Vishal Shah v. Politico LLC

Opinion

UNITED STATES DISTRICT COURT

VISHAL SHAH, Case No. 25-cv-05213-NW Plaintiff, v.

Politico LLC, ORDER GRANTING IN PART AND Defendant. DENYING IN PART POLITICO’S MOTION TO DISMISS Re: ECF No. 18 This class action alleges that the news website Politico LLC (“Politico” or “Defendant”) allowed visitors to politico.com to opt out of third party cookies and tracking technologies but nevertheless continued to “cause[] users’ devices to store and/or transmit both first-party and third-party tracking cookies.” Compl. ¶ 16. Specifically, lead Plaintiff Vishal Shah (“Shah” or “Plaintiff”) alleges nine causes of action against Politico: (1) invasion of privacy; (2) intrusion upon seclusion; (3) wiretapping in violation of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 631; (4) use of a pen register in violation of CIPA, Cal. Penal Code § 638.51; (5) common law fraud, deceit, and/or misrepresentation; (6) unjust enrichment; (7) breach of contract; (8) breach of the implied covenant of good faith and fair dealing; and (9) trespass to chattels. Id. ¶¶ 92-190. Politico timely moved to dismiss all of Plaintiff’s claims. ECF No. 18. For the reasons set forth below, the Court GRANTS IN PART AND DENIES IN PART Politico’s motion to dismiss. I. BACKGROUND1 Sometime “in the first half of 2023,” Shah, a California resident, visited the Politico website “to read the news and follow current events.” Compl. ¶¶ 75-76. Because Shah was in 1 Plaintiff has brought several near identical complaints against other websites in this district, and Plaintiff’s counsel has brought still more on behalf of other plaintiffs. One of these cases is Pemberton v. Restaurant Brands International, Inc. See No. 25-CV-03647-JSC, 2025 WL 3268404 (N.D. Cal. Nov. 24, 2025). The Court has compared the complaints in that action against California, the website “immediately” presented a popup cookie consent banner (“Cookie Banner”) that explained that users could “choose not to allow certain types of cookies” by toggling off certain categories of cookies (“Performance Cookies” and “Online Behavioural Advertising” cookies). Id. ¶ 78. Shah toggled off these cookies accordingly and then clicked the “Confirm my Choices” button under the toggle-sliders. Id. Believing these steps would “allow him to opt out of, decline, and/or reject all non-essential cookies and other tracking technologies,” Shah continued browsing the website in reliance on Defendant’s promises. Id. ¶¶ 78, 81. According to Shah, “Defendants nonetheless continued to cause the placement and/or transmission of cookies along with user data, including those that cause the disclosure of user data to the Third Parties on his device,” and therefore “permitted the Third Parties to track and collect Shah’s Private Communications as Shah browsed the Website.” Id. ¶ 81. Shah alleges:

[T]he third-party cookies stored on and/or loaded from users’ devices when they interact with the Website are transmitted to those third parties, enabling them to surreptitiously track in real time and collect Website users’ personal information, such as their browsing activities and private communications with Defendant, including the following:

• Browsing History: Information about the webpages a Website user visits, including the URLs, titles, and keywords associated with the webpages viewed, time spent on each page, and navigation patterns; • Visit History: Information about the frequency and total number of visits to the Website; • Website Interactions: Data on which links, buttons, or ads on the Website that a user clicks; • User Input Data: The information the user entered into the Website’s form fields, including search queries, the user’s name, age, gender, email address, location, and/or payment information; • Demographic Information: Inferences about age, gender, and location based on browsing habits and interactions with Website content; • Interests and Preferences: Insights into user interests based on the types of Website content viewed, products searched for, or topics engaged with; • Shopping Behavior: Information about the Website products

