In a win for businesses using third-party technologies to power their websites, a California federal court applied the Ninth Circuit’s recent decision in Popa v. Microsoft Corporation to dismiss a “pen register” claim brought under the California Invasion of Privacy Act (“CIPA”) for lack of Article III standing.  Khamooshi v. Politico LLC, No. 24-cv-07836-SK, 2025 WL 2822879 (N.D. Cal. Oct. 2, 2025).  “As in Popa,” the Khamooshi court held that the plaintiffs—who alleged the collection of their device type, browser type, and “device fingerprints”—“identifie[d] no embarrassing, invasive, or otherwise private information collected,” as required to establish an Article III injury. 

The plaintiffs were users of politico.com who brought a putative class action against the owner of the namesake political news website in September 2024.  They asserted that Politico embedded on its website third-party technologies that purportedly collected information including “browser and device data, IP address, and ‘other identifying information.’”  The plaintiffs claimed that this gave rise to a violation of the pen register provision of CIPA, Cal. Penal Code § 638.51, among others.  The court initially dismissed the case for lack of standing because the allegedly collected data was “too vague to assert a protectable privacy interest.”  Subsequently, the plaintiffs filed an amended complaint, adding additional categories of information purportedly disclosed.

The court recently dismissed that amended complaint, too.  In doing so, the court followed the Ninth Circuit’s recent decision in Popa v. Microsoft Corporation, which requires the plaintiff to identify “embarrassing, invasive, or otherwise private information collected” to establish a concrete privacy injury “analogous to the common-law privacy torts.”  There, the Ninth Circuit rejected a privacy claim for lack of standing, even though the plaintiff alleged “over 30 different categories of information” collected throughout the plaintiffs’ “entire visit to the website.”  The Ninth Circuit likened those categories to “a store clerk’s observing shoppers” to identify popular aisles or to spot problems, which does not give rise to a concrete privacy injury.  Here, the court held that the allegedly collected data—“device type, browser type, and ‘device fingerprints’”—was “even less specific than the 30 different categories of information alleged in Popa,” warranting dismissal for lack of standing. 

This decision reinforces the need, as the Ninth Circuit identified in Popa, for plaintiffs in privacy cases to make factual allegations showing that “embarrassing, invasive, or otherwise private information collected” to have Article III standing to pursue those claims.