Suellen Crano v. Sojern, Inc.

Opinion

1 2 3 4 5 UNITED STATES DISTRICT COURT 6 NORTHERN DISTRICT OF CALIFORNIA 7 8 SUELLEN CRANO, Case No. 3:25-cv-02600-JSC

9 Plaintiff, ORDER RE: MOTION TO DISMISS 10 v. SECOND AMENDED COMPLAINT

11 SOJERN, INC., Re: Dkt. No. 60 Defendant. 12

13 14 Suellen Crano (“Plaintiff”) filed this putative class action against Sojern, Inc. (“Sojern”) 15 alleging it illicitly tracked her information in violation of the Electronic Communications Privacy 16 Act, 18 U.S.C. § 2511, and various California laws when she booked hotel rooms on the Hilton 17 and Marriott websites. The Court previously granted Sojern’s motion to dismiss for failure to 18 state a claim. (Dkt. No. 42. 1) Plaintiff thereafter filed her Second Amended Complaint which 19 Sojern again moves to dismiss. (Dkt. Nos. 44, 60.) At oral argument, the Court raised the issue of 20 Article III standing and allowed the parties to submit supplemental briefing. Having considered 21 the briefs, including the supplemental submissions, and having had the benefit of oral argument on 22 April 14, 2026, the Court DISMISSES this action with leave to amend. Plaintiff has failed to 23 allege a concrete injury for purposes of Article III standing. 24 // 25 // 26 // 27 1 BACKGROUND 2 A. Second Amended Complaint Allegations 3 Plaintiff visited the Hilton.com website in April 2024 and the Marriott.com website in 4 August 2023 to search for and book hotels. (Dkt. No. 44 ¶ 4.) Unbeknownst to her, both Hilton 5 and Marriott had installed Sojern’s tracking technology on their websites to collect information 6 contained in her communications with the hotel’s websites and provide, among other things, 7 targeted advertising. (Id. ¶¶ 4, 30.) The information collected included “unique identifying 8 numbers associated with Plaintiff Crano alongside information that identified the relevant hotel 9 ID, hotel name/location, hotel room price, number of rooms, check in date, check out date, and the 10 fact that Plaintiff Crano completed her reservations.” (Id. ¶ 4.) The “unique identifying numbers” 11 include “the hotel website and a cookie ID, mobile advertising ID (MAID), TV identifier, email 12 address, and other persistent alpha-numerical unique identifiers […] such as IP address, device 13 type, browser type, date and time stamp of clicks and web visits, detailed referrer URLs, and other 14 technical information.” (Id. ¶ 33.) Sojern pairs the web interaction data “with a user’s identity 15 using various unique IDs, including IDs referred to as a cid, apnid, ttdid, adfid, ccid, uid2.0, and, 16 when supplied by the travel company, an email address.” (Id. ¶ 56.) Sojern collected this 17 information without Plaintiff’s consent. (Id. ¶ 4) 18 B. Procedural History 19 Plaintiff originally filed this action in March 2025 bringing claims on behalf of a class of 20 California consumers who had their “personal information collected by Sojern while booking an 21 inn, hotel, motel, or lodginghouse.” (Dkt. No. 1 ¶ 78.) The Court denied Sojern’s motion to 22 transfer to the District Court for the Eastern District of Virginia pursuant to 28 U.S.C. § 1404(a) 23 based on a purported forum selection clause. (Dkt. No. 42.) The Court granted, with leave to 24 amend, Sojern’s motion to dismiss Plaintiff’s First Amended Complaint (“FAC”), and ordered 25 Plaintiff to request further leave of Court before adding new defendants or claims. (Id.) About one 26 month later, Plaintiff filed the now operative Second Amended Complaint (“SAC”), adding 27 allegations about Sojern’s collection of information from her browser and pleading claims for: (1) 1 intrusion upon seclusion and invasion of privacy under the California Constitution; (3) violation of 2 the Electronic Communications and Privacy Act, 18 U.S.C. § 2511(1) et seq.; (4) violation of 3 California’s Unfair Competition Law (“UCL”), Bus. & Prof. Code §§ 17200 et seq.; and (5) unjust 4 enrichment. (Dkt. No. 44.) Although Plaintiff added claims for intrusion upon seclusion and 5 violation of Section 632 without requesting leave of Court, the Court later granted Plaintiff’s 6 motion for leave to add these additional claims. (Dkt. No. 56.) Sojern now moves to dismiss 7 Plaintiff’s SAC under Rule 12(b)(6) for failure to state a claim. (Dkt. No. 60.) In advance of oral 8 argument, the Court raised the issue of standing under Article III and allowed supplemental 9 briefing following the hearing. (Dkt. Nos. 68, 72, 73.) 