Adding to a growing body of case law following the Ninth Circuit’s decision in Popa v. Microsoft Corporation, a California federal court has dismissed for lack of subject matter jurisdiction a privacy suit against a news website, holding that the plaintiffs failed to allege a concrete injury sufficient to establish Article III standing. In Re: USA Today Co., Inc. Internet Tracking Litigation, 2026 WL 932655, at *3 (N.D. Cal. Apr. 6, 2026).

The plaintiffs sued for purported violations of the California Invasion of Privacy Act’s (“CIPA”) trap-and-trace provision, among others, claiming that the defendant installed third-party website technologies that collected IP addresses, location, browser type, and similar information. The court held that the disclosure of this information “would [not] be highly offensive to a reasonable person,” emphasizing that courts have repeatedly found no reasonable expectation of privacy in such “unprotected” disclosures. Although the plaintiffs attempted to broaden their theory by invoking purportedly “unique and persistent identifiers,” the court found these allegations too vague to establish a concrete injury.

The court also rejected the plaintiffs’ alternative theories of harm. Allegations that the defendant was unjustly enriched by the economic value of user data similarly failed because plaintiffs did not plausibly allege collection of data in which they had a protected privacy interest. And, citing Popa, the court reiterated that a bare CIPA statutory violation, standing alone, is insufficient to confer Article III standing absent a concrete injury. The court granted the plaintiffs leave to file an amended complaint.

This decision reinforces the need, as the Ninth Circuit identified in Popa, for plaintiffs in privacy cases to plead facts showing that “embarrassing, invasive, or otherwise private information” was collected to have Article III standing to pursue those claims.