Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

As we have <a href="https://www.thompsonhine.com/services/privacy-cybersecurity/cipa-claims/" target="_blank" rel="noreferrer noopener">previously reported</a>, businesses continue to face an onslaught of legal claims alleging that the use of website cookies and pixels violates the pen register and trap and trace device (PR/TT) provisions of the California Invasion of Privacy Act (CIPA). One reason these cases are difficult to manage is the inconsistent case law being developed by federal and state court judges. However, in the last few weeks, California judges have dismissed CIPA PR/TT claims on the grounds that the plaintiff’s complaint did not satisfy CIPA’s injury requirements. Businesses should consider invoking these holdings when defending themselves against CIPA-based website tracking claims.

contentpilot/introduction

core/heading

In <a>Rodriguez v. </a>Fountain9, Inc., (Cal. Sup., 24-ST-CV-04504), the plaintiff, Rebeka Rodriguez, filed her initial complaint on February 22, 2024, and then filed her first amended complaint (FAC) on April 18, 2024. She was represented by <a>Pacific Trial Attorney</a>s.

core/paragraph

The FAC stated that the plaintiff is a consumer privacy advocate who works as a “tester” to ensure that companies abide by the privacy obligations imposed by California law. It further alleged that the defendant’s publicly available corporate website unlawfully incorporated the code of about 10 different PR/TT beacons in violation of CIPA. It alleged that these tools unlawfully collected website visitors’ IP addresses, which the PR/TT beacon’s developer used to provide services to the defendant, such as targeted advertisements and website analytics. The plaintiff equated this to “digitally fingerprint[ing]” each website visitor.

On July 9, 2024, Judge Daniel Crowley dismissed the FAC on the grounds that it failed to state a claim and, more specifically, that the plaintiff failed “to allege a concrete injury-in-fact.” Specifically, he found that “[t]he only allegedly personal information that Plaintiff alleges that Defendant ‘collected’ was her IP address” and her “only allegation regarding injury is that ‘Plaintiff has been injured by Defendant’s violation’ of” CIPA. Judge Crowley held that the plaintiff’s “alleged injury is abstract and hypothetical because it is solely premised on statutory damages under CIPA.”

In addition, the judge found that the FAC failed to allege that the defendant itself “is tracing Plaintiff’s activities or is creating a digital fingerprint of Plaintiff,” and only alleged that a third-party software developer service provider packages and sells the information related to the plaintiff to third parties for advertising and marketing purposes.

The court sustained the defendant’s demurrer and granted the plaintiff 20 days to file an amended complaint. On July&nbsp;29, 2024, the plaintiff filed a second amended complaint (SAC), which was substantially similar to the FAC. However, the key difference between the two complaints was the SAC identified 15 different types of “PR/TT spyware beacons detected on Defendant’s Website” and provided more detail about their purpose and use than what was originally set forth in the FAC. The defendant called this description in the SAC “unintelligible” and indicated that the SAC is a “sham pleading.” Judge Crowley once again sided with the defendant, stating that the “plaintiff fails to allege a concrete injury-in-fact.”

In his ruling, <a>Judge Crowley </a>noted that the “Plaintiff claims that she ‘suffered an injury to her dignity’ and ‘suffered the loss of her anonymity’ as a result of Defendant’s ‘wrongdoing’ and the wrongdoing of third parties.” He found these claims lack merit because she could not demonstrate that the defendant collected any data beyond her IP address, which, according to the judge, “provides no information about the user, as it consists merely of a string of numbers.”

Judge Crowley emphasized that the “Plaintiff’s allegation of injury still fails to meet the ‘concrete’ injury required for standing” and “[t]he alleged injury is abstract and hypothetical because it is solely premised on statutory damages under CIPA.”

Unlike his ruling in the FAC, Judge Crowley’s ruling in the SAC addressed the legal elements of “causation.” Specifically, the judge noted that when the alleged facts “do not give rise to an inference that the claimed injury would naturally result from the alleged wrongful conduct, Plaintiff must allege with specificity how exactly the alleged wrongful conduct could have caused the alleged injury.” According to Judge Crowley, “A mere allegation of injury without a reasonable relationship to Defendant’s acts is grounds for a demurrer.” In the case at hand, he found that the plaintiff failed to “adequately plead the element of causation given the facts alleged.”

The defendant’s demurrer to the SAC was sustained without leave to amend the complaint and a formal order finalizing the case was issued on December 17, 2024.

In Palacios v. Office Depot, LLC (Cal. Sup., 24-ST-CV-11977), the plaintiff, Marielita Palacios, filed her initial complaint on May 13, 2024, and then filed her FAC on August 16, 2024. She also was represented by Pacific Trial Attorneys.

In her FAC, the plaintiff alleged that Office Depot’s website deployed “at least six types of PR/TT spyware,” which were essentially used to “digitally fingerprint” each website visitor in violation of CIPA. On December 3, 2024, Judge Alison Mackenzie posted a tentative order sustaining the defendant’s demurrer and granting the plaintiff 20 days to amend her complaint.

Judge Mackenzie’s order primarily focused on the defendant’s argument that the plaintiff had not suffered any injury and, therefore, lacks standing to bring a claim. According to Judge Mackenzie, “[a] litigant’s standing to sue is a ‘threshold issue to be resolved before the matter can be reached on the merits’” and they must be able to demonstrate a beneficial interest in the case’s controversy “that is concrete and actual, and not conjectural or hypothetical.” This “beneficial interest test” is essentially equivalent to the federal “injury in fact” test.

Because the matter at hand involved CIPA-related claims, Judge Mackenzie emphasized that the “prerequisites for standing to assert statutorily based causes of action are determined from the statutory language, as well as the underlying legislative intent and the purpose of the statute.” Next, the judge found that although CIPA “permits a plaintiff to file an action without alleging they suffered or are threatened with actual damages,” the law “only authorizes such a suit by ‘a person who has been injured’ by a violation” of the law’s provisions. In other words, while a plaintiff does not need to show actual damages to bring a CIPA claim, they must still allege a statutory injury.

In the case at hand, the plaintiff alleged that she suffered an “intangible injury to her dignitary interest which is harmed by an invasion of privacy” that was essentially caused by the defendant’s website deploying software on the plaintiff’s browser that collected her IP address. Judge Mackenzie emphasized that an IP address functions like a Social Security number or telephone number in that it is unique and corresponds to a specific entity connected to the internet, but that individuals do not have any expectation of privacy in their IP addresses. Therefore, according to Judge Mackenzie, collecting an IP address “cannot constitute an injury authorizing a suit” under CIPA. Judge Mackenzie dismissed the plaintiff’s allegations that the defendant “will use the software on Plaintiff’s browser to collect additional personal identifying information.” Here, the judge held that the plaintiff’s complaint is premised “only” on the defendant “collecting ‘dialing, routing, addressing, or signaling information,’ ‘but not the contents of a communication’” and therefore, she “has failed to allege facts showing that she suffered an injury caused by Defendant’s alleged” CIPA violation.

core/separator

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2025/01/Privacy-Cybersecurity-Update-Multiple-California-Judges-Dismiss-CIPA-Pen-Trap-Cases-for-a-Lack-of-Injury.pdf

Multiple California Judges Dismiss CIPA Pen/Trap Cases for a Lack of Injury

Services