Unreported / Non-Citable
Background
Carol Jackson filed a proposed class action against DIFF, LLC on May 21, 2026, asserting five claims: violation of the Federal Wiretap Act, two claims under the California Invasion of Privacy Act, invasion of privacy under the California Constitution, and intrusion upon seclusion. She alleged that she visited DIFF’s website on or around October 9, 2025, browsed for and purchased eyewear, and expected her communications with the retailer to remain confined to DIFF.
The complaint alleged that DIFF enabled Google, Pinterest, and Snap to use tracking technologies to intercept website communications. According to Jackson, those technologies captured product categories, frame and lens filters, particular frames viewed, color changes, shopping-cart contents, and visits to cart and checkout pages. She also alleged that Snap received information submitted at checkout, including hashed email addresses, phone numbers, and names, and that cookies and other identifiers could connect activity with users’ identities.
DIFF moved to dismiss under Rules 12(b)(1) and 12(b)(6), arguing that Jackson lacked Article III standing and failed to state a claim. Its standing argument focused on whether the alleged disclosure of routine browsing and purchasing information caused a concrete injury analogous to intrusion upon seclusion. Jackson responded that interception of her communications, association of her activity with personal identifiers, and the resulting loss of control over her information were sufficient. The court held a hearing on October 19, 2026.
The Court’s Holding
The court evaluated standing for each claim and explained that even statutory privacy claims require an actual, concrete injury. For an intangible privacy harm, the relevant inquiry was whether Jackson identified a close historical or common-law analogue, particularized to her circumstances. The parties treated intrusion upon seclusion as the applicable analogue. Jackson did not have to prove every element of that tort to establish standing, but she did have to allege harm bearing a close relationship to the traditionally recognized intrusion.
Comparing Ninth Circuit decisions, the court distinguished pervasive, surreptitious surveillance from routine monitoring in an ordinary commercial setting. It found Jackson’s allegations closer to Popa v. Microsoft Corp., involving ordinary shopping activity, than to Davis v. Facebook, Inc., involving comprehensive cross-site profiles. The identified transmissions mainly concerned eyewear frames, colors, lens options, reading magnification, and purchase activity during a single website visit. The complaint did not allege that DIFF monitored Jackson across numerous unrelated websites or that the trackers actually compiled a comprehensive profile of her browsing history or personal life.
The court also held that interception of names, email addresses, and phone numbers did not, on these allegations, trigger a sufficiently private interest. Jackson’s prescription-eyewear theory failed because she did not allege that she bought prescription glasses, uploaded a prescription, or even purchased or browsed sunglasses; she could not rely on hypothetical injuries to other class members. The court added that the complaint alleged interception of lens selections, not the contents of an actual prescription. It therefore granted DIFF’s motion to dismiss the complaint with leave to amend within fourteen days, without reaching the alternative Rule 12(b)(6) arguments.
Key Takeaways
- A federal or state statutory privacy claim still requires the plaintiff to allege an actual, concrete Article III injury.
- The court treated ordinary retail browsing, product selections, cart activity, and checkout progression as closer to routine commercial observation than to highly offensive intrusion upon seclusion.
- Allegations that tracking tools could identify users or facilitate advertising did not replace an allegation that they actually compiled a comprehensive profile of Jackson’s private affairs.
- Jackson could not establish her own standing through hypothetical prescription-related injuries allegedly suffered by unidentified putative class members.
- The court granted DIFF’s motion with leave to amend, and it expressly left DIFF’s Rule 12(b)(6) arguments undecided.
Why It Matters
The decision applies a fact-specific standing analysis rather than treating every alleged third-party interception of website activity as a concrete privacy injury. The nature of the transmitted information, the scope of the alleged surveillance, and the plaintiff’s own alleged experience were central to the comparison with common-law intrusion upon seclusion.
The ruling also separates standing from the ultimate merits of Jackson’s five claims. Because the court found the alleged injury insufficient, it granted the motion without deciding whether the complaint otherwise stated claims under the federal and state statutes, the California Constitution, or common law. The fourteen-day amendment opportunity leaves open whether Jackson can allege a concrete injury particular to her own website activity.