The deluge of lawsuits and demand letters under the California Invasion of Privacy Act (CIPA) has prompted courts to scrutinize CIPA claims more rigorously, including the threshold question of whether CIPA plaintiffs have standing to sue. Recent federal and state court decisions have now answered the standing question in the negative, and the resulting dismissals of CIPA litigation may indicate some relief from the CIPA onslaught. 

For example, in Gabrielli v. Insider, Inc., No. 24-cv-01566 (ER), 2025 WL 522515 (S.D.N.Y. Feb. 18, 2025), plaintiff claimed that the defendant violated CIPA’s restrictions as to pen registers by deploying technology on its website that captured and sent plaintiff’s IP address to a third party. As is typical in CIPA litigation, plaintiff argued that the mere statutory violation itself was sufficient to confer standing. The district court disagreed. Citing TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the district court found that plaintiff had failed to identify any harm from the alleged sharing of an IP address that was analogous to privacy interests protected under common law, rejecting plaintiff’s position that an IP address necessarily implicates “a legally protected privacy interest[.]” The district court also rejected plaintiff’s argument that CIPA’s pen register restrictions codified any substantive privacy right, holding that the alleged violation was at most a “bare procedural violation, divorced from any concrete harm.” Finding that these deficiencies could not be cured by amendment, the court dismissed the complaint without leave to amend. 

Although California state courts apply a slightly different analysis, these courts generally require that a plaintiff allege a concrete injury or allege the violation of a statute that authorizes public interest lawsuits by plaintiffs not injured by the statutory violation. See, e.g., Muha v. Experian Info. Sols., Inc., 106 Cal. App. 5th 199, 208-09 (2024). A series of trial court decisions have recently concluded that CIPA is not such a statute and have dismissed lawsuits based on the premise that a mere statutory violation is insufficient to support standing. See, e.g., Rodriguez v. Fountain9, Inc., No. 24STCV04504, 2024 WL 4905217 (Cal. Super. Ct. L.A. Cty. Nov. 21, 2024). Although these decisions are not citable in California state court, they can be invoked in response to demand letters—or their reasoning deployed in motions to dismiss.

This trend further suggests that courts will continue to challenge individual and putative class action litigation brought on the premise that any CIPA violation confers sufficient standing. These decisions may stem the tide of further litigation in this area and provide companies with an additional basis to reject increasingly indiscriminate CIPA claims.