10 DISCUSSION 11 A. Article III Standing 12 Federal courts are courts of “limited jurisdiction” which “possess only that power 13 authorized by Constitution and statute.” Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 14 377 (1994). Article III of the United States Constitution “confines the federal judicial power to 15 the resolution of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 16 (2021). “For there to be a case or controversy under Article III, the plaintiff must have a ‘personal 17 stake’ in the case—in other words, standing.” Id. (citations omitted). To establish standing 18 sufficient to satisfy constitutional requirements, “a plaintiff must show (i) that [s]he suffered an 19 injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely 20 caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Id. 21 (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–561 (1992)). Article III standing can 22 be raised any time including sua sponte by the court. City of Los Angeles v. Cnty. of Kern, 581 23 F.3d 841, 845 (9th Cir. 2009). 24 Plaintiff insists she has Article III standing based on tangible economic injury and 25 intangible privacy injuries. Neither argument is persuasive. 26 27 1 1. Intangible Privacy Injuries 2 In Popa v. Microsoft Corp, 153 F.4th 784 (9th Cir. 2025), the plaintiff alleged a privacy 3 violation based on the defendant’s session-replay technology which captured her information 4 while she browsed for pet supplies on a pet supply website. The Ninth Circuit held plaintiff did 5 not allege a “concrete” injury sufficient to establish Article III injury-in-fact because the plaintiff 6 did not explain how a website’s conduct in tracking web interactions caused “any kind of harm 7 that is remotely similar to the ‘highly offensive’ interferences or disclosures that were actionable 8 at common law.” 153 F.4th at 791 (citing Spokeo Inc. v. Robins, 578 U.S. 330, 340 (2017); 9 Transunion, 594 U.S. at 424). “[A]n ‘exact duplicate’ is not required, and many courts require a 10 match only in the kind of harm and not degree[,]” but the plaintiff “identifie[d] no embarrassing, 11 invasive, or otherwise private information collected[.]” Popa, 153 F.4th at 791. The Ninth Circuit 12 rejected the plaintiff’s argument an alleged violation of a statute protecting a substantive privacy 13 right, without more, satisfies Article III. Id. at 792-93. Concreteness requires “something beyond 14 retention alone that resulted in an injury of the sort recognized by the Supreme Court, such as a 15 material risk of future tangible harm, a violation of the common law right to privacy, or a 16 cognizable constitutional violation.” Id. at 793 (emphasis, quotation marks, and citations omitted). 17 “Session-replay” data—i.e., data reflecting a user’s interactions with a website—which revealed 18 “nothing more than the products that interested … Popa,” was “not the type of private information 19 that the law has historically protected.” Id. at 786-87. 20 Plaintiff insists the tracking at issue here is “far more invasive than that alleged in Popa” 21 because Sojern collected “personally identif[ying] information,” which it used to “create rich, deep 22 profiles on individual travelers, including to identify those individuals’ intended purchases and 23 where they will be and when,” so that Sojern could “sell [its] marketing services to other travel 24 companies that want to market products to the same highly specific audiences” and “create 25 granular audience segments that reflect actual traveler intent.” (Dkt. No. 73 at 5-6.) Plaintiff 26 maintains these allegations implicate the following common law privacy interests: (1) “right to be 27 free from trespass on one’s property interests”; (2) “right to be free from intrusion upon 1 3-4.) Plaintiff’s arguments fail to persuade. 