Tanner Herzman, individually and on behalf of all others similarly situated v. Smile Brands Inc. d/b/a Bright Now! Dental & Orthodontics

Opinion

TANNER HERZMAN, individually and Case No.: 25-cv-03400-H-BLM on behalf of all others similarly situated, ORDER GRANTING DEFENDANT’S Plaintiff, v. COMPLAINT WITH LEAVE TO AMEND SMILE BRANDS INC. d/b/a BRIGHT NOW! DENTAL & ORTHODONTICS, [Doc. No. 8.] Defendant. On February 16, 2026, Defendant Smile Brands Inc. filed a motion to dismiss Plaintiff Tanner Herzman’s complaint pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of jurisdiction and pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (Doc. No. 8.) On March 16, 2026, Plaintiff filed a response in opposition to Defendant’s motion. (Doc. No. 9.) On April 6, 2026, Defendant filed a reply. (Doc. No. 10.) A hearing on Defendant’s motion to dismiss is currently scheduled for Monday, June 1, 2026 at 10:30 a.m. The Court, pursuant to its discretion under Civil Local Rule 7.1(d)(1), determines the matter is appropriate for resolution without oral argument, submits the motion on the parties’ papers, and vacates the hearing. For the reasons below, the Court grants Defendant’s motion to dismiss with leave to amend. Background The following background is based on the allegations in Plaintiff’s complaint. Defendant is one of the largest providers of dental support services in the world, including general dentistry, cosmetic dentistry, specialty dentistry, dental implants, and clear aligners. (Doc. No. 1, Compl. ¶ 2.) Plaintiff alleges that on or about October 2024, he made an appointment using Defendant’s website for “dental services” at Defendant’s Bright Now location in Oceanside, California. (Id. ¶ 10.) Plaintiff states in the complaint that “[t]he specific dental services scheduled by Plaintiff have been intentionally omitted [from the complaint] to protect his privacy. (Id. at 3 n.5.) Plaintiff alleges that, unbeknownst to him, Defendant then disclosed his “protected health information” (PHI) – “including the specific details about his dental appointments” – to Google for targeted advertising purposes. (Id. ¶ 11.) Plaintiff also alleges that Defendant intercepted and disclosed to Google “personally identifiable information” (PII) sufficient to identify Plaintiff as the precise individual booking dental appointments. (Id.) Plaintiff further alleges that, after booking appointments on Defendant’s website, he began receiving targeted advertisements for similar products and services. (Id. ¶ 12.) Plaintiff alleges that he would not have made an appointment on Defendant’s website if he knew Defendant was sharing his PHI with unknown third parties. (Id.) On December 3, 2025, Plaintiff filed a class action complaint against Defendant, alleging claims for: (1) violation of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2511(1) et seq.; (2) violation of California’s Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 631(a); (3) violation of CIPA, Cal. Penal Code § 632; and (4) invasion of privacy under California’s constitution. (See id. ¶¶ 117–76.) By the present motion, Defendant moves to dismiss the complaint pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction and pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (Doc. No. 8.) / / / / / / Discussion Defendant moves pursuant to Federal Rule of Civil Procedure 12(b)(1) to dismiss Plaintiff’s complaint for lack of subject matter jurisdiction. (Doc. No. 8 at 4–9.) Specifically, Defendant argues that Plaintiff lacks standing to bring his claims because he lacks an injury in fact and has failed to plausibly allege a fairly traceable injury. (See id.) I. Legal Standards for a Rule 12(b)(1) Motion to Dismiss Federal Rule of Civil Procedure 12(b)(1) authorizes a court to dismiss claims for lack of subject matter jurisdiction. “Rule 12(b)(1) jurisdictional attacks can be either facial or factual.” White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Here, Defendant’s Rule 12(b)(1) motion focuses solely on the allegations in Plaintiff’s complaint, and, thus, Defendant makes a facial attack under Rule 12(b)(1). (See Doc. No. 8 at 4–9.) “In deciding a Rule 12(b)(1) facial attack motion, a court must assume the facts alleged in the complaint to be true and construe them in the light most favorable to the nonmoving party.” Strojnik v. Kapalua Land Co. Ltd., 379 F. Supp. 3d 1078, 1082 (D. Haw. 2019) (citing Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003)); see Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 F.3d 1036, 1039 (9th Cir. 2003); Rimac v. Duncan, 319 F. App’x 535, 536 (9th Cir. 2009). But a court need not accept as true conclusory allegations. See Winsor v. Sequoia Benefits & Ins. Servs., LLC, 62 F.4th 517, 525 (9th Cir. 2023). II. Analysis Defendant argues that Plaintiff lacks Article III standing to bring his claims. (Doc. No. 8 at 4–9.) Article III of the Constitution “confines the federal judicial power to the resolution of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). “For there to be a case or controversy under Article III, the plaintiff must have a personal stake in the case—in other words, standing.” Id. “[T]he ‘irreducible constitutional minimum’ of standing consists of three elements.