difference is the addition of two contract claims in the instant action (Counts VIII and IX). This Court has reviewed the decision in Pemberton and has found it well-reasoned and persuasive. As viewed or added to shopping carts; • Device Information: Details about the Website user’s device, such as the type of device (mobile, tablet, desktop), operating system, and browser type; • Referring URL: Information about the website that referred the user to the Website; • Session Information: Details about the user’s current Website browsing session, including the exact date and time of the user’s session, the session duration and actions taken on the Website during that session; • User Identifiers: A unique ID that is used to recognize and track a specific Website user across different websites over time; and/or • Geolocation Data: General location information based on the Website user’s IP address or GPS data, if accessible. Id. ¶ 19. Shah states if he had known “Defendants’ representations to Website users that they could opt out of the sale/sharing of his personal information and opt out of all cookies were untrue,” he would not have used the site. Id. ¶ 82. Shah further alleges he “continues to desire to browse content featured on the Politico website, but will not do so until the website is “programmed to honor users’ requests to opt out of the sale/sharing of their personal information and opt out of all non-required cookies and tracking technologies.” Id. ¶ 83. II. LEGAL STANDARD A. Article III Standing “In the absence of standing, a federal court lacks subject matter jurisdiction over the suit.” Righthaven LLC v. Hoehn, 716 F.3d 1166, 1172 (9th Cir. 2013) (quotations omitted). To demonstrate Article III standing, a plaintiff must show an injury, trace that injury to the defendants’ conduct, and prove that courts can provide adequate redress for the injury. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992). A plaintiff must show that he suffered “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Id. at 560. For an injury to be particularized, it “must affect the plaintiff in a personal and individual way.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016). “Only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.” TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021) (emphasis added). B. Rule 12(b)(6) Federal Rule of Civil Procedure 12(b)(6) is designed to “test[ ] the legal sufficiency of a claim.” Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). A dismissal under Rule 12(b)(6) for failure to state a claim can be based on either (1) the lack of a cognizable legal theory or (2) insufficient facts to support a cognizable legal claim. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990). When analyzing a complaint under Rule 12(b)(6), the well-pled factual allegations are taken as true and construed in the light most favorable to the nonmoving party. Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). Legal conclusions couched as factual allegations are not entitled to the assumption of truth, Ashcroft v. Iqbal, 556 U.S. 662, 680 (2009), and therefore are insufficient to defeat a motion to dismiss for failure to state a claim, In re Cutera Sec. Litig., 610 F.3d 1103, 1108 (9th Cir. 2010). C. Rule 9(b) Any claims that are “grounded in fraud . . . must satisfy the traditional plausibility standard of Rules 8(a) and 12(b)(6), as well as the heightened pleading requirements of Rule 9(b).” Davidson v. Kimberly-Clark Corp., 889 F.3d 956, 964 (9th Cir. 2018). The heightened pleading standard set forth in Rule 9(b) requires a plaintiff to “state with particularity the circumstances constituting fraud or mistake.” Fed. R. Civ. P. 9(b). Allegations of fraud must “be specific enough to give defendants notice of the particular misconduct so that they can defend against the charge and not just deny that they have done anything wrong. Averments of fraud must be accompanied by the who, what, when, where, and how of the misconduct charged.” Vess v. Ciba- Geigy Corp. USA, 317 F.3d 1097, 1106 (9th Cir. 2003) (internal quotation marks, alteration, and citations omitted). A. Article III Standing Politico argues that Shah fails to establish an injury sufficient to give rise to Article III legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Lujan, 504 U.S. at 560 (quotations omitted). “Central to assessing concreteness is whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts.” TransUnion, 594 U.S. at 417; see also Popa v. Microsoft Corp., 153 F.4th 784, 791 (9th Cir. 2025) (“TransUnion requires a court to assess whether an individual plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal system.”). According to Politico, Plaintiff has failed to demonstrate that he has been injured because he has not “identif[ied] the specific personal information” that “implicates a protectable privacy interest.” Byars v. Sterling Jewelers, Inc., No. 5:22-CV-01456-SB-SP, 2023 WL 2996686, at *1 (C.D. Cal. Apr. 4, 2023); Mot. at 7. Defendant cites to a recent decision from this Court in