Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 Case No.: 25cv0742 DMS (MMP) JUSTIN BRADSHAW, and GUSTAVO 11 LOPEZ, individual and on behalf of all ORDER DENYING DEFENDANT’S others similarly situated, 12 MOTION TO DISMISS Plaintiffs, 13 v. 14 LOWE’S HOME CENTERS, LLC, a 15 North Carolina limited liability company, 16 Defendant. 17 18 19 This case comes before the Court on the motion to dismiss filed by Defendant 20 Lowe’s Home Centers, LLC. Plaintiffs filed an opposition to the motion, and Defendant 21 filed a reply. The motion came on for hearing on August 18, 2026. Michael Blatchley 22 appeared for Plaintiffs, and Kamran Ahmadian appeared for Defendant. After reviewing 23 the parties’ briefs, the record, the relevant legal authority, and hearing argument from 24 counsel, the Court denies Defendant’s motion. 25 I. 26 BACKGROUND 27 This case originated in this Court on March 31, 2025, under the Class Action 28 Fairness Act (CAFA). Named Plaintiffs are Justin Bradshaw and Gustavo Lopez, both 1 California residents who visited Defendant Lowe’s website during the relevant time period. 2 In the original complaint, Plaintiffs named both Lowe’s Home Centers, LLC and Lowe’s 3 Companies, Inc. as defendants. (ECF No. 1.) Plaintiffs alleged Defendants violated Section 4 638.51 of the California Invasion of Privacy Act (CIPA) by secretly installing various 5 trackers, including TikTok Pixel and Microsoft Bing (“Trackers”), on users’ internet 6 browsers. They alleged these Trackers collected users’ IP addresses, unique identifiers, 7 and browsing information, and then shared the information with TikTok and Microsoft 8 without users’ consent. 9 After meeting and conferring with this Court, Plaintiffs filed a First Amended 10 Complaint on June 10, 2025. (ECF No. 14.) Defendants then filed a Motion to Dismiss for 11 lack of personal jurisdiction, lack of Article III standing, and failure to state a claim. (ECF 12 No. 17.) This Court denied Defendants’ motion to dismiss for failure to state a claim but 13 granted Defendants’ motion to dismiss for lack of personal jurisdiction and lack of Article 14 III standing. (ECF No. 39.) On the standing issue, this Court found Plaintiffs had not 15 shown that unique identifiers, device information, and browsing information fit within the 16 scope of Section 638.50(b). This left only Plaintiffs’ claim concerning the capture of their 17 IP addresses. Case law supported that Plaintiffs had no reasonable expectation of privacy 18 in their IP addresses. Therefore, the Court found Plaintiffs had failed to plead the requisite 19 injury for Article III standing. 20 The Court granted Plaintiffs leave to amend their Complaint to address this pleading 21 deficiency, and in accordance therewith, Plaintiffs filed a Second Amended Complaint 22 (SAC) on November 19, 2025. In their SAC, Plaintiffs removed Lowe’s Companies, Inc. 23 as a defendant, leaving Lowe’s Home Centers, LLC as the singular remaining defendant. 24 Plaintiffs expanded their SAC to include allegations that Defendant tracked their online 25 behavior not only while they were on Defendant’s website, but also after they left 26 Defendant’s website and began to browse the internet. They allege that the data from 27 Trackers on Defendant’s website allows TikTok and Microsoft to create “cradle-to-grave” 28 profiles, including information about who visitors were, what visitors were doing and why, 1 where a user was when they visited the website, and how a user made their way to 2 Defendant’s website. They further allege that Defendant collects the “full destination 3 URL” of the page requested on Defendant’s website. They allege Defendant then 4 leveraged this data for targeted advertising. 5 Plaintiffs also added information regarding the value and sensitivity of their data and 6 Plaintiffs’ use of the Lowe’s website. Furthermore, to satisfy Article III standing 7 requirements, Plaintiffs analogize the harm they suffered to an intrusion upon seclusion 8 claim, pleading that they had both a reasonable expectation of privacy in the data collected 9 and that Defendant’s use of the Trackers was highly offensive. Lastly, they argue 10 Defendant’s use of the Trackers caused Plaintiffs to suffer a concrete economic injury by 11 misappropriating Plaintiffs’ data without compensation and through unjust enrichment. 12 In the present motion, Defendant moves to dismiss the case for lack of Article III 13 standing. Specifically, Defendant argues Plaintiffs have failed again to plead they suffered 14 an Article III injury. 15 II. 16 LEGAL STANDARD 17 Federal Rule of Civil Procedure 12(b)(1) permits challenges to federal courts’ 18 subject matter jurisdiction, including for lack of Article III standing. Fed. R. Civ. P. 19 12(b)(1). Federal courts are of limited jurisdiction, “[possessing] only that power 20 authorized by Constitution and statute, which is not to be expanded by judicial decree.” 