Northern District of California Underscores Futility of Certain CIPA “Trap and Trace” Class Actions

By Jennifer Hadley Catero

The Northern District of California recently dismissed, with prejudice, a purported class action against Royal Caribbean Cruises Ltd. (Royal Caribbean), alleging a violation of the California Invasion of Privacy Act (CIPA) via a TikTok “trap and trace” tool. In Kishnani v. Royal Caribbean Cruises Ltd.,¹ the Plaintiff alleged that Royal Caribbean violated CIPA through its website’s use of a TikTok tracking tool. Plaintiff alleged that the software used on Royal Caribbean’s Website: (1) “cause[s] the extraction and transmission of data . . . so that each person who visits the Website can be personally identified;” (2) “collects as much data as it can . . . and matches it with existing data that TikTok has acquired;” (3) “gathers device and browser information, geographic information, referral tracking and URL tracking. . . ultimately sent to TikTok;” and (4) “scans every page of the Website visited for additional information about the visitor, such as name, date of birth, and address.” The Court held that these allegations were conclusory in nature and failed to allege a sufficiently concrete injury to confer Article III standing.
 
The Court relied upon the United States Supreme Court holding in TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021) for the proposition that an “injury in law is not an injury in fact,” and a “legislature’s creation of a statutory prohibition or obligation and a cause of action does not relieve courts of the responsibility to independently decide whether a plaintiff has suffered concrete harm under Article III.” In the case at hand, the Plaintiff failed to allege a concrete injury in fact inasmuch as he failed to allege basic facts such as “when and how many times [he] visited the site, what information [he] provided, what information Defendant captured, whether [he] was aware of Defendant’s tracking practices, or if [he] had any reason to believe that [he] was indeed de-anonymized.”² The Court noted that while Plaintiff did allege that Defendant “could” potentially gain additional information such as name, date of birth, and address and that this “could” intrude on the right to privacy – here the allegations were insufficient to “convert that hypothetical into concrete harm to him.” In light of this, the Court held that the Plaintiff lacked Article III standing and dismissed Plaintiff’s claim with prejudice.

Perhaps motivated by the fact that counsel for Plaintiff filed “at last fifteen substantively identical cases in California federal district court” “in this year alone” (which the Court took pains to list out in a dedicated footnote), the Court did not stop here with its analysis. Instead, the Order goes on to point out that even if Plaintiff could allege that specific information about him had been collected by the TikTok tracking tool – the CIPA claim would still fail because the statute would then cease to apply. This is because under CIPA, a “trap and trace device” is defined as “a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of the communication.”³ (emphasis added). Thus, by definition, a “trap and trace device” captures identifying information “about” a communication (i.e. the metadata) but not the “contents” of the communication. To allege standing, a Plaintiff would necessarily have to allege the device captured the content of the communication but, in that instance, the statute would then cease to apply. The Court noted that this critical distinction “crystalizes the futility of Plaintiff’s suit (and the myriad identical cases Plaintiff’s counsel has filed in both federal and state courts)” arising from the TikTok software.