Unreported / Non-Citable
Background
Vishal Shah, Heidi Willis, and Stacy Penning alleged that Politico offered website visitors a cookie banner that let them reject performance and behavioral-advertising cookies, but continued placing third-party cookies and transmitting user data after visitors confirmed those choices. The alleged data included browsing and visit history, interactions, user inputs, demographics, interests, device information, identifiers, and geolocation.
The proposed class action asserted common-law privacy and intrusion claims, wiretap and pen-register claims under the California Invasion of Privacy Act, or CIPA, fraud, and unjust enrichment. An earlier order had allowed Shah’s privacy and fraud theories to proceed but dismissed his CIPA claims as untimely. The amended complaint added Willis and Penning and revised the unjust-enrichment theory.
Politico again moved to dismiss, arguing among other things that the plaintiffs lacked a concrete injury, that Penning was a professional privacy tester, that the new plaintiffs could not have seen the banner when alleged, and that the statutory claims fell outside CIPA’s one-year limitations period.
The Court’s Holding
Judge Noël Wise held that the plaintiffs adequately alleged Article III standing. Politico allegedly created an expectation that opting out would stop collection, then collected detailed information anyway. The court treated that claimed invasion of an expectation of privacy as a concrete injury, particularly because Politico is a political-news website and the collected data could reveal sociopolitical interests. Whether Penning genuinely visited for news or acted as a tester presented a factual dispute that could not be resolved on the pleadings.
The common-law invasion-of-privacy, intrusion-upon-seclusion, fraud, and quasi-contract claims survived. Willis and Penning described their own visits and opt-out choices, and the court found those allegations materially similar to Shah’s. The revised complaint also alleged that Politico obtained advertising, analytics, and profiling benefits by transmitting the plaintiffs’ information to identified third parties, which was enough at the pleading stage to support restitution under a quasi-contract theory.
The CIPA claims did not survive. CIPA carries a one-year limitations period, and Shah had not cured the timeliness defect identified in the earlier ruling, so his claims were dismissed with prejudice. Willis and Penning alleged discovery only after counsel informed them in January 2026, but did not plead what diligent steps they had taken earlier. The cookie banner’s alleged deception was the same conduct underlying the lawsuit and therefore was not separate concealment that could toll the statute. Their claims were dismissed with narrowly limited leave to amend facts supporting delayed discovery.
Key Takeaways
- A website’s express cookie opt-out can create a heightened expectation of privacy when the site allegedly continues tracking after the user rejects nonessential cookies.
- The sensitivity of tracking may depend on context; browsing data from a political-news site can support a more concrete privacy injury than similar data from an ordinary retail site.
- A litigation history does not automatically establish that a plaintiff is a tester or negate standing at the motion-to-dismiss stage when bona fide use is plausibly alleged.
- CIPA’s one-year deadline requires detailed delayed-discovery allegations, including when the violation was discovered and why reasonable diligence could not have uncovered it sooner.
- Fraudulent concealment generally requires conduct beyond the wrongdoing that forms the claim itself.
Why It Matters
Businesses serving Californians should ensure that the technical behavior of consent-management tools matches the choices presented to users. A prominent opt-out that does not work as represented may strengthen standing, common-law privacy, fraud, and restitution theories even when statutory interception claims are untimely.
For privacy litigators, the order draws a sharp line between injury and limitations defenses. Detailed collection allegations and a broken privacy promise may get a plaintiff into federal court, but they do not excuse delay. Any delayed-discovery theory should plead the investigation chronologically and explain why ordinary diligence would not have exposed the tracking sooner.