Data Privacy and Cybersecurity

In Smith v. Rack Room Shoes, Inc., No. 24-cv-06709-RFL (N.D. Cal. Sept. 21, 2026), Plaintiffs sought class certification on claims under the California Invasion of Privacy Act, Cal. Penal Code §§ 631 and 632, and the Federal Wiretap Act, 18 U.S.C. § 2511(1)(a).  Plaintiffs asserted that Defendant Rack Room, an online shoe retailer, helped third-party pixel-tracking services intercept private communications containing personally identifiable information.  The Court found that Plaintiffs had no Article III standing, rejecting harm theories based on both actual and attempted interception of private information, and dismissed those claims without prejudice while denying class certification.

Continue Reading Pixel Tracking Technologies and Article III Standing: Lessons from the Rack Room Shoes Decision

On September 30, Governor Gavin Newsom signed SB 690, a significant new law aimed at curbing the wave of lawsuits and demand letters asserting “pen register” claims under the California Invasion of Privacy Act (“CIPA”).  The legislation eliminates the private right of action for pen register and trap-and-trace claims arising…

Continue Reading California Governor Signs SB 690, Eliminating Private Website-Based CIPA Pen Register Claims and Calling for Broader CIPA Reform

On August 28, 2026, the California Legislature passed SB 690, a significant bill aimed at curbing the flood of demand letters and lawsuits asserting “pen register” claims under the California Invasion of Privacy Act (“CIPA”). If enacted, the bill would eliminate the private right of action for website-based pen register claims and could affect many pending lawsuits filed since January 1, 2025.

Continue Reading California Legislature Passes CIPA Pen Register Reform Bill and Sends It to Governor

In a recent decision challenging Google’s Gemini AI features, a California federal court held that allegations concerning an AI tool’s capabilities, without facts showing actual access or use of plaintiffs’ data, were insufficient to demonstrate the “concrete” harm required for Article III standing.  Thele v. Google LLC, 2026 WL…

Continue Reading Gemini Tracking Allegations Fall Short of Article III Standing

In a decision highlighting the importance of testing standing through discovery, a Florida federal court dismissed privacy claims at the class-certification stage after concluding that neither named plaintiff could establish Article III standing.  Although the plaintiffs’ allegations survived a motion to dismiss, discovery later exposed their “utter disregard” for the allegedly private information at issue, leaving them with nothing more than “a bare statutory violation.”  Cobbs v. PetMed Express, Inc., 2026 WL 2234135 (S.D. Fla. July 31, 2026).

Continue Reading Letting the Cat Out of the Bag: Named Plaintiffs’ Own Conduct Defeats Privacy Claims

On July 1, 2026, a California legislative committee advanced amendments to SB 690 that would eliminate private suits asserting website-based “pen register” claims under the California Invasion of Privacy Act (“CIPA”), leaving enforcement exclusively to the California Attorney General.  The amendments come amid a surge of lawsuits and demand letters challenging the use of website technologies under the pen register provision, which the committee described as a “poster child for abusive lawsuits.”  According to the committee analysis, “[b]ecause the potential liability can be staggering,” businesses often settle quickly, thereby “encouraging vexatious litigants to continue blasting out demand letters.”

Continue Reading California Legislature Advances Bill Targeting Wave of CIPA Pen Register Lawsuits

Recently, a California federal judge dismissed—for the second time—a suit asserting that Sojern, Inc., a travel marketing platform, violated the Federal Wiretap Act and California privacy laws by allegedly deploying “tracking technology” on two hotel websites.  Crano v. Sojern, Inc., 2026 WL 1670136 (N.D. Cal. June 9, 2026).

Continue Reading California Court Dismisses Amended Complaint in Hotel Website Wiretapping Suit for Lack of Article III Standing

The First Circuit recently affirmed a Puerto Rico district court’s ruling dismissing a class action suit arising from a 2019 ransomware attack against a hospital in which 522,493 patients’ personally identifiable information (“PII”) and protected health information (“PHI”) was allegedly accessed by hackers, albeit in “encrypted” form.  See Santos-Pagán v. Bayamon Medical Center, No. 24-2018, 2026 WL 1693930 (1st Cir. June 11, 2026).

Continue Reading First Circuit Scrutinizes Causation Issues to Find No Article III Standing in Data Breach Case

In a consolidated putative class action arising out of an alleged data breach, In re A-Line Staffing Solutions Data Security Incident Litigation, Case No. 24-cv-11917 (E.D. Mich. May 27, 2026), a Michigan district court declined to dismiss the complaint under Rule 12(b)(1) but granted the defendant’s motion to dismiss without prejudice on Rule 12(b)(6) grounds.  The decision exemplifies a theme in such data breach cases: even where plaintiffs clear the Article III standing hurdle, their allegations may still fail to state a claim.

Continue Reading Standing Found, But Negligence Fails: Eastern District of Michigan Dismisses Data Breach Claims for Lack of Causation

The Third Circuit continues to draw a firm line on Article III standing in website “wiretapping” cases.  Just weeks after the court’s decision in Harriet Carter Gifts, the court has issued yet another decision reinforcing that the alleged collection of data through third party tools does not create a concrete injury unless the tools capture truly sensitive, identifying information.

Continue Reading Third Circuit Addresses Standing in Website Wiretapping Claims—Again