Bradshaw

1

2

3

4

5

6

7

8 UNITED STATES DISTRICT COURT

9 SOUTHERN DISTRICT OF CALIFORNIA

10 Case No.: 25cv0742 DMS (MMP)

JUSTIN BRADSHAW, and GUSTAVO

11 LOPEZ, individual and on behalf of all

ORDER DENYING DEFENDANT’S

others similarly situated,

12 MOTION TO DISMISS

Plaintiffs,

13

v.

14

LOWE’S HOME CENTERS, LLC, a

15 North Carolina limited liability company,

16 Defendant.

17

18

19 This case comes before the Court on the motion to dismiss filed by Defendant

20 Lowe’s Home Centers, LLC. Plaintiffs filed an opposition to the motion, and Defendant

21 filed a reply. The motion came on for hearing on August 18, 2026. Michael Blatchley

22 appeared for Plaintiffs, and Kamran Ahmadian appeared for Defendant. After reviewing

23 the parties’ briefs, the record, the relevant legal authority, and hearing argument from

24 counsel, the Court denies Defendant’s motion.

25 I.

26 BACKGROUND

27 This case originated in this Court on March 31, 2025, under the Class Action

28 Fairness Act (CAFA). Named Plaintiffs are Justin Bradshaw and Gustavo Lopez, both

1 California residents who visited Defendant Lowe’s website during the relevant time period.

2 In the original complaint, Plaintiffs named both Lowe’s Home Centers, LLC and Lowe’s

3 Companies, Inc. as defendants. (ECF No. 1.) Plaintiffs alleged Defendants violated Section

4 638.51 of the California Invasion of Privacy Act (CIPA) by secretly installing various

5 trackers, including TikTok Pixel and Microsoft Bing (“Trackers”), on users’ internet

6 browsers. They alleged these Trackers collected users’ IP addresses, unique identifiers,

7 and browsing information, and then shared the information with TikTok and Microsoft

8 without users’ consent.

9 After meeting and conferring with this Court, Plaintiffs filed a First Amended

10 Complaint on June 10, 2025. (ECF No. 14.) Defendants then filed a Motion to Dismiss for

11 lack of personal jurisdiction, lack of Article III standing, and failure to state a claim. (ECF

12 No. 17.) This Court denied Defendants’ motion to dismiss for failure to state a claim but

13 granted Defendants’ motion to dismiss for lack of personal jurisdiction and lack of Article

14 III standing. (ECF No. 39.) On the standing issue, this Court found Plaintiffs had not

15 shown that unique identifiers, device information, and browsing information fit within the

16 scope of Section 638.50(b). This left only Plaintiffs’ claim concerning the capture of their

17 IP addresses. Case law supported that Plaintiffs had no reasonable expectation of privacy

18 in their IP addresses. Therefore, the Court found Plaintiffs had failed to plead the requisite

19 injury for Article III standing.

20 The Court granted Plaintiffs leave to amend their Complaint to address this pleading

21 deficiency, and in accordance therewith, Plaintiffs filed a Second Amended Complaint

22 (SAC) on November 19, 2025. In their SAC, Plaintiffs removed Lowe’s Companies, Inc.

23 as a defendant, leaving Lowe’s Home Centers, LLC as the singular remaining defendant.

24 Plaintiffs expanded their SAC to include allegations that Defendant tracked their online

25 behavior not only while they were on Defendant’s website, but also after they left

26 Defendant’s website and began to browse the internet. They allege that the data from

27 Trackers on Defendant’s website allows TikTok and Microsoft to create “cradle-to-grave”

28 profiles, including information about who visitors were, what visitors were doing and why,

1 where a user was when they visited the website, and how a user made their way to

2 Defendant’s website. They further allege that Defendant collects the “full destination

3 URL” of the page requested on Defendant’s website. They allege Defendant then

4 leveraged this data for targeted advertising.

5 Plaintiffs also added information regarding the value and sensitivity of their data and

6 Plaintiffs’ use of the Lowe’s website. Furthermore, to satisfy Article III standing

7 requirements, Plaintiffs analogize the harm they suffered to an intrusion upon seclusion

8 claim, pleading that they had both a reasonable expectation of privacy in the data collected

9 and that Defendant’s use of the Trackers was highly offensive. Lastly, they argue

10 Defendant’s use of the Trackers caused Plaintiffs to suffer a concrete economic injury by

11 misappropriating Plaintiffs’ data without compensation and through unjust enrichment.

12 In the present motion, Defendant moves to dismiss the case for lack of Article III

13 standing. Specifically, Defendant argues Plaintiffs have failed again to plead they suffered

14 an Article III injury.

15 II.

16 LEGAL STANDARD

17 Federal Rule of Civil Procedure 12(b)(1) permits challenges to federal courts’

18 subject matter jurisdiction, including for lack of Article III standing. Fed. R. Civ. P.

