1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 CHRISTINE WILEY, et al., Case No. 25-cv-03095-PCP

8 Plaintiffs,

ORDER DENYING IN PART,

9 v. GRANTING IN PART MOTION TO

DISMISS

10 UNIVERSAL MUSIC GROUP, INC., Re: Dkt. No. 21 Defendant. 11

12 In their class action complaint, plaintiffs Christine Wiley and Vishal Shah allege that 13 defendant Universal Music Group, Inc. (UMG) violated their privacy rights by placing certain 14 cookies on their devices even though they had expressly opted out of receiving such cookies. 15 UMG moves to dismiss plaintiffs’ lawsuit for failure to state a claim under Federal Rule of Civil 16 Procedure 12(b)(6). UMG also moves to strike several of plaintiffs’ allegations and their class 17 definition. For the reasons stated below, the Court grants in part and denies in part UMG’s motion 18 to dismiss and denies UMG’s motion to strike. 19 BACKGROUND 20 UMG is a music company that owns and operates websites where users can get 21 information about artists and merchandise.1 UMG’s websites place cookies—text files that 22 identify users to websites—on users’ browsing devices. Cookies allow websites to recognize 23 individual users because they are sent to a website’s server alongside requests for the website’s 24 content. Generally, a website may store third-party cookies on a user’s device, allowing the third- 25 party to track that user across different websites. Owners of websites can use cookies to analyze 26 users’ behavior, personalize information presented, target advertising, and integrate social media 27 1 functions. 2 UMG presented users a choice as to how they would be tracked while on UMG websites. 3 UMG’s privacy policy explains that its websites use cookies and that plaintiffs can “make certain 4 choices about cookies through the cookie choices tools … .” UMG’s popup cookie consent banner 5 told users that the sites use cookies for “Online Advertising” on both the site they visit and 6 “another site you may visit in the future.” UMG’s banner also said that the cookies it used for 7 “Performance and Analytics” were meant “to improve our site” and were “[n]ot used for online 8 advertising purposes or by third parties for their own use.” For California consumers, UMG’s 9 popup cookie consent banner gave users the option to change their “Cookie Choices” by opting 10 out of receiving “Online Advertising” and “Performance and Analytics” cookies, including by 11 clicking “Decline All.” In other words, UMG’s popup cookie consent banner told users that the 12 website they were visiting used cookies but appeared to give users some control over how they 13 would be tracked and how their personal data would be used. 14 Plaintiffs allege that, in reality, even if users clicked “Decline All” or opted out of either 15 “Online Advertising” or “Performance and Analytics” cookies, UMG’s websites nonetheless 16 placed third-party cookies on users’ devices and allowed third parties—including Meta Platforms, 17 Inc., Google LLC, ByteDance Ltd. (TikTok), Snap Inc. (SnapChat), and Appreciation Engine 18 Inc.—to use those cookies to track users’ online activities, including, plaintiffs allege, their “browsing history, visit history, website interactions, user input data, demographic information, 19 interests and preferences, shopping behaviors, device information, referring URLs, session 20 information, user identifiers, and/or geolocation data.” 21 Plaintiffs Christine Wiley and Vishal Shah are California residents who say UMG tracked 22 them despite their having expressly opted out of advertising and performance cookies. Wiley says 23 that “during the last four years” she visited arianagrande.com, icespicemusic.com, 24 universalmusic.com, nickiminajofficial.com, theweekend.com, and lilyachtyofficial.com. Wiley 25 says that she read UMG’s popup cookie consent banner and “Decline[d] All” advertising and 26 performance analytics cookies. UMG nonetheless enabled cookies and other tracking technology 27 1 Plaintiff Shah alleges largely the same facts, contending that he visited postmalone.com and 2 imaginedragonsmusic.com in the last four years “including[] in or around March 2024.” 3 Wiley and Shah bring suit on behalf of a class of similarly situated people, defining the 4 class as “[a]ll persons who browsed the Websites in the State of California after clicking the 5 ‘Cookie Choices’ link and declined cookies in the cookie consent preferences window within the 6 four years preceding the filing of this Complaint.” Plaintiffs bring claims against UMG for 7 invasion of privacy; intrusion upon seclusion; wiretapping in violation of the California Invasion 8 of Privacy Act (CIPA); use of a pen register in violation of CIPA; common law fraud, deceit, or 9 misrepresentation; unjust enrichment; breach of contract; breach of the implied covenant of good 10 faith and fair dealing; and trespass to chattels. Plaintiffs seek injunctive relief, damages, and fees. 11 UMG now moves to dismiss plaintiffs’ complaint for failure to state a claim under Rule 12(b)(6) 12 and moves to strike certain allegations, including plaintiffs’ class allegations. 13 LEGAL STANDARD 14 Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include a “short and plain 15 statement of the claim showing that the pleader is entitled to relief.” Federal Rule of Civil 16 Procedure 12(b)(6) allows a defendant to move to dismiss a complaint for failure to state a claim 17 upon which relief can be granted. Dismissal is required if the plaintiff fails to allege facts allowing 18 the Court to “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “Dismissal under Rule 12(b)(6) is 19 appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support 20 a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th 21 Cir. 2008). To survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a 22 claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). 