Kishnani v. Royal Caribbean Cruises Ltd., where the undersigned found plaintiff’s bare allegations that defendant collected his “‘data’ and ‘information’” insufficient to demonstrate injury-in-fact. No. 25-CV-01473-NW, 2025 WL 1745726, at *2 (N.D. Cal. June 24, 2025) (internal citations and quotations omitted). Politico’s attempts to liken this case to Kishnani are unavailing. Despite superficial similarities, this case is distinguishable because Shah has: (1) identified the specific personal information disclosed that implicates a protectable privacy interest and (2) alleged an invasion of a legally protected right. First, in Kishnani, the “[p]laintiff allege[d] only that [d]efendant invaded his privacy by impermissibly collecting Plaintiff’s ‘data’ and ‘information.’” Id. at *3. In contrast, Shah alleges that Politico collected his “browsing history, visit history, website interactions, user input data, demographic information, interests and preferences, shopping behavior, device information, referring URL, session information, user identifiers, and geolocation data.” Compl. ¶ 19. Shah sets forth the specific cookies Politico used (furnished by Google and Adobe, among others) and the specific information each cookie collected. Compl. ¶¶ 38-68. Kishnani concerned a single cookie furnished by TikTok, and failed to explain what, if any, actual information that cookie collected. See Kishnani, 2025 WL 1745726, at *3. Second, the legally protected right that was missing in Kishnani is present in the instant action. There, the Court acknowledged that “‘[i]ntrusion on privacy alone can be a concrete injury,’ [but] the nature of the injury turns on whether a plaintiff has a legitimate expectation of privacy.” Id. (quoting Patel v. Facebook Inc., 290 F. Supp. 3d 948, 954 (N.D. Cal. 2018)). Kishnani did not have a reasonable expectation of privacy: the defendant there had not offered Kishnani the opportunity to opt out of tracking cookies, so he could not reasonably expect that cookies would not be deployed when he browsed defendant’s website. In contrast, Shah was immediately presented with an option to opt out of certain tracking cookies upon entering the Politico site, giving rise to an expectation of privacy. In short, Politico “set an expectation that . . . user data would not be collected, but then collected it anyway.” Facebook Tracking. That is enough to allege an injury. The cases cited by Politico do not support a different finding, not least because they are the same cases that Pemberton compellingly distinguished:

[I]n Mikulsky v. Noom, Inc., 682 F. Supp. 3d 855 (S.D. Cal. 2023), the court dismissed the plaintiff’s claims for lack of standing because she only alleged disclosure of “personal information” without specifying what that information included, so the court could not conclude she “ha[d] a protectable privacy interest in that information.” Id. at 864-65. Similarly, in Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174 (N.D. Cal. 2025), the court held the plaintiffs lacked standing because they only alleged collection of their IP addresses, in which they lacked a reasonable expectation of privacy. Id. at 1179. In contrast to both Mikulsky and Khamooshi, Plaintiff specifically alleges Defendants allowed “Third Parties to track and collect [his] Private Communications,” including his browsing history, visit history, website interactions, user input data, demographic information, interests and preferences, shopping behavior, device information, referring URL, session information, user identifiers, and geolocation data. Pemberton, 2025 WL 3268404, at *4; see infra n.1 (discussing the similarities between Pemberton and the instant action). In short, “because a misrepresentation about how information would be used and the non-consensual sharing of personal information could give rise to injuries that were actionable invasions of privacy at common law, plaintiffs have sufficiently pleaded an injury-in- fact for the purposes of Article III.” See Shah v. MyFitnessPal, Inc., No. 25-CV-04430-PCP, 2026 WL 216334, at *3 (N.D. Cal. Jan. 27, 2026).2 B. Motion to Dismiss for Failure to State A Claim 1. Causes of Action I and II: Invasion of Privacy and Intrusion Upon Seclusion As set forth in Pemberton,

