UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

MICHAEL SELBY, et al., Case No. 25-cv-03139-RFL

Plaintiffs,

ORDER DENYING MOTION TO

v. TRANSFER AND GRANTING IN

PART AND DENYING IN PART

SOVRN HOLDINGS, INC., MOTION TO DISMISS

Defendant. Re: Dkt. No. 19

Plaintiffs bring this action on behalf of a putative class, alleging that Sovrn Holdings, Inc.’s software products “track[] in real time and record[] indefinitely the personal information and specific web activity of hundreds of millions of Americans.” (Dkt. No. 1 (“CAC”) ¶ 1.) They allege that Sovrn’s conduct constitutes intrusion upon seclusion under California law (Count 1); violates California Penal Code §§ 631(a) & 638.51(a) (Counts 2–3); constitutes unjust enrichment (Count 4); and violates the Electronic Communications Privacy Act (“ECPA”) (Count 5). Sovrn seeks dismissal or transfer of the case as improperly venued, or transfer for the convenience of the parties and witnesses, and in the interests of justice. (Dkt. No. 19 (“Motion”).) Alternatively, Sovrn seeks dismissal for failure to state a claim. (Id.) For the reasons explained below, the Motion is GRANTED IN PART AND DENIED IN PART. This order assumes the reader is familiar with the facts of the case, the applicable legal standards, and the arguments made by the parties. A. Improper Venue Motion Mandatory Dismissal or Transfer. 28 U.S.C. § 1391 provides that a “civil action may only be brought in (1) a judicial district in which any defendant resides, if all defendants are residents of the State in which the district is located; (2) a judicial district in which a substantial part of the events or omissions giving rise to the claim occurred . . . ; or (3) if there is no district in which an action may otherwise be brought as provided in this section, any judicial district in which any defendant is subject to the court’s personal jurisdiction with respect to such action.” 28 U.S.C. § 1391(b) (emphasis added). If none of these prongs are met, the Court must either dismiss or transfer the case. 28 U.S.C. § 1406(a) The parties agree that prongs one and three are inapplicable here. (Dkt. No. 19 at 13; Dkt. No. 21 at 8.)1 Sovrn argues that venue is also improper under prong two because the conduct giving rise to Plaintiffs’ claims—Sovrn’s alleged tracking of Plaintiffs’ web activity, primarily through the Lijit Pixel—occurred in Colorado, not California. (Dkt. No. 19 at 13.) Sovrn notes that “[t]he majority of Sovrn employees who developed or implemented the Lijit Pixel are located in Colorado and none are located in Northern California.” (Id.) But one of Plaintiffs’ central allegations is that Sovrn operates the Lijit Pixel, which allegedly installed tracking cookies onto Plaintiffs’ browsers while at least some of them were in this district, and proceeded to “track[]” them as they “navigated through [] website[s]” in this district. (See, e.g., CAC ¶¶ 55, 196–99.) Therefore, Plaintiffs have alleged a substantial part of Sovrn’s alleged misconduct occurred in California. Furthermore, even if Sovrn were correct that none of its acts occurred outside of Colorado, venue is still proper because at least some Plaintiffs were injured in this district. Myers v. Bennett Law Offices is instructive. In Myers, plaintiffs, residents of Nevada, filed suit in Nevada alleging that defendant, a Utah resident, ordered their credit report in violation of the Fair Credit Reporting Act. 238 F.3d 1068, 1075 (9th Cir. 2001). On the issue of venue, the Ninth Circuit reasoned that “at least one” of plaintiffs’ harms was “akin to the tort of invasion of privacy,” and that the harm was felt in Nevada. Id. at 1075–76. “Accordingly, a substantial part of the events giving rise to the claim occurred in Nevada. Thus, venue was proper.” Id. Here,

