Hello everyone! So, I have some good news and I have some not-so-good news this morning. Starting with the good, today’s blog is all about cookies! As for the not-so-good news, we won’t be talking about the tasty, edible kind. Instead, the case Gail Spears, et al., Plaintiffs, v. The Campbell’s Company, et al., Defendants. Additional Party Names: Melvin Colman, Pac. Foods of Oregon LLC, Revital Yogev, No. 26-CV-02385-TSH, 2026 WL 2654729 (N.D. Cal. Sept. 8, 2026) discusses the implications of a website publisher’s use of tracking cookies.
In case there are any readers like me who have heard about website cookies several times but never really understood what they are, I am going to begin with a quick explanation. Tracking cookies are little packages of code sent from a website server to a user’s browser and stored locally on the user’s device. They enable third parties to recognize individual users across websites and track them in real time to collect personal information. While the use of cookies can be necessary to a website’s operation, they are also commonly used for analytics, targeting, advertising, and personalization.
Here, Plaintiffs allege that Defendants designed their websites to allow third parties to place cookies on visitors’ web browsers and transmit their data. They were then able to track and collect data such as website visitors’ browsing history, website interactions, shopping behaviors, device information, demographic information, and even geographical location. Plaintiffs alleged that Defendants’ websites displayed a pop-up cookie consent banner informing users that cookies were being used but expressly giving users an opt-out option for all non-essential cookies. However, the websites continued tracking and storing user data even after users opted out of or rejected non-essential cookies. Plaintiffs therefore argued that Defendants’ representation that users could use the websites without being tracked were false and deceptive.
Plaintiffs therefore brought this putative class action, alleging six causes of action: (1) Invasion of Privacy; (2) Intrusion Upon Seclusion; (3) Wiretapping in Violation of the California Invasion of Privacy Act; (4) Use of a Pen Register in Violation of the California Invasion of Privacy Act; (5) Common Law Fraud, Deceit and/or Misrepresentation; and (6) Unjust Enrichment. Defendants responded by filing a motion to dismiss the case for lack of standing and failure to state a claim.
Standing
A court is only allowed to hear a case if the plaintiff has standing. To establish standing, a plaintiff must have (1) suffered an injury, (2) that is traceable to the conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision. This means that if there is no concrete harm, there is no standing and the court will not hear the case. Defendants tried to attack Plaintiffs’ standing for claims three and four by arguing that a concrete injury had not been suffered because Plaintiffs could not have reasonably expected privacy in their search inquiries for food products on a website. The court rejected this argument because the right to privacy includes the ability to control one’s personal information. Taking Plaintiffs’ allegations at face value, Defendants’ misrepresentations regarding the ability to opt out of cookies interfered with Plaintiffs’ right to control their personal information. As such, Plaintiffs had standing for claims 3 and 4.
Next, the court reviewed each of Defendants’ attempts to dismiss Plaintiffs’ claims for failure to state a cognizable claim. We will take a look at each of Defendants’ arguments one at a time.
Invasion of Privacy and Intrusion Upon Seclusion
Defendants tried to argue that Plaintiffs’ claims failed because they had no expectation of privacy in information voluntarily provided on a website and the alleged conduct was not so egregious as to violate social norms. However, the court explained that Defendants’ alleged conduct of giving Plaintiffs a choice with regard to cookie tracking created a reasonable expectation that their information would remain private despite their use of the website. Furthermore, permitting the collection of a large amount of data after telling Plaintiffs they could opt out constituted a “highly offensive” intrusion of privacy. Accordingly, the court denied Defendants’ motion to dismiss claims 1 and 2.
Wiretapping
Defendants next argued that Plaintiffs failed to allege that third-party vendors read any of the communications transmitted by the cookies or that Defendants knowingly and intentionally aided any such violation, as required by CIPA’s wiretapping provision. The court was not convinced by Defendants’ argument, finding that Plaintiffs sufficiently alleged that third parties intercepted communications in real time as communications traveled to the website. Second, Plaintiffs’ allegation that Defendants purposely programmed their websites to include cookies and provided an ineffective opt-out option supported an inference that Defendants knew the tracking cookies constituted a breach of their legal responsibilities. So, Defendants’ motion to dismiss claim three was also denied.
Use of a Pen Register in Violation of CIPA
Defendants then argued that Plaintiffs’ fourth claim regarding CIPA’s Pen Register provision failed because that provision does not apply to cookies on websites. Defendants claim that this specific provision does not apply to internet tracking because it only pertains to telephones. The court, however, explained that it must begin with the plain meaning when interpreting statutes. If the language of the statute is not ambiguous, then the plain meaning prevails. The provision in question applies to pen registers that record or decode “information transmitted by an instrument or facility from which a wire or electronic communication is transmitted.” Cal. Penal Code §§ 638.50(b), 638.51(a). This section makes no mention of telephones and presents no ambiguities. As such, the court concluded that the plain language plausibly supported Plaintiffs’ theory that tracking cookies constituted the use of a pen register and rejected Defendants’ motion to dismiss claim four.
Common Law Fraud, Deceit, and/or Misrepresentation
Defendants argued that Plaintiffs’ fraud claim failed because Plaintiffs were not injured and Plaintiffs failed to plead intent with the requisite specificity. However, Plaintiffs alleged that Defendants voluntarily designed their websites in a manner that allowed cookies to track website users’ activities, even after telling them they would not be tracked. The court found these allegations adequate because they sufficiently demonstrated intent. In addition, Plaintiffs alleged that they were harmed by the deprivation of control over their data. The court clarified that a defendant’s tracking and data collection practices can cause harm to an individual’s interest in controlling their own data. Accordingly, the court denied Defendants’ motion to dismiss Plaintiffs’ fifth claim.
Unjust Enrichment
Plaintiffs’ final claim alleged that Defendants were unjustly enriched by the collection of personal user information. Plaintiffs alleged that Defendants deprived them of the ability to decide whether their personal information would be monetized and that Defendants benefited from this by selling the information to third parties or using the data themselves. The court construed this allegation in the light most favorable to Plaintiffs, as is required when evaluating a motion to dismiss, and decided that Plaintiffs met their burden of distinguishing between relief for damages and restitution. As a result, the court denied Defendants’ motion to dismiss claim six.
In review, Defendants failed to demonstrate any deficiencies in Plaintiffs’ pleadings. Plaintiffs sufficiently alleged that Defendants exploited private communications and user data in violation of California consumer privacy laws. Therefore, the court denied Defendants’ motion to dismiss.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]