Washington v. Flixbus, Inc.

Opinion

CHARLES WASHINGTON, Case No.: 3:25-cv-00212-H-MSB

Plaintiff, ORDER GRANTING DEFENDANT’S v. MOTION TO DISMISS

[Doc. No. 6] Defendant. On April 4, 2025, Defendant Flixbus, Inc. filed a motion to dismiss Plaintiff Charles Washington’s complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) on the grounds that Plaintiff lacks standing, Plaintiff’s claims are preempted, and the Complaint fails to state a claim upon which relief can be granted. (Doc. No. 6.) On April 21, 2025, Plaintiff filed a response in opposition to Defendant’s motion to dismiss. (Doc. No. 7.) Defendant filed a reply on April 28, 2025. (Doc. No. 9.) On June 2, 2025, the Court took the matter under submission. (Doc. No. 11.) For the reasons below, the Court grants Defendant’s motion to dismiss without leave to amend. BACKGROUND In this putative class action, Defendant Flixbux, Inc. is a passenger bus transportation company and Plaintiff Charles Washington is an individual who used Defendant’s website to book a bus ticket. (Compl., Doc. No 1 ¶¶ 2, 7.) Travelers can book bus tickets using Defendant’s website, www.flixbus.com. (Compl., Doc. No 1 ¶¶ 2, 32.) Defendant integrates the “Facebook Tracking Pixel” into its website. (Compl., Doc. No 1 ¶ 2.) The Facebook Tracking Pixel is one of Meta Platforms, Inc.’s (“Facebook”) business tools, which are “bits of code that advertisers can integrate into their website, mobile applications, and servers, thereby enabling Facebook to intercept and collect user activity on those platforms.” (Compl., Doc. No 1 ¶¶ 27, 29.) When a user accesses a website that integrates the Facebook Tracking Pixel, Facebook’s software script directs the user’s browser to send a separate message to Facebook’s servers containing certain data the Pixel is configured to collect. (Compl., Doc. No 1 ¶ 29.) The Pixel uses cookies to pair event data like dates and locations of travel with personally identifiable information so it can later retarget consumers with advertising on Facebook. (Compl., Doc. No 1 ¶¶ 33, 44, 46.) By integrating the Pixel into its website, Defendant assists Facebook with pairing the identifiers with event data. (Compl., Doc. No 1 ¶ 33, 47.) Plaintiff alleges that Defendant does not provide reasonably conspicuous notice to its users of its terms and conditions or privacy policy. (Compl., Doc. No 1 ¶¶ 49-57.) In or around September 2024, Plaintiff visited Defendant’s website to book a bus ticket from San Diego to Los Angeles. (Compl., Doc. No 1 ¶ 7.) Unbeknownst to Plaintiff and allegedly without his consent, Defendant assisted Facebook with intercepting his communications, including communications that contained his personally identifiable information and details regarding his private travel itinerary. (Compl., Doc. No 1 ¶¶ 7-8.) Such details included his departure and return date, the origin and destination cities, and the number of travelers in his party. (Compl., Doc. No 1 ¶ 7.) Based on these allegations, Plaintiff asserts claims under the California Information Privacy Act (“CIPA”) and invasion of privacy under the California Constitution. (Compl., Doc. No. 1 ¶¶ 67-87.) By the present motion, Defendant moves to dismiss Plaintiff’s complaint in its entirety pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) on the grounds that (a) the Court lacks subject matter jurisdiction because Plaintiff has no Article III standing, (b) the Interstate Commerce Commission Termination Act, 49 U.S.C. § 14501, expressly preempts all of Plaintiff’s claims, and (c) the Complaint fails to state a claim upon which relief can be granted. (Doc. No. 6.) I. Standard for Dismissal Pursuant to Rule 12(b)(6) A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of the pleadings and allows a court to dismiss a complaint if the plaintiff has failed to state a claim upon which relief can be granted. See Conservation Force v. Salazar, 646 F.3d 1240, 1241 (9th Cir. 2011) (citing Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001)). Federal Rule of Civil Procedure 8(a)(2) requires that a pleading that states a claim for relief contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” The function of this pleading requirement is to “‘give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.’” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957)). A complaint will survive a Rule 12(b)(6) motion to dismiss if it contains “enough facts to state a claim to relief that is plausible on its face.” Id. at 570. “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “A pleading that offers ‘labels and conclusions’ or ‘a formulaic recitation of the elements of a cause of action will not do.’” Id. (quoting Twombly, 550 U.S. at 555). