D’Antonio v. Smith & Wesson Inc.

Background

The plaintiffs filed a proposed class action alleging that Smith & Wesson placed certain cookies on their devices even though they had expressly rejected receiving such cookies. The court had previously dismissed claims for wiretapping under the California Invasion of Privacy Act (CIPA), use of a pen register under CIPA, breach of contract, breach of the implied covenant of good faith and fair dealing, and trespass to chattels. It also dismissed Cuevas Garcia’s common-law fraud claim, while allowing the plaintiffs’ invasion-of-privacy and intrusion-upon-seclusion claims and D’Antonio’s and Thayer’s common-law fraud claims to continue.

The plaintiffs then filed an amended complaint. They added factual allegations and dropped the claims for breach of an implied contract, breach of the covenant of good faith and fair dealing, and trespass to chattels. The amended complaint asserted claims for invasion of privacy, intrusion upon seclusion, CIPA wiretapping, CIPA use of a pen register, common-law fraud, deceit, or misrepresentation, and unjust enrichment.

Smith & Wesson moved to dismiss all of the plaintiffs’ CIPA claims, Thayer’s claims based on events before 2024, and Cuevas Garcia’s common-law fraud claim.

Legal standard

The court applied Federal Rule of Civil Procedure 12(b)(6), which allows dismissal when a complaint does not state a legally valid claim. At this stage, the court accepts factual allegations as true and views the complaint in the plaintiffs’ favor, but it does not accept unsupported legal conclusions. The complaint must contain enough facts to make liability plausible.

Thayer’s pre-2024 claims

Thayer alleged that he visited Smith & Wesson’s website in 2019 to purchase a firearm, returned several times over the following years to search for accessories, and visited again around November 2024, when he rejected all cookies. He filed the action on April 4, 2025. Smith & Wesson argued that claims based on visits before 2024 were barred by the applicable statutes of limitations.

The court declined to decide that issue against Thayer at the pleading stage. It explained that the discovery rule can delay when a claim begins to run until the plaintiff discovers, or has reason to discover, the injury. It also noted that fraudulent concealment can pause the limitations period when a defendant’s deceptive conduct prevents discovery. Because the court had to accept as true the plaintiffs’ allegations that they reasonably could not discover the alleged wrongdoing earlier and that Smith & Wesson’s misrepresentations prevented knowledge of the facts, the complaint did not establish on its face that Thayer’s earlier claims were untimely.

CIPA wiretapping claim

California Penal Code section 631(a) prohibits several forms of intentional wiretapping, attempting to learn the contents or meaning of a communication while it is in transit, and using or communicating information obtained through those acts. The statute also prohibits aiding or abetting those acts.

The court held that the plaintiffs sufficiently alleged a predicate violation for an aiding-and-abetting theory. D’Antonio alleged that he searched for shirts and entered “t-shirts and other merchandise” into the website’s search bar. Thayer alleged searches for a Smith & Wesson 9mm M&P Shield and related accessories. Cuevas Garcia alleged that she researched firearms and accessories and searched for firearms, calibers, and accessories.

The court concluded that these searches included specific inquiries communicated from the plaintiffs to Smith & Wesson’s website and therefore supplied sufficient allegations about the contents of communications. It rejected Smith & Wesson’s arguments that the plaintiffs had to identify particular cookies, transmissions, or third parties at this stage. The court also found sufficient the allegations that the data traveled in real time from the plaintiffs’ browsers to the website before being processed and stored. Questions about the processing platform and whether an interception actually occurred were factual issues better addressed later.

CIPA pen-register claim

California Penal Code section 638.51(a) generally prohibits installing or using a pen register without a court order in specified circumstances. The statute defines a pen register as a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility used to transmit a wire or electronic communication, but not the communication’s contents.

The court had previously dismissed this claim because the plaintiffs had not alleged that they communicated with the website. In the amended complaint, they alleged communications with the website and alleged that cookies on their devices enabled tracking of transmission-control-protocol or user-datagram-protocol port numbers, protocol-level metadata, and HTTP request-header metadata. The plaintiffs argued that these categories could involve addressing, signaling, and dialing information covered by the pen-register statute.

The court held that the allegations were sufficient at the pleading stage. It stated that the plaintiffs did not need to plead exactly how the metadata was tracked. Whether the cookies tracked information covered by the statute would depend on a fuller factual record, including what was tracked, where the alleged pen-register device was installed, and whether it tracked qualifying information from outgoing communications.

Cuevas Garcia’s common-law fraud claim

California common-law fraud requires a misrepresentation or concealment, knowledge that it was false, an intent to induce reliance, justifiable reliance, and resulting damage. Federal Rule of Civil Procedure 9(b) also requires fraud allegations to identify the basic details of the alleged misconduct, including who, what, when, where, and how.

The court had previously dismissed Cuevas Garcia’s fraud claim because her earlier allegation that she visited the website “in or around 2024” was not specific enough. In the amended complaint, she alleged that she visited the website multiple times during a three-month period between June and August 2024.

The court found that timeframe sufficiently specific. The complaint identified the alleged tracking cookies, explained why the website’s conduct was misleading—because cookies allowing third parties to track her activity were allegedly installed—and stated when the conduct occurred. The court also noted that Smith & Wesson possessed information about which cookies were used and how they were used during that period. It therefore concluded that the amended complaint gave Smith & Wesson adequate notice under Rule 9(b).

Disposition

The court denied Smith & Wesson’s motion to dismiss. The opinion did not decide whether the plaintiffs will ultimately prevail on their claims; it decided only that the specified claims could proceed beyond the pleading stage.