Vishal Shah v. Politico LLC

• Court: District Court, N.D. California
• Decided: February 6, 2026
• Docket: 5:25-cv-05213
• Status: Unknown

Opinion

2 UNITED STATES DISTRICT COURT 3 NORTHERN DISTRICT OF CALIFORNIA

4 VISHAL SHAH, Case No. 25-cv-05213-NW 5 Plaintiff, v.

6 Politico LLC, ORDER GRANTING IN PART AND 7 Defendant. DENYING IN PART POLITICO’S MOTION TO DISMISS 8 Re: ECF No. 18 9 10 This class action alleges that the news website Politico LLC (“Politico” or “Defendant”) 11 allowed visitors to politico.com to opt out of third party cookies and tracking technologies but 12 nevertheless continued to “cause[] users’ devices to store and/or transmit both first-party and 13 third-party tracking cookies.” Compl. ¶ 16. Specifically, lead Plaintiff Vishal Shah (“Shah” or 14 “Plaintiff”) alleges nine causes of action against Politico: (1) invasion of privacy; (2) intrusion 15 upon seclusion; (3) wiretapping in violation of the California Invasion of Privacy Act (“CIPA”), 16 Cal. Penal Code § 631; (4) use of a pen register in violation of CIPA, Cal. Penal Code § 638.51; 17 (5) common law fraud, deceit, and/or misrepresentation; (6) unjust enrichment; (7) breach of 18 contract; (8) breach of the implied covenant of good faith and fair dealing; and (9) trespass to 19 chattels. Id. ¶¶ 92-190. Politico timely moved to dismiss all of Plaintiff’s claims. ECF No. 18. 20 For the reasons set forth below, the Court GRANTS IN PART AND DENIES IN PART 21 Politico’s motion to dismiss. 22 I. BACKGROUND1 23 Sometime “in the first half of 2023,” Shah, a California resident, visited the Politico 24 website “to read the news and follow current events.” Compl. ¶¶ 75-76. Because Shah was in 25 1 Plaintiff has brought several near identical complaints against other websites in this district, and 26 Plaintiff’s counsel has brought still more on behalf of other plaintiffs. One of these cases is Pemberton v. Restaurant Brands International, Inc. See No. 25-CV-03647-JSC, 2025 WL 27 3268404 (N.D. Cal. Nov. 24, 2025). The Court has compared the complaints in that action against 1 California, the website “immediately” presented a popup cookie consent banner (“Cookie 2 Banner”) that explained that users could “choose not to allow certain types of cookies” by toggling 3 off certain categories of cookies (“Performance Cookies” and “Online Behavioural Advertising” 4 cookies). Id. ¶ 78. Shah toggled off these cookies accordingly and then clicked the “Confirm my 5 Choices” button under the toggle-sliders. Id. Believing these steps would “allow him to opt out 6 of, decline, and/or reject all non-essential cookies and other tracking technologies,” Shah 7 continued browsing the website in reliance on Defendant’s promises. Id. ¶¶ 78, 81. 8 According to Shah, “Defendants nonetheless continued to cause the placement and/or 9 transmission of cookies along with user data, including those that cause the disclosure of user data 10 to the Third Parties on his device,” and therefore “permitted the Third Parties to track and collect 11 Shah’s Private Communications as Shah browsed the Website.” Id. ¶ 81. Shah alleges:

12 [T]he third-party cookies stored on and/or loaded from users’ devices when they interact with the Website are transmitted to those third 13 parties, enabling them to surreptitiously track in real time and collect Website users’ personal information, such as their browsing activities 14 and private communications with Defendant, including the following:

15 • Browsing History: Information about the webpages a Website user visits, including the URLs, titles, and keywords 16 associated with the webpages viewed, time spent on each page, and navigation patterns; 17 • Visit History: Information about the frequency and total 18 number of visits to the Website; • Website Interactions: Data on which links, buttons, or ads 19 on the Website that a user clicks; 20 • User Input Data: The information the user entered into the Website’s form fields, including search queries, the user’s 21 name, age, gender, email address, location, and/or payment information; 22 • Demographic Information: Inferences about age, gender, and location based on browsing habits and interactions with 23 Website content; 24 • Interests and Preferences: Insights into user interests based on the types of Website content viewed, products searched for, 25 or topics engaged with; • Shopping Behavior: Information about the Website products 26

