COOKIE HUNTING: Central District Of California Dismisses Claims By Self-Proclaimed Online Privacy Tester

Hi, CIPAWORLD! Kelly Sandberg here, with a case dismissing California privacy claims brought by a self-proclaimed online privacy tester who failed to allege a substantial impact on her privacy interests.

In the case of Emily Rodriguez v. Accident Fund Holdings, Inc., the Central District of California granted Defendant Accident Fund Holdings’(AFHI’s) motion to dismiss Plaintiff Emily Rodriguez’s (Plaintiff’s) second amended complaint containing claims of California invasion of privacy and the common law tort of intrusion upon seclusion. Emily Rodriguez v. Accident Fund Holdings, Inc., No. 2:25-CV-03920-SK, 2026 WL 2365062 (C.D. Cal., August 13, 2026). The Court found that Plaintiff had failed to plausibly allege either claim based on the lack of a substantial impact on her privacy interests.

Plaintiff is a self-proclaimed online privacy tester. In other words, she visits websites in search of California privacy law violations to then sue the website owners.

Defendant AFHI operates the website, wwww.compwestinsurance.com, that serves as a workers’ compensation insurance marketplace for businesses. In May 2024, Plaintiff visited this website and browsed a few pages without buying anything, filling out any forms, logging into a customer portal or entering any personal or demographic information. Surprisingly, she did not click the link for the website’s privacy policy, nor did she opt out of the sharing or sale of her personal information.

AFHI has third-party software codes embedded in their website, which includes Google Analytics, Meta’s Facebook Pixel, LinkedIn’s Insight Tag and Basis. Each code can be used for digital fingerprinting to match captured metadata against its own database of user profiles from other, unrelated websites to determine if the website visitor is a known user.

Plaintiff brought this action against AFHI initially alleging California Invasion of Privacy (“CIPA”), and California Consumer Privacy Act (“CCPA”) claims. However, her second amended complaint also included a state-law constitutional claim for invasion of privacy and a state common-law claim for intrusion upon seclusion. The Court here did not discuss the CCPA violation because CCPA has an anti-boot strapping rule disallowing for a private right of action under any other law. So, Plaintiff contended that her complaint was actionable under a California Constitutional claim for invasion of privacy and the common law tort of intrusion upon seclusion.

The claims of intrusion upon seclusion and California Constitution claim for invasion of privacy share materially identical elements. The Court relied on the case of Facebook Tracking, finding that a plaintiff must plausibly allege that (1) she had “a reasonable expectation of privacy,” and (2) defendant’s intrusion upon her privacy was “highly offensive.”

A reasonable expectation of privacy depends on “whether a defendant gained ‘unwanted access to data by electronic or other covert means, in violation of the law or social norms.’” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 601-02 (9th Cir. 2020) (quotations omitted). The Court relied on the factors of “the customs, practices, and circumstances surrounding a defendant’s particular activities.” Facebook Tracking, 956 F. 3d at 602 (quotations omitted).

Here, Plaintiff denied entering any of her genuinely private information, including demographics, interests and preferences, or even any input data. Because she did not clearly allege what personal information was input that would be considered protected, no protectable privacy interest was triggered. “Routine internet tracking today-with nothing more-cannot create a reasonable privacy expectation enforceable by California’s privacy torts.” Accident Fund Holdings, Inc., 2026 WL 2365062, at *7.

Further a claim for privacy invasion also requires that the intrusion be considered “’highly offensive’ to a reasonable person, and ‘sufficiently serious’ and unwarranted so as to constitute an ‘egregious breach of the social norms.’” Facebook Tracking, 956 F.3d at 606 (quotations omitted). The factors used to determine whether an intrusion is highly offensive includes factors “such as the likelihood of serious harm to the victim, the degree and setting of the intrusion, the intruder’s motives and objectives, and whether countervailing interests or social norms render the intrusion offensive.” Facebook Tracking, 956 F.3d at 606.

Here, Plaintiff could have met this element if the “undisputed material facts show…an insubstantial impact on privacy interests.” Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1140 (E.D. Cal. 2021) (quotation omitted). However, Plaintiff’s allegations of “injury to her dignity” and “the loss of anonymity” did not amount to any concrete loss such as financial loss, identity theft or any other harms that would normally be associated with the disclosure of sensitive data. Further, Plaintiff did not input any user data, and each category of “personal information” she identified only fell within the CCPA’s definition, rather than the claims discussed by the Court here. The Court noted that “the collection of basic browsing history information – the IP address, URLs of the pages visited – on a public website is routine commercial behavior that, on its own, is not highly offensive.” Accident Fund Holdings, Inc., 2026 WL 2365062, at *8.

The Court dismissed Plaintiff’s second amended complaint without leave to amend, finding that Plaintiff did not plausibly allege a claim under either the common law tort of intrusion upon seclusion or for a California Constitutional claim for invasion of privacy.

The important takeaway to understand here is that plaintiffs alleging California privacy claims must allege that they suffered a concrete harm which substantially impacted their privacy interests, and that these privacy interests must at least amount to the receipt of identifiable, sensitive data.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.