Courts evaluating whether plaintiffs have stated a claim for invasion of privacy or intrusion upon seclusion under California law “consider the claims together and ask whether: (1) there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive.” [In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020)] (quoting Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 (2009)). First, to determine whether a reasonable expectation of privacy exists, courts consider “the customs, practices, and circumstances surrounding the data collection, including the amount of data collected, the sensitivity of data collected, the manner of data collection, and the defendant’s representations to its customers.” Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1088 (N.D. Cal. 2022) (citing Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 26 (1994)). A reasonable expectation of privacy may exist when a defendant gains “unwanted access to data by electronic or other covert means, in violation of the law or social norms.” Facebook Internet Tracking, 956 F.3d at 601-02 (quotation marks and citation omitted). Second, when determining whether an invasion is “highly offensive,” courts consider “the degree and setting of the intrusion,” as well as “the intruder’s motives and objectives.” Hernandez, 47 Cal. 4th at 287. Because both inquiries are highly factual, “[c]ourts are generally hesitant to decide claims of this nature at the pleading stage.” In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 799 (N.D. Cal. 2022). Pemberton, 2025 WL 3268404, at *4. Plaintiffs have alleged facts sufficient to show that Politico’s alleged collection of data could be highly offensive. “Under California law, courts must be reluctant to reach a conclusion at the pleading stage about how offensive or serious the privacy intrusion is.” In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 797 (N.D. Cal. 2019). Indeed, determining the offensiveness of an invasion requires consideration of “the degree of the intrusion,

2 Shah, the Plaintiff here, also filed Shah v. MyFitnessPal, an action raising near identical factual and legal issues but filed against a different defendant. Politico contends that Shah’s status as a plaintiff in that and several other similar cases demonstrates that Shah is a “tester,” and therefore the context, conduct and circumstances surrounding the intrusion as well as the intruder’s motives and objectives, the setting into which he intrudes, and the expectations of those whose privacy is invaded.” Hill, 865 P.2d at 648. Only if the allegations “show no reasonable expectation of privacy or an insubstantial impact on privacy interests” can the “question of [a serious or highly offensive] invasion [ ] be adjudicated as a matter of law.” Id. at 657. That is not the case here. See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 606 (9th Cir. 2020) (“The ultimate question of whether Facebook’s tracking and collection practices could highly offend a reasonable individual is an issue that cannot be resolved at the pleading stage.”); de Ayora v. Inspire Brands, Inc., No. 25-CV-03645-AGT, 2025 WL 3707561, at *3 (N.D. Cal. Dec. 22, 2025). Politico’s motion to dismiss Counts I and II is DENIED. 2. Causes of Action III and IV: CIPA Wiretap and CIPA Pen Register CIPA has a one-year statute of limitations. See Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 134 (N.D. Cal. 2020). Because these claims are untimely, the Court DISMISSES these claims. As demonstrated by the documents attached to Defendant’s request for judicial notice, 3 Shah took a screenshot of Politico’s website on August 12, 2023, and sent a demand letter to Politico on August 17, 2023. See RJN, Ex. A, ECF No. 19-2. Four months (126 days) later on December 21, 2023, Shah filed a complaint and demand for arbitration (“Arbitration Complaint”). See id. Seven months (221 days) later, on July 29, 2024, the arbitrator granted Shah’s motion for non-arbitrability. See id., Sub-Exhibit A. Shah then waited until February 7, 2025 (193 days) to file a petition to confirm the non-final, non-monetary arbitration decision (a suit the court ultimately dismissed for lack of subject matter jurisdiction). Shah v. POLITICO LLC, Case No. 4:25-cv-01338 (N.D. Cal. Feb. 7, 2025). On June 20, 2025, 133 days after filing a petition to confirm the arbitration award, but while the petition was still pending, Shah filed his complaint in this case. The complaint arises from the same facts Shah alleged in the Arbitration Complain. See generally Compl. Shah filed his complaint nearly two years after he took the screenshot of Politico’s website and sent a demand letter. The Court is inclined to toll the 221 days that passed between the date the arbitration was filed and the date the arbitrator found the suit non-arbitrable. Considered in the light most favorable to Shah, he may have reasonably believed that he would have to take this step