difference is the addition of two contract claims in the instant action (Counts VIII and IX). This 27 Court has reviewed the decision in Pemberton and has found it well-reasoned and persuasive. As viewed or added to shopping carts; 1 • Device Information: Details about the Website user’s device, 2 such as the type of device (mobile, tablet, desktop), operating system, and browser type; 3 • Referring URL: Information about the website that referred the user to the Website; 4 • Session Information: Details about the user’s current 5 Website browsing session, including the exact date and time of the user’s session, the session duration and actions taken on 6 the Website during that session; • User Identifiers: A unique ID that is used to recognize and 7 track a specific Website user across different websites over time; and/or 8 • Geolocation Data: General location information based on the 9 Website user’s IP address or GPS data, if accessible. 10 Id. ¶ 19. Shah states if he had known “Defendants’ representations to Website users that they 11 could opt out of the sale/sharing of his personal information and opt out of all cookies were 12 untrue,” he would not have used the site. Id. ¶ 82. Shah further alleges he “continues to desire to 13 browse content featured on the Politico website, but will not do so until the website is 14 “programmed to honor users’ requests to opt out of the sale/sharing of their personal information 15 and opt out of all non-required cookies and tracking technologies.” Id. ¶ 83. 16 II. LEGAL STANDARD 17 A. Article III Standing 18 “In the absence of standing, a federal court lacks subject matter jurisdiction over the suit.” 19 Righthaven LLC v. Hoehn, 716 F.3d 1166, 1172 (9th Cir. 2013) (quotations omitted). To 20 demonstrate Article III standing, a plaintiff must show an injury, trace that injury to the 21 defendants’ conduct, and prove that courts can provide adequate redress for the injury. Lujan v. 22 Defs. of Wildlife, 504 U.S. 555, 560-61 (1992). A plaintiff must show that he suffered “an 23 invasion of a legally protected interest” that is “concrete and particularized” and “actual or 24 imminent, not conjectural or hypothetical.” Id. at 560. For an injury to be particularized, it “must 25 affect the plaintiff in a personal and individual way.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 26 (2016). “Only those plaintiffs who have been concretely harmed by a defendant’s statutory 27 1 violation may sue that private defendant over that violation in federal court.” TransUnion LLC v. 2 Ramirez, 594 U.S. 413, 427 (2021) (emphasis added). 3 B. Rule 12(b)(6) 4 Federal Rule of Civil Procedure 12(b)(6) is designed to “test[ ] the legal sufficiency of a 5 claim.” Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). A dismissal under Rule 12(b)(6) for 6 failure to state a claim can be based on either (1) the lack of a cognizable legal theory or (2) 7 insufficient facts to support a cognizable legal claim. Balistreri v. Pacifica Police Dep’t, 901 F.2d 8 696, 699 (9th Cir. 1990). When analyzing a complaint under Rule 12(b)(6), the well-pled factual 9 allegations are taken as true and construed in the light most favorable to the nonmoving party. 10 Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). Legal conclusions couched as factual 11 allegations are not entitled to the assumption of truth, Ashcroft v. Iqbal, 556 U.S. 662, 680 (2009), 12 and therefore are insufficient to defeat a motion to dismiss for failure to state a claim, In re Cutera 13 Sec. Litig., 610 F.3d 1103, 1108 (9th Cir. 2010). 14 C. Rule 9(b) 15 Any claims that are “grounded in fraud . . . must satisfy the traditional plausibility standard 16 of Rules 8(a) and 12(b)(6), as well as the heightened pleading requirements of Rule 9(b).” 17 Davidson v. Kimberly-Clark Corp., 889 F.3d 956, 964 (9th Cir. 2018). The heightened pleading 18 standard set forth in Rule 9(b) requires a plaintiff to “state with particularity the circumstances 19 constituting fraud or mistake.” Fed. R. Civ. P. 9(b). Allegations of fraud must “be specific 20 enough to give defendants notice of the particular misconduct so that they can defend against the 21 charge and not just deny that they have done anything wrong. Averments of fraud must be 22 accompanied by the who, what, when, where, and how of the misconduct charged.” Vess v. Ciba- 23 Geigy Corp. USA, 317 F.3d 1097, 1106 (9th Cir. 2003) (internal quotation marks, alteration, and 24 citations omitted). 25 III. DISCUSSION 26 A. Article III Standing 27 Politico argues that Shah fails to establish an injury sufficient to give rise to Article III 1 legally protected interest” that is “concrete and particularized” and “actual or imminent, not 2 conjectural or hypothetical.” Lujan, 504 U.S. at 560 (quotations omitted). “Central to assessing 3 concreteness is whether the asserted harm has a ‘close relationship’ to a harm traditionally 4 recognized as providing a basis for a lawsuit in American courts.” TransUnion, 594 U.S. at 417; 5 see also Popa v. Microsoft Corp., 153 F.4th 784, 791 (9th Cir. 2025) (“TransUnion requires a 6 court to assess whether an individual plaintiff has suffered a harm that has traditionally been 7 actionable in our nation’s legal system.”). 8 According to Politico, Plaintiff has failed to demonstrate that he has been injured because 9 he has not “identif[ied] the specific personal information” that “implicates a protectable privacy 10 interest.” Byars v. Sterling Jewelers, Inc., No. 5:22-CV-01456-SB-SP, 2023 WL 2996686, at *1 11 (C.D. Cal. Apr. 4, 2023); Mot. at 7. Defendant cites to a recent decision from this Court in 12 Kishnani v. Royal Caribbean Cruises Ltd., where the undersigned found plaintiff’s bare 13 allegations that defendant collected his “‘data’ and ‘information’” insufficient to demonstrate 14 injury-in-fact. No. 25-CV-01473-NW, 2025 WL 1745726, at *2 (N.D. Cal. June 24, 2025) 15 (internal citations and quotations omitted). Politico’s attempts to liken this case to Kishnani are 16 unavailing. Despite superficial similarities, this case is distinguishable because Shah has: (1) 17 identified the specific personal information disclosed that implicates a protectable privacy interest 18 and (2) alleged an invasion of a legally protected right. 19 First, in Kishnani, the “[p]laintiff allege[d] only that [d]efendant invaded his privacy by 20 impermissibly collecting Plaintiff’s ‘data’ and ‘information.’” Id. at *3. In contrast, Shah alleges 21 that Politico collected his “browsing history, visit history, website interactions, user input data, 22 demographic information, interests and preferences, shopping behavior, device information, 23 referring URL, session information, user identifiers, and geolocation data.” Compl. ¶ 19. Shah 24 sets forth the specific cookies Politico used (furnished by Google and Adobe, among others) and 25 the specific information each cookie collected. Compl. ¶¶ 38-68. Kishnani concerned a single 26 cookie furnished by TikTok, and failed to explain what, if any, actual information that cookie 27 collected. See Kishnani, 2025 WL 1745726, at *3. 1 Second, the legally protected right that was missing in Kishnani is present in the instant 2 action. There, the Court acknowledged that “‘[i]ntrusion on privacy alone can be a concrete 3 injury,’ [but] the nature of the injury turns on whether a plaintiff has a legitimate expectation of 4 privacy.” Id. (quoting Patel v. Facebook Inc., 290 F. Supp. 3d 948, 954 (N.D. Cal. 2018)). 5 Kishnani did not have a reasonable expectation of privacy: the defendant there had not offered 6 Kishnani the opportunity to opt out of tracking cookies, so he could not reasonably expect that 7 cookies would not be deployed when he browsed defendant’s website. In contrast, Shah was 8 immediately presented with an option to opt out of certain tracking cookies upon entering the 9 Politico site, giving rise to an expectation of privacy. In short, Politico “set an expectation that . . . 10 user data would not be collected, but then collected it anyway.” Facebook Tracking. That is 11 enough to allege an injury. 12 The cases cited by Politico do not support a different finding, not least because they are the 13 same cases that Pemberton compellingly distinguished:

