UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

ARIEL GILLIGAN, et al., Case No. 25-cv-02873-RFL

Plaintiffs,

ORDER DENYING MOTION TO

v. STAY AND GRANTING IN PART

AND DENYING IN PART MOTION

EXPERIAN DATA CORPORATION, et TO DISMISS al., Re: Dkt. Nos. 26, 44 Defendants.

Plaintiffs bring this action on behalf of a putative class, alleging that Experian Data Corporation, Experian PLC, Experian Information Solutions, Inc., and Tapad, Inc. (together “Experian”), use Tapad pixels to “track[] in real time and record[] indefinitely the personal information and specific web activity” of Plaintiffs and putative class members. (Dkt. No. 1 (“CAC”) ¶ 1.) They allege that Experian’s conduct constitutes intrusion upon seclusion under California law (Count 1); violates provisions of the California Invasion of Privacy Act (“CIPA”), California Penal Code §§ 631(a) and 638.51(a) (Counts 2–3); constitutes unjust enrichment (Count 4); and violates the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2511 (Count 5). Experian seeks to stay this action pending resolution of certain arbitration proceedings. (Dkt. No. 44.) Alternatively, Experian seeks dismissal for failure to state a claim. (Dkt. No. 26.) For the reasons explained below, the Motion to Stay is DENIED, and the Motion to Dismiss is GRANTED IN PART AND DENIED IN PART. This order assumes the reader is familiar with the facts of the case, the applicable legal standards, and the arguments made by the parties. A. Motion to Stay It is “within a district court’s discretion whether to stay, for ‘considerations of economy and efficiency,’ an entire action, including issues not arbitrable, pending arbitration.” BrowserCam, Inc. v. Gomez, Inc., No. 08-cv-02959-WHA, 2009 WL 210513, at *3 (N.D. Cal. Jan. 27, 2009) (quoting United States ex rel. Newton v. Neumann Caribbean Int’l, Ltd., 750 F.2d 1422, 1427 (9th Cir. 1985)); see also Moses H. Cone Memorial Hosp. v. Mercury Constr. Corp., 460 U.S. 1, 20 n. 23 (1983) (“[I]t may be advisable to stay litigation among the non-arbitrating parties pending the outcome of the arbitration. That decision is one left to the district court . . . as a matter of its discretion to control its docket.”). “A district court’s inherent, discretionary power to control its proceedings should promote economy of time and effort for itself, for counsel, and for litigants.” Congdon v. Uber Techs., Inc., 226 F. Supp. 3d 983, 990 (N.D. Cal. 2016) (internal quotation marks and citation omitted). Staying this entire action pending arbitration of claims brought by the plaintiffs in Zhen v. Experian Data Corporation, No. 25-cv-00948-RFL (N.D. Cal. 2025), is not warranted. Experian has not shown that the resolution of the Zhen plaintiffs’ arbitrable claims on an individual basis would bind the Court in some way with respect to the non-arbitrable putative class claims asserted in this action. See Congdon, 226 F. Supp. 3d at 990–91. Regardless of the outcome of the arbitration, Plaintiffs’ claims will need to be litigated in this Court. Nor has Experian shown that proceeding with the non-arbitrable claims here would negatively impact the parallel arbitration. The Court finds a stay in this case would result in needless delay, with no discernible benefit, and would not promote efficiency. See id. at 991–92 (denying a motion to stay a case pending arbitration where there was no justification or benefit for delaying judicial resolution of non-arbitrable claims). Any discovery to be produced by Experian in the arbitration would likely be narrower, not broader, than the discovery already being produced in this putative class action involving similar claims and facts. In the unlikely event that the arbitrator orders Experian to submit to additional discovery not already at issue in this case, any such minimal prejudice to Experian is outweighed by the harm to Plaintiffs if they were required to delay their action to await the results of an arbitration to which they are not parties and by which they would not be bound. Therefore, the Court denies Experian’s request to stay this action pending completion of the Zhen plaintiffs’ arbitration proceedings. B. Motion to Dismiss Plaintiffs Have Adequately Alleged an Injurious Privacy Invasion. Experian argues that the alleged data collection practices at issue are not a “highly offensive” intrusion, that Plaintiffs lack a reasonable expectation of privacy in the information at issue, and that the remaining named Plaintiffs—Ariel Gilligan and Logan Mitchell —have not pled specific cognizable privacy injuries conferring Article III standing. (Dkt. No. 26-1 at 11–15.)1 Plaintiffs have adequately alleged an injury and an intrusion upon seclusion claim. Plaintiffs allege that Experian engages in unauthorized widespread tracking and data collection, allowing it to compile detailed profiles of each Plaintiff’s online web browsing activity tied to their email address and other personal identifiers, and that Experian continues to track “future web browsing activity across the internet.” (CAC ¶¶ 59–120, 258, 280.) Allegedly, “Tapad collected information on 1% of all web traffic . . . in July 2024 alone.” (Id. ¶ 60.) The collected data allegedly includes information regarding users’ activity on websites and communications with websites in the form of full-string URLs and button click events. (Id. ¶ 67.) At the pleading stage, such allegations satisfy the requirement for a “highly offensive” intrusion that invades reasonable internet users’ expectations of privacy. See, e.g., Katz-Lacabe v. Oracle Am., Inc., 668 F. Supp. 3d 928, 940, 942 (N.D. Cal. 2023) (finding that allegations that defendant collected a “vast repository of personal data,” including on plaintiffs, sufficient to plead standing and an intrusion upon seclusion claim); In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 606 (9th Cir. 2020) (“The ultimate question of whether Facebook’s tracking and collection practices could highly offend a reasonable individual is an issue that cannot be

