Lutge v. Timex.com

Background

Trevor Lutge sued Timex.com, Inc., individually and on behalf of a proposed class. He alleged that Timex allowed Klaviyo, a third-party company, to collect information about website visitors through cookies and embedded code without their consent. The alleged information included website activity, purchase activity, names, email addresses, phone numbers, and other identifiers. Lutge alleged that he rejected cookie tracking while visiting Timex’s website and purchasing a watch on or around February 13, 2025, but that information about his interactions and purchase was nevertheless sent to Klaviyo.

Lutge asserted claims under the Electronic Communications Privacy Act, the California Invasion of Privacy Act, and the California Constitution. Timex moved to transfer the case to the District of Connecticut under 28 U.S.C. § 1404(a), or alternatively to dismiss all claims for failure to state a claim. Timex did not seek dismissal based on standing.

Standing Analysis

The court independently considered standing, which is the requirement that a plaintiff show a concrete, real injury that gives a federal court authority to hear the case. The court explained that a privacy violation does not automatically create standing. For an alleged intangible privacy injury, the alleged harm must be similar to an injury traditionally recognized by the legal system, such as a sufficiently offensive intrusion into private affairs.

The court compared Lutge’s allegations with Ninth Circuit precedent involving session-replay technology. It concluded that the information collected from Timex’s website—Lutge’s name, email address, and watch-browsing and purchase activity—was not sufficiently confidential, sensitive, or invasive to constitute an actionable intrusion. The court acknowledged that Klaviyo’s alleged identity-resolution technology could connect information to a particular consumer and could use information from other sources. But Lutge did not allege that Klaviyo had actually created an extensive, invasive profile comparable to a comprehensive “cradle-to-grave” profile.

The court also recognized that Timex allegedly misrepresented the effect of rejecting cookies. It held, however, that deception alone did not make the collection of otherwise routine, nonsensitive information highly offensive. The court distinguished cases involving medical, immigration, health, or other especially sensitive information, as well as cases involving much more extensive tracking.

Disposition

The court held that Lutge had not established Article III standing and therefore dismissed for lack of jurisdiction. It granted Timex’s motion to dismiss without prejudice and dismissed Lutge’s complaint with leave to amend. The court did not reach Timex’s transfer request or the merits of Lutge’s privacy claims.