Recent Decisions Strengthen The Defense Playbook In Website Tracking Class Actions

Fourrecent federal court decisions have dealt significant blows to plaintiffs in the ongoing wave of "pixel" and cookie-tracking privacy class actions, while one decision illustrates that plaintiffs can still survive early dismissal when they plead their claims with sufficient factual specificity. Together, the rulings sharpen the emerging battle lines for defendants facing wiretapping, invasion-of-privacy and computer-fraud claims premised on website tracking technologies.

In Cobbs v. PetMed Express, Inc., the U.S. District Court for the Southern District of Florida denied class certification and dismissed the case entirely for lack of Article III standing after full class discovery undercut the named plaintiffs' claimed privacy interests. In Lewis v. Magnite, Inc., the U.S. District Court for the Central District of California denied class certification outright, finding that individualized issues of cookie identification, consent and standing predominate over common questions in tracking-technology cases. In In re: Zeta Global Data Privacy Litigation, the U.S. District Court for the Southern District of New York dismissed the entire putative class action at the pleading stage for lack of Article III standing, holding that generic allegations of personally identifiable information (PII) disclosure did not plausibly plead a concrete injury. By contrast, in Briskin v. Shopify Inc., the U.S. District Court for the Northern District of California denied a motion to dismiss where the plaintiff's third amended complaint added concrete, nonspeculative factual allegations about the defendant's data practices and intent.

Key Takeaways for Defendants

Vague, Generic "PII" Allegations Will Not Survive a Motion to Dismiss

In the Zeta litigation, the court granted dismissal at the pleading stage because the complaint referred repeatedly to the interception and disclosure of plaintiffs' PII without ever specifying what information was actually disclosed as to each named plaintiff—beyond generic references to an email address and unspecified "other information." The court held that this kind of "less sensitive data" (email addresses, IP addresses, browser and device information, campaign identifiers) does not constitute the sensitive information needed to plead a cognizable privacy injury and that speculation about what a defendant "likely" collected cannot support standing.

Lesson: Move to dismiss aggressively where a complaint relies on the undefined term "PII" or similar catchalls without pleading the specific categories of information actually disclosed as to each named plaintiff.

Traceability and Voluntary Disclosure Defenses Remain Powerful, Even Independent of Injury

The Zeta court also held that, even assuming a cognizable injury, the plaintiffs failed to plead that the harm was traceable to the defendants because plaintiffs voluntarily provided their information to access a website or newsletter, and the complaint itself acknowledged uncertainty about how their data reached the defendant (raising the possibility that it came from other data aggregators entirely).

Lesson: Press both injury-in-fact and traceability arguments independently—an ambiguous complaint about the data's path to the defendant can defeat standing on its own, separate from any injury analysis.

Economic-Harm and Loss-of-Control Theories Require Concrete Factual Support, Not Conclusory Assertions

The Zeta court rejected the plaintiffs' alternative theories that they suffered a "diminished value" of their data or that the defendants' profits constituted an injury to plaintiffs because the complaint did not allege a market for the specific data at issue, any actual decrease in that data's value or any intent by plaintiffs to monetize it. It likewise rejected device-impact and loss-of-control theories as speculative where no facts particular to the named plaintiffs were pled.

Lesson: Scrutinize each independent injury theory a complaint advances and move to dismiss each one on its own terms; courts are increasingly requiring particularized, nonconclusory factual support for every theory of harm asserted.

Depositions Can Unwind Standing Even After a Favorable Pleading-Stage Ruling

In Cobbs, the court had earlier found Article III standing plausible at the motion-to-dismiss stage. But after class discovery, both named plaintiffs testified they had no genuine subjective expectation of privacy in the information at issue—one testified she had no concern about the disclosure and that privacy policies were "inconsequential" to her, and both continued shopping on the defendant's site without changing their behavior. The court held that "seclusion" is an essential element of the intrusion-upon-seclusion comparator tort, and where discovery reveals no genuine secluded interest, only a "bare statutory violation" remains—insufficient for standing.

Lesson: Aggressively depose named plaintiffs on their actual privacy expectations and post-litigation conduct; testimony admitting indifference to disclosure can defeat standing even after surviving a motion to dismiss.

Individualized Issues of Cookie/Pixel Identification Defeat Predominance

In Lewis, the court denied certification because identifying which individuals even had the challenged cookie installed required an individualized, technical inquiry—a user's browser and device combination, privacy settings and page configuration all affected whether a tracking ID was ever set, and the same identifier could correspond to multiple people or one person could have multiple identifiers.

Lesson: Develop and present expert evidence early showing that class membership itself cannot be determined on a classwide basis without individualized inquiry.

Varying Consent Disclosures Across Websites Defeat Predominance and Undermine Classwide Theories

The Lewis court also found that because putative class members visited many different websites with differing privacy policies and disclosures regarding the tracking technology at issue, the case would require assessing each individual's subjective understanding of the disclosures they encountered—precluding common resolution of consent.

Lesson: Catalog variation in the privacy disclosures encountered by different putative class members as an affirmative predominance defense.

A Workable Classwide Damages Methodology Is Not Optional

The Lewis court separately denied certification because the plaintiffs offered no expert methodology for calculating statutory or unjust-enrichment damages on a classwide basis, contrasting the case with precedent where plaintiffs provided a detailed damages model.

Lesson: Press plaintiffs early, through expert discovery and Daubert practice, to produce (or fail to produce) a rigorous classwide damages methodology.

Generic "Bare Violation" Theories Will Not Carry Standing or Predominance

Cobbs, Lewis and the Zeta litigation all reaffirm that a statutory violation alone—without a concrete, individualized harm resembling a traditional common-law tort—does not establish standing under TransUnion and its progeny. Framing the injury as merely the placement of a tracker, the fact of a technical statutory violation, or an undifferentiated reference to PII is insufficient.

Lesson: Continue to press TransUnion/Spokeo standing arguments even in circuits or courts that previously allowed such claims to proceed past the pleadings, and revisit standing at every stage as the factual record develops.

Early, Specific Factual Pleading Remains Plaintiffs' Most Durable Path Past a Motion to Dismiss – Plan Accordingly

Briskin is a reminder that these defenses are not guaranteed at the pleading stage. There, the court denied dismissal because the plaintiff's third amended complaint added concrete, nonspeculative factual allegations—including the defendant's own contemporaneous privacy-policy disclosures and specific allegations about real-time data interception and control over the merchant's checkout flow—sufficient to plausibly allege intent and "in-transit" interception under the California Invasion of Privacy Act. The court emphasized that arguments requiring an evidentiary record (such as whether communications were truly read "in transit") are properly reserved for summary judgment, not a motion to dismiss.

Lesson: Expect well-pleaded complaints with specific, nonconclusory factual allegations to survive dismissal; the more promising defense inflection points remain the pleading-specificity challenges illustrated by Zeta, standing after discovery as in Cobbs and class certification as in Lewis.

Practical Implications

These decisions suggest that motions to dismiss remain a meaningful checkpoint where complaints rely on generic, undifferentiated allegations of data collection or PII disclosure—but offer limited relief once plaintiffs plead specific, nonconclusory facts. Defendants should press pleading-stage challenges to injury, traceability and each independent harm theory at the outset, while also building a discovery record from the start aimed at the later-stage battles that have proven most successful: named plaintiffs' actual privacy expectations and conduct, and class certification briefing that exposes individualized issues of cookie/pixel attribution, consent and damages.