14 [I]n Mikulsky v. Noom, Inc., 682 F. Supp. 3d 855 (S.D. Cal. 2023), the court dismissed the plaintiff’s claims for lack of standing because 15 she only alleged disclosure of “personal information” without specifying what that information included, so the court could not 16 conclude she “ha[d] a protectable privacy interest in that information.” Id. at 864-65. Similarly, in Khamooshi v. Politico LLC, 17 786 F. Supp. 3d 1174 (N.D. Cal. 2025), the court held the plaintiffs lacked standing because they only alleged collection of their IP 18 addresses, in which they lacked a reasonable expectation of privacy. Id. at 1179. In contrast to both Mikulsky and Khamooshi, Plaintiff 19 specifically alleges Defendants allowed “Third Parties to track and collect [his] Private Communications,” including his browsing 20 history, visit history, website interactions, user input data, demographic information, interests and preferences, shopping 21 behavior, device information, referring URL, session information, user identifiers, and geolocation data. 22 23 Pemberton, 2025 WL 3268404, at *4; see infra n.1 (discussing the similarities between Pemberton 24 and the instant action). In short, “because a misrepresentation about how information would be 25 used and the non-consensual sharing of personal information could give rise to injuries that were 26 actionable invasions of privacy at common law, plaintiffs have sufficiently pleaded an injury-in- 27 1 fact for the purposes of Article III.” See Shah v. MyFitnessPal, Inc., No. 25-CV-04430-PCP, 2026 2 WL 216334, at *3 (N.D. Cal. Jan. 27, 2026).2 3 B. Motion to Dismiss for Failure to State A Claim 4 1. Causes of Action I and II: Invasion of Privacy and Intrusion Upon 5 Seclusion 6 As set forth in Pemberton,