23 In considering a Rule 12(b)(6) motion, the Court must “accept all factual allegations in the 24 complaint as true and construe the pleadings in the light most favorable” to the non-moving party. 25 Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029-30 (9th Cir. 2009). While legal 26 conclusions “can provide the [complaint’s] framework,” the Court will not assume they are correct 27 1 as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable 2 inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quoting Sprewell 3 v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)). 4 ANALYSIS 5 I. Motion to Dismiss 6 A. Statute of Limitations 7 Wiley alleges that she visited UMG websites “during the last four years” but alleges no 8 specific date on which she visited those websites. Because a portion of the alleged four-year 9 period falls outside the applicable statutes of limitations, UMG argues that Wiley’s invasion of 10 privacy, intrusion upon seclusion, wiretapping, and pen register claims are untimely.2 11 Because plaintiffs bring state law claims, California’s statutes of limitations apply. See 12 Nev. Power Co. v. Monsanto Co., 955 F.2d 1304, 1306 (9th Cir. 1992). The applicable statutes of 13 limitations range from two years for their invasion of privacy and intrusion upon seclusion claims, 14 Cal. Civ. Proc. Code § 335.1; Brown v. Google LLC, 525 F. Supp. 3d 1049, 1069 (N.D. Cal. 15 2021), to one year for their CIPA wiretapping and pen register claims, see Cal. Civ. Proc. Code 16 § 340; Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 134 (N.D. Cal. 2020). 17 The statute of limitations is “generally an affirmative defense rather than an element of the 18 plaintiff’s claim.” Turner v. Google LLC, 737 F. Supp. 3d 869, 877 (N.D. Cal. 2024). Affirmative defenses do not provide a basis for dismissal under Rule 12(b)(6) unless the plaintiff has pleaded 19 herself out of a claim by “admit[ing] all the ingredients of an impenetrable defense,” Durnford v. 20 MusclePharm Corp., 907 F.3d 595, 604 n.8 (9th Cir. 2018), meaning that the plaintiff’s pleaded 21 facts demonstrate no “potential factual dispute that could affect whether the defense applies,” 22 Rabin v. Google LLC, 725 F. Supp. 3d 1028, 1031 (N.D. Cal. Mar. 26, 2024). Where the 23 defendant moves to dismiss a claim as untimely under the applicable statute of limitations, the 24 motion can be granted “only when ‘the running of the statute is apparent on the face of the 25 complaint.’” Van Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 969 (9th Cir. 26 27 1 2010) (quoting Huynh v. Chase Manhattan Bank, 465 F.3d 992, 997 (9th Cir. 2006)). 2 Here, plaintiffs’ complaint does not admit the ingredients of an impenetrable statute of 3 limitations defense as to Wiley. “The face of the complaint,” Huynh, 465 F.3d at 997, alleges that 4 “Plaintiff Wiley visited the arianagrande.com, icespicemusic.com, universalmusic.com, 5 nickiminajofficial.com, theweekend.com, and lilyachtyofficial.com Websites to browse 6 information about music and related products on multiple occasions during the last four years.” 7 The “last four years” includes the past two years or one year, so it is entirely possible, from the 8 face of the complaint, that Wiley’s claims are timely. Therefore, plaintiffs have adequately alleged 9 that their claims are timely. 10 B. Invasion of Privacy & Intrusion upon Seclusion 11 UMG argues that plaintiffs have failed to adequately plead the substantive elements of 12 their causes of action for invasion of privacy and intrusion upon seclusion. Because both causes of 13 actions have similar elements, they are considered together. See In re Facebook, Inc. Internet 14 Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020). Both require plausibly alleging, first, that the 15 defendant intruded into a “place, conversation, or matter as to which the plaintiff had a reasonable 16 expectation of privacy” and, second, that the defendant’s intrusion was “highly offensive.” Id.; see 17 also Hammerling v. Google, 615 F. Supp. 3d 1069, 1088 (N.D. Cal. 2022). 18 Reasonable Expectation of Privacy UMG argues that plaintiffs’ allegations do not indicate that they had a reasonable 19 expectation of privacy in the specific browsing information allegedly shared with UMG’s 20 assistance. Whether one has a reasonable expectation of privacy is a mixed question of law and 21 fact, informed by “whether a defendant gained ‘unwanted access to data by electronic or other 22 covert means, in violation of the law or social norms.” See In re Facebook, 956 F.3d at 601–02 23 (quoting Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 286 (2009)). “To make this determination, 24 courts consider a variety of factors, including the customs, practices, and circumstances 25 surrounding a defendant’s particular activities.” Id. (citing Hill v. NCAA, 7 Cal. 4th 1, 36 (1994)). 26 In support of their privacy claims, plaintiffs allege that UMG told them that it would not 27 1 Shah thought that they were opting out of tracking that they allege UMG nevertheless facilitated. 