2 First, Popa held there is “no free-roaming privacy right at common law but rather four 3 discrete torts that protected specific kinds of privacy-related harms” which are “intrusion upon 4 seclusion, appropriation of another person’s name or likeness, publicity given to another person’s 5 private life, and publicity that places one in a false light.” Popa, 153 F.4th 792. Neither trespass 6 nor the right to control information concerning his or her person are among those identified by 7 Popa. 2 Leaving this aside, Plaintiff’s right to control information theory is essentially a recast of 8 her intrusion upon seclusion argument and will be addressed below. And, even if the Court were 9 to look to trespass to chattels as a common law analog to Plaintiff’s trespass claim, Plaintiff has 10 not adequately alleged facts which support a claim of trespass to chattels. 11 “Under California law, trespass to chattels ‘lies where an intentional interference with the 12 possession of personal property has proximately caused injury.’” In re Apple Inc. Device 13 Performance Litig., 347 F. Supp. 3d 434, 455 (N.D. Cal. 2018) (quoting Thrifty-Tel, Inc. v. 14 Bezenek, 46 Cal. App. 4th 1559, 1566 (1996)). “[T]o prevail on a claim for trespass based on 15 accessing a computer system, the plaintiff must establish: (1) defendant intentionally and without 16 authorization interfered with plaintiff’s possessory interest in the computer system; and (2) 17 defendant’s unauthorized use proximately resulted in damage to plaintiff.” eBay, Inc. v. Bidder’s 18 Edge, Inc., 100 F. Supp. 2d 1058, 1069-70 (N.D. Cal. 2000) (citing Thrify-Tel, Inc., 46 Cal. App. 19 4th at 1566). A plaintiff may satisfy the damages element by pleading the trespass “impaired the 20 condition, quality, or value of the personal property.” Fields v. Wise Media, LLC, No. 12-05160 21 WHA, 2013 WL 5340490, at *4 (N.D. Cal. Sept. 24, 2013) (citing Intel Corp. v. Hamidi, 30 Cal. 22 4th 1342, 1356 (2003)). Even accepting as true that Sojern’s tracking pixel—unlike other tracking 23 pixels—works by installing itself on Plaintiff’s computer rather than the browser, Plaintiff has not 24 25 2 Plaintiff’s argument that Popa “recogoniz[ed] that trespass could form the basis for Article III 26 standing where online tracking technology ‘operate[d]’ on ‘an individual’s computer’” misstates Popa’s reasoning. (Dkt. No. 73 at 6.) Popa noted in a footnote that the plaintiff had “mention[ed] 27 trespass as a potential common-law analog twice in her opening brief” but did not consider the 1 alleged damage to or impaired functioning of her computer.3 Plaintiff has thus not pled a privacy 2 interest based on a claim of trespass. 3 Second, to establish intrusion upon seclusion, a plaintiff must show “an intentional 4 interference with his interest in solitude or seclusion, either as to his person or as to his private 5 affairs or concerns, of a kind that would be highly offensive to a reasonable man.” Popa, 153 F.4th 6 at 791 (emphasis in original) (quoting Nayab v. Cap. One Bank (USA), N.A., 942 F.3d 480, 491 7 (9th Cir. 2019)). Plaintiff, however, “identifies no embarrassing, invasive, or otherwise private 8 information collected by [Sojern].” Popa, 153 F.4th at 791. Critically, the SAC does not allege 9 the tracking pixel actually collected Plaintiff’s personal information. Rather, it collected “unique 10 identifying numbers associated with Plaintiff Crano alongside information that identified the 11 relevant hotel ID, hotel name/location, hotel room price, number of rooms, check in date, check 12 out date, and the fact that Plaintiff Crano completed her Reservations.” (Dkt. No. 44 at ¶ 4.) 