 25-CV-07118-LB, 2026 WL 1495202, at *6 (N.D. Cal. May 28, 2026) (dismissing for lack of Article III standing based on an unjust to SeatGeek and the third parties ‘unjustly enriched’ themselves.”).4 Plaintiff’s reliance Tsering v. Meta Platforms, Inc., No. 25-CV-01611-RFL, 2026 WL 89320, at *3 (N.D. Cal. Jan. 12, 2026), is unpersuasive as there the plaintiffs “allege[d] not only that their geolocation data has monetary value, but also that Meta was able to monetize their data by collecting it, creating comprehensive user profiles, incorporating it into its advertising products, and selling it for advertising purposes.”5 Here, in contrast, Plaintiff has not alleged Sojern monetized her data. See In re Zoom Video Commc'ns Inc. Priv. Litig., 525 F. Supp. 3d 1017, 1044 (N.D. Cal. 2021) (dismissing for failure to allege injury when “Plaintiffs fail to allege facts that plausibly show that Plaintiffs’ private data was disclosed, such as facts ‘regarding the participants in the conversations, the locations of the conversations, or examples of content from the conversations” in which Plaintiffs’ private data was disclosed.’”) (emphasis in original). *** For the reasons stated above, drawing inferences in Plaintiff’s favor, the SAC does not allege Plaintiff suffered a concrete injury and thus she has not met her burden of demonstrating Article III standing. Because it is not clear Plaintiff could not amend her complaint to plead an injury personal to herself, this dismissal is with leave to amend. For the reasons stated above, the SAC is dismissed with leave to amend. If Plaintiff has a good faith basis consistent with Federal Rule of Civil Procedure 11 for believing she can amend to adequately allege standing to sue in federal court, she may amend her complaint. Any amended

4 Plaintiff’s allegations are similarly conclusory: “Sojern is unjustly enriching itself at the cost of consumer choice, when the consumer would otherwise have the ability to choose how they would monetize their own data.” (Dkt. No. 44 at ¶ 87.) Further, “Plaintiff and Class Members were damaged by Sojern’s conduct because Sojern took something of value to them (i.e., their communications and data with the hotels in the Sojern marketing enterprise) without their consent or providing compensation.” (Id. at ¶ 90.) 5 A.J. v. LMND Med. Grp., Inc., No. 23-CV-03288-RFL, 2024 WL 4579143, at *4 (N.D. Cal. Oct. 25, 2024), is unpersuasive for the same reason. Id. at *4 (alleging “Plaintiffs have adequately pled a reasonable expectation of compensation for their financially valuable medical information, alleging that they ‘would have refused to consent to such use of their Private Information or would have demanded compensation for such usage,’ and that ‘[n]ow knowing of [Lemonaid’s] ] complaint is due by June 25, 2026. If Plaintiff chooses not to amend, this action will be dismissed 2 without prejudice to being pursued in state court. See Missouri ex rel. Koster v. Harris, 847 F.3d 3 646, 656 (9th Cir. 2017) (“In general, dismissal for lack of subject matter jurisdiction is without 4 prejudice.”). 5 This Order disposes of Docket No. 60. 7 Dated: June 9, 2026

9 ne ‘A CQUELINE SCOTT CORLEY‘ 10 United States District Judge 1] a 12 13

Z 18 19 20 21 22 23 24 25 26 27 28