Selby v. Sovrn Holdings

Background

The plaintiffs brought the action on behalf of a putative class. They alleged that Sovrn’s software products tracked web activity in real time and recorded personal information. Their claims were for intrusion upon seclusion under California law; violations of California Penal Code §§ 631(a) and 638.51(a); unjust enrichment; and violations of the Electronic Communications Privacy Act (ECPA).

Sovrn moved to dismiss or transfer the case. It argued that venue was improper because the relevant conduct occurred in Colorado rather than California. It alternatively sought transfer to Colorado under 28 U.S.C. § 1404(a), which permits transfer for convenience and in the interest of justice. Sovrn also moved to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), the rule used to challenge whether a complaint adequately alleges a legal claim.

Venue and Transfer

The court held that venue was proper in the Northern District of California. The plaintiffs alleged that Sovrn’s tracking pixel installed cookies on browsers while at least some plaintiffs were in the district and tracked their activity as they navigated websites there. The court also relied on allegations that three plaintiffs resided in the district and experienced privacy-related harm there.

The court denied discretionary transfer to Colorado. The plaintiffs’ choice of forum weighed against transfer because three plaintiffs resided in the district and alleged that much of their injury occurred there. Convenience of the parties and non-party witnesses was neutral because the parties had not shown that the relevant non-party witnesses were located in either district. Access to evidence weighed slightly in favor of transfer, but the court gave that factor minimal weight because documents could generally be exchanged electronically. The court found that familiarity with California law and California’s interest in protecting local residents weighed against transfer. The motion to transfer was denied.

Motion to Dismiss

The court held that the plaintiffs adequately alleged an injurious privacy invasion. The complaint alleged unauthorized, widespread tracking; detailed profiles of online browsing activity; collection of sensitive browsing information; and collection of full-string URLs tied to email addresses and other personal identifiers. The court concluded that these allegations were sufficient at the pleading stage for the intrusion-upon-seclusion and California privacy-injury theories.

The court also held that the plaintiffs adequately alleged that Sovrn collected the content or meaning of communications under the California Invasion of Privacy Act (CIPA) and the ECPA. The alleged full-string URLs could include search queries and specific items viewed. The court further found that the complaint adequately alleged that the interceptions occurred while communications were in transit, in part because it described the tracking pixel and related technology and included source-code screenshots.

The court rejected Sovrn’s argument that the tracking pixels could not qualify as a pen register under CIPA because they involved internet technology rather than telephone lines. It denied dismissal of the claim under California Penal Code § 638.51(a).

The court dismissed the unjust-enrichment claim with leave to amend. It found that the plaintiffs had not alleged that they lacked an adequate remedy at law, and nothing in the complaint showed that their legal remedies were insufficient.

Disposition

Judge Rita F. Lin denied Sovrn’s motion to transfer. She granted in part and denied in part Sovrn’s motion to dismiss: the motion was granted with leave to amend as to the unjust-enrichment claim and denied as to all other claims. The plaintiffs were permitted to file an amended complaint by November 6, 2025, to correct the identified deficiencies. The amendment could not add new claims or parties or otherwise change the allegations without court permission or the parties’ stipulation.