privacy

In Shah v. Politico LLC, 5:25-cv-05213 (N.D. Cal. Sept. 25, 2026), the Court addressed plaintiffs’ attempts to invoke equitable tolling, delayed discovery, and fraudulent concealment to save untimely claims under the California Invasion of Privacy Act (“CIPA”).  

Defendant Politico LLC (“Politico”) had filed a motion to dismiss allegations…

Continue Reading N.D. Cal. Rejects Non-Specific Tolling Arguments in Shah v. Politico LLC

In Smith v. Rack Room Shoes, Inc., No. 24-cv-06709-RFL (N.D. Cal. Sept. 21, 2026), Plaintiffs sought class certification on claims under the California Invasion of Privacy Act, Cal. Penal Code §§ 631 and 632, and the Federal Wiretap Act, 18 U.S.C. § 2511(1)(a).  Plaintiffs asserted that Defendant Rack Room, an online shoe retailer, helped third-party pixel-tracking services intercept private communications containing personally identifiable information.  The Court found that Plaintiffs had no Article III standing, rejecting harm theories based on both actual and attempted interception of private information, and dismissed those claims without prejudice while denying class certification.

Continue Reading Pixel Tracking Technologies and Article III Standing: Lessons from the Rack Room Shoes Decision

In a recent decision challenging Google’s Gemini AI features, a California federal court held that allegations concerning an AI tool’s capabilities, without facts showing actual access or use of plaintiffs’ data, were insufficient to demonstrate the “concrete” harm required for Article III standing.  Thele v. Google LLC, 2026 WL…

Continue Reading Gemini Tracking Allegations Fall Short of Article III Standing

In a decision highlighting the importance of testing standing through discovery, a Florida federal court dismissed privacy claims at the class-certification stage after concluding that neither named plaintiff could establish Article III standing.  Although the plaintiffs’ allegations survived a motion to dismiss, discovery later exposed their “utter disregard” for the allegedly private information at issue, leaving them with nothing more than “a bare statutory violation.”  Cobbs v. PetMed Express, Inc., 2026 WL 2234135 (S.D. Fla. July 31, 2026).

Continue Reading Letting the Cat Out of the Bag: Named Plaintiffs’ Own Conduct Defeats Privacy Claims

In an effort to overcome hurdles to Article III standing, many website wiretapping suits today accuse businesses of unlawfully sharing sensitive health or financial data with third parties.  However, Federal Rule of Civil Procedure 11(b) requires plaintiffs’ lawyers to ensure that these “factual contentions” in a complaint “have evidentiary support.”  A California federal judge gave teeth to this requirement in a recent sanctions order, admonishing the plaintiff’s lawyers for “advancing unfounded and irrelevant allegations” about a business’s sharing of “health information.”  Mitchener v. Talkspace Network LLC, No. 2:24-CV-07067-JAK (BFMX), 2026 WL 84466, at *3-4 (C.D. Cal. Jan. 7, 2026).

Continue Reading Sanctions Order in Website Wiretapping Suit Reinforces Importance of Early Fact Investigation

Courts continue to grapple with the type of “concrete harm” that is required to confer Article III standing under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), particularly in data breach and privacy class actions.  On October 14, the Fourth Circuit contributed to this debate, holding that allegations that plaintiffs’ driver’s license data had been leaked and appeared on the dark web were sufficient to establish standing.

Holmes v. Elephant Ins. Co., — F.4th —, 2025 WL 2907615 (4th Cir. 2025), started with a 2022 data breach of Elephant Insurance Company’s networks.  Id. at *1.  Plaintiffs were Elephant customers whose driver’s license numbers were compromised in the breach.  Id.  They sued Elephant for alleged harms stemming from the breach.  Id. at *3.  Two plaintiffs specifically alleged that they had found their driver’s license numbers on the dark web; the others did not.  Id. at *2.  The district court dismissed plaintiffs’ claims, holding that none of the alleged injuries were sufficient to confer standing.  Id.  But the Fourth Circuit disagreed in part, reversing the lower court’s dismissal of the two plaintiffs who alleged that their driver’s license information appeared on the dark web, but affirming dismissal of the other two. 

Continue Reading Standing in the Dark:  Fourth Circuit Finds Standing for Driver’s License Information on the Dark Web

In Nicole Pileggi v. Washington Newspaper Publishing Company LLC, the D.C. Circuit unanimously affirmed the district court’s dismissal of a complaint alleging that news magazine and website Washington Examiner disclosed consumers’ personal information through a third-party pixel in violation of the Video Privacy Protection Act (“VPPA”). 

In 2023, Pileggi alleged that the Examiner’s use of a third-party pixel on its site gave the third party the ability to collect website visitors’ personal information, including IP addresses and titles of videos they had watched.  The District Court for the District of Columbia granted the Examiner’s motion to dismiss early last year, holding that Pileggi was not a “consumer” under the VPPA and that she failed to establish the requisite connection between her subscription to the Examiner’s newsletter and the video information allegedly disclosed.

Continue Reading D.C. Circuit Deepens Circuit Split on Interpretation of “Consumer” Under VPPA

Lawsuits targeting businesses’ use of website tools under the California Invasion of Privacy Act (“CIPA”) increasingly are filed by so-called “tester” plaintiffs.  These plaintiffs seek out websites to “test” for potential CIPA violations and then file lawsuits seeking damages for those alleged violations.  A California federal court recently confirmed that…

Continue Reading “Tester” Plaintiff Who “Actively Seeks Out Privacy Violations” Lacks Standing to Pursue CIPA Claim

Many businesses use customer support software that may include call recording features to help ensure a better customer service experience.  A California federal court dismissed a wiretapping lawsuit filed against a software company offering this software tool (TalkDesk), holding that TalkDesk’s alleged recording of customers’ conversations with clothing retailers “is simply not private or personal enough to confer [Article III] standing.”  See Lien, et al., v. Talkdesk, Inc., No. 24-CV-06467-VC, 2025 WL 551664 (N.D. Cal. Feb. 19, 2025).

Continue Reading Recording of Customer Service Call “Not Private or Personal Enough” to Confer Article III Standing

The Illinois Supreme Court recently ruled that the named plaintiff in a putative data breach class action lacked standing to pursue her claims given that her private personal information had not actually been misused by a third party.

Continue Reading Illinois Supreme Court Rules That Plaintiff Lacks Standing to Bring Putative Data Breach Class Action