19 12(b)(1). Federal courts are of limited jurisdiction, “[possessing] only that power

20 authorized by Constitution and statute, which is not to be expanded by judicial decree.”

21 Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994) (citations omitted).

22 Among the limits on that jurisdiction is the requirement of Article III standing. See Bender

23 v. Williamsport Area Sch. Dist., 475 U.S. 534, 531–42 (1986). “[T]he irreducible

24 constitutional minimum of standing” requires plaintiff to prove (1) injury in fact, which

25 must be (a) concrete and particularized, and (b) actual or imminent; (2) a causal connection

26 between the injury and defendant’s conduct; and (3) that the injury is likely to be redressed

27 by a favorable decision. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992).

28 Where these requirements are not met, “a federal court without jurisdiction over certain

1 claims has no choice but to dismiss them regardless of their gravity or potential validity.”

2 Fed. Election Comm’n v. Adams, 558 F. Supp. 2d 982, 986 (C.D. Cal. 2008). “The party

3 asserting federal subject matter jurisdiction bears the burden of proving its existence.”

4 Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir. 2010).

5 III.

6 DISCUSSION

7 Defendant’s first argument is that Plaintiffs fail to allege facts about their own visits

8 to the website, and that Plaintiffs’ allegations are hypothetical and conclusory. (Mot. to

9 Dismiss 8–9.) In both their Motion to Dismiss and oral argument, Defendant argued that

10 Plaintiffs’ allegations lack specificity and require additional details about which pages on

11 Defendant’s website they accessed and which sensitive products they viewed. Defendant

12 likened Plaintiffs here to the plaintiff in Popa v. Microsoft Corporation, who did not

13 identify any “embarrassing, invasive, or otherwise private information collected” by

14 trackers. 153 F.4th 784, 791 (9th Cir. 2025).

15 However, unlike the plaintiff in Popa, Plaintiffs here allege that their browsing

16 information could reveal “sensitive demographic data” and “users’ financial and

17 socioeconomic statuses.” (SAC §§ 10, 97.) Popa specifically considers disclosure of

18 financial information as sensitive private information. Popa, 153 F.4th at 791 (finding a

19 privacy interest in “sensitive medical or financial information”). Furthermore, Plaintiffs

20 include a section within their SAC that addresses Plaintiffs’ experiences with the website.

21 (SAC §§ 82–87.) At the pleading stage, without the benefit of discovery, Plaintiffs are not

22 required to provide the depth of detail that Defendant demands. See Leite v. Crane Co.,

23 749 F.3d 1117, 1121 (9th Cir. 2014) (requiring courts to draw all reasonable inferences in

24 favor of plaintiffs when considering a motion to dismiss for lack of Article III standing).

25 This Court finds Plaintiffs’ allegations are sufficiently concrete and specific as not to be

26 merely “conjectural” or “hypothetical.” See Lujan, 504 U.S. at 560.

27 Second, Defendant argues Plaintiffs have failed both pleading elements of an

28 intrusion upon seclusion claim. (Mot. to Dismiss 15–18.) The substantive elements of an

1 intrusion upon seclusion claim are that the defendant intruded into a “place, conversation,

2 or matter as to which the plaintiff has a reasonable expectation of privacy” and second, that

3 the defendant’s intrusion was “highly offensive.” See In re Facebook Internet Tracking

4 Litig., 956 F.3d 589, 601 (9th Cir. 2020).

5 Defendant argues Plaintiffs have no reasonable expectation of privacy in the

6 information allegedly collected. They argue the website does not handle particularly

7 sensitive data, and Plaintiffs have failed to identify any personal information captured by

8 the Trackers. They also argue the SAC asserts website tracking is ubiquitous and,

9 therefore, internet users have a diminished expectation of privacy in information collected

10 and shared by third parties. Plaintiffs argue courts have consistently found a reasonable

11 expectation of privacy in the kind of “detailed URLs” and browsing history that Plaintiffs

12 allege were collected. (Opp’n 13–14.) Additionally, they argue their expectation of privacy

13 was shaped by Defendants’ Privacy Statement, which allegedly stated it would share

14 information with third parties only “with [visitor’s] consent.” (Id. 14–15.)

15 Whether one has a reasonable expectation of privacy is a mixed question of law and

16 fact, informed by “whether a defendant gained ‘unwanted access to data by electronic or

17 other covert means, in violation of the law or social norms.” See Facebook Internet

18 Tracking, 956 F.3d at 603. As stated in the Court’s previous order, there is no reasonable

19 expectation of privacy in one’s IP address. However, courts in this Circuit have

20 consistently found a reasonable expectation of privacy in cases where browsing history is

21 collected surreptitiously and used to create extensive consumer profiles. See id. (“[T]he

22 allegations that Facebook allegedly compiled highly personalized profiles from sensitive

23 browsing histories and habits prevent us from concluding that the Plaintiffs have no

24 reasonable expectation of privacy.”); Griffith v. TikTok, Inc., 697 F. Supp. 3d 963, 972

25 (C.D. Cal. 2023) (same); Katz-Lacabe v. Oracle Am., Inc., 668 F. Supp. 3d 928, 942 (N.D.

