Kishnani v. Royal Caribbean Cruises Ltd.

Background

Kieren Kishnani sued Royal Caribbean Cruises Ltd. over software that Royal Caribbean allegedly used on the celebritycruises.com website. Kishnani alleged that software designed by TikTok automatically collected and transmitted information from website visitors’ devices, including device and browser information, geographic information, referral and URL tracking, and potentially visitors’ names, birth dates, and addresses. He alleged that the software could identify visitors and operated without their consent.

Kishnani claimed that the software was a “trap and trace device” under the California Invasion of Privacy Act. That law defines such a device as one that captures information identifying the source of a communication, but not the communication’s contents. Kishnani sought statutory penalties and proposed a class of California residents whose identifying information was allegedly sent to TikTok after visiting the website.

Standing

The court first addressed Article III standing, which requires a plaintiff to show a concrete and particularized injury that was caused by the defendant and could be remedied by the court. The court held that Kishnani’s allegations were too general. He alleged that the software collected his “data” and “information,” but he did not identify the specific personal information he disclosed or that Royal Caribbean actually collected from him.

The court explained that general allegations about website tracking do not establish a concrete injury. It also stated that collecting basic contact information, device information, geographic information, or Internet Protocol addresses does not, by itself, establish the required harm. Although the complaint alleged that the software could collect biographical information, Kishnani did not allege that the website collected that information from him. Because he lacked standing to sue for his own injury, he also could not represent the proposed class.

Trap-and-trace-device claim

The court separately held that the claim would fail even if Kishnani alleged that the website collected additional information about him. Under the California statute, a trap-and-trace device captures information about a communication—such as who sent it, when, or where—but not the communication’s content.

The court reasoned that if the software collected biographical information, that information would be communication content rather than information about the communication. In that situation, the software would not be a trap-and-trace device covered by the statute. If it collected only metadata, such as an Internet Protocol address or general geographic location, the court stated that Kishnani had not shown a legally protected privacy interest in that information.

Ruling

The court granted Royal Caribbean’s motion to dismiss without leave to amend, concluding that amendment could not cure Kishnani’s lack of standing. The court dismissed the first amended complaint with prejudice and vacated the hearing that had been scheduled for June 25, 2025.