13 Elsewhere, the SAC alleges generally that the tracking pixel collects “a cookie ID, mobile 14 advertising ID (MAID), TV identifier, email address, and other persistent alpha-numerical unique 15 identifiers, … IP address, device type, browser type, date and time stamp of clicks and web visits, 16 detailed referrer URLs, and other technical information.” (Id. at ¶ 33.) This information is akin to 17 the information Popa held did not give rise to a concrete privacy interest. Popa, 153 F.4th at 786 18 (discussing collection of “over 30 different categories of information including” the visit date, 19 device type of browser, operating system, country of origin, mouse movements, screen swipes, 20 text inputted, scrolling activity, and “the user’s mailing address with the street number and zip 21 code omitted, and the pet supplies products that interested the user.”). 22 Courts in the Ninth Circuit have consistently concluded “disclosure of one’s email address 23

24 3 Plaintiff’s allegations as to how the tracking pixel works are also internally inconsistent as Plaintiff elsewhere alleges the tracking pixel “intercepts” the user’s communications and “[t]he 25 relevant parts of the communication are then transmitted from the user’s browser to Sojern’s servers, where it is then further processed and analyzed and used, in this case, for targeted 26 advertising” and the “transmission is initiated by a tracking tool’s code that lives on the user’s browser and concurrent with the communications with the host website. (Dkt. No. 44 at ¶¶ 27 24-25 (emphasis added); see also ¶ 50 (“Sojern has caused to be placed the Sojern Tracking Pixel 1 and IP address, without more, does not bear similarity to the ‘highly offensive’ interferences or 2 disclosures that were actionable at common law.” Wooten v. BioLife Plasma Servs. L.P., 807 F. 3 Supp. 3d 1139, 1144 (E.D. Cal. 2025) (collecting cases similarly reasoning); see also Carolus v. 4 Nexstar Media Inc., No. 24-CV-07790-VC, 2025 WL 1338193, at *1 (N.D. Cal. Apr. 9, 2025) 5 (rejecting theory of concrete injury based on a privacy interest in controlling one’s personal 6 information when the plaintiffs alleged collection of their IP address because that “only disclose[s] 7 the fact that a given device visited [the] website and the general location of that device, including 8 what zip code it’s in …[defendant’s] acquisition of that information does not cause the kind of 9 harm that can be vindicated in federal court.”). 10 Third, Plaintiff’s oral argument contention this case is distinguishable from the session- 11 replay technology at issue in Popa because Sojern sells Plaintiff’s data to third parties without 12 consent is unsupported by the SAC’s factual allegations. Plaintiff insisted Paragraph 36 supports 13 this theory. That paragraph states:

14 36. Sojern is, in essence, a data business. It sources data directly from users’ communications with hotels and other travel businesses (e.g., 15 airlines, travel and leisure companies, etc) and uses that data to create rich, deep profiles on individual travelers, including to identify those 16 individuals’ intended purchases and where they will be and when. It then uses that data to sell Sojern’s marketing services to other travel 17 companies that want to market products to the same highly specific audiences. So, for example, the communications Sojern intercepts 18 related to hotel booking will tell Sojern where an individual traveler is heading and when, and Sojern then uses that information for other 19 marketing clients who wish to sell that consumer other products at that specific location. 20 (Dkt. No. 44 at ¶ 36 (emphasis added).) These allegations do not support a plausible inference 21 Sojern is selling the data; rather, as the Court indicated at oral argument, they allege Sojern is 22 using the data to improve its ability to market its clients’ products. Drawing all inferences in 23 Sojern’s favor, Sojern alleges it uses the data to make its services more marketable, but not that it 24 mines users’ data to sell to third-parties. In that sense, it is no different than the session-replay 25 technology at issue in Popa. Popa, 153 F.4th at 786 (“A business utilizing this technology can 26 then access useful consumer data, including “detailed heatmaps of a website that provide 27 information about which elements of a website have high user engagement, how far website users 1 scrolled on the website, and the total clicks within a given area on the website.” In essence, 2 session-replay technology helps a business to determine which parts of its website are effective 3 with customers and which are not.”). To the extent Plaintiff argues California’s Guest Records 4 Statute, Civil Code Section 53.5, gives rise to a privacy interest, the Court rejected that argument 5 in its prior Order and nothing in Plaintiff’s SAC persuades the Court otherwise. (Dkt. No. 42 at 6 12-14.) 