The California Invasion of Privacy Act (CIPA) provides a private right of action only to those who have “been injured by a violation of” CIPA.  A California Superior Court decision, Rodriguez v. Fountain9, Inc., 2024 WL 3886811, at *4 (Cal. Super. July 9, 2024), confirmed that a plaintiff cannot satisfy this statutory standing requirement unless the plaintiff alleges “a concrete injury-in-fact.”

Plaintiff Rebeka Rodriguez alleged that Defendant Fountain9 installed on its website a third-party tool (called a “PR/TT beacon”) to help with targeted advertisements and website analytics.  Rodriguez alleged that she visited Fountain9’s website, and that Fountain9 and the third-party tool’s developer used the PR/TT beacon to collect her IP address.  Rodriguez characterized the PR/TT beacon as a “pen register” and she asserted a claim against Fountain9 for allegedly violating CIPA’s prohibitions on the installation or use of a “pen register.”  Rodriguez brought her claim under CIPA section 637.2, which provides a private right of action for “any person who has been injured by a violation of” CIPA to seek $5,000 in statutory damages per violation.

The Court sustained Fountain9’s demurrer (with leave to amend) because Rodriguez “fail[ed] to allege a concrete injury-in-fact” sufficient to confer standing under CIPA section 637.2.  Instead, Rodriguez’s “alleged injury” was “abstract and hypothetical” because it was “solely premised on statutory damages under CIPA.”  Rodriguez did not allege any concrete injury from the collection of her IP address, which was “[t]he only allegedly personal information that Plaintiff alleges that Defendant collected.”  In support of this holding, the Court recited the U.S. Supreme Court’s oft-repeated phrase, “No concrete harm, no standing,” from TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2199 (2021), which analogously held that bare statutory violations are insufficient to confer Article III standing.

This decision reaffirms that a plaintiff cannot bring a CIPA claim based on a mere violation of one of CIPA’s statutory provisions.  Regardless of whether a plaintiff is bringing a claim for violation of CIPA’s pen register provision at issue in Rodriguez or CIPA’s more frequently invoked wiretap provisions in the website context, a plaintiff must allege a concrete injury-in-fact.

Photo of Dominic Booth Dominic Booth

Dominic Booth is an associate in the firm’s Palo Alto office who focuses on commercial litigation and complex class actions. He has experience working with clients in the technology and financial services industries in matters involving privacy, consumer protection, product liability, and breach…

Dominic Booth is an associate in the firm’s Palo Alto office who focuses on commercial litigation and complex class actions. He has experience working with clients in the technology and financial services industries in matters involving privacy, consumer protection, product liability, and breach of contract claims. In particular, Dominic has experience litigating cases brought under the Federal Wiretap Act, California Invasion of Privacy Act (CIPA), and Video Privacy Protection Act (VPPA).

Photo of Matthew Verdin Matthew Verdin

Matthew Verdin focuses on defending clients in the technology and financial services sectors. He has a strong record of delivering wins on behalf of clients in class actions and complex litigation, particularly in privacy and consumer protection lawsuits. Matthew is particularly successful in…

Matthew Verdin focuses on defending clients in the technology and financial services sectors. He has a strong record of delivering wins on behalf of clients in class actions and complex litigation, particularly in privacy and consumer protection lawsuits. Matthew is particularly successful in securing dismissals at the pleadings stage. For example, he won dismissal at the pleadings stage of over a dozen wiretapping class actions involving the alleged use of website analytics tools to collect data about users’ website visits. He also advises companies on managing litigation risk under federal and state wiretapping laws.

Matthew is also dedicated to pro bono legal services. Recently, he helped a domestic violence survivor win a case in the California Court of Appeal. Matthew’s oral argument led to the court ordering renewal of his client’s restraining order just one day later.