Unreported / Non-Citable
Background
Jose Torres filed a putative class action against SeatGeek, Inc., alleging that the ticket-resale website embedded third-party advertising trackers (TikTok Pixel, Meta Pixel, and Microsoft Bing tracker) that collected his browsing data—including IP address, device metadata, URLs visited, button clicks, and ticket searches for NFL and San Diego Padres games—and transmitted it to those third parties without his consent. Torres asserted claims under the California Comprehensive Computer Data Access and Fraud Act (CDAFA), the California Invasion of Privacy Act (CIPA) for pen register and wiretapping violations, the California Constitution, and common-law intrusion upon seclusion. The court previously dismissed the first amended complaint (FAC) for lack of Article III standing, holding that the collection of non-sensitive record information from a public website did not constitute a concrete injury under Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). Torres filed a second amended complaint (SAC) adding allegations that the trackers captured the specific pages viewed, URLs, button clicks, and search terms, and that he subsequently saw targeted Instagram ads related to his searches. SeatGeek moved to dismiss the SAC under Rules 12(b)(1) and 12(b)(6).
The Court’s Holding
The court granted SeatGeek’s motion to dismiss the SAC for lack of Article III standing, without leave to amend and without prejudice. The court held that the new allegations—capturing exact webpages visited, button clicks, and ticket searches for sports events—did not alter the standing analysis under Popa. Browsing for sports tickets on a public website, even with detailed tracking of page visits and searches, does not reveal embarrassing, invasive, or otherwise private information akin to a common-law privacy tort. The aggregation of this non-sensitive browsing data with third-party profiles did not create a concrete injury, as SeatGeek embedded trackers only on its own site and made no misrepresentations, distinguishing In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020). The court also found the collection was not highly offensive, as SeatGeek did not override privacy choices, collect sensitive data, or engage in deception. The unjust-enrichment theory failed because Torres lacked a privacy interest in the data and the allegations remained conclusory. Having amended twice after an order identifying deficiencies, and identifying no new facts to cure the defect, Torres was denied leave to amend. The dismissal is without prejudice to refiling in state court.
Key Takeaways
- Detailed tracking of browsing activity on a single public commercial website (pages visited, URLs, button clicks, searches) does not establish Article III standing absent allegations that the information is inherently sensitive, embarrassing, or private.
- The Ninth Circuit’s Popa decision controls: capturing URLs, clicks, and keystrokes on a retail site is akin to a store clerk observing shoppers and does not constitute a concrete privacy injury.
- Linking non-sensitive browsing data to third-party advertising profiles does not transform the data into private information where the website operator tracks only on its own site and makes no misrepresentations.
- Receiving targeted ads based on non-confidential browsing history is not a highly offensive intrusion supporting standing.
- A plaintiff who amends twice after a court identifies standing deficiencies and fails to identify new facts that could cure the defect may be denied leave to amend as futile.
Why It Matters
This decision reinforces the narrow path for Article III standing in pixel-tracking class actions after the Ninth Circuit’s Popa ruling. It clarifies that even granular browsing data—specific URLs, button clicks, and search terms—collected on a single public website does not constitute a concrete injury if the information reveals only ordinary consumer interests (here, sports tickets). The ruling draws a firm line between website operators using common advertising tools on their own sites and data brokers or platforms that track users across the internet or disregard privacy representations. It also confirms that statutory violations under CIPA or CDAFA do not automatically confer standing without a corresponding common-law privacy harm. The denial of leave to amend after two opportunities signals judicial impatience with repetitive pleading of insufficient privacy theories.