7 Regardless, Plaintiff must have personal standing. TransUnion, 594 U.S. at 423 (to invoke 8 Article III of the Constitution, a “plaintiff must have a ‘personal stake’ in the case”). That is, 9 Plaintiff must allege Sojern collected her private information and used that information to create a 10 profile about her which it then provided to or used on behalf of third-party marketing clients. The 11 SAC includes a single paragraph of allegations as to Plaintiff and a plethora of allegations as to 12 how Sojern’s technology theoretically works, but no allegations it employed her data as part of its 13 marketing enterprise. (Compare Dkt. No. 44 at ¶ 4 (allegations as to Plaintiff) with ¶¶ 34-42 14 (describing Sojern’s “curation business”). Plaintiff has not alleged actual injury to herself and 15 instead alleges the “trackers have the capability to use these pieces of information ..which could 16 then result in targeted advertising and could contribute to defendants’ marketing, advertising, and 17 data analytics efforts” but Plaintiff does “not allege that defendant[] themselves took any such 18 actions [or] that [she was] subject to any such targeted advertising.” Wooten v. BioLife Plasma 19 Servs. L.P., 807 F. Supp. 3d 1139, 1145–46 (E.D. Cal. 2025) (citing Doe I v. Google LLC, 741 F. 20 Supp. 3d 828, 839 (N.D. Cal. 2024) (“[I]nstead of offering factual allegations about how the 21 plaintiffs’ various providers are actually using Google’s products, the plaintiffs allege hypothetical 22 examples—based on the generic product descriptions—of how various product features could be 23 used in ways that could result in privacy violations.”); Xu v. Reuters News & Media Inc., No. 24 24 CIV. 2466 (PAE), 2025 WL 488501, at *3 (S.D.N.Y. Feb. 13, 2025) (“[T]he complaint does not 25 allege that [plaintiff] received any targeted advertising or was otherwise affected, much less that 26 [plaintiff] was concretely harmed by any such advertising.”)). “Unless the retention of unlawfully 27 obtained or created information amounts to the type of concrete injury recognized by the Supreme 1 F.4th 986, 993 (9th Cir. 2023) (“Where we have held that the retention of illegally obtained 2 records resulted in a concrete injury, we have always identified something beyond retention alone 3 that resulted in an injury of the sort recognized by the Supreme Court, such as ... a violation of the 4 common law right to privacy.”). 5 So, the SAC’s allegations do not support a plausible inference Plaintiff suffered an 6 intangible privacy injury. 7 2. Tangible Financial Injury 8 Economic injury can provide a basis for Article III standing. See Cent. Arizona Water 9 Conservation Dist. v. U.S. E.P.A., 990 F.2d 1531, 1537 (9th Cir. 1993). Plaintiff’s theory of 10 economic loss is predicated on an unjust enrichment theory. (Dkt. No. 73 at 2.) To establish 11 standing under this theory, plaintiffs “must allege they retain a stake in the profits garnered from 12 their [IP addresses] because ‘the circumstances are such that, as between the two parties, it is 13 unjust for [Defendant] to retain it.’” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 14 600 (9th Cir. 2020) (quoting McBride v. Boughton, 123 Cal. App. 4th 379, 389 (2004) (emphasis 15 in original)). “Plaintiffs must allege that (1) Defendant’s actions were unjust, and (2) as a result, 16 Defendant was enriched.” Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174, 1182 (N.D. Cal. 17 2025). 