Ayora v. Brands

Background

The plaintiffs alleged that the defendants’ websites placed cookies and other tracking technologies on visitors’ devices even after users clicked a button indicating that they declined cookies. They alleged that third parties obtained browsing history, website interactions, user-input data, demographic information, interests and preferences, shopping behaviors, device information, referring URLs, session information, user identifiers, and geolocation data.

The complaint asserted claims involving California privacy law, common-law privacy, wiretapping, use of a pen register, fraud, unjust enrichment, and trespass to chattels. The defendants moved to dismiss and separately asked the court to strike the class allegations.

Standing and Privacy Injury

The court dismissed Inspire for lack of standing because no named plaintiff alleged visiting Inspire’s website or reading its privacy policies. The plaintiffs also did not provide authority showing that the existence of Inspire’s name in other defendants’ privacy policies, or Inspire’s status as a parent company, was enough to connect Inspire to the alleged harm. The dismissal of Inspire was with leave to amend.

The court rejected the defendants’ argument that the plaintiffs had not alleged a concrete privacy injury. It found that the alleged collection of historical data and referring-URL information was more intrusive than the information involved in a cited Ninth Circuit case. At the pleading stage, the court could not decide as a matter of law that the alleged collection could not be highly offensive. The court therefore concluded that the plaintiffs had sufficiently alleged a concrete privacy injury.

Rule 9(b) Pleading Requirement

Federal Rule of Civil Procedure 9(b) requires allegations of fraudulent conduct to provide particular details, including who committed the conduct, what occurred, when and where it occurred, and how it happened. The court held that Rule 9(b) applied because the alleged deception—representing that users could decline tracking while allegedly tracking them anyway—formed the basis of all the plaintiffs’ claims.

The court found that the complaint did not adequately identify when and where the alleged deception occurred. The alleged class period lasted four years, and the defendants represented that cookie banners were implemented and changed at different times on different websites. The court therefore dismissed all claims for failure to satisfy Rule 9(b).

Individual Claims

The fifth claim, fraud, was dismissed with leave to amend because the plaintiffs had not pleaded the alleged misrepresentations with the required detail. The sixth claim, unjust enrichment, was also dismissed with leave to amend. The court followed decisions allowing unjust-enrichment claims to proceed under a quasi-contract theory, but found that the plaintiffs had not adequately alleged the fraud-based relationship needed for that theory.

The first and second common-law privacy claims otherwise could survive dismissal under Rule 12(b)(6), which tests whether a complaint states a legally sufficient claim, assuming the plaintiffs could satisfy Rule 9(b). The court found that the plaintiffs plausibly alleged both a reasonable expectation of privacy and an intrusion that could be highly offensive.

For Plaintiff De Ayora’s California Invasion of Privacy Act, or CIPA, claims, the court found that the one-year limitations period appeared to have expired. It held that equitable tolling—a possible extension of a filing deadline—did not apply to claims against Baskin Robbins, Dunkin’, or Jimmy John’s because De Ayora’s arbitration demand notified only Inspire and Arby’s. Those claims were dismissed with leave to amend to the extent De Ayora could allege facts showing timely notice.

For Plaintiff Wiley’s CIPA claims, the court held that equitable tolling did not apply because her arbitration demand did not notify Baskin Robbins or Dunkin’. The court also found that Wiley did not explain why she waited eight months after receiving the arbitration decision before joining this case. It dismissed Wiley’s CIPA claims against Jimmy John’s, Baskin Robbins, and Dunkin’ without leave to amend.

The third claim, wiretapping under California Penal Code section 631(a), was dismissed with leave to amend under Rule 12(b)(6). The court found that the plaintiffs had not alleged facts explaining how the software worked or how communications were acquired while they were being transmitted. The plaintiffs’ fourth claim, alleging use of a pen register under California Penal Code section 638.51, was otherwise sufficiently pleaded because the alleged cookies and tracking code could qualify as pen-register technology under the authorities discussed. That claim could proceed only if it also satisfied Rule 9(b) and applicable timeliness requirements.

The seventh claim, trespass to chattels, was dismissed with leave to amend. The plaintiffs alleged that cookies reduced the storage, disk space, and performance of their devices but did not explain how those reductions occurred or provide supporting facts.

Class Allegations and Disposition

The court denied the defendants’ request to strike the class allegations without prejudice. It found that deciding whether the proposed class was overbroad or unworkable would be premature at the pleading stage.

The conclusion states that the defendants’ motion to dismiss was granted and that all claims were dismissed with leave to amend, while also stating that Wiley’s claims against Jimmy John’s, Baskin Robbins, and Dunkin’ were dismissed without leave to amend. The order required any amended complaint to be filed by January 30, 2026.