2 Plaintiffs allege that the information UMG collected on them included “their browsing history, 3 visit history, website interactions, user input data, demographic information, interests and 4 preferences, shopping behaviors, device information, referring URLs, session information, user 5 identifiers, and/or geolocation data.” 6 UMG is correct that the information at issue, standing alone, may not involve the types of 7 information in which users have an unqualified expectation of privacy. But in this case UMG 8 allegedly represented to plaintiffs that it would not collect information for advertising or analytics 9 if they opted out of such collection. A reasonable visitor to UMG’s website who selected “Decline 10 All” would thus reasonably expect UMG not to install performance and analytics cookies on their 11 devices. Because UMG told users that they could opt out of such forms of information collection, 12 users of UMG’s website had a reasonable expectation of privacy with respect to that information. 13 UMG’s alleged affirmative misrepresentation distinguishes its actions from those in the 14 cases it cites. See, e.g., In re Zynga Priv. Litig., 750 F.3d 1098, 1108–09 (9th Cir. 2014); In re 15 Google Location Hist. Litig., 428 F. Supp. 3d 185, 198 (N.D. Cal. 2019); D’Angelo v. FCA US, 16 LLC, 726 F. Supp. 3d 1179, 1206 (S.D. Cal. 2024)). Those cases did not involve an affirmative 17 representation that the defendant would not engage in the information collecting at issue. For 18 example, in D’Angelo v. FCA, plaintiffs sued Dodge for not informing them that Dodge.com allowed Salesforce to intercept and analyze their chats. 726 F. Supp. 3d at 1187–88. In relevant 19 part, the district court held that the data allegedly collected—including “the user’s account name, 20 IP address, geographic location, and site the user previously visited”—were not “sensitive” 21 enough to “give rise to an invasion of privacy.” Id. at 1206. At the same time, the court found it 22 relevant that “Plaintiffs do not allege that Defendant set out an expectation that it would not collect 23 chat conversations….” Id. at 1205. In contrast here, UMG “set out an expectation that it would not 24 collect” plaintiffs’ information from advertising or analytics cookies. Id. D’Angelo and other cases 25 where the website owner did not “set out an expectation that it would not collect” information are 26 therefore inapposite. 27 1 plaintiffs Wiley and Shah had a reasonable expectation of privacy in the information that was 2 collected by cookies they had attempted to reject. As the California Attorney General’s website 3 explains, the CCPA requires that companies give users the choice to opt out of any collection of 4 personal information for “cross-context behavioral advertising, which is the targeting of 5 advertising to a consumer based on the consumer’s personal information obtained from the 6 consumer’s online activity across numerous websites.” California Consumer Privacy Act, Off. of 7 the Attorney General, State of California (Mar. 13, 2024), https://oag.ca.gov/privacy/ccpa. 8 When evaluating Californians’ reasonable privacy expectations, the CCPA’s provisions are 9 highly relevant “customs, practices, and circumstances,” In re Facebook, 956 F.3d at 602, because 10 they provide Californians with the reasonable expectation that they will have some control over 11 their data and necessarily shape users’ expectations about their ability to opt out of websites’ 12 collection of data for profit. Cases decided prior to the 2020 adoption of the CCPA are thus of 13 limited value in considering users’ reasonable post-enactment expectations. See, e.g., In re Zynga 14 Priv. Litig., 750 F.3d 1098; In re Google Location Hist. Litig., 428 F. Supp. 3d at 198; White v. 15 Soc. Sec. Admin., 111 F. Supp. 3d 1041 (N.D. Cal. 2015). Today, when California users visit a 16 website, they can expect to see a popup screen giving them the option to opt out of various types 17 of tracking. Because many of the cases UMG cites do not consider this changed circumstance, 18 they do not persuasively establish the absence of a reasonable expectation of privacy with respect to the forms of post-CCPA data collection at issue here. 19 Considering both UMG’s affirmative representation that users could disable the tracking at 20 issue here as well as the CCPA, the “customs, practices, and circumstances” surrounding 21 plaintiffs’ visits to UMG’s websites gave plaintiffs a reasonable expectation of privacy with 22 respect to the data whose collection UMG allegedly facilitated. In re Facebook, 956 F.3d at 602. 23 Highly Offensive 24 UMG separately argues that even if plaintiffs had a reasonable expectation of privacy, the 25 alleged data collection and dissemination were not “highly offensive.” Whether a particular 26 invasion or intrusion was “highly offensive” presents a mixed question of law and fact, see Hill, 7 27 1 questions of law and fact.”), and requires considering the “degree and setting of the intrusion” and 2 “the intruder’s motives and objectives,” Hernandez, 47 Cal. 4th at 295. The “ultimate question of 3 whether … tracking and collection practices could highly offend a reasonable individual is an 4 issue that [often] cannot be resolved at the pleading stage.” See In re Facebook, 956 F.3d at 606. 5 As a result, dismissal under Rule 12(b)(6) is appropriate only if the allegations “show no 6 reasonable expectation of privacy or an insubstantial impact on privacy interests.” Hill, 7 Cal. 4th 7 at 40. “[D]eceit can be a kind of ‘plus’ factor” in determining whether an action is highly 8 offensive. See In re Google Location Hist. Litig., 514 F. Supp. 3d 1147, 1157 (N.D. Cal. 2021) 9 (quoting Heeger v. Facebook, Inc., 2019 WL 7282477, at *4 (N.D. Cal. Dec. 27, 2019); 10 McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022, 1036 (N.D. Cal. 2019)). 