18 Plaintiff’s allegations fail to support a plausible inference Sojern’s collection of her hotel 19 booking data for its marketing enterprise was unjust. In Facebook Internet Tracking, the Ninth 20 Circuit concluded the plaintiffs adequately alleged an injury in unjustly earned profits by alleging 21 Facebook “charges users by acquiring the users’ sensitive and valuable personal information and 22 selling it to advertisers for a profit.” 956 F.3d at 601 (internal quotation marks omitted). That is, 23 the holding turned on the “sensitive” and “personal” nature of the information at issue. As 24 discussed above, Plaintiff has not alleged facts that support an inference of a privacy interest in the 25 information collected about Plaintiff; indeed, Plaintiff has not alleged any particular information 26 about her was collected. See also Torres v. SeatGeek, No. 25-CV-07118-LB, 2026 WL 1495202, 27 at *6 (N.D. Cal. May 28, 2026) (dismissing for lack of Article III standing based on an unjust 1 to SeatGeek and the third parties ‘unjustly enriched’ themselves.”).4 2 Plaintiff’s reliance Tsering v. Meta Platforms, Inc., No. 25-CV-01611-RFL, 2026 WL 3 89320, at *3 (N.D. Cal. Jan. 12, 2026), is unpersuasive as there the plaintiffs “allege[d] not only 4 that their geolocation data has monetary value, but also that Meta was able to monetize their data 5 by collecting it, creating comprehensive user profiles, incorporating it into its advertising products, 6 and selling it for advertising purposes.”5 Here, in contrast, Plaintiff has not alleged Sojern 7 monetized her data. See In re Zoom Video Commc'ns Inc. Priv. Litig., 525 F. Supp. 3d 1017, 1044 8 (N.D. Cal. 2021) (dismissing for failure to allege injury when “Plaintiffs fail to allege facts that 9 plausibly show that Plaintiffs’ private data was disclosed, such as facts ‘regarding the participants 10 in the conversations, the locations of the conversations, or examples of content from the 11 conversations” in which Plaintiffs’ private data was disclosed.’”) (emphasis in original). 12 *** 13 For the reasons stated above, drawing inferences in Plaintiff’s favor, the SAC does not 14 allege Plaintiff suffered a concrete injury and thus she has not met her burden of demonstrating 15 Article III standing. Because it is not clear Plaintiff could not amend her complaint to plead an 16 injury personal to herself, this dismissal is with leave to amend. 17 CONCLUSION 18 For the reasons stated above, the SAC is dismissed with leave to amend. If Plaintiff has a 19 good faith basis consistent with Federal Rule of Civil Procedure 11 for believing she can amend to 20 adequately allege standing to sue in federal court, she may amend her complaint. Any amended 21

22 4 Plaintiff’s allegations are similarly conclusory: “Sojern is unjustly enriching itself at the cost of consumer choice, when the consumer would otherwise have the ability to choose how they would 23 monetize their own data.” (Dkt. No. 44 at ¶ 87.) Further, “Plaintiff and Class Members were damaged by Sojern’s conduct because Sojern took something of value to them (i.e., their 24 communications and data with the hotels in the Sojern marketing enterprise) without their consent or providing compensation.” (Id. at ¶ 90.) 25 5 A.J. v. LMND Med. Grp., Inc., No. 23-CV-03288-RFL, 2024 WL 4579143, at *4 (N.D. Cal. Oct. 25, 2024), is unpersuasive for the same reason. Id. at *4 (alleging “Plaintiffs have adequately pled 26 a reasonable expectation of compensation for their financially valuable medical information, alleging that they ‘would have refused to consent to such use of their Private Information or would 27 have demanded compensation for such usage,’ and that ‘[n]ow knowing of [Lemonaid’s] ] complaint is due by June 25, 2026. If Plaintiff chooses not to amend, this action will be dismissed 2 || without prejudice to being pursued in state court. See Missouri ex rel. Koster v. Harris, 847 F.3d 3 646, 656 (9th Cir. 2017) (“In general, dismissal for lack of subject matter jurisdiction is without 4 || prejudice.”). 5 This Order disposes of Docket No. 60. 6 IT IS SO ORDERED. 7 Dated: June 9, 2026

9 ne ‘A CQUELINE SCOTT CORLEY‘ 10 United States District Judge 1] a 12 13

Z 18 19 20 21 22 23 24 25 26 27 28