Hi CIPAWorld, Monica here, one of Troutman Amin LLP’s newest additions. I come bearing some great news for CIPA defendants. A California judge recently held that rejecting cookie tracking alone is not enough to establish standing under Article III, even if the website allegedly tracks you anyway.
The issue came before the court in Trevor Lutge v. Trimex.com, Inc. (N.D. Cal. Sept. 14, 2026) when Timex moved to dismiss the complaint for failure to state a claim for relief. And here’s your reminder that knowledgeable counsel, and apparently a knowledgeable judge, can make all the difference: Timex didn’t even raise standing as a ground for dismissal! Instead, the Court spotted the issue on its own and ultimately dismissed the case. Timex can certainly thank the judge for catching that one!
Here, Lutge alleges that Timex uses a third-party company, Klaviyo, to collect information about the website’s visitors through cookies. Trevor Lutge visited Timex’s online watch store and rejected cookie tracking before purchasing a watch in February of 2025. Lutge claims that even though he rejected cookie tracking, Timex continued to track his interactions with the website and shared this information with Klaviyo. Lutge further alleges that Klaviyo has the capacity to build consumer profiles with the information it collects from the different sources beyond Timex.
Lutge filed a putative class action alleging that Timex violated the Electronic Communications Privacy Act, the California Invasion of Privacy Act, and the California Constitution.
The Court’s discussion focused on whether Lutge had Article III standing to bring these claims forward. And if there’s one thing law school drilled into all of us, it’s this: Article III of the U.S. Constitution requires a real, concrete injury. It was that basic, first year of law school principle, that ended up being a fatal flaw in Lutge’s case.
In addressing whether Lutge’s injury was “concrete” and “actually exists”, the Court relied heavily on the Ninth Circuit’s decision in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). Specifically, the Court focused on whether the information that was allegedly gathered by Timex was sufficiently private or sensitive to constitute a “highly offensive” intrusion. And fortunately for Timex, Lutge’s name, email address, and browsing activity simply did not meet that bar.
Now, this does not mean companies can just go and track anyone who rejects cookie tracking without consequences. The Court explained that deceit can be a “plus factor”, elevating otherwise borderline conduct into a highly offensive intrusion. But the key here is that deceit alone does not get a plaintiff across the finish line.
Likewise, companies sharing non-sensitive information with third-party companies such as Klaviyo may still be on the hook. The Court explained that aggregating information to create a comprehensive profile containing invasive or sensitive information could amount to the type of “cradle-to-grave” profiling necessary to establish standing. Lutge’s allegations, however, fell short because he failed to allege that Klaviyo had actually collected and de-anonymized materially more sensitive information about him.
This is a HUGE win for companies facing the wave of cookie tracking litigation. Whether other courts will follow this remains to be seen, but you can rest assured we will be watching. Come back for the latest developments!
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]