Unreported / Non-Citable
Background
Eden McKie, a Fremont, California resident, alleged that on or around June 11, 2025 she visited Huel Ltd.'s online food and grocery retail website, rejected tracking through its pop-up cookie-consent banner, and purchased four hot & savory meal packs and seven hot & savory meal cups. She claimed that embedded third-party cookies from Meta, TikTok, and Snapchat nevertheless intercepted her identifying and contact information, the pages she viewed, and her purchase details despite her opt-out. Her putative class action, brought on behalf of nationwide and California user subclasses, asserted five claims under the Electronic Communications Privacy Act, Sections 631 and 632 of the California Invasion of Privacy Act, the Comprehensive Computer Data Access and Fraud Act, and the California Constitution. Huel moved to dismiss all claims for lack of Article III standing and failure to state a claim.
The court treated standing as the threshold jurisdictional inquiry and expressly declined to reach the failure-to-state-a-claim arguments. It explained that a statutory violation alone does not establish injury in fact; the alleged harm must be concrete and particularized and bear a close relationship to a harm traditionally recognized by American courts. Applying TransUnion and Spokeo, the court used public disclosure of private facts and intrusion upon seclusion as the relevant common-law analogues, examining whether McKie had a reasonable expectation of privacy and whether the alleged intrusion was highly offensive to a reasonable person.
The Court’s Holding
The court found McKie's expectation-of-privacy allegations plausible. Huel's opt-out choices and its representation that opted-out data would be anonymized amounted to an affirmative representation supporting that expectation, even though the complaint never specified exactly which banner controls she clicked—the court noted that "rejected tracking" was not itself a button on the documented banner. The court also observed that California's CCPA has shifted user expectations toward customized privacy controls online. Her earlier disclosures of contact information when creating Meta, TikTok, and Snapchat accounts did not eliminate her expectation of privacy in potentially changed details or in purchase and browsing information she had not previously supplied to those companies. But that expectation alone did not establish a concrete injury. Reading Popa v. Microsoft as rejecting a per se rule, the court treated continued tracking after an opt-out as one factor rather than a dispositive answer to the highly-offensive inquiry.
The remaining factors favored dismissal. The court characterized the meal purchases, page views, identifiers, and contact details as nonsensitive retail information—analogous to grocery purchases or the pet-store preferences in Popa rather than medical or similarly private information—and emphasized that the alleged collection occurred during a single visit and remained confined to Huel's website, unlike the extensive cross-site "cradle-to-grave" profiling that supported standing in In re Facebook. Those limitations outweighed the adequately pleaded expectation of privacy, so all five claims failed Article III standing. The court separately held that the CDAFA claim lacked statutory standing because McKie alleged no economic loss. It granted the motion to dismiss all claims with leave to amend within thirty days if McKie could do so in good faith, without reaching Huel's failure-to-state-a-claim arguments.
Key Takeaways
- A cookie banner's opt-out promise can support a plausible expectation of privacy without automatically establishing the concrete injury required for federal standing.
- Under the court's application of Popa, tracking despite an opt-out representation is relevant but does not by itself make an intrusion highly offensive.
- The alleged food purchases and browsing details were treated as nonsensitive retail information rather than information comparable to medical or other traditionally private disclosures.
- Tracking limited to one website and one visit lacked the breadth of the cross-site, comprehensive profiling that supported standing in In re Facebook.
- The dismissal covered all claims with leave to amend, while the court left Huel's failure-to-state-a-claim arguments undecided.
Why It Matters
The order applies a fact-specific standing analysis that separates a website's deception about cookie choices from the sensitivity and scope of the information actually collected. For similarly pleaded website-tracking cases in this district, an opt-out representation may establish the expectation-of-privacy factor yet still be insufficient when the allegations concern ordinary retail activity confined to a single visit. The court's reliance on Popa and post-Popa district decisions reflects the ongoing division over how much weight misrepresentation carries after the Ninth Circuit's clarification.
The thirty-day amendment window gives McKie an opportunity to cure the identified pleading deficiencies in good faith; the dismissal is jurisdictional and with leave to amend, not a merits adjudication of the five statutory and constitutional claims.