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id. “While legal conclusions can provide the framework of a complaint, they must be supported by factual allegations.” Id. at 679. Accordingly, dismissal for failure to state a claim is proper where the claim “lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008); see L.A. Lakers, Inc. v. Fed. Ins. Co., 869 F.3d 795, 800 (9th Cir. 2017). In reviewing a Rule 12(b)(6) motion to dismiss, a district court must “accept the factual allegations of the complaint as true and construe them in the light most favorable to the plaintiff.” L.A. Lakers, 869 F.3d at 800 (quoting AE ex rel. Hernandez v. Cnty. of Tulare, 666 F.3d 631, 636 (9th Cir. 2012)). But a court need not accept “legal conclusions” as true. Iqbal, 556 U.S. at 678. “Further, it is improper for a court to assume the claimant “can prove facts which it has not alleged or that the defendants have violated the . . . laws in ways that have not been alleged.” Associated Gen. Contractors of Cal., Inc. v. Cal. State Council of Carpenters, 459 U.S. 519, 526 (1983). In addition, a court may consider documents incorporated into the complaint by reference and items that are proper subjects of judicial notice. See Coto Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010). If the court dismisses a complaint for failure to state a claim, it must then determine whether to grant leave to amend. See Doe v. United States, 58 F.3d 494, 497 (9th Cir. 1995). “A district court should grant leave to amend . . . unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Id. (citation omitted). II. Analysis Defendant argues Plaintiff’s claims under CIPA and the California Constitution are barred because Plaintiff consented to Defendant’s Privacy Policy and Terms and Conditions, which disclose the data practices he now challenges. (Doc. No. 6-1 at 11-14.) Plaintiff argues he did not consent because Defendant did not provide reasonably conspicuous notice of its policies. (Compl., Doc. No. 1 ¶¶ 49-57; Doc. No. 7 at 10-15.) Consent is a bar to claims under CIPA. See Smith v. Facebook, Inc., 262 F. Supp. 3d 943, 955 (N.D. Cal. 2017) (holding plaintiffs who consented to tracking activity could not state a claim under CIPA because the statute “imposes liability only for interception ‘without the consent of all parties’”), aff’d, 745 F. App’x 8 (9th Cir. 2018); Reyes v. Educ. Credit Mgmt. Corp., 773 F. App’x 989, 990 n.1 (9th Cir. 2019) (“It appears that, under California law, the plaintiff bringing a CIPA claim has the burden to prove that the defendant lacked consent to record.”). Consent is also a bar to claims for invasion of privacy under the California Constitution. See Smith, 262 F. Supp. 3d at 955; Cal. Civ. Code § 3515 (“A person who consents to an act is not wronged by it.”); Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 26 (1994) (“Moreover, the plaintiff in an invasion of privacy case must have conducted himself or herself in a manner consistent with an actual expectation of privacy, i.e., he or she must not have manifested by his or her conduct a voluntary consent to the invasive actions of defendant. If voluntary consent is present, a defendant’s conduct will rarely be deemed ‘highly offensive to a reasonable person’ so as to justify tort liability.”); In re Yahoo Mail Litig., 7 F. Supp. 3d at 1037-38 (“The plaintiff in an invasion of privacy action must have conducted himself or herself in a manner consistent with an actual expectation of privacy, i.e., he or she must not have manifested by his or her conduct a voluntary consent to the invasive actions of defendant.”). Here, Plaintiff alleges that he did not consent to the data practices at issue in the complaint. But the Court need not accept that legal conclusion as true. Iqbal, 556 U.S. at 678. Turning to the facts alleged in the complaint, Plaintiff alleges that during the checkout process for purchasing a ticket through Defendant’s website, after the purchaser enters their payment method, a checkbox appears next to a “Pay now” button, along with the text: “I declare to have read the Privacy Policy and I agree to the T&C of Booking and T&C of Carriage.” (Compl., Doc. No. 1 ¶ 51, Fig. 5.) This notice includes hyperlinks to the full text of those policies. (Id.) If a purchaser clicks these hyperlinks, they are redirected to a new page to read the linked documents. (Compl., Doc. No. 1 ¶ 53.) This type of disclosure is commonly referred to as a “clickwrap” agreement. See Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1175-76 (9th Cir. 2014) (defining clickwrap agreements as those “in which website users are required to click on an ‘I agree’ box after being presented