11 Here, plaintiffs have pleaded that UMG affirmatively promised not to enable the tracking 12 of plaintiffs’ browsing behavior. Plaintiffs allege not only that they understood UMG to be 13 promising not to track them using performance or analytics cookies, but also that they “would not 14 have used the Websites” otherwise. UMG thus not only misled users into thinking that their opt 15 outs would be effective but led them to engage in tracked conduct they otherwise would not have 16 undertaken. Given that plaintiffs have alleged both an invasion of their reasonable expectations of 17 privacy and that this invasion was undertaken through deceptive conduct, plaintiffs have pleaded 18 facts sufficient to preclude the Court from concluding, as a matter of law, that UMG’s invasion was not “highly offensive.” 19 In arguing that enabling third-party data collection and disclosure was not “highly 20 offensive,” UMG relies on In re iPhone Application Litig., 844 F. Supp. 2d 1040 (N.D. Cal. 2012), 21 and Hammerling, 615 F. Supp. 3d 1060. But neither case involved a specific promise that users 22 would not be tracked in specific ways. See In re iPhone, 844 F. Supp. 2d at 1049–50; 23 Hammerling, 615 F. Supp. 3d at 1078–79. Likewise, although the court in Morilha v. Alphabet 24 Inc., 2024 WL 5205542 (N.D. Cal. Dec. 23, 2024), concluded that “disclosure of IP addresses and 25 geolocation data is not sufficiently ‘egregious’ to support an invasion of privacy claim,” id. at *4, 26 plaintiffs here allege that a broader set of data was collected and disseminated, including 27 1 interests and preferences, shopping behaviors, device information, referring URLs, session 2 information, user identifiers, and/or geolocation data.” Similarly, in Jones v. Tonal Sys., Inc., 751 3 F. Supp. 3d 1025 (S.D. Cal. 2024), the court dismissed plaintiff’s claim because she “only 4 allude[d] to the possibility that chat feature conversations could be ‘private and deeply personal’” 5 and cited an inapposite study. Id. at 1043–44. In contrast here, plaintiffs have identified specific 6 kinds of information that, in the aggregate and drawing all inferences in plaintiffs’ favor, plausibly 7 allege that their tracking and disclosure of the information at issue was “highly offensive.” 8 As UMG notes, the Ninth Circuit recently held in Popa v. Microsoft Corp., 153 F.4th 784 9 (9th Cir. 2025), that the plaintiff in that case had not established a concrete injury-in-fact for 10 Article III standing purposes stemming from Microsoft’s “session-replay technology,” which 11 enables businesses to track users’ browsing activity. The panel reasoned that the plaintiff had not 12 established “how the tracking of her interactions … caused her to experience any kind of harm that 13 is remotely similar to the ‘highly offensive’ interferences or disclosures that were actionable at 14 common law.” Id. at 791. The Ninth Circuit suggested that “the kind of harm and not the degree” 15 is relevant for determining whether an alleged injury-in-fact is concrete enough relative to a 16 “specific common-law tort.” Id. 17 Here, plaintiffs have adequately alleged a concrete injury-in-fact under Popa. The website 18 owner in Popa did not indicate to users that it would not track their activities. See id. at 786–87. In 19 contrast, UMG did. Wiley and Shah affirmatively opted out of advertising and analytics cookies, 20 and UMG disregarded those choices. In other words, UMG made a misrepresentation to users 21 about whether they would be tracked. UMG’s misrepresentations make the actions alleged here 22 sufficiently “highly offensive” for an invasion of privacy or intrusion upon seclusion claim at the 23 pleadings stage. The harm is similar to that addressed by the common law public-disclosure-of- 24 private-facts tort, which prohibits the “public disclosure … of a private fact, … which would be 25 offensive and objectionable to the reasonable person, and … which is not of legitimate public 26 concern.” Taus v. Loftus, 40 Cal. 4th 683, 717 (2007). Though the tort has traditionally required 27 that the private information be “publicized,” the specific inquiry into whether a disclosure is 1 Article III injury in fact. Indeed, the Restatement (Second) of Torts, which Popa cited 2 approvingly, see 153 F.4th at 791, explains that misrepresenting how private information will be 3 used can constitute an invasion of privacy, see Restatement (Second) of Torts, § 652D cmt. C, 4 illus. 11. Here, plaintiffs allege that UMG told them that their individual information would not be 5 shared because they could opt out of unnecessary cookies, and yet it was. Plaintiffs have therefore 6 sufficiently pleaded an injury-in-fact for purposes of Article III standing. 7 For the foregoing reasons, UMG’s motion to dismiss plaintiffs’ intrusion upon seclusion 8 and invasion of privacy claims is denied. 9 C. Wiretapping 10 California Penal Code § 631(a) prohibits: 11 1) “by means of any machine, instrument, or contrivance, or in any other manner, intentionally tap[ping] or mak[ing] any unauthorized connection … with any 12 telegraph or telephone wire, line, cable, or instrument” 13 2) “willfully and without the consent of all parties to the communication, or in any 14 unauthorized manner, read[ing], or attempt[ing] to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit” 15 3) “us[ing], or attempt[ing] to use, in any manner, or for any purpose, or to 16 communicate in any way, any information so obtained” and 17 4) “aid[ing], agree[ing] with, employ[ing], or conspir[ing] with any person or persons 18 to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above….” 