1 All citations to page numbers refer to ECF pagination. resolved at the pleading stage.”). Gilligan and Mitchell have adequately alleged that they were subject to these profile- building practices. They each allegedly visited websites that load Tapad pixels (Buzzfeed and Bon Appetit, respectively) and “navigated through” and “read” articles on those websites, and as a result, their activity on the “webpages [they] visited” and future web browsing activity “across the internet” is now being tracked. (CAC ¶¶ 251–58, 273–280.) That is sufficient to plead an injury conferring Article III standing and to state a claim for intrusion upon seclusion. See Katz- Lacabe, 668 F. Supp. 3d at 92; Deivaprakash v. Conde Nast Digital, No. 25-cv-04021-RFL, 2025 WL 2541952, at *4 n. 4 (N.D. Cal. Sept. 4, 2025). The scope of the alleged tracking in this case is materially more invasive than the limited tracking at issue in the Ninth Circuit’s recent decision in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). In Popa, the tracking of plaintiff’s non-sensitive interactions with a single website, www.petsuppliesplus.com, did not give rise to a cognizable Article III injury. Id. at 786, 791–94. Here, Plaintiffs allege that Experian compiled detailed profiles by tracking their interactions across many websites, and that the tracking “across the internet” remains ongoing. Furthermore, while Experian cites Phillips v. U.S. Customs & Border Prot., 74 F.4th 986 (9th Cir. 2023), the Ninth Circuit found a lack of concrete injury there because the plaintiffs had alleged only that the government had retained illegally obtained records, without further disclosing them. See id. at 992. Here, the allegation is that Experian developed extensive profiles that were disclosed on a large scale and sold commercially. Finally, Experian argues that California law expressly permits businesses to collect, track, and sell the data of internet users to third parties so long as they comply with the California Consumer Privacy Act (“CCPA”). (Dkt. No. 26-1 at 14–15 (citing Cal. Civ. Code §§ 1798.12, 1798.99.80(c).) But the CCPA does not authorize a party to intercept communications without the communicator’s knowledge or consent, and therefore does not preclude the asserted causes of action. See Deivaprakash, 798 F. Supp. 3d at 1106. Plaintiffs have adequately alleged that they have Article III standing and have stated a claim for intrusion upon seclusion. CIPA and ECPA Wiretap Claims. Experian argues that none of the information it allegedly collected from Plaintiffs is “contents” of communications under CIPA or the ECPA. (Dkt. No. 26-1 at 15–17.) However, Plaintiffs have alleged that Experian, working with partner pixels, intercepts “full-string URLs” that reflect not only the website visited, but also, for example, search queries or specific pages Plaintiffs viewed. (See, e.g., CAC ¶¶ 66–67, 152–59, 166–173.) This information constitutes contents of communications under CIPA and the ECPA. See Selby v. Sovrn Holdings, Inc., No. 25-cv-03139-RFL, 2025 WL 2950164, at *3 (N.D. Cal. Oct. 17, 2025); see also In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 605 (explaining that full-string URLs can include “search terms inputted” and can “divulge a user’s personal interests [and] queries”). Plaintiffs have adequately alleged that the contents of their communications were collected. Experian also argues that Plaintiffs fail to plausibly allege that Experian “intercepted” and “read, attempted to read, or to learn the contents of” any of their communications in transit. (Dkt. No. 26-1 at 17.) But the Complaint contains a detailed description of the pixel and related technology at issue, including screenshots of the source code. (CAC ¶¶ 59–68, 151–179.) The Complaint adequately alleges that these interceptions occur in transit, at the time the user selects a particular article or link on the Buzzfeed and Bon Appetit websites. (Id. ¶¶ 155, 169.) Furthermore, the Complaint adequately alleges that Experian read and learned the content at issue. There are no allegations in the Complaint suggesting that the intercepted communications are “hashed and indecipherable,” as Experian contends in its opposition brief. See Smith v. Rack Room Shoes, Inc., No. 24-cv-06709-RFL, 2025 WL 1085169, at *4 n. 5 (N.D. Cal. Apr. 4, 2025). To the contrary, Experian is alleged to have used the content for profiles about the users visiting the websites, and to have provided that information in real-time to permit active bidding on advertising space on those websites during the user’s visits. (CAC ¶¶ 151–179.) Finally, Experian argues that the host websites consented to the alleged