with a list of terms and conditions of use”). Plaintiff alleges he purchased a ticket through Defendant’s website, and his complaint shows that the checkout process requires users to assent to Defendant’s terms in order to complete their purchase. (See Compl., Doc. No. 1 ¶¶ 7, 51, Fig. 5.) Plaintiff does not deny that he checked the box indicating his consent to the terms in order to purchase his ticket. Defendant has included copies of its policies with its motion to dismiss. (See Doc. No. 6-2 at 5-34, 37-46.) Plaintiff does not dispute the accuracy of the documents Defendant provided, nor does he argue the Court should not consider them. (See Doc. No. 7 at 11-12.) Moreover, Plaintiff has incorporated these documents into his complaint by reference, as the complaint refers extensively to the Privacy Policy and Terms and Conditions, and his claims depend on his allegation that he did not consent to Defendant’s data practices. (Compl., Doc. No. 1 ¶¶ 49-57.) See United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003) (“Even if a document is not attached to a complaint, it may be incorporated by reference into a complaint if the plaintiff refers extensively to the document or the document forms the basis of the plaintiff’s claim.”); Reyes, 773 F. App’x at 990 n.1 (“It appears that, under California law, the plaintiff bringing a CIPA claim has the burden to prove that the defendant lacked consent to record.”); Cal. Civ. Code § 3515 (“A person who consents to an act is not wronged by it.”). See also Garcia v. Enter. Holdings, Inc., 78 F. Supp. 3d 1125, 1136-37 (N.D. Cal. 2015) (considering privacy policy and terms of service presented by defendants in a motion to dismiss); Coto Settlement, 593 F.3d at 1038 (courts may consider documents incorporated by reference on a motion to dismiss). Accordingly, the Court now turns to Defendant’s Privacy Policy and Terms and Conditions to determine whether they disclose the data practices Plaintiff challenges in his complaint. Defendant’s Privacy Policy states that Defendant collects information provided to it, “such as when you purchase a ticket[,]” which may include personal information, demographic data, transaction information, and cookies. (Doc. No. 6-2 at 6-7.) It provides that Defendant may use the information collected for marketing purposes or to provide users personalized content. (Doc. No. 6-2 at 9.) It further states: “Flix and our partners may use cookies, web beacons, embedded scripts, pixels, tags, session replay tools, SDKs, and other identification technologies (‘Tracking Technologies’) in connection with our Services for purposes described in this Privacy Policy.” (Doc. No. 6-2 at 10.) The policy explains that a tracking cookie is “is a small text file that is stored [and remains] on a user’s device” which “help[s] in understanding how you use the Service and enhance your user experience.” (Doc. No. 6-2 at 11.) It explains that tracking pixels are “small graphic images . . . embedded in web pages and email messages” that “may be used, without limitation, to count the number of visitors to the Service, to monitor how Users navigate the Service, and to count content views.” (Id.) It states that Defendant “may disclose the personal information / data” it collects to “marketing partners, research firms, and other service providers.” (Doc. No. 6-2 at 13-14.) It states that it discloses “personal identifiers” and “commercial information” including transaction details to its business partners. (Doc. No. 6-2 at 17-19.) It states that third-party digital businesses “may associate cookies and other tracking technologies that Collect PI about you on our services, or otherwise Collect and Process PI that we make available about you, including digital activity information.” (Doc. No. 6-2 at 26.) Defendant’s Terms and Conditions of Purchase includes a section titled “Consent to Use of Personal Data.” (Doc. No. 6-2 at 46.) The section provides: “Upon booking a ticket for transportation . . . you hereby authorize Flix, Bus Operators, and their affiliates and authorized agents to (i) collect, process, retain and use, and (ii) transfer to third parties, including, but not limited to . . . marketing partners . . . any and all personal data you provide . . . as Flix and/or Bus Operators deem necessary to carry out any and all business purposes related to the program or services being requested and/or in the promotion of other information, goods, and services that may be of interest to you[.]” (Id.) The section states that such business purposes may include “sales and marketing” and “promotions for Flix and/or its affiliates [sic] goods and services and third party goods and services[.]” (Id.) In