In a significant win for Royal Caribbean Cruises, a federal judge dismissed a lawsuit that alleged the cruise line’s website violated a California privacy law by using a TikTok tracking tool. The case, Kishnani v. Royal Caribbean Cruises, challenged the cruise operator’s use of the tool under the California Invasion of Privacy Act (CIPA), which restricts the use of so-called “trap and trace” devices.

CIPA prohibits tracking devices that capture identifying information about a communication’s origin, such as telephone numbers, without a court order. CIPA was first intended to restrict and prohibit wiretaps. However, the U.S. District Court for the Northern District of California held that the statute does not apply to the collection of message content, such as names, addresses, and other biographical details.

Plaintiff Kieren Kishnani claimed the TikTok tool collected metadata, including browser type, device details, location, and URL tracking in violation of CIPA. However, Judge Noël Wise found that Kishnani failed to allege a concrete injury and offered only conclusory statements. Even if metadata had been collected, the court ruled that basic contact and tracking information does not meet the threshold of a legally recognized harm under CIPA.

Judge Wise also emphasized that to the extent the tool may collect biographical content voluntarily submitted by users, such data falls outside CIPA’s scope. Crucially, the court also ruled that Kishnani has no reasonable expectation of privacy over metadata, and that the TikTok tool does not qualify as a “trap and trace” device as defined under the law.

The court dismissed the case with prejudice, meaning Kishnani cannot amend and refile the complaint.

The decision underscores the challenges of using CIPA to target modern web tracking technologies—particularly when plaintiffs cannot demonstrate personal harm or link data collection practices to prohibited activities under the statute. This is a win for businesses across the country.