interception, and the ECPA’s crime-tort exception is inapplicable because Experian’s “primary motivation was to make money, not to injure plaintiffs tortiously.” (Dkt. No. 26-1 at 18–19) (citation omitted). But being primarily motivated to make money does not preclude application of the crime-tort exception, which is adequately alleged to apply here. See R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 901–02 (C.D. Cal. 2024) (collecting cases); Smith v. Rack Room Shoes, Inc., No. 24-cv- 06709-RFL, 2025 WL 2210002, at *5 (N.D. Cal. Aug. 4, 2025) (explaining that “the crime-tort exception applies when a party uses intercepted communications to blackmail someone, even if the primary motivation for engaging in blackmail is to make money”). Furthermore, the disclosure and use of Plaintiffs’ information for advertising can plausibly constitute an independent invasion of privacy beyond the act of intercepting the information alone, satisfying the crime-tort exception. Id. Plaintiffs’ wiretap claims will not be dismissed. CIPA Pen Register Claim. Experian argues that Plaintiffs lack a private right of action to bring their pen register claim. (Dkt. No. 26-1 at 18–20.) But California Penal Code section “637.2 expressly states that all CIPA violations, including [section] 638.51 [violations], confer a private right of action.” Moody v. C2 Educ. Sys. Inc, 742 F. Supp. 3d 1072, 1078 (C.D. Cal. 2024). There is no basis to disregard the plain meaning of the statute. Next, Experian argues that the Tapad pixels do not meet the definition of a “pen register” under the meaning of CIPA because they involve internet technology, not telephone lines. (Dkt. No. 26-1 at 20–21.) This Court previously found that similar internet tracking technology qualifies as a pen register. See Shah v. Fandom, Inc., 754 F. Supp. 3d 924, 931 (N.D. Cal. 2024) (explaining that “CIPA was passed in part because ‘the development of new devices and techniques for the purpose of eavesdropping upon private communications . . . has created a serious threat to the free exercise of personal liberties’” (quoting Cal. Penal Code § 630)). The reasoning in Shah is equally applicable here. Furthermore, the rule of lenity is inapplicable because there is no ambiguity—“let alone ambiguities that cannot practicably be resolved in a convincing manner”—in the text of sections 637.2 and 638.51. See Deivaprakash, 798 F. Supp. 3d at 1108. Finally, Experian argues that the conduct alleged is exempt because section 638.50 excludes from the meaning of a pen register a “process used by a provider or customer of [an] . . . electronic communication service for . . . communications service provided by such provider . . . or other similar services in the ordinary course of business.’” (Dkt. No. 36 at 14 (quoting Cal. Pen. Code, § 638.50(b)) (emphasis added by Experian).) Experian has waived this argument, which was raised for the first time on reply. Graves v. Arpaio, 623 F.3d 1043, 1048 (9th Cir. 2010). In any event, the allegations in the Complaint are insufficient to determine, as a matter of law, that the exception is applicable. Nothing in the Complaint suggests that the third- party websites use the Tapad pixels to provide communications service or the like, or that Experian itself uses the Tapad pixels’ interceptions to provide communications services or the like, “in the ordinary course of business.” As such, the pen register claim cannot be dismissed based on this exception. Unjust Enrichment Claim. Plaintiffs’ unjust enrichment claim must be dismissed, with leave to amend, because Plaintiffs have failed to allege that they lack an adequate remedy at law. See In re Apple Processor Litig., No. 22-16164, 2023 WL 5950622, at *2 (9th Cir. Sept. 13, 2023) (affirming dismissal of equitable claims where plaintiffs failed to explain “how the money they seek through restitution is any different than the money they seek as damages”). Nothing in the Complaint indicates that Plaintiffs’ legal remedies are insufficient. C. Conclusion For the reasons discussed above, Experian’s Motion to Stay is DENIED. Its Motion to Dismiss is GRANTED with leave to amend as to the unjust enrichment claim, and DENIED as to all other claims. If Plaintiffs wish to file an amended complaint correcting the deficiencies identified above, counsel shall do so by January 27, 2026. The amended complaint may not add new claims or parties, or otherwise change the allegations except to correct the identified deficiencies, absent leave of the Court or stipulation by the parties pursuant to Federal Rule of Civil Procedure 15.

IT IS SO ORDERED.

Dated: January 6, 2026 ZZ

RITA F. LIN

United States District Judge