regardless, as Politico would likely insist at the outset of any federal case that Shah was subject to the arbitrability provision within Politico’s privacy policy. In asking the arbitrator to find otherwise, Shah gained the efficiency of avoiding a motion to compel arbitration. This does not explain, however, why Shah waited four months after he sent Politico his demand letter to bring his Arbitration Complaint, nor does it explain why Shah failed to immediately file suit once the arbitrator issued the decision. More than six months passed before Shah acted on the arbitrator’s finding that his claims were non-arbitrable, and when he did act, instead of filing his complaint, he inexplicably filed a suit to “confirm” the “award.” Shah, Case No. 4:25-cv-01338. There was no reason for Shah to wait for judicial confirmation of the arbitrator’s decision that his claims were non-arbitrable, and indeed, the court considering that petition ultimately found it lacked the authority to do so. Id., ECF No. 33. In short, Shah could have and should have directly filed suit once he had the arbitrator’s decision in hand. In total, at least 452 un-tolled days passed between the date the alleged injury occurred and the date Shah filed this action. As a result, Shah’s CIPA claims are untimely. Like the plaintiff in Pemberton, Shah argues in his response that “his CIPA claim is timely because the arbitration proceeding equitably tolled the statute of limitations from . . . when he filed the arbitration demand, until” the date he filed the instant suit. Pemberton, 2025 WL 3268404, at *5. A plaintiff seeking to invoke California’s equitable tolling doctrine must demonstrate: (1) timely notice, (2) lack of prejudice to the defendant, and (3) reasonable and good faith conduct by the plaintiff. See Saint Francis Mem’l Hosp. v. State Dep’t of Pub. Health, 9 Cal. 5th 710, 724 (2020). To be reasonable and in good faith, “[a] plaintiff’s conduct must be objectively reasonable and subjectively in good faith.” Id. at 729. Although “California’s fact-intensive test for equitable have decided equitable tolling at the motion to dismiss stage when “some fact, evident from the face of the complaint, supported the conclusion that the plaintiff could not prevail, as a matter of law, on the equitable tolling issue.” Cervantes v. City of San Diego, 5 F.3d 1273, 1276 (9th Cir. 1993). The Court agrees with the reasoning put forth in Pemberton:

Plaintiff is not entitled to equitable tolling because no complaint allegations support an inference of reasonable and good faith conduct in waiting . . . from July [29], 2024, when the arbitrator ruled a court needed to determine whether an arbitration agreement existed, until [June 20], 2025—to file his complaint in this Court. See Long v. Forty Niners Football Co., LLC, 33 Cal. App. 5th 550, 555 (2019), as modified (Apr. 8, 2019) (“Where a claim is time-barred on its face, the plaintiff must specifically plead facts that would support equitable tolling”). Although “[t]he third prerequisite of good faith and reasonable conduct . . . is less clearly defined in the cases[,] [ ] in Addison v. State of California, . . . the [California] Supreme Court did stress that the plaintiff filed his second claim a short time after tolling ended.” McDonald v. Antelope Valley Cmty. Coll. Dist., 45 Cal. 4th 88, 102 n.2 (2008) (citing Addison v. State of California, 21 Cal. 3d 313, 321 (1978)). So, a “plaintiff’s reasonable promptness in refiling is necessary for relief.” Kolani v. Gluska, 64 Cal. App. 4th 402, 411 (1998) (“[T]he leading cases finding an equitable tolling have involved short intervals between dismissal and refiling.”); see also Hatfield v. Halifax PLC, 564 F.3d 1177, 1186 (9th Cir. 2009) (noting plaintiff “filed the district court action on the day that tolling ceased”). Absent further explanation from Plaintiff, his nearly [eleven] month delay in filing this complaint was unreasonable and defeats application of equitable tolling. See Darnaa, LLC v. Google, Inc., No. 15-CV-03221-RMW, 2016 WL 6540452, at *5 (N.D. Cal. Nov. 2, 2016) (citing cases and finding ten-month delay suggested unreasonable conduct); see also Kolani, 64 Cal. App. 4th at 411 (finding 78-day delay in refiling unreasonable); Yetter v. Ford Motor Co., 428 F. Supp. 3d 210, 230 (N.D. Cal. 2019) (citing cases and finding 16-month delay for claims with three-or four-year statutes of limitations unreasonable). Pemberton, 2025 WL 3268404, at *6. As in Pemberton, Shah has failed to demonstrate good faith in waiting so long to file this suit and therefore has not alleged equitable tolling on his CIPA claims. Politico’s motion to dismiss Counts III and IV is GRANTED with leave for Plaintiff to amend alleging facts that justified his delay in filing the complaint. 