19 20 UMG argues that plaintiffs have inadequately alleged a violation of Clause 2 21 because that provision applies only when a third party reads “the contents or meaning of 22 any message, report, or communication” and only when it is “in transit.” Further, UMG 23 argues that plaintiffs have failed to adequately plead a violation of Clauses 3 or 4 because 24 a violation of those clauses depends in this case on a violation of Clause 2.3 And UMG 25 argues that, even if plaintiffs have adequately pleaded that third parties violated CIPA, they 26 have not pleaded that UMG aided those third parties because they have not alleged the 27 1 requisite intent. 2 Clause 2 of California Penal Code Section 631(a) prohibits “willfully and without the 3 consent of all parties to the communication, or in any unauthorized manner, read[ing], or 4 attempt[ing] to read, or to learn the content or meaning of any message, report, or communication 5 while the same is in transit.” UMG argues that “contents” of communications were not intercepted 6 and that, assuming they were, they were not intercepted while those contents were “in transit.” 7 Interpreting a similar provision in the federal Electronic Communications Privacy Act of 8 1986, the Ninth Circuit has distinguished between the contents of a message—i.e., the “intended 9 message conveyed by the communication” including “any information concerning the substance, 10 purport, or meaning of a communication”—and “record information regarding the characteristics 11 of the message that is generated in the course of the communication.” In re Zynga Priv. Litig., 750 12 F.3d at 1106–07 (citing 18 U.S.C. §§ 2511(3)(a), 2702(a), 2510(8)). Whether a particular form of 13 information involves the “contents” of a communication as opposed to mere “record information,” 14 depends on context. See id. For example, “a user’s request to a search engine for specific 15 information could constitute a communication such that divulging a URL containing that search 16 term to a third party could amount to disclosure of the contents of a communication.” Id. at 1108– 17 09; see also Brown v. Google, 685 F. Supp. 3d 909, 936 (N.D. Cal. 2023) (holding that “full-string 18 detailed URLs” that indicate search queries can be “contents” under the Wiretap Act). 19 Plaintiffs allege that third parties intercepted users’ “affirmative decisions, actions, choices, preferences, and activities, … including their browsing history, visit history, website 20 interactions, user input data, demographic information, interests and preferences, shopping 21 behaviors, device information, referring URLs, session information, user identifiers and/or 22 geolocation data.” While many of these categories of information appear to involve record 23 information rather than the contents of users’ communications, the alleged tracking of “website 24 interactions,” “user input data,” “shopping behaviors,” and potentially “referring URLs” could 25 convey, among other things, what users were searching for or what they wanted to do on UMG’s 26 websites. Both types of information would likely entail queries or clicks from users and as a result 27 1 Recovery Ctr. LLC, 2025 WL 2971090, at *4 (N.D. Cal. Oct. 17, 2025) (concluding that data 2 suffices as content for the purposes of § 631 when it “conveys far more than basic identification 3 and address information”). 4 The problem with plaintiffs’ wiretapping claim, however, is that plaintiffs do not 5 specifically allege that their communications were intercepted by any third parties. Plaintiffs 6 repeatedly allege that UMG enabled third parties to track the information and communications of 7 “Website users.” But with respect to their own interactions with UMG’s websites, plaintiffs allege 8 only that they visited UMG’s websites and chose to “Decline All” advertising and analytics 9 cookies. They do not allege that, in interacting with UMG’s websites, they personally engaged in 10 any communications with the websites whose content could have been intercepted. Cf. Yoon v. 11 Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1077, 1083 (C.D. Cal. 2021); Heerde v. Learfield 12 Commc’ns, LLC, 741 F. Supp. 3d 849, 854–55, 861–62 (C.D. Cal. 2024); Brown v. Google LLC, 13 685 F. Supp. 3d at 936–39; St. Aubin v. Carbon Health Techs., Inc., 2024 WL 4369675, at *2 14 (N.D. Cal. Oct. 1, 2024); In re Google RTB Consumer Priv. Litig., 606 F. Supp. 3d 935, 949 (N.D. 15 Cal. 2022). In the absence of any allegation that plaintiffs themselves interacted with the websites 16 in a manner that involved communications whose contents could have been intercepted, they fail 17 to plead the elements of a valid wiretapping claim. That claim will therefore be dismissed with 18 leave to amend. D. Pen Register 19 California Penal Code § 638.51(a) prohibits “install[ing] or us[ing] a pen register” without 20 a court order under specific circumstances. Section 638.50(b) defines a “pen register” as “a device 21 or process that records or decodes dialing, routing, addressing, or signaling information 22 transmitted by an instrument or facility from which a wire or electronic communication is 23 transmitted, but not the contents of a communication.” 