1 All citations to page numbers refer to ECF pagination. Plaintiffs assert a similar privacy claim, and allege that three of the Plaintiffs reside in this district and experienced harm associated with the invasion of their privacy in this district. (CAC ¶¶ 4, 7–8.) Therefore, venue is not improper. Discretionary Transfer. Sovrn argues, in the alternative, that the case should be transferred to Colorado under 28 U.S.C. 1404(a) for convenience of the parties and witnesses and in the interest of justice. (Dkt. No. 19 at 13–19.) In the Ninth Circuit, courts commonly consider the following factors when ruling on a motion to transfer under Section 1404(a): (1) plaintiff’s choice of forum, (2) convenience of the parties, (3) convenience of the witnesses, (4) ease of access to the evidence, (5) familiarity of each forum with the applicable law, (6) feasibility of consolidation of other claims, (7) any local interest in the controversy, and (8) the relative court congestion and time of trial in each forum. Barnes & Noble v. LSI Corp., 823 F. Supp. 2d 980, 993 (N.D. Cal. 2011). “The burden of showing that transfer is appropriate is on the moving party.” Williams v. Bowman, 157 F. Supp. 2d 1103, 1106 (N.D. Cal. 2001). “Transfer under § 1404(a) should not be freely granted.” Jernigan v. California Dep’t of Corr. & Rehab., No. 09-cv-5192-RS, 2011 WL 255798, at *2 (N.D. Cal. Jan. 24, 2011) (quotation omitted). The first factor, Plaintiffs’ choice of forum, weighs against transfer. Three of the Plaintiffs reside in this district, and the injury they allegedly experienced occurred, in a large part, in this district. See, e.g., Rafton v. Rydex Series Funds, No. 10-cv-1171-CRB, 2010 WL 2629579, at *2–4, (N.D. Cal. June 29, 2010). These facts are distinguishable from circumstances where named plaintiffs in a putative class action had no connection to the forum district, and the district lacked significant connections to the litigation. Id.; see also Lax v. Toyota Motor Corp., 65 F. Supp. 3d 772, 777–78 (N.D. Cal. 2014) (where one of several named plaintiffs resided in the forum and was injured in the forum, plaintiffs’ choice of forum weighed against transfer). The second and third factors, convenience of the parties and non-party witnesses, is neutral. Three Plaintiffs are located in the district, while Sovrn and “[m]ost of Sovrn’s employees . . . are in Colorado.” (Dkt. No. 19 at 15.) There is no evidence that the non-party witnesses, which are anticipated to be primarily the operators of the “Pixel Partners,” are in this district or in Colorado. (Id. at 15–16.) Although Sovrn raises the possibility that its Colorado- based former employees might be witnesses, Sovrn does not carry its burden to identify who those witnesses are or why their historical knowledge is necessary to the case. In sum, whether or not the case is transferred, this litigation will likely require the parties and non-party witnesses to travel. It is improper to transfer that burden from Sovrn to Plaintiffs. See SkyRiver Tech. Solutions, LLC v. OCLC Online Computer Library Ctr., Inc., No. 10-cv-03305-JSW, 2010 WL 4366127, at *3 (N.D. Cal. Oct. 28, 2010) (“the convenience of a litigant’s employee witnesses [is] entitled to little weight because litigants are able to compel their employees to testify at trial, regardless of forum”). The fourth factor, access to evidence, weighs slightly in favor of transfer, given the location of Sovrn’s headquarters in Colorado. However, “[m]odern technology— which enables the transmission of many documents over large distances in little time—often renders documents’ physical locations unimportant.” LRN Corp. v. RGA Reinsurance Co., No. 14-cv-05771, 2015 WL 13285086, at *4 (C.D. Cal. Jan. 20, 2015). Sovrn does not identify any reason why most discovery could not be exchanged electronically. Therefore, this factor is given minimal weight. The fifth and seventh factors weigh against transfer.2 Here, much of the alleged harm occurred in the district, and none is alleged to have occurred in Colorado. Furthermore, three of Plaintiffs’ claims are brought under California law. Although Colorado has an interest in curbing unlawful practices by Colorado businesses, California “has a countervailing interest in protecting local residents from [Sovrn’s] practices” by enforcing California law. Imran v. Vital Pharms., Inc., No. 18-cv-05758-JST, 2019 WL 1509180, at *6 (N.D. Cal. Apr. 5, 2019). This Court is also more likely to be familiar with California law than a federal court sitting in Colorado. As to the final factor, while Sovrn argues that Colorado courts are less congested, the difference is not stark, and this factor alone does not weigh heavily in favor of transfer.