7 Courts evaluating whether plaintiffs have stated a claim for invasion of privacy or intrusion upon seclusion under California law “consider 8 the claims together and ask whether: (1) there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive.” 9 [In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020)] (quoting Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 10 (2009)). First, to determine whether a reasonable expectation of privacy exists, courts consider “the customs, practices, and 11 circumstances surrounding the data collection, including the amount of data collected, the sensitivity of data collected, the manner of data 12 collection, and the defendant’s representations to its customers.” Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1088 (N.D. Cal. 13 2022) (citing Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 26 (1994)). A reasonable expectation of privacy may exist when a 14 defendant gains “unwanted access to data by electronic or other covert means, in violation of the law or social norms.” Facebook Internet 15 Tracking, 956 F.3d at 601-02 (quotation marks and citation omitted). Second, when determining whether an invasion is “highly offensive,” 16 courts consider “the degree and setting of the intrusion,” as well as “the intruder’s motives and objectives.” Hernandez, 47 Cal. 4th at 17 287. Because both inquiries are highly factual, “[c]ourts are generally hesitant to decide claims of this nature at the pleading stage.” In re 18 Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 799 (N.D. Cal. 2022). 19 Pemberton, 2025 WL 3268404, at *4. 20 Plaintiffs have alleged facts sufficient to show that Politico’s alleged collection of data 21 could be highly offensive. “Under California law, courts must be reluctant to reach a conclusion 22 at the pleading stage about how offensive or serious the privacy intrusion is.” In re Facebook, 23 Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 797 (N.D. Cal. 2019). Indeed, 24 determining the offensiveness of an invasion requires consideration of “the degree of the intrusion, 25

26 2 Shah, the Plaintiff here, also filed Shah v. MyFitnessPal, an action raising near identical factual and legal issues but filed against a different defendant. Politico contends that Shah’s status as a 27 plaintiff in that and several other similar cases demonstrates that Shah is a “tester,” and therefore 1 the context, conduct and circumstances surrounding the intrusion as well as the intruder’s motives 2 and objectives, the setting into which he intrudes, and the expectations of those whose privacy is 3 invaded.” Hill, 865 P.2d at 648. Only if the allegations “show no reasonable expectation of 4 privacy or an insubstantial impact on privacy interests” can the “question of [a serious or highly 5 offensive] invasion [ ] be adjudicated as a matter of law.” Id. at 657. That is not the case here. 6 See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 606 (9th Cir. 2020) (“The ultimate 7 question of whether Facebook’s tracking and collection practices could highly offend a reasonable 8 individual is an issue that cannot be resolved at the pleading stage.”); de Ayora v. Inspire Brands, 9 Inc., No. 25-CV-03645-AGT, 2025 WL 3707561, at *3 (N.D. Cal. Dec. 22, 2025). 10 Politico’s motion to dismiss Counts I and II is DENIED. 11 2. Causes of Action III and IV: CIPA Wiretap and CIPA Pen Register 12 CIPA has a one-year statute of limitations. See Brodsky v. Apple Inc., 445 F. Supp. 3d 13 110, 134 (N.D. Cal. 2020). Because these claims are untimely, the Court DISMISSES these 14 claims. 15 As demonstrated by the documents attached to Defendant’s request for judicial notice, 3 16 Shah took a screenshot of Politico’s website on August 12, 2023, and sent a demand letter to 17 Politico on August 17, 2023. See RJN, Ex. A, ECF No. 19-2. Four months (126 days) later on 18 December 21, 2023, Shah filed a complaint and demand for arbitration (“Arbitration Complaint”). 19 See id. Seven months (221 days) later, on July 29, 2024, the arbitrator granted Shah’s motion for 20 non-arbitrability. See id., Sub-Exhibit A. Shah then waited until February 7, 2025 (193 days) to 21 file a petition to confirm the non-final, non-monetary arbitration decision (a suit the court 22 ultimately dismissed for lack of subject matter jurisdiction). Shah v. POLITICO LLC, Case No. 23 4:25-cv-01338 (N.D. Cal. Feb. 7, 2025). On June 20, 2025, 133 days after filing a petition to 24 confirm the arbitration award, but while the petition was still pending, Shah filed his complaint in 25 this case. The complaint arises from the same facts Shah alleged in the Arbitration Complain. See 26 27 1 generally Compl. Shah filed his complaint nearly two years after he took the screenshot of 2 Politico’s website and sent a demand letter. 3 The Court is inclined to toll the 221 days that passed between the date the arbitration was 4 filed and the date the arbitrator found the suit non-arbitrable. Considered in the light most 5 favorable to Shah, he may have reasonably believed that he would have to take this step 6 regardless, as Politico would likely insist at the outset of any federal case that Shah was subject to 7 the arbitrability provision within Politico’s privacy policy. In asking the arbitrator to find 8 otherwise, Shah gained the efficiency of avoiding a motion to compel arbitration. 9 This does not explain, however, why Shah waited four months after he sent Politico his 10 demand letter to bring his Arbitration Complaint, nor does it explain why Shah failed to 11 immediately file suit once the arbitrator issued the decision. More than six months passed before 12 Shah acted on the arbitrator’s finding that his claims were non-arbitrable, and when he did act, 13 instead of filing his complaint, he inexplicably filed a suit to “confirm” the “award.” Shah, Case 14 No. 4:25-cv-01338. There was no reason for Shah to wait for judicial confirmation of the 15 arbitrator’s decision that his claims were non-arbitrable, and indeed, the court considering that 16 petition ultimately found it lacked the authority to do so. Id., ECF No. 33. In short, Shah could 17 have and should have directly filed suit once he had the arbitrator’s decision in hand. In total, at 18 least 452 un-tolled days passed between the date the alleged injury occurred and the date Shah 19 filed this action. As a result, Shah’s CIPA claims are untimely. 20 Like the plaintiff in Pemberton, Shah argues in his response that “his CIPA claim is timely 21 because the arbitration proceeding equitably tolled the statute of limitations from . . . when he filed 22 the arbitration demand, until” the date he filed the instant suit. Pemberton, 2025 WL 3268404, at 23 *5. A plaintiff seeking to invoke California’s equitable tolling doctrine must demonstrate: (1) 24 timely notice, (2) lack of prejudice to the defendant, and (3) reasonable and good faith conduct by 25 the plaintiff. See Saint Francis Mem’l Hosp. v. State Dep’t of Pub. Health, 9 Cal. 5th 710, 724 26 (2020). To be reasonable and in good faith, “[a] plaintiff’s conduct must be objectively reasonable 27 and subjectively in good faith.” Id. at 729. Although “California’s fact-intensive test for equitable 1 have decided equitable tolling at the motion to dismiss stage when “some fact, evident from the 2 face of the complaint, supported the conclusion that the plaintiff could not prevail, as a matter of 3 law, on the equitable tolling issue.” Cervantes v. City of San Diego, 5 F.3d 1273, 1276 (9th Cir. 4 1993). 5 The Court agrees with the reasoning put forth in Pemberton:

6 Plaintiff is not entitled to equitable tolling because no complaint allegations support an inference of reasonable and good faith conduct 7 in waiting . . . from July [29], 2024, when the arbitrator ruled a court needed to determine whether an arbitration agreement existed, until 8 [June 20], 2025—to file his complaint in this Court. See Long v. Forty Niners Football Co., LLC, 33 Cal. App. 5th 550, 555 (2019), as 9 modified (Apr. 8, 2019) (“Where a claim is time-barred on its face, the plaintiff must specifically plead facts that would support equitable 10 tolling”). Although “[t]he third prerequisite of good faith and reasonable conduct . . . is less clearly defined in the cases[,] [ ] in 11 Addison v. State of California, . . . the [California] Supreme Court did stress that the plaintiff filed his second claim a short time after tolling 12 ended.” McDonald v. Antelope Valley Cmty. Coll. Dist., 45 Cal. 4th 88, 102 n.2 (2008) (citing Addison v. State of California, 21 Cal. 3d 13 313, 321 (1978)). So, a “plaintiff’s reasonable promptness in refiling is necessary for relief.” Kolani v. Gluska, 64 Cal. App. 4th 402, 411 14 (1998) (“[T]he leading cases finding an equitable tolling have involved short intervals between dismissal and refiling.”); see also 15 Hatfield v. Halifax PLC, 564 F.3d 1177, 1186 (9th Cir. 2009) (noting plaintiff “filed the district court action on the day that tolling ceased”). 16 Absent further explanation from Plaintiff, his nearly [eleven] month delay in filing this complaint was unreasonable and defeats 17 application of equitable tolling. See Darnaa, LLC v. Google, Inc., No. 15-CV-03221-RMW, 2016 WL 6540452, at *5 (N.D. Cal. Nov. 18 2, 2016) (citing cases and finding ten-month delay suggested unreasonable conduct); see also Kolani, 64 Cal. App. 4th at 411 19 (finding 78-day delay in refiling unreasonable); Yetter v. Ford Motor Co., 428 F. Supp. 3d 210, 230 (N.D. Cal. 2019) (citing cases and 20 finding 16-month delay for claims with three-or four-year statutes of limitations unreasonable). 21 Pemberton, 2025 WL 3268404, at *6. As in Pemberton, Shah has failed to demonstrate good faith 22 in waiting so long to file this suit and therefore has not alleged equitable tolling on his CIPA 23 claims. Politico’s motion to dismiss Counts III and IV is GRANTED with leave for Plaintiff to 24 amend alleging facts that justified his delay in filing the complaint. 25 3. Cause of Action V: Fraud, Deceit, and Misrepresentation 26 Under California law, common-law fraud or intentional misrepresentation requires: (i) 27 misrepresentation; (ii) scienter; (iii) intent to induce reliance; (iv) justifiable reliance; and (v) 1 injury. Shin v. Sanyo Foods Corp. of Am., 348 F.R.D. 477, 486 (C.D. Cal. 2025) (citing Engalla v. 2 Permanente Med. Grp., Inc., 15 Cal. 4th 951, 974 (1997)). A claim for fraudulent concealment or 3 omission requires that: (1) the defendant concealed or suppressed a material fact; (2) had a duty to 4 disclose it; (3) intentionally concealed it with intent to defraud; (4) plaintiff was unaware of the 5 fact and would have acted differently if aware; and (5) plaintiff sustained damage as a result. 6 Boschma v. Home Loan Ctr., Inc., 198 Cal. App. 4th 230, 248 (2011). Fraud claims have two 7 distinct causation elements: actual and justifiable reliance that caused a detrimental action, and 8 that detrimental action caused the alleged damages. Beckwith v. Dahl, 205 Cal. App. 4th 1039, 9 1062 (2012). 10 Pursuant to Federal Rule of Civil Procedure 9(b), the elements of fraud must be alleged 11 “with particularity” and “accompanied by the who, what, when, where, and how of the misconduct 12 charged.” Kearns v. Ford Motor Co., 567 F.3d 1120, 1124 (9th Cir. 2009) (quotation marks and 13 citation omitted). “Malice, intent, knowledge, and other conditions of a person’s mind may be 14 alleged generally,” however. See Fed. R. Civ. P. 9(b); see also In re GlenFed, Inc. Sec. Litig., 42 15 F.3d 1541, 1547 (9th Cir. 1994) (en banc) (“[P]laintiffs may aver scienter generally . . . simply by 16 saying that scienter existed.”), superseded by statute on other grounds, Private Securities 17 Litigation Reform Act of 1995, 15 U.S.C. § 78u-4(b)(1), as recognized in Avakian v. Wells Fargo 18 Bank, N.A., 827 Fed. App’x 765, 766 (9th Cir. 2020). 19 Like Pemberton, the Court finds Plaintiff’s allegations are sufficient to withstand a motion 20 to dismiss. On nearly identical facts, the court in Pemberton found:

21 [p]laintiff sufficiently alleges the factual circumstances of his fraud claim. Specifically, he alleges [d]efendants (who), on their website’s 22 Cookie Window (where) in March 2023 (when), represented Plaintiff could use the toggle switch to “opt out of the sale of personal 23 information” (what), but “nonetheless caused cookies” and user data to be transmitted third parties (how). 24 Pemberton, 2025 WL 3268404, at *7. Though Plaintiff in the instant action is less precise about 25 the “when” of the fraud—his most specific allegation is that he visited Politico’s website “in the 26 first half of 2023”—at this stage the Court finds Shah’s allegations sufficient when considered 27 alongside the specificity of the other aspects of his claim. “The purpose of Rule 9(b) is to give 1 defendants notice of the specific fraudulent conduct against which they must defend.” Bankers 2 Life & Cas. Co. v. Mallin, No. 25-CV-02430-RFL, 2025 WL 3186358, at *7 (N.D. Cal. Nov. 5, 3 2025). Shah has given Defendant adequate notice to survive a motion to dismiss. 4 In addition to insisting Shah failed to meet the Rule 9(b) standard, Defendant argues that 5 Shah (1) fails to plausibly allege justifiable reliance, (2) fails to establish a duty to disclose, and 6 (3) fails to show any compensable injury. None of these arguments are persuasive. First, Shah 7 explicitly pleads justifiable reliance by alleging that Shah continued browsing Politico’s website 8 “in reliance on” “Defendant’s representations that consumers could ‘opt-out of . . . Performance 9 Cookies [and] Online Behavioural Advertising’ cookies.” Compl. ¶¶ 79, 82. And though Politico 10 may not normally have a duty to disclose, such a duty arises where Defendant affirmatively 11 volunteers false information. See Vega v. Jones, Day, Reavis & Pogue, 121 Cal.App.4th 282, 292 12 (2004) (“Even where no duty to disclose would otherwise exist, where one does speak[,] he must 13 speak the whole truth to the end that he does not conceal any facts which materially qualify those 14 stated.”). Finally, Shah “alleges damages because Plaintiff’s affected personal information ‘ha[s] 15 value as demonstrated by the use and sale of consumers’ browsing activity,’ and Defendants 16 ‘gained financially from’ their misrepresentation even as the misrepresentation revoked Plaintiff’s 17 control over that information and diminished its value.” Pemberton, 2025 WL 3268404, at *7. At 18 this stage in the case, that is sufficient. 19 Politico’s motion to dismiss Count V is DENIED. 20 4. Cause of Action VI: Unjust Enrichment 21 In the alternative to his contract claims, Plaintiff brings a cause of action for unjust 22 enrichment. This Court, like many others, generally dismisses such claims because “unjust 23 enrichment is not a cause of action” in California. See Teva Pharms. USA, Inc. v. Corcept 24 Therapeutics, Inc., No. 24-CV-03567-NW, 2025 WL 2637507, at *18 (N.D. Cal. Sept. 12, 2025) 25 (quoting De Havilland v. FX Networks, LLC, 21 Cal. App. 5th 845, 870 (2018)). In limited 26 circumstances, however, “the law will imply a contract (or rather, a quasi-contract), without regard 27 to the parties’ intent, in order to avoid unjust enrichment.” Isgur v. Meta Platforms, Inc., No. 24- 1 CV-06559-WHO, 2026 WL 194640, at *10 (N.D. Cal. Jan. 26, 2026) (internal citation and 2 quotation omitted). Notwithstanding that narrow allowance, Shah’s unjust enrichment claim fails. 