24 UMG first argues that California’s pen register law only applies to telephones. The text of 25 the statute, however, contains no such limitation. Section 638.50’s definition does not limit “pen 26 registers” to telephones, even though other sections of CIPA are expressly so limited. See 27 1 Cal. Penal Code §§ 631(a), 632.7). This is a strong indication that UMG’s proposed limitation 2 misconstrues the statute. 3 UMG’s construction is also inconsistent with the California Legislature’s purpose in 4 enacting CIPA. Given ambiguity in construing California state law, “California courts ‘determine 5 the Legislature’s intent so as to effectuate the law’s purpose.’” In re Meta Pixel Tax Filing Cases, 6 793 F. Supp. 3d 1147, 1153 (N.D. Cal. 2025) (quoting Skidgel v. Cal. Unemp. Ins. Appeals Bd., 12 7 Cal. 5th 1, 14 (2021)). The California Legislature enacted CIPA and prohibited pen registers to 8 “protect the right of privacy of the people of this state from what it perceived as a serious threat to 9 the free exercise of personal liberties that cannot be tolerated in a free and civilized society,” as the 10 California Supreme Court observed. Flanagan v. Flanagan, 27 Cal. 4th 766, 775 (2002) (cleaned 11 up). CIPA’s purpose of protecting individuals’ privacy would be ill-served by limiting Section 12 638.51 to telephones in the absence of a strong textual basis for that limitation. 13 In support of its argument that pen register claims only apply to telephones, UMG points 14 to different statutory text and to CIPA’s legislative history. UMG notes that section 638.52(d), 15 which establishes the required content of any judicial order permitting use of a pen register, 16 requires specifying the “number and, if known, physical location of the telephone line to which the 17 pen register … is to be attached….” Cal. Penal Code. § 638.52(d)(3). In UMG’s view, these 18 references to telephone line-specific features demonstrate that the entire pen register statute applies only to telephones. 19 This limited textual provision suggesting that pen registers generally involve telephones 20 cannot trump the express statutory definition of pen register, which is not so limited. To the 21 contrary, a fair reading of Section 638.52(d) would allow an officer seeking a judicial order for an 22 online pen register to provide the equivalent of a “number” for the online device. The broader, 23 more capacious definition of Section 638.50 applies to more devices than the later statutory 24 sections might envision. 25 The legislative history UMG cites also does not prove that pen register claims must 26 involve telephones. While specific portions of the legislative history show that members of 27 1 calls,” the language that it chose was not so limited. Again, if California sought to limit pen 2 register claims to telephones, it knew how to do so and in fact did so in other sections of the 3 statute. 4 UMG also argues that because California law prohibits pen registers that record 5 information “but not the contents of a communication,” the law cannot apply to devices that also 6 collect the contents of a communication. This Court recently considered that argument and 7 rejected it in In re Meta Pixel Tax Filing Cases, 793 F. Supp. 3d at 1152–55. UMG does not offer 8 any arguments that lead the Court to reach a different conclusion here. 9 For these reasons, plaintiffs have sufficiently pleaded that the cookies placed on certain 10 users’ devices could amount to an unauthorized pen register. Once again, however, the problem 11 with plaintiffs’ pen register claim is that they have not alleged that they ever communicated with 12 the website. In the absence of any allegation that they communicated with the websites, they 13 cannot allege that the “dialing, routing, addressing, or signaling information” relating to any such 14 communication was unlawfully tracked. 15 As with plaintiffs’ wiretapping claim, UMG’s motion to dismiss plaintiffs’ pen register 16 claim is granted with leave to amend. Should plaintiffs choose to amend this claim, they must 17 identify not only their communications with UMG’s websites but also the specific “dialing, 18 routing, addressing, or signaling information” for outgoing communications that was tracked. E. Common law fraud, deceit, or misrepresentation 19 UMG argues that plaintiffs’ common law fraud, deceit, or misrepresentation claim should 20 be dismissed because plaintiffs fail to plead with requisite specificity the manner in which they 21 were harmed by UMG’s allegedly fraudulent conduct. Common law fraud in California requires 22 “(a) misrepresentation (false representation, concealment, or nondisclosure); (b) knowledge of 23 falsity (or ‘scienter’); (c) intent to defraud, i.e., to induce reliance; (d) justifiable reliance; and (e) 24 resulting damage.” Kearns v. Ford Motor Co., 567 F.3d 1120, 1126 (9th Cir. 2009) (emphasis 25 removed). A state law fraud claim being pursued in federal court must also satisfy Federal Rule of 26 Civil Procedure 9(b)’s particularity requirement by pleading “the who, what, when, where, and 27 1 Rule 9(b) is to “provide defendants with adequate notice to allow them to defend the charge and 2 deter plaintiffs from the filing of complaints as a pretext for the discovery of unknown wrongs.” 