Unreported / Non-Citable
Background
Two California residents brought a proposed class action against the operator of Crypto.com. They alleged that the website continued placing third-party cookies after they selected “Disable All,” allowing Meta, Google, X, and Snap to receive information about their cryptocurrency research. Their claims included invasion of privacy, fraud, unjust enrichment, and violations of the California Invasion of Privacy Act.
The amended complaint alleged that the transmitted data included page visits, searches, device information, IP addresses, and browser identifiers. But it did not allege that either plaintiff created an account, logged in, submitted personal details, or had the browsing information tied to his identity. Although the defendant moved to dismiss on the merits, the court independently examined Article III standing, the constitutional requirement that a federal plaintiff suffer a concrete and particularized injury.
The Court’s Holding
The court dismissed without prejudice for lack of standing. Applying recent Ninth Circuit authority, it reasoned that browsing public cryptocurrency prices and market information was not comparable to intrusion into a traditionally protected private sphere. The information concerned the plaintiffs’ interests and research, not their own bank accounts, credit, income, or other personal financial records.
The alleged failure to honor the cookie opt-out did not by itself create a concrete federal injury. Deception may make an intrusion more offensive, but the sensitivity of the information collected remains central. Nor was it enough to allege generally that third parties can combine data into broad profiles; the plaintiffs did not plausibly allege that anyone actually identified them or combined their browsing with materially more sensitive information. The court allowed 30 days to amend.
Key Takeaways
- A statutory privacy violation alone does not necessarily establish Article III standing in federal court.
- Website-tracking plaintiffs should plead what data was actually collected from them, whether it was identifiable, and why it was sensitive.
- Browsing financial topics is not the same as disclosure of a user’s own financial records.
- An ignored opt-out can strengthen a privacy theory, but deception does not replace the need for concrete harm.
Why It Matters
The decision is a practical pleading guide for California businesses and privacy litigators facing cookie, pixel, and session-tracking claims. Complaints framed at the level of what tracking technology could collect may fail if they do not connect the alleged collection to the named plaintiffs and a historically recognized privacy harm.
Because dismissal was without prejudice, the order does not foreclose a claim supported by allegations that tracking captured identifiable or genuinely sensitive information. It does, however, reinforce that standing must be evaluated plaintiff by plaintiff before the court reaches California statutory claims.