26 Cal. 2023) (same); Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1089 (N.D. Cal.

27 2022) (same). Therefore, Plaintiffs have adequately alleged a reasonable expectation of

28 privacy in their browsing data.

1 Defendant also argues their conduct was not highly offensive. They cite case law

2 supporting their argument that collecting IP addresses, zip codes, device identifiers, and

3 general browsing information on a public, unauthenticated website is not highly offensive.

4 Plaintiffs argue the highly offensive prong is satisfied by Defendant’s surreptitious

5 collection of their data and that the collected data allowed third parties to associate

6 Plaintiffs’ browsing habits with their identity. (Opp’n 17–18.)

7 Determining whether a defendant's actions were “highly offensive to a reasonable

8 person” requires a “holistic consideration of factors such as the likelihood of serious harm

9 to the victim, the degree and setting of the intrusion, the intruder's motives and objectives,

10 and whether countervailing interests or social norms render the intrusion inoffensive.”

11 Facebook Internet Tracking, 956 F.3d at 606 (citation omitted). At the pleading stage,

12 some courts have been reluctant to conclude that conduct was “highly offensive.” Briskin

13 v. Shopify, Inc., No. 21-cv-06269-PJH, 2026 WL 161441, at *8 (N.D. Cal. Jan. 21, 2026);

14 see Facebook Internet Tracking, 956 F.3d at 606 (“The ultimate question of whether

15 Facebook’s tracking and collection practices could highly offend a reasonable individual

16 is an issue that cannot be resolved at the pleading stage.”). However, other courts have

17 found, as a matter of law, that certain data-sharing practices constitute highly offensive

18 conduct because of the data's sensitive nature or because the defendant engaged in “secret

19 or deceptive data collection.” See In re Ambry Genetics Data Breach Litig., 567 F. Supp.

20 3d 1130, 1143 (C.D. Cal. 2021); Hubbard v. Google LLC, No. 19-cv-07016-SVK, 2024

21 WL 3302066, at *7 (N.D. Cal. July 1, 2024); Tsering v. Meta Platforms, Inc., No. 25-cv-

22 01611-RFL, 2026 WL 89320, at *7 (N.D. Cal. Jan. 12, 2026).

23 Here, Plaintiffs allege the Privacy Statement represented it would only share

24 personal information with third parties “with [users’] consent,” and Plaintiffs never

25 consented. (SAC ¶ 94.) They further allege that, after Plaintiffs filed this lawsuit,

26 Defendant amended their Privacy Statement “to strike the provision promising to secure

27 consent. . . in effect conceding that their prior actions were done in violation of their own

28 policy.” (Id. ¶ 100.) Therefore, this Court declines to find that Defendant’s data collection

1 was not highly offensive as a matter of law. See Brown v. Google LLC, 685 F. Supp. 3d

2 909, 941 (N.D. Cal. 2023). Accordingly, Plaintiffs have adequately alleged the elements

3 of an intrusion upon seclusion claim.

4 Finally, Defendant argues Plaintiffs have not suffered monetary harm. (Mot. to

5 Dismiss 18.) They argue the SAC omits factual allegations, such as the potential monetary

6 value of each type of information collected, how Defendant’s collection diminished the

7 value, and Plaintiffs’ intention to sell the data. They also argue the ubiquitous nature of

8 website tracking undermines the claim of financial harm. Plaintiffs argue California law

9 requires disgorgement of unjustly earned profits regardless of whether a plaintiff expended

10 their financial resources. (Opp’n 22.) Additionally, Plaintiffs argue Defendant deprived

11 Plaintiffs of their right to exclude, the benefit of their bargain, and the right to control their

12 personal information.

13 The Ninth Circuit has established that

14 California law requires disgorgement of unjustly earned profits regardless of

whether a defendant’s actions caused a plaintiff to expend his or her own

15

financial resources directly or whether a defendant’s actions directly caused

16 the plaintiff’s property to become less valuable. . . this stake in unjustly earned

profits exists regardless of whether an individual planned to sell his or her data

17

or whether the individual’s data is made less valuable.

18

19 Facebook Internet Tracking, 956 F.3d at 600. Therefore, Plaintiffs have adequately

20 pleaded monetary harm sufficient to satisfy Article III.

21 / / /

22 / / /

23 / / /

24 / / /

25 / / /

26 / / /

27 / / /

28 / / /

1 IV.

2 CONCLUSION

3 For the reasons set out above, the Court denies Defendant’s motion to dismiss the

4 || case for lack of Article III standing.

5 IT IS SO ORDERED.

6 Dated: August 26, 2026

3 Hon. Dana M. Sabraw

United States District Judge

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28