3 Id. at 1125 (internal quotation marks omitted).4 4 Here, plaintiffs have inadequately pleaded the “when … of the misconduct alleged.” Id. at 5 1126. Plaintiffs allege only that they visited specific UMG websites at some unspecified point in 6 the last four years and that, despite opting out of some cookies, UMG “nonetheless caused cookies 7 and tracking technologies … to be placed on [plaintiffs’] device[s] and/or transmitted to the Third 8 Parties along with user data, without [plaintiffs’] knowledge.” This level of generality fails to 9 provide UMG with notice of the misconduct alleged. UMG cannot, for example, determine what 10 specific representations regarding cookies were made on UMG websites on the specific dates that 11 Shah and Wiley visited those websites or determine how the websites were using any cookies 12 placed on users’ devices on those specific dates. See, e.g., Kearns, 567 F.3d at 1126 (concluding 13 that the plaintiff had not satisfied Rule 9(b) when he failed to plead “when he was exposed to” the 14 television advertisements at issue or to “specify … when [an allegedly fraudulent] statement was 15 made”). Because plaintiffs’ allegations do not satisfy Rule 9(b), UMG’s motion to dismiss 16 plaintiffs’ common law fraud, deceit, or misrepresentation claim is granted with leave to amend. 17 F. Unjust enrichment 18 UMG argues that plaintiffs’ unjust enrichment claim fails because unjust enrichment is not a standalone cause of action, because such a remedy only applies in the absence of a contract 19 (which plaintiffs argue exists), and because there was no misrepresentation or omission. On each 20 of these arguments, UMG is incorrect. 21 First, while California does not have a standalone cause of action called “unjust 22 23 4 As UMG notes, if a party alleges a “unified course of fraudulent conduct and rel[ies] entirely on 24 that course of conduct as the basis” for their claim, the “pleading … as a whole must satisfy the particularity requirement of Rule 9(b).” Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir. 25 2009). Contrary to UMG’s argument, however, Rule 9(b) does not apply to plaintiffs’ “pleading as a whole.” Id. While plaintiffs’ suit is based in part on UMG’s allegedly false promise not to enable 26 third parties to track users, none of their claims other than their fraud claim rely “entirely” upon that course of conduct. Id. Instead, the other claims focus primarily on privacy-related harms 27 resulting from the information gathering that was enabled by the cookies placed on plaintiffs’ 1 enrichment,” “[w]hen a plaintiff alleges unjust enrichment, a court may construe the cause of 2 action as a quasi-contract claim seeking restitution.” Astiana v. Hain Celestial Grp., Inc., 783 F.3d 3 753, 762 (9th Cir. 2015) (cleaned up); see also Hartford Cas. Ins. Co. v. J.R. Mktg., L.L.C., 61 4 Cal. 4th 988, 998 (2015). 5 Second, though plaintiffs allege contractual claims, plaintiffs have not plausibly pleaded 6 the existence of a contract, for the reasons explained below. 7 And third, plaintiffs have plausibly pleaded the existence of a misrepresentation or 8 omission because plaintiffs allege that UMG’s “representations that consumers could ‘Decline 9 All’ or toggle off all ‘Online Advertising’ and ‘Performance Analytics’ cookies while Plaintiff 10 Shah and users browsed the Websites, or at least those involved in providing personalized content, 11 advertising, and analytics services, were untrue.” 12 A defendant who unjustly enriches itself “may be required to make restitution[.]” Hartford 13 Cas. Ins., 61 Cal. 4th at 998. “[T]he obligation arises when the enrichment obtained lacks any 14 adequate legal basis and thus ‘cannot conscientiously be retained.’” Id. (quoting Restatement (3d), 15 Restitution and Unjust Enrichment, § 1 cmt. B, p. 6). Plaintiffs have alleged that UMG misled 16 them as to the effect of opting out of certain cookies and that the resulting data collection was 17 valuable because it enabled UMG to better market artists, better target advertisements, and better 18 profit from its understanding of users’ behaviors. Because plaintiffs have thus adequately alleged a cause of action for unjust enrichment, UMG’s motion to dismiss that claim is denied. 19 G. Breach of Contract 20 UMG argues that plaintiffs’ breach of contract claim should be dismissed because 21 plaintiffs did not form a contract with UMG. All enforceable contracts require consideration, 22 which means “[a]ny benefit conferred, or agreed to be conferred, upon the promisor, by any other 23 person, to which the promisor is not lawfully entitled, or any prejudice suffered, or agreed to be 24 suffered, by such person other than such as he is at the time of consent lawfully bound to suffer,” 25 Cal. Civ. Code § 1605; see Godun v. JustAnswer LLC, 135 F.4th 699, 708 (9th Cir. 2025) 26 (“Because contract formation is a question of state law, we first look to the appropriate state 27 1 that a party must “confer (or agree to confer) a benefit or must suffer (or agree to suffer) 2 prejudice,” and, second, that the benefit or prejudice “must have induced the promisor’s promise.” 3 Steiner v. Thexton, 48 Cal. 4th 411, 420–21 (2010). 4 Plaintiffs have not adequately alleged the existence of a contract because they have not 5 pleaded that there was a bargained-for exchange. Plaintiffs argue that the benefit they conferred on 6 UMG was “surrender[ing] more data than they bargained for and that such data is valuable.” But 7 plaintiffs do not allege that they “bargained” for less tracking as opposed to having merely 8 indicated their preference for less tracking. To the contrary, plaintiffs received the same access to 9 UMG’s website whether or not they consented to additional cookies. While plaintiffs may have 10 alleged that UMG broke a promise, they have not alleged that the benefit plaintiffs conferred on 11 UMG induced UMG’s promise. Because plaintiffs have not adequately alleged that they formed a 12 contract with UMG, UMG’s motion to dismiss that claim is granted with leave to amend. 