Smith v. Rack Room Shoes, Inc.

Background

The plaintiffs brought a proposed class action against Rack Room Shoes, Inc. They alleged that Rack Room embedded code from Meta, Attentive, and other third parties in its website. According to the allegations, the code caused visitors’ browsers to send information to those companies, including URLs revealing search and browsing activity, webpage and button names, viewed or purchased products, and information connected to visitors’ names, addresses, phone numbers, email addresses, or Facebook accounts.

The plaintiffs alleged that Rack Room and the third parties used this information for services, commercial purposes, and targeted advertising. They also alleged that Rack Room’s privacy policy did not disclose that third parties could collect, store, analyze, or commercially use personally identifiable browsing and purchase information.

In an earlier round of this case, the court dismissed the plaintiffs’ California Comprehensive Computer Data and Access Fraud Act (CDAFA), California Unfair Competition Law (UCL), Consumers Legal Remedies Act (CLRA), and federal Wiretap Act claims with leave to amend. The plaintiffs then filed a Second Amended Complaint adding allegations about the financial value of their data, the defendants’ alleged profits, Rack Room’s role in customizing and deploying the tracking code, and Rack Room’s use of the resulting consumer profiles.

CDAFA claim

The court denied Rack Room’s motion to dismiss the CDAFA claim. CDAFA allows a civil action by a computer owner who suffers damage or loss from a violation. The court had previously found that the plaintiffs had not adequately alleged that type of harm.

The court concluded that the new allegations plausibly showed compensable damage or loss. The plaintiffs alleged that third parties and Rack Room unjustly profited from their personal information and online activity and sought repayment of those profits. Relying on California law concerning disgorgement—the recovery of profits allegedly obtained unfairly—the court held that the plaintiffs’ alleged failure to receive a share of profits generated from their data could qualify as damage under CDAFA.

UCL and CLRA claims

The court granted Rack Room’s motion to dismiss the UCL and CLRA claims without leave to amend. For a UCL claim, a plaintiff must allege an injury in fact and loss of money or property caused by unfair competition. For a CLRA claim, a plaintiff must allege a tangible increased cost or burden to the consumer.

The court found that the plaintiffs’ general allegations about the value of web-browsing data did not adequately support their theory that the data had lost value. It also held that the plaintiffs’ unjust-enrichment theory did not meet the UCL or CLRA requirements because those statutes require loss of money or property, or a tangible increased cost or burden, rather than the broader type of damage sufficient for CDAFA. Because the plaintiffs had already received an opportunity to amend and had not corrected the deficiencies, the court found further amendment futile.

Federal Wiretap Act claim

The court denied Rack Room’s motion to dismiss the federal Wiretap Act claim. The Wiretap Act prohibits intentional interception or intentional use of intercepted communications when the user knows, or has reason to know, that the information was obtained through interception. The statute contains a party exception for an interception by a party to the communication or with a party’s consent, but that exception does not apply when the interception is for the purpose of committing a separate criminal or tortious act.

The court held that the plaintiffs plausibly alleged intentional use because Rack Room allegedly received consumer profiles incorporating intercepted communications, knew that the profiles contained that information, and used them to guide targeted advertising. The court also accepted the plaintiffs’ allegation that Rack Room played an active role in the interception by customizing and deploying the third-party code.

The court found that the plaintiffs plausibly alleged the required separate tortious purpose. They alleged that Rack Room intended to disclose and use personally identifiable communications for advertising even though its privacy policy promised not to collect or use the information in that way. The court stated that a financial motive does not shield a party from Wiretap Act liability at the motion-to-dismiss stage when the alleged conduct may also violate state law. The court noted that the plaintiffs had not adequately alleged that Meta, Attentive, or the other third parties themselves knew about Rack Room’s lack of consent or its alleged contrary use of the data, but it found those allegations unnecessary because Rack Room itself was alleged to have actively participated in the interception.

Motion to strike and judicial notice

The court denied Rack Room’s motion to strike. Rack Room sought to remove allegations concerning third parties other than Meta and Attentive, but the court found those allegations relevant to the claims against Rack Room and, at minimum, to Rack Room’s alleged intent concerning the plaintiffs’ California Invasion of Privacy Act claims.

Rack Room also sought to strike the proposed nationwide Wiretap Act class. The court found that request premature because no class had been certified and the named plaintiffs resided in California. It denied the motion to strike without prejudice to raising the issue again at class certification.

The court denied Rack Room’s request for judicial notice as moot because it did not rely on the documents to rule in Rack Room’s favor on the UCL or CLRA claims, and the documents did not concern its rulings on the CDAFA or Wiretap Act claims.

Disposition

The court denied Rack Room’s motion to dismiss as to the CDAFA and federal Wiretap Act claims and granted it without leave to amend as to the UCL and CLRA claims. The court denied the motion to strike, denied the request for judicial notice as moot, and granted the plaintiffs’ motion to extend the deadline to amend the pleadings to August 18, 2025. Judge Rita F. Lin signed the order.