3 The fatal flaw in Shah’s unjust enrichment claim is his insistence, elsewhere in his 4 complaint, that an enforceable contract exists between the parties. Compl. ¶¶ 24, 169 (“The 5 Website’s Privacy Policy contains enforceable promises that Defendant made to Plaintiff and 6 Class members.”). “As a matter of law, an unjust enrichment claim does not lie where the parties 7 have an enforceable express contract.” Durrell v. Sharp Healthcare, 183 Cal. App. 4th 1350, 8 1370 (2010). Federal Rule of Civil Procedure 8 allows a plaintiff to assert “inconsistent theories 9 of recovery at the pleading stage . . . and even inconsistent claims alleging both the existence and 10 the absence of an enforceable contract.” Schulz v. Cisco Webex, LLC, No. 13-CV-04987-BLF, 11 2014 WL 2115168, at *5 (N.D. Cal. 2014). But “a plaintiff may not plead the existence of an 12 enforceable contract and maintain a quasi-contract claim at the same time, unless the plaintiff has 13 pled facts suggesting that the contract may be unenforceable or invalid.” Isgur, 2026 WL 194640, 14 at *10 (quoting Jacobs v. Sustainability Partners LLC, No. 20-CV-01981-PJH, 2020 WL 15 5593200, at *17 (N.D. Cal. Sept. 18, 2020)). Where, as here, a plaintiff fails to plead “facts 16 suggesting that the contract may be unenforceable or invalid,” the claim cannot stand. Beluca 17 Ventures LLC v. Aktiebolag, No. 21-CV-06992-WHO, 2022 WL 3579879, at *3 (N.D. Cal. Aug. 18 19, 2022). 19 Politico’s motion to dismiss Counts VI is GRANTED with leave for Plaintiff to amend to 20 include facts suggesting the unenforceability or invalidity of the contract at issue. 21 5. Causes of Action VII and VIII: Breach of Contract and Breach of the 22 Covenant of Good Faith and Fair Dealing 23 Claims for breach of contract or for breach of the implied covenant of good faith and fair 24 dealing require allegations of actual damages. Ruiz v. Gap, Inc., 380 F. App’x 689, 692 (9th Cir. 25 2010) (“Under California law, a breach of contract claim requires a showing of appreciable and 26 actual damage.”); Bennett v. Ohio Nat’l Life Assurance Corp., 92 Cal. App. 5th 723, 729 (2023) 27 (“Both breach of contract and breach of the implied covenant of good faith and fair dealing, i.e., 1 plaintiff’s injury is based on the loss of the inherent value of their personal data, as well as where 2 it was undisputed that plaintiffs paid no money to the defendant.” Nienaber v. Overlake Hosp. 3 Med. Ctr., 733 F. Supp. 3d 1072, 1092 (W.D. Wash. 2024) (internal citations and quotations 4 omitted); see also Saeedy v. Microsoft Corp., No. C23-1104, 2023 WL 8828852, at *6 (W.D. 5 Wash. Dec. 21, 2023) (requiring plaintiffs to “show that they personally lost money or property as 6 a result of [Defendant]’s conduct” when alleging the damage to be the “loss of value in their 7 data.”). 8 Politico argues that Shah failed to allege economic damage, and the Court agrees. Shah 9 alleges only that he was “damaged in an amount at least equal to the difference in value between 10 that which was promised and Defendant’s partial, deficient, and/or defective performance.” 11 Compl. ¶ 173. Politco rightly points out that this statement is conclusory and fails to explain the 12 economic value supposedly promised when Plaintiff admits he never paid Politico for the services 13 it provided. See Gabrielli v. Motorola Mobility LLC, No. 24-CV-09533-JST, 2025 WL 1939957, 14 at *12–13 (N.D. Cal. July 14, 2025) (“[T]he lost benefit of the bargain is not sufficient to allege 15 damages because [plaintiff] ha[s] not shown that [he] paid anything for the received services— 16 access to [defendant]’s website.”) (internal quotation omitted); see also Walsh v. Dollar Tree 17 Stores, Inc., No. 25-CV-01601-SVK, 2025 WL 2939229, at *19 (N.D. Cal. Oct. 16, 2025). 18 Shah has not alleged damages sufficient to support either of his contract-based claims. The 19 Court GRANTS Politico’s motion to dismiss Counts VIII and VIII with leave to amend. 20 6. Cause of Action IX: Trespass to Chattels 21 As set forth in Pemberton,