3. Cause of Action V: Fraud, Deceit, and Misrepresentation Under California law, common-law fraud or intentional misrepresentation requires: (i) misrepresentation; (ii) scienter; (iii) intent to induce reliance; (iv) justifiable reliance; and (v) injury. Shin v. Sanyo Foods Corp. of Am., 348 F.R.D. 477, 486 (C.D. Cal. 2025) (citing Engalla v. Permanente Med. Grp., Inc., 15 Cal. 4th 951, 974 (1997)). A claim for fraudulent concealment or omission requires that: (1) the defendant concealed or suppressed a material fact; (2) had a duty to disclose it; (3) intentionally concealed it with intent to defraud; (4) plaintiff was unaware of the fact and would have acted differently if aware; and (5) plaintiff sustained damage as a result. Boschma v. Home Loan Ctr., Inc., 198 Cal. App. 4th 230, 248 (2011). Fraud claims have two distinct causation elements: actual and justifiable reliance that caused a detrimental action, and that detrimental action caused the alleged damages. Beckwith v. Dahl, 205 Cal. App. 4th 1039, 1062 (2012). Pursuant to Federal Rule of Civil Procedure 9(b), the elements of fraud must be alleged “with particularity” and “accompanied by the who, what, when, where, and how of the misconduct charged.” Kearns v. Ford Motor Co., 567 F.3d 1120, 1124 (9th Cir. 2009) (quotation marks and citation omitted). “Malice, intent, knowledge, and other conditions of a person’s mind may be alleged generally,” however. See Fed. R. Civ. P. 9(b); see also In re GlenFed, Inc. Sec. Litig., 42 F.3d 1541, 1547 (9th Cir. 1994) (en banc) (“[P]laintiffs may aver scienter generally . . . simply by saying that scienter existed.”), superseded by statute on other grounds, Private Securities Litigation Reform Act of 1995, 15 U.S.C. § 78u-4(b)(1), as recognized in Avakian v. Wells Fargo Bank, N.A., 827 Fed. App’x 765, 766 (9th Cir. 2020). Like Pemberton, the Court finds Plaintiff’s allegations are sufficient to withstand a motion to dismiss. On nearly identical facts, the court in Pemberton found:

[p]laintiff sufficiently alleges the factual circumstances of his fraud claim. Specifically, he alleges [d]efendants (who), on their website’s Cookie Window (where) in March 2023 (when), represented Plaintiff could use the toggle switch to “opt out of the sale of personal information” (what), but “nonetheless caused cookies” and user data to be transmitted third parties (how). Pemberton, 2025 WL 3268404, at *7. Though Plaintiff in the instant action is less precise about the “when” of the fraud—his most specific allegation is that he visited Politico’s website “in the first half of 2023”—at this stage the Court finds Shah’s allegations sufficient when considered alongside the specificity of the other aspects of his claim. “The purpose of Rule 9(b) is to give defendants notice of the specific fraudulent conduct against which they must defend.” Bankers Life & Cas. Co. v. Mallin, No. 25-CV-02430-RFL, 2025 WL 3186358, at *7 (N.D. Cal. Nov. 5, 2025). Shah has given Defendant adequate notice to survive a motion to dismiss. In addition to insisting Shah failed to meet the Rule 9(b) standard, Defendant argues that Shah (1) fails to plausibly allege justifiable reliance, (2) fails to establish a duty to disclose, and (3) fails to show any compensable injury. None of these arguments are persuasive. First, Shah explicitly pleads justifiable reliance by alleging that Shah continued browsing Politico’s website “in reliance on” “Defendant’s representations that consumers could ‘opt-out of . . . Performance Cookies [and] Online Behavioural Advertising’ cookies.” Compl. ¶¶ 79, 82. And though Politico may not normally have a duty to disclose, such a duty arises where Defendant affirmatively volunteers false information. See Vega v. Jones, Day, Reavis & Pogue, 121 Cal.App.4th 282, 292 (2004) (“Even where no duty to disclose would otherwise exist, where one does speak[,] he must speak the whole truth to the end that he does not conceal any facts which materially qualify those stated.”). Finally, Shah “alleges damages because Plaintiff’s affected personal information ‘ha[s] value as demonstrated by the use and sale of consumers’ browsing activity,’ and Defendants ‘gained financially from’ their misrepresentation even as the misrepresentation revoked Plaintiff’s control over that information and diminished its value.” Pemberton, 2025 WL 3268404, at *7. At this stage in the case, that is sufficient. Politico’s motion to dismiss Count V is DENIED. 