13 H. Breach of the Implied Covenant of Good Faith and Fair Dealing 14 The implied covenant of good faith and fair dealing exists in every contract and requires 15 “that no party to the contract will do anything that would deprive another party of the benefits of 16 the contract” and functions to “protect[] the reasonable expectations of the contracting parties 17 based on their mutual promises.” Digerati Holdings, LLC v. Young Money Ent., LLC, 194 Cal. 18 App. 4th 873, 885 (2011) (citing, among other cases, Wilson v. 21st Century Ins. Co., 42 Cal. 4th 713, 720 (2007), and Carma Developers (Cal.), Inc. v. Marathon Dev. Cal., Inc., 2 Cal. 4th 342, 19 373–74 (1992)). The implied covenant, however, applies only to existing contracts. See Guz v. 20 Bechtel Nat’l Inc., 24 Cal. 4th 317, 349–50 (2000). Because plaintiffs did not form a contract with 21 UMG, plaintiffs cannot plead a breach of the implied covenant of good faith and fair dealing. 22 UMG’s motion to dismiss the breach of the implied covenant of good faith and fair dealing is 23 therefore granted with leave to amend. 24

I. Trespass to Chattels

25 Finally, UMG argues that plaintiffs have failed to state a claim for trespass to chattels 26 because they have not plausibly alleged damage to their property. Under California law, a 27 1 interfere[] with plaintiff’s possessory interest,” and the trespass “proximately resulted in damage” 2 that “impaired the condition, quality, or value of the personal property.” Bui-Ford v. Tesla, Inc., 3 2024 WL 694485, at *7 (N.D. Cal. Feb. 20, 2024) (citing California state decisions). 4 Plaintiffs have failed to plausibly allege the second requirement—that UMG “impaired the 5 condition, quality, or value of [their] personal property.” Plaintiffs argue that the cookies impaired 6 their devices by damaging their security and “by taking up storage space.” In Intel Corp. v. 7 Hamidi, 30 Cal. 4th 1342 (2003), however, the California Supreme Court said that a trespass-to- 8 chattels plaintiff must “demonstrate some measurable loss from the use of [their] computer 9 system,” observing as relevant whether a defendant caused “any physical or functional harm or 10 disruption.” Id. at 1357, 1360. Here, plaintiffs have not plausibly alleged physical, functional, or 11 other “measurable loss” from the involuntary placement of cookies on their devices. UMG’s 12 motion to dismiss the trespass-to-chattels claim is therefore granted with leave to amend. 13 II. Motion to Strike 14 Federal Rule of Civil Procedure 12(f) allows striking “any redundant, immaterial, 15 impertinent, or scandalous matter.” Matter is “immaterial” if it “has no essential or important 16 relationship to the claim for relief or the defenses being pleaded” and is “impertinent” if it 17 “consists of statements that do not pertain, and are not necessary, to the issues in question.” 18 Fantasy, Inc. v. Fogerty, 984 F.2d 1524, 1527 (9th Cir. 1993) (quoting 5 Charles A. Wright & Arthur R. Miller, Fed. Prac. & Proc. § 1382, at 706–07, 711 (1990)), rev’d on other grounds, 510 19

U.S. 517 (1994).

20 UMG moves to strike certain screenshots plaintiff included in their complaint as well as 21 the multiple UMG websites they have listed. Those allegations, however, are not immaterial or 22 impertinent. The screenshots satisfy Rule 12(f) because, if properly authenticated, they show that 23 UMG continued to track users after users opted out of advertising or analytics cookies. The list of 24 websites identifies other UMG websites that may track users in similar ways because of UMG’s 25 actions. While UMG points out that plaintiffs do not say that the undated screenshots in question 26 are from plaintiffs’ own devices or experiences, the screenshots could later be verified as 27 1 an illustration of what happened when plaintiffs attempted to opt out of tracking. 2 UMG also argues that plaintiffs’ class allegations should be stricken because plaintiffs’ 3 || pleadings are inappropriately broad and untimely. Class allegations can be evaluated at the 4 || pleading stage, but their deficiencies should be “plain enough from the pleadings.” See Gen. Tel. 5 Co. of the Sw. v. Falcon, 457 U.S. 147, 160 (1982). UMG’s criticisms of plaintiffs’ class pleadings 6 and class definition are not so plain as to warrant striking them at this stage. UMG may raise its 7 arguments about plaintiffs’ proposed class definition at a later stage. 8 Accordingly, UMG’s motion to strike is denied in its entirety. 9 CONCLUSION 10 For the foregoing reasons, UMG’s motion to dismiss is denied in part and granted in part. 11 UMG’s motion to dismiss plaintiffs’ intrusion upon seclusion, invasion of privacy, and unjust a 12 enrichment claims is denied. UMG’s motion to dismiss plaintiffs’ CIPA wiretapping, CIPA pen 5 13 register, common law fraud, breach of contract, breach of the implied covenant of good faith and S 14 || fair dealing, and trespass to chattels claims is granted with leave to amend. Plaintiffs must file any 3 15 amended complaint within 28 days. Failure to file an amended complaint will result in the 16 || dismissal with prejudice of the claims dismissed in this order. UMG’s motion to strike is denied.

IT IS SO ORDERED.

5 1g || Dated: December 17, 2025 19 20 Maybe P. Casey Pitts 21 United States District Judge 22 23 24 25 26 27 28