Butler v. Bancorp

Background

U.S. Bancorp (U.S. Bank), a national financial services provider with a principal place of business in Minnesota, operates a website and mobile applications that customers use to access account information and apply for financial products. Plaintiff Christopher Butler, a California resident, alleged that U.S. Bank embedded Meta Pixel — a piece of tracking code that captures real-time user activity and transmits data to Meta/Facebook — into its website and mobile app. According to Butler's First Amended Complaint (FAC), Pixel collected data such as pages visited, information entered into product applications, browsing behavior, browser identifiers, and IP addresses, and then shared that data with Meta, enabling Meta to build detailed user profiles for targeted advertising.

Butler alleged that at some unspecified time he applied for a credit card on U.S. Bank's website, inputting unspecified "personal information," and that shortly afterward he noticed an increase in targeted advertising on Facebook related to U.S. Bank's Money Market account products. He alleged this occurred without his knowledge or consent, and that had he known, he would not have interacted with the website. The FAC did not specify what information Butler entered, whether U.S. Bank had integrated Pixel into its site at the time of his application, or whether he actually completed and submitted the application.

Claims

Butler alleged two categories of injury: (1) intangible harms from the interception and disclosure of his "highly sensitive" personally identifiable financial information (PIFI), and (2) economic harm from the "diminution in value" of his PIFI.

Legal Standard

U.S. Bank moved to dismiss all claims for lack of standing (under Federal Rule of Civil Procedure 12(b)(1)) and for failure to state a claim (under Rule 12(b)(6)). The court addressed standing first, as it is a jurisdictional prerequisite that must be established before reaching the merits.

Under Article III of the U.S. Constitution, a plaintiff must plead three elements: (1) an injury in fact, (2) a causal connection between the injury and the defendant's conduct ("fair traceability"), and (3) redressability. To qualify as an injury in fact, the harm must be "concrete and particularized" and "actual or imminent." Concrete injuries include tangible harms (physical or monetary) and intangible harms that closely resemble traditionally recognized common-law torts, such as intrusion upon seclusion or public disclosure of private facts — both of which require that the disclosed information be "highly offensive" to a reasonable person.

Analysis: Intangible Harms

The court found that Butler failed to allege a concrete intangible injury for two key reasons.

First, Butler did not specify what personal information he entered into U.S. Bank's website, and the FAC did not allege that Pixel was even integrated into the website at the time he applied for the credit card. The court noted that even Butler's legal brief opposing dismissal conspicuously avoided asserting that Pixel was active at the time of his application. An allegation made only in a brief — that U.S. Bank distributed his Social Security number to Meta — was not included in the FAC and was therefore disregarded by the court.

Second, because Butler provided no specifics about what information was disclosed, the court could not assess whether the disclosed data rose to the level of "highly offensive" information required to support standing. The court compared Butler's allegations unfavorably to cases where courts found standing, such as those involving disclosure of sensitive medical information, private video-viewing history, or comprehensive internet browsing profiles. It contrasted Butler's case with cases where courts found no standing — including a case involving the same Meta Pixel technology (In re BPS Direct, LLC) where plaintiffs similarly failed to identify what personal information they inputted and where the disclosed information amounted to basic contact data.

The court also noted that Butler's allegation of an "uptick in targeted advertising" on Facebook does not, by itself, constitute a cognizable concrete harm, citing multiple decisions reaching the same conclusion.

Analysis: Economic Harms

The court rejected Butler's economic injury theory — diminution in value of PIFI — on two independent grounds.

First, because Butler did not specify what information he entered or whether Pixel was active at the time, the court declined to accept his legal conclusion that the unspecified information constituted PIFI with discernible economic value.

Second, even setting aside those gaps, Butler failed to plead the elements courts have required to establish diminution-in-value standing: the existence of a market for his personal information, his participation or intent to participate in that market, and actual loss of value in that market. The FAC contained none of these allegations. The court also distinguished a case Butler cited in his brief (Sequeira v. U.S. Department of Homeland Security), noting that the plaintiff there alleged paying the defendant money for services — an allegation entirely absent from Butler's FAC.

Class Action

Because Butler was the only named plaintiff and lacked standing, the court held it had no jurisdiction over the putative class claims and did not address class certification.

Disposition

The court granted U.S. Bank's Motion to Dismiss without prejudice, meaning the dismissal does not permanently bar Butler from refiling if he can allege more specific and sufficient facts. Judgment was ordered to be entered accordingly.