4. Cause of Action VI: Unjust Enrichment In the alternative to his contract claims, Plaintiff brings a cause of action for unjust enrichment. This Court, like many others, generally dismisses such claims because “unjust enrichment is not a cause of action” in California. See Teva Pharms. USA, Inc. v. Corcept Therapeutics, Inc., No. 24-CV-03567-NW, 2025 WL 2637507, at *18 (N.D. Cal. Sept. 12, 2025) (quoting De Havilland v. FX Networks, LLC, 21 Cal. App. 5th 845, 870 (2018)). In limited circumstances, however, “the law will imply a contract (or rather, a quasi-contract), without regard to the parties’ intent, in order to avoid unjust enrichment.” Isgur v. Meta Platforms, Inc., No. 24- CV-06559-WHO, 2026 WL 194640, at *10 (N.D. Cal. Jan. 26, 2026) (internal citation and quotation omitted). Notwithstanding that narrow allowance, Shah’s unjust enrichment claim fails. The fatal flaw in Shah’s unjust enrichment claim is his insistence, elsewhere in his complaint, that an enforceable contract exists between the parties. Compl. ¶¶ 24, 169 (“The Website’s Privacy Policy contains enforceable promises that Defendant made to Plaintiff and Class members.”). “As a matter of law, an unjust enrichment claim does not lie where the parties have an enforceable express contract.” Durrell v. Sharp Healthcare, 183 Cal. App. 4th 1350, 1370 (2010). Federal Rule of Civil Procedure 8 allows a plaintiff to assert “inconsistent theories of recovery at the pleading stage . . . and even inconsistent claims alleging both the existence and the absence of an enforceable contract.” Schulz v. Cisco Webex, LLC, No. 13-CV-04987-BLF, 2014 WL 2115168, at *5 (N.D. Cal. 2014). But “a plaintiff may not plead the existence of an enforceable contract and maintain a quasi-contract claim at the same time, unless the plaintiff has pled facts suggesting that the contract may be unenforceable or invalid.” Isgur, 2026 WL 194640, at *10 (quoting Jacobs v. Sustainability Partners LLC, No. 20-CV-01981-PJH, 2020 WL 5593200, at *17 (N.D. Cal. Sept. 18, 2020)). Where, as here, a plaintiff fails to plead “facts suggesting that the contract may be unenforceable or invalid,” the claim cannot stand. Beluca Ventures LLC v. Aktiebolag, No. 21-CV-06992-WHO, 2022 WL 3579879, at *3 (N.D. Cal. Aug. 19, 2022). Politico’s motion to dismiss Counts VI is GRANTED with leave for Plaintiff to amend to include facts suggesting the unenforceability or invalidity of the contract at issue. 5. Causes of Action VII and VIII: Breach of Contract and Breach of the Covenant of Good Faith and Fair Dealing Claims for breach of contract or for breach of the implied covenant of good faith and fair dealing require allegations of actual damages. Ruiz v. Gap, Inc., 380 F. App’x 689, 692 (9th Cir. 2010) (“Under California law, a breach of contract claim requires a showing of appreciable and actual damage.”); Bennett v. Ohio Nat’l Life Assurance Corp., 92 Cal. App. 5th 723, 729 (2023) (“Both breach of contract and breach of the implied covenant of good faith and fair dealing, i.e., plaintiff’s injury is based on the loss of the inherent value of their personal data, as well as where it was undisputed that plaintiffs paid no money to the defendant.” Nienaber v. Overlake Hosp. Med. Ctr., 733 F. Supp. 3d 1072, 1092 (W.D. Wash. 2024) (internal citations and quotations omitted); see also Saeedy v. Microsoft Corp., No. C23-1104, 2023 WL 8828852, at *6 (W.D. Wash. Dec. 21, 2023) (requiring plaintiffs to “show that they personally lost money or property as a result of [Defendant]’s conduct” when alleging the damage to be the “loss of value in their data.”). Politico argues that Shah failed to allege economic damage, and the Court agrees. Shah alleges only that he was “damaged in an amount at least equal to the difference in value between that which was promised and Defendant’s partial, deficient, and/or defective performance.” Compl. ¶ 173. Politco rightly points out that this statement is conclusory and fails to explain the economic value supposedly promised when Plaintiff admits he never paid Politico for the services it provided. See Gabrielli v. Motorola Mobility LLC, No. 24-CV-09533-JST, 2025 WL 1939957, at *12–13 (N.D. Cal. July 14, 2025) (“[T]he lost benefit of the bargain is not sufficient to allege damages because [plaintiff] ha[s] not shown that [he] paid anything for the received services— access to [defendant]’s website.”) (internal quotation omitted); see also Walsh v. Dollar Tree Stores, Inc., No. 25-CV-01601-SVK, 2025 WL 2939229, at *19 (N.D. Cal. Oct. 16, 2025). Shah has not alleged damages sufficient to support either of his contract-based claims. The Court GRANTS Politico’s motion to dismiss Counts VIII and VIII with leave to amend. 6. Cause of Action IX: Trespass to Chattels As set forth in Pemberton,