order for a user’s acceptance of data practices to constitute actual consent, “the disclosures must ‘explicitly notify’ users of the practice at issue.” Lakes v. Ubisoft, Inc., __ F. Supp. 3d __, 2025 WL 1036639, at *5 (N.D. Cal. Apr. 2, 2025) (quoting In re Google Inc., 2013 WL 5423918, at *13 (N.D. Cal. Sept. 26, 2013)). Further, “[t]he disclosures must have only one plausible interpretation for a finding of consent.” Id. (citing In re Facebook, Inc., Consumer Privacy User Profile Litig., 402 F. Supp. 3d 767, 794 (N.D. Cal. 2019)). “[I]f a reasonable . . . user could plausibly have interpreted the contract language as not disclosing that [the Defendant] would engage in particular conduct, then [the Defendant] cannot obtain dismissal of a claim about that conduct (at least not based on the issue of consent).” In re Facebook, Inc., 402 F. Supp. 3d at 789-90. Plaintiff argues here that there is no provision in Defendant’s terms that explicitly notifies users that their personal information or travel details would be disclosed to third parties. (Doc. No. 7 at 12.) The Court disagrees. As summarized above, Defendant’s Privacy Policy and Terms and Conditions explicitly notify users of the data practices at issue by disclosing the use of cookies and tracking pixels to track certain data and disclose that data to Defendant’s business partners, including marketing partners. Accordingly, a user’s acceptance of Defendant’s terms constitutes actual consent to the data practices Plaintiff challenges. As Defendant notes, Plaintiff does not deny that he checked the box indicating he consented to Defendant’s Terms and Conditions. Instead, he argues that consumers “do not” assent to Defendant’s terms because Defendant “does not provide reasonably conspicuous notice” of its policies and because Defendant “intentionally conceals and limits a consumer’s opportunity to review them prior to booking travel accommodations on its Website.” (Compl., Doc. No. 1 ¶¶ 49-57.) Specifically, he notes that a ten-minute timer begins counting down when a user enters the checkout process, and if the user does not complete their purchase during that time, they must restart the checkout process. (Compl., Doc. No. 1 ¶¶ 50, 52.) At that point, a pop-up window will appear stating: “Are you still there? Your cart has expired, but you can always try to book the same tickets!” and providing options to “Go back to search” or “Try again.” (Compl., Doc. No. 1 ¶ 52, Fig. 6.) Plaintiff argues that given the length of Defendant’s Privacy Policy and Terms and Conditions, and the fact that the hyperlinks to those policies only appear after the user selects a payment method, the average user cannot read the entirely of those policies before the ten-minute checkout timer has expired. (Compl., Doc. No. 1 ¶¶ 49-51.) The Court rejects Plaintiff’s contention that users “do not assent” to Defendant’s terms because a user with an average reading speed cannot finish reading the Privacy Policy and Terms and Conditions before the checkout timer elapses. It similarly rejects Plaintiff’s suggestion that the countdown timer imposes undue pressure that negates any consent users do provide via the checkbox. If a user has not completed reviewing Defendant’s terms before ten minutes have elapsed, the user is under no obligation to complete the checkout process. This remains the case even it this means the user’s selected seats may no longer be available after the timer elapses. See Oberstein v. Live Nation Ent., Inc., 2021 WL 4772885 (C.D. Cal. Sept. 20, 2021), aff’d, 60 F.4th 505, at *8 (9th Cir. 2023) (rejecting plaintiffs’ argument that the pressure applied by “ticket holds” and a checkout countdown timer prevented them from reviewing defendant’s terms before making a purchase). Further, as Defendant notes and Plaintiff acknowledges in his opposition, if users wish to review Defendant’s Privacy Policy and Terms and Conditions outside the checkout process, they may access the policies at any time via hyperlinks at the bottom of Defendant’s website. (See Doc. No. 7 at 10.) Though Plaintiff acknowledges the links to Defendant’s policies at the bottom of its website, he argues the links are “inconsequential to this Court’s inquiry” in light of Ninth Circuit precedent stating that “consumers cannot be expected to ferret out hyperlinks to terms and conditions to which they have no reason to suspect they will be bound.” (Doc. No. 7 at 10-11 (quoting Jackson v. Amazon.com, Inc., 65 F.4th 1093, 1100 (9th Cir. 2023) (quoting Nguyen v. Barnes & Noble Inc., 763 F.3d at 1179)).) But the authority Plaintiff cites does not support his position. In Nguyen, the Ninth Circuit considered browsewrap agreements. In contrast with the clickwrap agreement at issue in this case, in a browsewrap agreement, “a website’s terms and conditions of use are generally posted on the website via a hyperlink at the bottom of the screen.” 