22 “trespass to chattels ‘lies where an intentional interference with the possession of personal property has proximately caused injury.’” In 23 re Apple Inc. Device Performance Litig., 347 F. Supp. 3d 434, 455 (N.D. Cal. 2018) (quoting Thrifty-Tel, Inc. v. Bezenek, 46 Cal. App. 24 4th 1559, 1566 (1996)); see also Best Carpet Values, Inc. v. Google LLC, 90 F.4th 962, 968 (9th Cir. 2024) (requiring intentional 25 interference with possession of property). The California Supreme Court has applied the principles underlying the tort to allegations of 26 digital trespass. See Intel Corp. v. Hamidi, 30 Cal. 4th 1342 (2003). Thus, “to prevail on a claim for trespass based on accessing a 27 computer system, the plaintiff must establish: (1) defendant unauthorized use proximately resulted in damage to plaintiff.” eBay, 1 Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058, 1069-70 (N.D. Cal. 2000) (citing Thrify-Tel, Inc., 46 Cal. App. 4th at 1566). A plaintiff 2 may satisfy the damages element by pleading the trespass “impaired the condition, quality, or value of the personal property.” Fields v. 3 Wise Media, LLC, No. C 12-05160 WHA, 2013 WL 5340490, at *4 (N.D. Cal. Sept. 24, 2013) (citing Hamidi, 30 Cal. 4th at 1356). 4 Pemberton, 2025 WL 3268404, at *9. 5 Defendants argue that Shah failed to allege the second element of trespass to chattels: 6 damage. The complaint perfunctorily alleges that the alleged interference caused (a) nominal 7 damages for trespass, (b) reduction of storage space on his device, and (c) loss of value of his 8 computing devices. But “[i]t is a matter of common understanding that cookies are minute in size 9 and thus incapable of noticeably affecting the performance of modern computers.” Henson v. 10 Turn, Inc., No. 15-CV-01497-JSW, 2018 WL 6605624, at *4 (N.D. Cal. Dec. 17, 2018) (quotation 11 marks and citations omitted). And nowhere else in the complaint does Plaintiff allege that “the 12 placement of the cookies had any noticeable effect on the performance of [his] devices.” Id.; see 13 also Doe I v. Google LLC, 741 F. Supp. 3d 828, 846 (N.D. Cal. 2024) (dismissing claim without 14 allegations “the existence of cookies physically impairs the functioning of the plaintiffs’ 15 computing devices”); Casillas v. Berkshire Hathaway Homestate Ins. Co., 79 Cal. App. 5th 755, 16 762-63 (2022) (explaining claim fails if trespass “neither damages the recipient computer system 17 nor impairs its functioning”). As a result, Politico contends, Shah’s generalized assertions of 18 reduced storage or performance . . . do not satisfy the requirement of actual, provable damages. 19 In response, Plaintiff cites In re Meta Healthcare Pixel Litigation, 713 F. Supp. 3d 650, 20 659 (N.D. Cal. 2024). There, the court allowed the trespass to chattels claim to go forward based 21 on claims of reduced storage upon the device. Id. Critically, however, the plaintiff in that action 22 alleged a “measurable impact on the functioning of the systems’ memory.” Id. Shah does not do 23 so, so his claim cannot proceed. See Walsh v. Dollar Tree Stores, Inc., No. 25-CV-01601-SVK, 24 2025 WL 2939229, at *22 (N.D. Cal. Oct. 16, 2025) (dismissing trespass to chattels claim where 25 “there are no allegations explaining how the cookies at issue . . . have actually impaired Plaintiffs’ 26 devices – e.g., how much storage space is taken up or whether any slowdown in performance has 27 been measured.”). ] Because Plaintiff does not allege the cookies affected or impaired his devices, Plaintiff 2 || fails to state a trespass to chattels claim. Politico’s motion to dismiss Count IX is GRANTED 3 || with leave to amend. 4 || IV. CONCLUSION 5 For the reasons stated above, the Court GRANTS IN PART AND DENIES IN PART 6 || Politico’s motion to dismiss. 7 Counts II, IV, VI, VIL, VIU, and IX are DISMISSED WITH LEAVE TO AMEND. See 8 || Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000) (“[The] court should grant leave to amend... 9 || unless it determines that the pleading could not possibly be cured by the allegation of other facts.” 10 || (quotation marks and citation omitted)). 1] The Court DENIES Politico’s motion to dismiss Counts I, II, and V. 12 Plaintiff shall file any amended complaint within 21 days of this Order. Plaintiff may not 13 add any new claims or defendants without prior leave of court. IT IS SO ORDERED. 3 13 Dated: February 6, 2026 , | . 2 □ A 16 Noél Wise 5 7 United States District Judge

Z 18 19 20 21 22 23 24 25 26 27 28