Wiley v. Universal Music Investments

Background

Christine Wiley and Vishal Shah filed an amended complaint against Universal Music Investments, Inc. (UMI). They alleged that UMI’s websites placed certain cookies on their devices and transmitted browsing information to third parties even though they had expressly opted out of receiving non-essential cookies. The amended complaint asserted claims for invasion of privacy, intrusion upon seclusion, unlawful wiretapping under California Penal Code section 631(a), unlawful use of a pen register under California Penal Code section 638.51(a), and unjust enrichment.

The plaintiffs alleged that their visits to UMI-related websites resulted in third parties receiving full-string URLs, session information, user identifiers, device information, button interactions, referring and clicked URLs, and geolocation data. The court had previously allowed some privacy-related and unjust-enrichment claims to proceed but had found the earlier wiretapping, pen-register, and several other claims insufficiently pleaded. The amended complaint omitted the previously rejected fraud, contract, implied-covenant, and trespass-to-chattels claims.

Timeliness and standing

UMI argued that the plaintiffs’ claims were barred by statutes of limitations because the complaint identified website visits occurring more than one year before the initial complaint. The court denied dismissal on that basis. It held that the complaint’s allegation that the plaintiffs visited the websites during the “last four years” did not conclusively establish that the claims were untimely. The court also held that the plaintiffs plausibly alleged fraudulent concealment, which may toll the limitations period, because they alleged that they had no reason or technical ability to know whether the websites honored their cookie choices.

UMI also argued that the plaintiffs lacked Article III standing because the collected data was not sufficiently private. The court rejected that argument. It held that the plaintiffs adequately alleged a concrete privacy injury based on disclosure of personal browsing information that could be embarrassing, invasive, or otherwise private, together with alleged deception about the websites’ tracking practices.

Wiretapping and pen-register claims

The court granted UMI’s motion to dismiss the California wiretapping claim. California Penal Code section 631(a) prohibits reading or learning the contents or meaning of a communication while it is in transit. The court found that the amended complaint adequately alleged that third parties intercepted the plaintiffs’ activity, but it did not plausibly allege that they intercepted the contents of communications. The allegations described webpage addresses and browsing information, including URLs for product and event pages, rather than messages the plaintiffs communicated to the websites. The court also noted that the amended complaint expressly excluded user-input search queries from the allegedly intercepted information.

The court also granted UMI’s motion to dismiss the pen-register claim. A pen register records or decodes dialing, routing, addressing, or signaling information associated with an electronic communication, but not the communication’s contents. The court concluded that the plaintiffs primarily alleged recording of website visits, clicks, and browsing activity, without alleging that they sent an express or implied message to the websites. The court therefore found the allegations insufficient to show that UMI or third parties recorded or decoded information associated with a qualifying communication.

Disposition

The court denied UMI’s motion to dismiss the invasion-of-privacy, intrusion-upon-seclusion, and unjust-enrichment claims. It also denied the motion insofar as it challenged timeliness and Article III standing. The court granted dismissal of the CIPA wiretapping and pen-register claims with prejudice and without further leave to amend because the plaintiffs had already received one opportunity to amend those claims. The court granted UMI’s requests for judicial notice of the existence and contents of its privacy policy and excerpts from a California Assembly committee transcript, without drawing additional conclusions or inferences from those documents. Judge Pitts entered the order on September 14, 2026.