Unreported / Non-Citable
Background
Martin Beltran and Paul Gioffre brought this action against FCA US LLC, alleging privacy violations arising from FCA’s ecommerce websites. The websites contain resources and programming scripts from third parties that place cookies and transmit user data even after visitors expressly opt out of non-essential tracking.
According to the complaint, FCA’s websites represent that users can opt out of “Targeting Cookies” and “Social Media Cookies” used by advertising partners and social media services, while marking “Essential Cookies” as always active. Plaintiffs alleged that despite selecting the opt-out toggle on FCA’s website and opting out of all non-essential cookies, FCA continued to enable third-party tracking technology to collect their personally identifiable information, including website interactions and shopping behaviors. The data was then used to build online profiles for advertising purposes.
Plaintiffs brought six claims: invasion of privacy and intrusion upon seclusion (Counts I–II); violations of the California Invasion of Privacy Act under Penal Code Sections 631 (wiretapping) and 638.51 (pen register) (Counts III–IV); common law fraud (Count V); and unjust enrichment (Count VI). FCA moved to dismiss all claims under Federal Rule of Civil Procedure 12(b)(1) for lack of Article III standing and under Rule 12(b)(6) for failure to state a claim.
The Court’s Holding
The district court granted the motion in part and denied it in part. The court first found that plaintiffs adequately pleaded Article III standing to pursue their claims. The complaint’s allegations that FCA allowed third-party tracking to continue despite the plaintiffs’ express election to keep that information private, and that this data could be consolidated into extensive online profiles for advertising purposes, constituted sufficient injury-in-fact to establish standing.
The court upheld the privacy claims for invasion of privacy and intrusion upon seclusion, finding that plaintiffs plausibly alleged a “highly offensive” intrusion into matters reasonably expected to be private. The court concluded that FCA’s own conduct was sufficiently knowing and intentional because FCA designed its websites to include third-party tracking capabilities, implicitly acknowledged knowing the destination and use of data collected by each third-party cookie by offering an opt-out mechanism, and used the collected data for its own advertising purposes. Together, these allegations supported a plausible claim that FCA knowingly and intentionally allowed third parties to continue tracking after users had opted out.
The court upheld both CIPA claims under an aiding and abetting theory. The Section 631(a) wiretapping claim survived because knowledge and intent were sufficiently alleged. The Section 638.51(a) pen register claim also survived because third parties receive IP addresses and other routing metadata used in real time to identify and log the origin and destination endpoints of plaintiffs’ communications, constituting a separate process from content collection. The fraud claim was dismissed with leave to amend for lack of specificity as to when plaintiffs visited the websites. The unjust enrichment claim survived because plaintiffs plausibly alleged that FCA profited from data it wrongfully acquired and had no adequate legal remedy to recover those profits.
Key Takeaways
- Companies cannot satisfy privacy obligations through privacy representations if they continue to enable tracking behind the scenes while offering opt-out mechanisms that do not actually function.
- Under CIPA Section 631, individuals can pursue wiretapping claims against companies that allow third parties to collect communications data through websites, under an aiding and abetting theory.
- CIPA Section 638.51’s pen register provision applies when third parties collect IP addresses and routing metadata through cookies and other tracking technologies to identify communication endpoints.
- Privacy violations constitute concrete injury sufficient to establish Article III standing, even when the harm is informational rather than economic.
- Companies may face unjust enrichment liability if they profit from data collected in violation of users’ privacy rights and opt-out instructions.
Why It Matters
This decision significantly strengthens the position of California consumers pursuing privacy claims against companies that implement deceptive cookie-tracking practices. For practitioners representing individuals in privacy litigation, the ruling confirms that CIPA claims can survive the pleading stage in federal court when facts suggest intentional tracking despite user opt-out. The court’s willingness to find sufficient knowledge and intent based on a company’s ability to implement an opt-out mechanism carries important implications: it suggests that companies cannot plausibly claim ignorance about the scope or use of third-party tracking if they have designed systems to control it.
For businesses, particularly those operating ecommerce platforms in California or nationwide, this case demonstrates the enforcement risk of cookie-management systems that do not function as advertised. The decision affects not only statutory privacy violations but also common law privacy torts, creating multiple enforcement pathways for plaintiffs. The unjust enrichment holding means that companies cannot offset privacy violations by framing the collected data as merely incidental to business operations. For California practitioners advising technology and ecommerce companies, this ruling is a reminder that privacy-by-design—ensuring that opt-out mechanisms actually work—is now a litigation-risk mitigation measure.