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). To establish standing, “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion, 594 U.S. at 423 (citing Lujan, 504 U.S. at 560–61). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Spokeo, 578 U.S. at 338; accord Popa v. Microsoft Corp., 153 F.4th 784, 788 (9th Cir. 2025). Further, “‘[t]hat a suit may be a class action . . . adds nothing to the question of standing, for even named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong.’” Spokeo, 578 U.S. at 338 n. 6 (quoting Simon v. Eastern Ky. Welfare Rights Organization, 426 U.S. 26, 40, n.20 (1976)); accord Lewis v. Casey, 518 U.S. 343, 357 (1996). To establish the first element of standing, “injury in fact,” “a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (citing Lujan, 504 U.S. at 560). “A “concrete” injury must be ‘de facto’; that is, it must actually exist.” Id. at 340. A concrete injury must be “real” and not “abstract.” Id. “[C]ertain harms readily qualify as concrete injuries under Article III. The most obvious are traditional tangible harms, such as physical harms and monetary harms.” TransUnion, 594 U.S. at 425. “Various intangible harms can also be concrete.” Id.; see Spokeo, 578 U.S. at 340. “Chief among them are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts[,] . . . for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” TransUnion, 594 U.S. at 425. Importantly, “‘Article III standing requires a concrete injury even in the context of a statutory violation.’” TransUnion, 594 U.S. at 426 (quoting Spokeo, 578 U.S. at 341). The Supreme Court “has rejected the proposition that ‘a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.’” Id. A legislature’s creation of a statutory prohibition or obligation and a cause of action does not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III. Id.; see also Popa, 153 F.4th at 792 (“TransUnion clearly cautions courts not to treat an injury as concrete for Article III purposes based only on Congress’s say- so.”). “[U]nder Article III, an injury in law is not an injury in fact.” TransUnion, 594 U.S. at 427. Here, Plaintiff acknowledges that in order to demonstrate a “concrete” injury in fact, the injury suffered by Plaintiff must be one traditionally recognized by American courts. (Doc. No. 9 at 5.) In an effort to satisfy this requirement, Plaintiff notes that violations of the right to privacy have long been actionable at common law. (Id. at 5–6 (citing In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020).) In a recent case, Popa v. Microsoft, the Ninth Circuit explained what kind of harm is similar to the types of harm recognized by common law privacy torts. To show intrusion upon seclusion, a plaintiff must show an intentional interference with his interest in solitude or seclusion, either as to his person or as to his private affairs or concerns, of a kind that would be highly offensive to a reasonable man. Similarly, a claim for public disclosure of private facts requires that a defendant gives publicity to a matter that concerns the private life of another, that the information is highly offensive to a reasonable person, and that the information is not of legitimate public concern. Popa, 153 F.4th at 791; see also, e.g., Khamooshi v. Politico LLC, No. 24-CV-07836-SK, 2025 WL 2822879, at *3 (N.D. Cal. Oct. 2, 2025) (applying Popa to an Article III standing analysis of privacy claims brought under CIPA and the California Constitution). Defendant argues that Plaintiff cannot show that the harm he allegedly suffered is similar to the kind of privacy harms recognized by the Ninth Circuit in Popa because the complaint does not contain any specific allegations explaining what information was disclosed to Defendant, what information Defendant transmitted to Google, and how any such information was linked to him as an identifiable individual. (Doc. No. 8 at 1–2, 6–8; Doc. No. 10 at 2–3.) Defendant is correct. Courts make their decisions regarding whether a plaintiff has stated a legally protectable privacy interest based on the nature of the information at issue. Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174, 1178 (N.D. Cal. 2025); Mikulsky v. Noom, Inc., 682 F. Supp. 3d 855, 864 (S.D. Cal. 2023); Maghoney v. Dotdash Meredith, Inc., No. 24-CV- 2394-AJB-BJW, 2026 WL 497402, at *5 (S.D. Cal. Feb. 23, 2026). Thus, “[t]o survive a motion to dismiss, a plaintiff must identify the specific personal information she disclosed that implicates a protectable privacy interest.” Khamooshi, 786 F. Supp. 3d at 1179 (quoting Mikulsky, 682 F. Supp. 3d at 864); accord Maghoney, 2026 WL 497402, at *5; see also Winsor, 62 F.4th at 523 (explaining that in order to adequately plead Article III standing, a plaintiff must “‘clearly . . . allege[] facts demonstrating’ a concrete injury”). Indeed, without such information, a court cannot assess whether a plaintiff has demonstrated a sufficient “concrete” harm that is “similar to the ‘highly offensive’ interferences or disclosures that were actionable at common law.” Popa, 153 F.4th at 791; cf. I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034, 1050 (N.D. Cal. 2022) (“[I]n data breach cases, courts must examine the nature of the specific information at issue to determine whether privacy interests were implicated at all.”). Here, Plaintiff’s complaint is devoid of specific factual allegations explaining what was actually disclosed to Defendant and what Defendant then allegedly disclosed to Google. Plaintiff alleges in a conclusory manner that on or about October 2024, he made an appointment using Defendant’s website for “dental services” at Defendant’s Bright Now location in Oceanside, California. (Doc. No. 1, Compl. ¶ 10.) However, the complaint contains no allegations explaining what information Plaintiff disclosed to Defendant when he made this appointment. Indeed, in the complaint, Plaintiff concedes that this information was “intentionally omitted.” (Id. at 3 n.5.) Without this information the Court cannot assess whether the information disclosed cause a sufficient “concrete” harm that is “similar to the ‘highly offensive’ interferences or disclosures that were actionable at common law.” Popa, 153 F.4th at 791. In the complaint, Plaintiff also alleges that, unbeknownst to him, Defendant then disclosed his “protected health information” (PHI) – “including the specific details about his dental appointments” – to Google for targeting advertising purposes. (Id. ¶ 11.) Plaintiff also alleges that Defendant intercepted and disclosed to Google “personally identifiable information” (PII) sufficient to identify Plaintiff as the precise individual booking dental appointments. (Id.) But, again, Plaintiff does not specifically allege what was disclosed to Google. Plaintiff’s bare allegations that “protected health information” and “personally identifiable information” were disclosed to Google is nothing more than legal conclusions cast in the form of factual allegations, and the Court need not accept them as true in deciding this motion to dismiss. See Ashcroft v. Iqbal, 556 U.S. 662, 681 (2009) (“[T]he allegations are conclusory and not entitled to be assumed true.”); Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987) (A court need not “assume the truth of legal conclusions merely because they are cast in the form of factual allegations”). In sum, Plaintiff has failed to adequately allege sufficient facts demonstrating that he has suffered a “concrete” injury in fact. See, e.g., Popa, 153 F.4th at 791 (affirming dismissal for lack of standing where the plaintiff failed to identify any “embarrassing, invasive, or otherwise private information collected by [the defendant]”); Heiting v. FKA Distrib. Co., No. 2:24-CV-07314-HDV-AGR, 2025 WL 736594, at *3 (C.D. Cal. Feb. 3, 2025) (dismissing CIPA claim for lack standing where plaintiff failed “to allege any basic facts from which the Court could infer a concrete injury, like when and how many times she visited the site, what information she provided, what information Defendant captured, whether she was aware of Defendant’s tracking practices, or if she has any reason to believe that she was indeed de-anonymized”). Because Plaintiff has failed to adequately allege that he has Article III standing, the Court must dismiss his complaint for lack of subject matter jurisdiction.! See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011) (“[L]ack of Article III standing requires dismissal for lack of subject matter jurisdiction.”’). Conclusion For the reasons above, the Court grants Defendant’s motion to dismiss Plaintiffs complaint for lack of subject matter jurisdiction. The Court’s dismissal of □□□□□□□□□□□ complaint is without prejudice and with leave to amend. See Telesaurus, 623 F.3d at 1003. Plaintiff may file a first amended complaint consistent with the analysis set forth in this order within 30 days from the date this order is filed. || DATED: April 23, 2026 | | | | | MARILYN ®. HUFF, Distri ge UNITED STATES DISTRICT COURT Because the Court dismisses Plaintiff's complaint for lack of subject matter jurisdiction based on lack of Article III standing, the Court declines to address the other 05) dismissal raised in Defendant’s motion to dismiss. (See generally Doc. No. 8