763 F.3d at 1176. “The defining feature of browsewrap agreements is that the user can continue to use the website or its services without visiting the page hosting the browsewrap agreement or even knowing that such a webpage exists.” Id. (quoting Be In, Inc. v. Google Inc., 2013 WL 5568706, at *6 (N.D. Cal. Oct. 9, 2013)). The Ninth Circuit held that that “where a website makes its terms of use available via a conspicuous hyperlink on every page of the website but otherwise provides no notice to users nor prompts them to take any affirmative action to demonstrate assent, even close proximity of the hyperlink to relevant buttons users must click on – without more – is insufficient to give rise to constructive notice.” Id. at 1178-79. It noted further that “[w]hile failure to read a contract before agreeing to its terms does not relieve a party of its obligations under the contract, the onus must be on website owners to put users on notice of the terms to which they wish to bind consumers.” Id. (citation omitted). Here, Defendant did more than simply make its terms available on its website. The allegations in the complaint show that it drew users’ attention to its policies during the ticket checkout process and required users to take affirmative action to demonstrate their assent to those terms. (See Compl., Doc. No. 1 ¶ 51, Fig. 5.) As such, Plaintiff was not expected to “ferret out a hyperlink” to policies he had no reason to suspect would bind him. Rather, Plaintiff was presented with conspicuous hyperlinks to Defendant’s policies during the checkout process, and in order to complete his purchase, Plaintiff was required to affirm that he agreed to be bound by the stated terms. And beyond that, Defendant provided hyperlinks to the same Privacy Policy and Terms and Conditions at the bottom of its website, which could be accessed at any time outside the checkout process. For the reasons above, the Court concludes that Plaintiff consented to Defendant’s Privacy Policy and Terms and Conditions, which disclose the data practices he challenges in his complaint. Accordingly, Plaintiff cannot state a claim for violations of CIPA or invasion of privacy under the California Constitution, and therefore, the Court dismisses those claims. III. Leave to Amend Is Denied Plaintiff requests leave to amend his complaint in the event that Defendant’s motion to dismiss is granted. (Doc. No. 7 at 23). “Leave to amend is warranted if the deficiencies can be cured with additional allegations that are ‘consistent with the challenged pleading’ and that do not contradict the allegations in the original complaint.” United States v. Corinthian Colleges, 655 F.3d 984, 995 (9th Cir. 2011) (quoting Reddy v. Litton Indus., Inc., 912 F.2d 291, 296-97 (9th Cir. 1990)). Under this standard, leave to amend should not be granted. The Court’s dismissal of Plaintiff’s claims under CIPA and the California Constitution is based on the allegations in his complaint that show he consented to Defendant’s Privacy Policy and Terms and Conditions, which disclose the data practices he challenges. As discussed, consent is a bar to both of Plaintiff’s claims. Plaintiff cannot }overcome this pleading deficiency through amendment. Accordingly, leave to amend would be futile and should not be granted. See Lakes, _ F. Supp. 3d __, 2025 WL 1036639, at *8-10 (dismissing complaint including CIPA claim and claim for invasion of privacy under California Constitution without leave to amend because amendment could not “overcome the issue of consent”); Smith, 262 F. Supp. 3d at 956 (denying leave to amend where “no amendment could change the fact that Plaintiffs consented to Facebook’s conduct’). For the reasons above, the Court grants Defendant’s motion to dismiss without leave amend for failure to state a claim.! 1] DATED: June 5, 2025 bu lL. . MARILYN L. NUFF, District J UNITED STATES DISTRICT COURT In its motion to dismiss, Defendant argues Plaintiff's complaint should be dismissed because: “(i) the Court lacks subject matter jurisdiction because Plaintiff has Article III standing, (11) the Interstate Commerce Commission Termination Act, 49 U.S.C. § 14501, expressly preempts all of Plaintiff's claims, and (111) the Complaint further fails to state a claim upon which relief can be granted.” (Doc. No. 6.) Because the Court grants Defendant’s motion to dismiss for the reasons above, the Court declines to address the additional bases Defendant argues constitute grounds for dismissal.