Recently, a California federal judge dismissed—for the second time—a suit asserting that Sojern, Inc., a travel marketing platform, violated the Federal Wiretap Act and California privacy laws by allegedly deploying “tracking technology” on two hotel websites. Crano v. Sojern, Inc., 2026 WL 1670136 (N.D. Cal. June 9, 2026).
Continue Reading California Court Dismisses Amended Complaint in Hotel Website Wiretapping Suit for Lack of Article III StandingData Privacy and Cybersecurity
First Circuit Scrutinizes Causation Issues to Find No Article III Standing in Data Breach Case
By Nathan Lange on
The First Circuit recently affirmed a Puerto Rico district court’s ruling dismissing a class action suit arising from a 2019 ransomware attack against a hospital in which 522,493 patients’ personally identifiable information (“PII”) and protected health information (“PHI”) was allegedly accessed by hackers, albeit in “encrypted” form. See Santos-Pagán v. Bayamon Medical Center, No. 24-2018, 2026 WL 1693930 (1st Cir. June 11, 2026).
Continue Reading First Circuit Scrutinizes Causation Issues to Find No Article III Standing in Data Breach CaseStanding Found, But Negligence Fails: Eastern District of Michigan Dismisses Data Breach Claims for Lack of Causation
By Sam Greeley on
In a consolidated putative class action arising out of an alleged data breach, In re A-Line Staffing Solutions Data Security Incident Litigation, Case No. 24-cv-11917 (E.D. Mich. May 27, 2026), a Michigan district court declined to dismiss the complaint under Rule 12(b)(1) but granted the defendant’s motion to dismiss without prejudice on Rule 12(b)(6) grounds. The decision exemplifies a theme in such data breach cases: even where plaintiffs clear the Article III standing hurdle, their allegations may still fail to state a claim.
Continue Reading Standing Found, But Negligence Fails: Eastern District of Michigan Dismisses Data Breach Claims for Lack of CausationThird Circuit Addresses Standing in Website Wiretapping Claims—Again
By Marianne Spencer on
The Third Circuit continues to draw a firm line on Article III standing in website “wiretapping” cases. Just weeks after the court’s decision in Harriet Carter Gifts, the court has issued yet another decision reinforcing that the alleged collection of data through third party tools does not create a concrete injury unless the tools capture truly sensitive, identifying information.
Continue Reading Third Circuit Addresses Standing in Website Wiretapping Claims—AgainWiretapping Suit Meets Triple Defeat: No Standing, Consent Established, Class Allegations Rejected
By Rachel Lia & Steve Petkis on
Continuing the trend of early dismissals in website wiretapping cases, a California federal court has dismissed a putative class action challenging the use of third-party pixel technology on nonprofit food bank websites. Timothee v. Meta Platforms, Inc., No. 25-CV-05106-LB, 2026 WL 1130363 (N.D. Cal. Apr. 27, 2026). The court held plaintiffs failed to plausibly plead concrete injury to establish Article III standing, consented to the third party’s receipt of their information, and proposed an impermissibly broad nationwide class.
The plaintiffs in Timothee alleged that several nonprofit food banks embedded third-party pixel technology into their websites, which collected and transmitted users’ addresses and “intent to receive nutrition assistance.” Some plaintiffs further alleged that the pixel technology collected detailed information about “financial hardship,” “disability status, mobility status, and urgency of [their] need for food assistance.” According to plaintiffs, this information was then used by the third party to target them with advertisements. The plaintiffs claimed these transmissions violated the California Invasion of Privacy Act (“CIPA”), the Federal Wiretap Act, and various California privacy and common-law doctrines. The court disagreed, dismissing plaintiffs’ claims, with leave to amend, on three grounds.
Continue Reading Wiretapping Suit Meets Triple Defeat: No Standing, Consent Established, Class Allegations RejectedAnother Court Dismisses Website Privacy Suit for Lack of Article III Standing
By Thea McCullough & Kathryn Cahoy on
Posted in Data Privacy and Cybersecurity
Adding to a growing body of case law following the Ninth Circuit’s decision in Popa v. Microsoft Corporation, a California federal court has dismissed for lack of subject matter jurisdiction a privacy suit against a news website, holding that the plaintiffs failed to allege a concrete injury sufficient to establish Article III standing. In Re: USA Today Co., Inc. Internet Tracking Litigation, 2026 WL 932655, at *3 (N.D. Cal. Apr. 6, 2026).
Continue Reading Another Court Dismisses Website Privacy Suit for Lack of Article III StandingSensitive Search Terms Not Enough To Establish Article III Standing Under Popa
A recent decision from the Southern District of California underscores a point courts have made increasingly clear after the Ninth Circuit’s precedential decision in Popa v. Microsoft: alleging the disclosure of online activity—even activity touching on sensitive health topics—is not enough, by itself to establish Article III standing. As the Court put it, the mere allegation that a defendant disclosed “sensitive health related” search terms, without any indication in the search terms that they “were tied to his personal medical history,” cannot establish a concrete injury. Maghoney v. Dotdash Meredith, Inc., 2026 WL 497402 (S.D. Cal. Feb. 23, 2026) (emphasis added).
Continue Reading Sensitive Search Terms Not Enough To Establish Article III Standing Under PopaSeventh Circuit Holds that BIPA Amendment Applies Retroactively
By Inside Privacy on
Posted in Data Privacy and Cybersecurity, Seventh Circuit
In a new post on the Inside Privacy blog, our colleagues discuss the Seventh Circuit’s recent Clay v. Union Pacific Railroad Company holding that a 2024 amendment to the Illinois Biometric Information Privacy Act (BIPA) limiting damages to a per-person basis applies retroactively to cases pending when the amendment…
Continue Reading Seventh Circuit Holds that BIPA Amendment Applies RetroactivelyStand Aside: Third Circuit Throws Out Harriet Carter Gifts Federal Wiretapping Case On Standing Grounds
We have routinely highlighted the proliferation of wiretapping class actions, and the variety of approaches courts have taken to address them. One common pitfall for plaintiffs in these types of cases is standing, an issue highlighted in a recent Third Circuit case throwing out a proposed federal class action against Harriet Carter Gifts and NaviStone Inc., and remanding it to state court.
The case, Popa v. Harriet Carter Gifts, Inc., No. 25-1760 (3d. Cir. 2026), involved plaintiff’s allegations that Harriet Carter Gifts and NaviStone tracked her browsing activity on Harriet Carter’s website while she shopped for pet stairs, purportedly in violation of the Pennsylvania Wiretapping and Electronic Surveillance Control Act. After removal, the district court twice granted summary judgment for the defendants, and both decisions were appealed to the Third Circuit.
Continue Reading Stand Aside: Third Circuit Throws Out Harriet Carter Gifts Federal Wiretapping Case On Standing GroundsFederal Court Rejects Claim that Cookies Are Illegal Trap and Trace Devices
By Erin Moore & Megan Rodgers on
Posted in Data Privacy and Cybersecurity
Many California-based privacy claims have turned on the application of longstanding statutes to modern technologies, with courts frequently holding that certain online tracking technologies can qualify as impermissible trap-and-trace devices in violation of California Penal Code section 638.51, part of the California Invasion of Privacy Act (CIPA). A recent decision from the Central District of California, however, signals that these arguments will not always succeed.
Continue Reading Federal Court Rejects Claim that Cookies Are Illegal Trap and Trace Devices