21 Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994) (citations omitted). 22 Among the limits on that jurisdiction is the requirement of Article III standing. See Bender 23 v. Williamsport Area Sch. Dist., 475 U.S. 534, 531–42 (1986). “[T]he irreducible 24 constitutional minimum of standing” requires plaintiff to prove (1) injury in fact, which 25 must be (a) concrete and particularized, and (b) actual or imminent; (2) a causal connection 26 between the injury and defendant’s conduct; and (3) that the injury is likely to be redressed 27 by a favorable decision. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992). 28 Where these requirements are not met, “a federal court without jurisdiction over certain 1 claims has no choice but to dismiss them regardless of their gravity or potential validity.” 2 Fed. Election Comm’n v. Adams, 558 F. Supp. 2d 982, 986 (C.D. Cal. 2008). “The party 3 asserting federal subject matter jurisdiction bears the burden of proving its existence.” 4 Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir. 2010). 5 III. 6 DISCUSSION 7 Defendant’s first argument is that Plaintiffs fail to allege facts about their own visits 8 to the website, and that Plaintiffs’ allegations are hypothetical and conclusory. (Mot. to 9 Dismiss 8–9.) In both their Motion to Dismiss and oral argument, Defendant argued that 10 Plaintiffs’ allegations lack specificity and require additional details about which pages on 11 Defendant’s website they accessed and which sensitive products they viewed. Defendant 12 likened Plaintiffs here to the plaintiff in Popa v. Microsoft Corporation, who did not 13 identify any “embarrassing, invasive, or otherwise private information collected” by 14 trackers. 153 F.4th 784, 791 (9th Cir. 2025). 15 However, unlike the plaintiff in Popa, Plaintiffs here allege that their browsing 16 information could reveal “sensitive demographic data” and “users’ financial and 17 socioeconomic statuses.” (SAC §§ 10, 97.) Popa specifically considers disclosure of 18 financial information as sensitive private information. Popa, 153 F.4th at 791 (finding a 19 privacy interest in “sensitive medical or financial information”). Furthermore, Plaintiffs 20 include a section within their SAC that addresses Plaintiffs’ experiences with the website. 21 (SAC §§ 82–87.) At the pleading stage, without the benefit of discovery, Plaintiffs are not 22 required to provide the depth of detail that Defendant demands. See Leite v. Crane Co., 23 749 F.3d 1117, 1121 (9th Cir. 2014) (requiring courts to draw all reasonable inferences in 24 favor of plaintiffs when considering a motion to dismiss for lack of Article III standing). 25 This Court finds Plaintiffs’ allegations are sufficiently concrete and specific as not to be 26 merely “conjectural” or “hypothetical.” See Lujan, 504 U.S. at 560. 27 Second, Defendant argues Plaintiffs have failed both pleading elements of an 28 intrusion upon seclusion claim. (Mot. to Dismiss 15–18.) The substantive elements of an 1 intrusion upon seclusion claim are that the defendant intruded into a “place, conversation, 2 or matter as to which the plaintiff has a reasonable expectation of privacy” and second, that 3 the defendant’s intrusion was “highly offensive.” See In re Facebook Internet Tracking 4 Litig., 956 F.3d 589, 601 (9th Cir. 2020). 5 Defendant argues Plaintiffs have no reasonable expectation of privacy in the 6 information allegedly collected. They argue the website does not handle particularly 7 sensitive data, and Plaintiffs have failed to identify any personal information captured by 8 the Trackers. They also argue the SAC asserts website tracking is ubiquitous and, 9 therefore, internet users have a diminished expectation of privacy in information collected 10 and shared by third parties. Plaintiffs argue courts have consistently found a reasonable 11 expectation of privacy in the kind of “detailed URLs” and browsing history that Plaintiffs 12 allege were collected. (Opp’n 13–14.) Additionally, they argue their expectation of privacy 13 was shaped by Defendants’ Privacy Statement, which allegedly stated it would share 14 information with third parties only “with [visitor’s] consent.” (Id. 14–15.) 