2 Neither party has identified cases that might be consolidated with this one, so the six factor is neutral. Considering the weight given to Plaintiffs’ choice of forum, this district’s interest in protecting its residents, and the importance of familiarity with California law, Sovrn has not demonstrated that the balance of convenience and interest of justice factors clearly favor transfer. The motion to transfer is denied. B. Motion to Dismiss Under 12(b)(6) Plaintiffs Have Adequately Alleged an Injurious Privacy Invasion. Sovrn argues that the alleged data collection practices are not a “highly offensive” privacy intrusion, and do not inflict a cognizable injury under Cal. Penal Code § 637.2. (Dkt. No. 19 at 20–21.) Plaintiffs have alleged that Sovrn engages in unauthorized widespread tracking and data collection, allowing it to compile detailed profiles of each Plaintiff’s online web browsing activity— including highly sensitive browsing activity (CAC ¶¶ 233–36)—tied to their email address and other personal identifiers. The collected data allegedly includes “full-string URLs” that reflect Plaintiffs’ specific interactions with the websites at issue. (Id. ¶ 57.) In such circumstances, this Court and many others have found that the tort of intrusion upon seclusion, and an injury for purposes of CIPA, is adequately alleged at the pleadings stage. See Deivaprakash v. Conde Nast Digital, No. 25-cv-04021-RFL, 2025 WL 2541952, at *4 & n. 4 (N.D. Cal. Sept. 4, 2025); Riganian v. LiveRamp Holdings, Inc., No. 25-cv-00824-JST, 2025 WL 2021802, at *5–7 (N.D. Cal. July 18, 2025).3 CIPA Eavesdropping Claim and ECPA Claim. Sovrn argues that none of the information it allegedly collected from Plaintiffs is “contents” or “meaning of a communication” under CIPA or the ECPA. (Dkt. No. 19 at 21, 23.) However, Plaintiffs have alleged that, among other things, Sovrn collects “full-string URLs” that reflect not only the website visited, but also,

3 The scope of the alleged tracking in this case is materially more invasive than the limited tracking at issue in the Ninth Circuit’s recent decision in Popa v. Microsoft Corp., No. 24-14, 2025 WL 2448824 (9th Cir. Aug. 26, 2025). In Popa, the tracking of plaintiff’s non-sensitive interactions with a single website, www.petsuppliesplus.com, did not give rise to a cognizable Article III injury. Id. at *5–8. Here, Plaintiffs allege that Sovrn compiled detailed profiles by tracking their interactions across many websites, including websites where they disclosed sensitive data. for example, search queries and specific items Plaintiffs viewed. (See, e.g., CAC ¶¶ 111–113, 132, 168–69.) This information constitutes content of communications under CIPA and the ECPA. See Smith v. Rack Room Shoes, Inc., No. 24-cv-06709-RFL, 2025 WL 1085169, at *4 (N.D. Cal. Apr. 4, 2025); see also In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 605 (9th Cir. 2020) (explaining that full-string URLs can include “search terms inputted” and can “divulge a user’s personal interests [and] queries”). Plaintiffs have adequately alleged that the content of their communications was collected. Sovrn also argues that “Plaintiffs must provide more than conclusory allegations that messages were intercepted ‘during transmission in real time’” to plead a CIPA eavesdropping claim. (Dkt. No. 19 at 22.) But Plaintiffs allegations are not conclusory. The Complaint contains a detailed description of the pixel and related technology at issue, including screenshots of the source code. (CAC ¶¶ 39–40, 43, 57, 61, 67, 113, 287.) The Complaint adequately alleges that the interceptions occurred in transit. CIPA Pen Register Claim. Sovrn argues that pixels do not meet the definition of a “pen register” under the meaning of CIPA because they involve internet technology, not telephone lines. (Dkt. No. 23 at 14–15.) However, the Court has previously found that similar internet tracking technology qualifies as a pen register. See Shah v. Fandom, Inc., 754 F. Supp. 3d 924, 930 (N.D. Cal. 2024) (explaining that “CIPA was passed in part because ‘the development of new devices and techniques for the purpose of eavesdropping upon private communications . . . has created a serious threat to the free exercise of personal liberties’” and quoting Cal. Penal Code § 630). The reasoning in Shah is equally applicable here. Id. Sovrn’s motion to dismiss the Section 638.51(a) claim is denied. Unjust Enrichment Claim. Plaintiffs’ unjust enrichment claim must be dismissed, with leave to amend, because Plaintiffs have failed to allege that they lack an adequate remedy at law. See In re Apple Processor Litig., No. 22-16164, 2023 WL 5950622, at *2 (9th Cir. Sept. 13, 2023) (affirming dismissal of equitable claims where plaintiffs failed to explain “how the money they seek through restitution is any different than the money they seek as damages”). Nothing in the Complaint indicates that Plaintiffs’ legal remedies are insufficient. C. Conclusion For the reasons discussed above, Sovrn’s Motion to Transfer is DENIED. Its Motion to Dismiss is GRANTED with leave to amend as to the unjust enrichment claim, and DENIED as to all other claims. If Plaintiffs wish to file an amended complaint correcting the deficiencies identified above, counsel shall do so by November 6, 2025. The amended complaint may not add new claims or parties, or otherwise change the allegations except to correct the identified deficiencies, absent leave of the Court or stipulation by the parties pursuant to Federal Rule of Civil Procedure 15.

IT IS SO ORDERED.

Dated: October 16, 2025 ZA

RITA F. LIN

United States District Judge