“trespass to chattels ‘lies where an intentional interference with the possession of personal property has proximately caused injury.’” In re Apple Inc. Device Performance Litig., 347 F. Supp. 3d 434, 455 (N.D. Cal. 2018) (quoting Thrifty-Tel, Inc. v. Bezenek, 46 Cal. App. 4th 1559, 1566 (1996)); see also Best Carpet Values, Inc. v. Google LLC, 90 F.4th 962, 968 (9th Cir. 2024) (requiring intentional interference with possession of property). The California Supreme Court has applied the principles underlying the tort to allegations of digital trespass. See Intel Corp. v. Hamidi, 30 Cal. 4th 1342 (2003). Thus, “to prevail on a claim for trespass based on accessing a computer system, the plaintiff must establish: (1) defendant unauthorized use proximately resulted in damage to plaintiff.” eBay, Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058, 1069-70 (N.D. Cal. 2000) (citing Thrify-Tel, Inc., 46 Cal. App. 4th at 1566). A plaintiff may satisfy the damages element by pleading the trespass “impaired the condition, quality, or value of the personal property.” Fields v. Wise Media, LLC, No. C 12-05160 WHA, 2013 WL 5340490, at *4 (N.D. Cal. Sept. 24, 2013) (citing Hamidi, 30 Cal. 4th at 1356). Pemberton, 2025 WL 3268404, at *9. Defendants argue that Shah failed to allege the second element of trespass to chattels: damage. The complaint perfunctorily alleges that the alleged interference caused (a) nominal damages for trespass, (b) reduction of storage space on his device, and (c) loss of value of his computing devices. But “[i]t is a matter of common understanding that cookies are minute in size and thus incapable of noticeably affecting the performance of modern computers.” Henson v. Turn, Inc., No. 15-CV-01497-JSW, 2018 WL 6605624, at *4 (N.D. Cal. Dec. 17, 2018) (quotation marks and citations omitted). And nowhere else in the complaint does Plaintiff allege that “the placement of the cookies had any noticeable effect on the performance of [his] devices.” Id.; see also Doe I v. Google LLC, 741 F. Supp. 3d 828, 846 (N.D. Cal. 2024) (dismissing claim without allegations “the existence of cookies physically impairs the functioning of the plaintiffs’ computing devices”); Casillas v. Berkshire Hathaway Homestate Ins. Co., 79 Cal. App. 5th 755, 762-63 (2022) (explaining claim fails if trespass “neither damages the recipient computer system nor impairs its functioning”). As a result, Politico contends, Shah’s generalized assertions of reduced storage or performance . . . do not satisfy the requirement of actual, provable damages. In response, Plaintiff cites In re Meta Healthcare Pixel Litigation, 713 F. Supp. 3d 650, 659 (N.D. Cal. 2024). There, the court allowed the trespass to chattels claim to go forward based on claims of reduced storage upon the device. Id. Critically, however, the plaintiff in that action alleged a “measurable impact on the functioning of the systems’ memory.” Id. Shah does not do so, so his claim cannot proceed. See Walsh v. Dollar Tree Stores, Inc., No. 25-CV-01601-SVK, 2025 WL 2939229, at *22 (N.D. Cal. Oct. 16, 2025) (dismissing trespass to chattels claim where “there are no allegations explaining how the cookies at issue . . . have actually impaired Plaintiffs’ devices – e.g., how much storage space is taken up or whether any slowdown in performance has been measured.”). ] Because Plaintiff does not allege the cookies affected or impaired his devices, Plaintiff 2 fails to state a trespass to chattels claim. Politico’s motion to dismiss Count IX is GRANTED 3 with leave to amend. 4 IV. CONCLUSION 5 For the reasons stated above, the Court GRANTS IN PART AND DENIES IN PART 6 Politico’s motion to dismiss. 7 Counts II, IV, VI, VIL, VIU, and IX are DISMISSED WITH LEAVE TO AMEND. See 8 Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000) (“[The] court should grant leave to amend... 9 unless it determines that the pleading could not possibly be cured by the allegation of other facts.” 10 (quotation marks and citation omitted)). 1] The Court DENIES Politico’s motion to dismiss Counts I, II, and V. 12 Plaintiff shall file any amended complaint within 21 days of this Order. Plaintiff may not 13 add any new claims or defendants without prior leave of court. IT IS SO ORDERED. 13 Dated: February 6, 2026 , | . 2 □ A 16 Noél Wise 7 United States District Judge

Z 18 19 20 21 22 23 24 25 26 27 28