15 Whether one has a reasonable expectation of privacy is a mixed question of law and 16 fact, informed by “whether a defendant gained ‘unwanted access to data by electronic or 17 other covert means, in violation of the law or social norms.” See Facebook Internet 18 Tracking, 956 F.3d at 603. As stated in the Court’s previous order, there is no reasonable 19 expectation of privacy in one’s IP address. However, courts in this Circuit have 20 consistently found a reasonable expectation of privacy in cases where browsing history is 21 collected surreptitiously and used to create extensive consumer profiles. See id. (“[T]he 22 allegations that Facebook allegedly compiled highly personalized profiles from sensitive 23 browsing histories and habits prevent us from concluding that the Plaintiffs have no 24 reasonable expectation of privacy.”); Griffith v. TikTok, Inc., 697 F. Supp. 3d 963, 972 25 (C.D. Cal. 2023) (same); Katz-Lacabe v. Oracle Am., Inc., 668 F. Supp. 3d 928, 942 (N.D. 26 Cal. 2023) (same); Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1089 (N.D. Cal. 27 2022) (same). Therefore, Plaintiffs have adequately alleged a reasonable expectation of 28 privacy in their browsing data. 1 Defendant also argues their conduct was not highly offensive. They cite case law 2 supporting their argument that collecting IP addresses, zip codes, device identifiers, and 3 general browsing information on a public, unauthenticated website is not highly offensive. 4 Plaintiffs argue the highly offensive prong is satisfied by Defendant’s surreptitious 5 collection of their data and that the collected data allowed third parties to associate 6 Plaintiffs’ browsing habits with their identity. (Opp’n 17–18.) 7 Determining whether a defendant's actions were “highly offensive to a reasonable 8 person” requires a “holistic consideration of factors such as the likelihood of serious harm 9 to the victim, the degree and setting of the intrusion, the intruder's motives and objectives, 10 and whether countervailing interests or social norms render the intrusion inoffensive.” 11 Facebook Internet Tracking, 956 F.3d at 606 (citation omitted). At the pleading stage, 12 some courts have been reluctant to conclude that conduct was “highly offensive.” Briskin 13 v. Shopify, Inc., No. 21-cv-06269-PJH, 2026 WL 161441, at *8 (N.D. Cal. Jan. 21, 2026); 14 see Facebook Internet Tracking, 956 F.3d at 606 (“The ultimate question of whether 15 Facebook’s tracking and collection practices could highly offend a reasonable individual 16 is an issue that cannot be resolved at the pleading stage.”). However, other courts have 17 found, as a matter of law, that certain data-sharing practices constitute highly offensive 18 conduct because of the data's sensitive nature or because the defendant engaged in “secret 19 or deceptive data collection.” See In re Ambry Genetics Data Breach Litig., 567 F. Supp. 20 3d 1130, 1143 (C.D. Cal. 2021); Hubbard v. Google LLC, No. 19-cv-07016-SVK, 2024 21 WL 3302066, at *7 (N.D. Cal. July 1, 2024); Tsering v. Meta Platforms, Inc., No. 25-cv- 22 01611-RFL, 2026 WL 89320, at *7 (N.D. Cal. Jan. 12, 2026). 23 Here, Plaintiffs allege the Privacy Statement represented it would only share 24 personal information with third parties “with [users’] consent,” and Plaintiffs never 25 consented. (SAC ¶ 94.) They further allege that, after Plaintiffs filed this lawsuit, 26 Defendant amended their Privacy Statement “to strike the provision promising to secure 27 consent. . . in effect conceding that their prior actions were done in violation of their own 28 policy.” (Id. ¶ 100.) Therefore, this Court declines to find that Defendant’s data collection 1 was not highly offensive as a matter of law. See Brown v. Google LLC, 685 F. Supp. 3d 2 909, 941 (N.D. Cal. 2023). Accordingly, Plaintiffs have adequately alleged the elements 3 of an intrusion upon seclusion claim. 4 Finally, Defendant argues Plaintiffs have not suffered monetary harm. (Mot. to 5 Dismiss 18.) They argue the SAC omits factual allegations, such as the potential monetary 6 value of each type of information collected, how Defendant’s collection diminished the 7 value, and Plaintiffs’ intention to sell the data. They also argue the ubiquitous nature of 8 website tracking undermines the claim of financial harm. Plaintiffs argue California law 9 requires disgorgement of unjustly earned profits regardless of whether a plaintiff expended 10 their financial resources. (Opp’n 22.) Additionally, Plaintiffs argue Defendant deprived 11 Plaintiffs of their right to exclude, the benefit of their bargain, and the right to control their 12 personal information. 13 The Ninth Circuit has established that 14 California law requires disgorgement of unjustly earned profits regardless of whether a defendant’s actions caused a plaintiff to expend his or her own 15 financial resources directly or whether a defendant’s actions directly caused 16 the plaintiff’s property to become less valuable. . . this stake in unjustly earned profits exists regardless of whether an individual planned to sell his or her data 17 or whether the individual’s data is made less valuable. 18 19 Facebook Internet Tracking, 956 F.3d at 600. Therefore, Plaintiffs have adequately 20 pleaded monetary harm sufficient to satisfy Article III. 21 / / / 22 / / / 23 / / / 24 / / / 25 / / / 26 / / / 27 / / / 28 / / / 1 IV. 2 CONCLUSION 3 For the reasons set out above, the Court denies Defendant’s motion to dismiss the 4 || case for lack of Article III standing. 5 IT IS SO ORDERED. 6 Dated: August 26, 2026 3 Hon. Dana M. Sabraw United States District Judge 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28