Unreported / Non-Citable
Background
Stacy Penning sued Farmers Insurance Company, Inc. in the Northern District of California in a putative class action alleging that Farmers installs third-party trackers on visitors' browsers through its website in violation of various California laws. Reviewing the First Amended Complaint (FAC), the court raised on its own motion whether Penning, the sole named plaintiff, has Article III standing, a question of subject matter jurisdiction that may be examined at any time. A plaintiff must show a concrete, particularized, and actual or imminent injury that the defendant likely caused and that judicial relief would likely redress, and the plaintiff bears that burden.
The FAC alleges that Penning visited the website to explore an automobile insurance quote. On one occasion in May or June 2025, he allegedly entered his zip code and portions of the quote questionnaire, such as name and birth date, but never submitted a quote request. He also alleges he opted out of cookie tracking and Farmers allowed the tracking anyway. These are allegations, not findings. The court relied mainly on Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025), which affirmed dismissal of a session-replay case because the information collected was not embarrassing, invasive, or otherwise private, and the plaintiff showed no harm similar to interferences actionable at common law. It also discussed recent district decisions applying Popa, including Ortiz v. Foris Dax, Inc., where cookies were allegedly used despite being disabled.
The Court’s Holding
This is an order to show cause, not a dismissal, and it decides no merits question. The court's statements are preliminary views on whether the FAC's allegations suffice. Drawing reasonable inferences for Penning, the court found that the FAC does not plausibly allege harm remotely similar to the highly offensive interferences or disclosures actionable at common law. A zip code, name, and birth date entered into a quote tool, with no quote submitted, does not support an inference that the information was sufficiently private or sensitive to constitute an intrusion upon seclusion. The court noted that Penning does not allege collection of his personal financial information, specific facts about inherently sensitive information such as medical data, immigration status, or sociopolitical views, or tracking extensive enough to create cradle-to-grave profiles.
On the opt-out allegation, the court said that ignored cookie preferences do not necessarily amount to concrete injury. Quoting Ortiz, it explained that deceit can be a plus factor elevating borderline conduct to a highly offensive intrusion, but deceit alone does not convert routine information collection into one, because the key is the sensitivity of the information. The court said the tracked data is likely not sufficiently sensitive and that it was not satisfied that failing to disable cookies as promised supports federal jurisdiction.
Penning must show cause in writing by November 2, 2026, how the FAC plausibly alleges Article III standing, and Farmers may respond by November 12, 2026. A no-standing ruling would not be a merits ruling; the action would be dismissed without prejudice to pursuing the claim in state court. If the court finds jurisdiction, Farmers' response to the amended complaint is due 14 days after that ruling.
Key Takeaways
- The order is a show-cause directive only; no claim has been dismissed, and the court's views on sensitivity are preliminary pending Penning's response.
- Under Popa as applied here, the focus is the sensitivity of the information collected, and basic quote-form entries such as zip code, name, and birth date, never submitted, appeared unlikely to qualify.
- Alleging that a website ignored a cookie opt-out does not by itself establish concrete injury, because deceit is a plus factor but not enough without sensitive data.
- A dismissal for lack of Article III standing would be without prejudice to refiling in state court and would not decide the merits.
Why It Matters
This is an unreported district court order, so it carries no binding precedential weight. It shows how one Northern District judge reads Popa in website-tracking class actions and aligns with recent district decisions the order cites. Plaintiffs in similar cases should plead facts showing the sensitivity of what was collected, not merely that tracking occurred or that an opt-out was ignored.
Still open are Penning's response, any reply from Farmers, and whether the pleading establishes standing. The court did not rule on the merits of any California-law claim.