The California Invasion of Privacy Act (CIPA) provides a private right of action only to those who have “been injured by a violation of” CIPA. A California Superior Court decision, Rodriguez v. Fountain9, Inc., 2024 WL 3886811, at *4 (Cal. Super. July 9, 2024), confirmed that a plaintiff cannot satisfy this statutory standing requirement unless the plaintiff alleges “a concrete injury-in-fact.”
Plaintiff Rebeka Rodriguez alleged that Defendant Fountain9 installed on its website a third-party tool (called a “PR/TT beacon”) to help with targeted advertisements and website analytics. Rodriguez alleged that she visited Fountain9’s website, and that Fountain9 and the third-party tool’s developer used the PR/TT beacon to collect her IP address. Rodriguez characterized the PR/TT beacon as a “pen register” and she asserted a claim against Fountain9 for allegedly violating CIPA’s prohibitions on the installation or use of a “pen register.” Rodriguez brought her claim under CIPA section 637.2, which provides a private right of action for “any person who has been injured by a violation of” CIPA to seek $5,000 in statutory damages per violation.
The Court sustained Fountain9’s demurrer (with leave to amend) because Rodriguez “fail[ed] to allege a concrete injury-in-fact” sufficient to confer standing under CIPA section 637.2. Instead, Rodriguez’s “alleged injury” was “abstract and hypothetical” because it was “solely premised on statutory damages under CIPA.” Rodriguez did not allege any concrete injury from the collection of her IP address, which was “[t]he only allegedly personal information that Plaintiff alleges that Defendant collected.” In support of this holding, the Court recited the U.S. Supreme Court’s oft-repeated phrase, “No concrete harm, no standing,” from TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2199 (2021), which analogously held that bare statutory violations are insufficient to confer Article III standing.
This decision reaffirms that a plaintiff cannot bring a CIPA claim based on a mere violation of one of CIPA’s statutory provisions. Regardless of whether a plaintiff is bringing a claim for violation of CIPA’s pen register provision at issue in Rodriguez or CIPA’s more frequently invoked wiretap provisions in the website context, a plaintiff must allege a concrete injury-in-fact.