Greetings CIPAWorld!
Just picked up a fresh California Invasion of Privacy Act (“CIPA”) ruling from Judge William H. Orrick in the Northern District of California that deserves your attention.
In Adam v. CaringBridge, Inc., No. 25-cv-06042-WHO, 2025 WL 3493565 (N.D. Cal. Dec. 5, 2025), the Court granted Defendant’s motion to transfer this putative class action all the way to Minnesota, even though venue was technically proper in California. How so, you may ask? A forum selection clause was buried in the website’s Terms of Use.
By way of background, CaringBridge operates a website that helps caregivers and individuals share and document health journeys. Think of it as a platform where people going through serious medical situations can connect with loved ones and coordinate care. To use the site, visitors must create an account and agree to the Terms of Use and Privacy Policy. This is a standard practice we see every day. However, here’s where it gets interesting for our purposes: Plaintiff alleged that to create an account, users had to disclose their health condition through a drop-down menu with options like “Brain Cancer,” “HIV/AIDS,” and “Substance Use Disorder.” Id. at *6. Pretty sensitive stuff at issue here.
Plaintiff, a California resident, claimed that while she was providing sensitive medical information, CaringBridge used Google Analytics and Meta Pixel to intercept her data in real time and share it with third parties for marketing and advertising purposes. She filed a putative class action in the Northern District of California, raising claims under CIPA, the California Constitution, and the federal Electronic Communications Privacy Act.
CaringBridge responded with a motion to transfer (or alternatively dismiss), pointing to the forum selection clause in its Terms of Use requiring that “any legal action or proceeding relating to your access to, or use of, this service or these terms of use shall be instituted only in a state or federal court located in Hennepin County, Minnesota.” Id. at *3.
Now, here’s where the legal analysis gets nuanced. Judge Orrick first addressed whether venue was even proper in California under 28 U.S.C. § 1391. The Judge made an important distinction: forum selection clauses can only be enforced under a motion to transfer pursuant to § 1404(a), not under a motion to dismiss for improper venue under § 1406(a). See Atl. Marine Constr. Co. v. U.S. Dist. Ct. for W. Dist. of Tex., 571 U.S. 49, 52 (2013). So the Court couldn’t even consider the forum-selection clause when deciding whether the venue was proper in California.
On the venue question itself, the Court found it a close call but ultimately concluded that venue was proper in the Northern District. Here, Plaintiff relied on Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 131 (3d Cir. 2022), which held that intercepted communications occur “at the plaintiff’s browser, not where the signals were received at defendant’s servers.” Under this reasoning, the interception happened in California, where Plaintiff was browsing, not in Minnesota, where CaringBridge’s servers sit. The Court accepted this argument for purposes of finding venue proper under § 1391(a)(2).
But here’s the kicker: venue being proper in California didn’t save the case from transfer!
Once the Court moved to the § 1404(a) transfer analysis, the forum selection clause changed everything. As the Court explained, when a valid forum selection clause exists, courts “must deem all factors relating to the private interests of the parties … entirely in favor of the preselected forum.” Sun v. Advanced China Healthcare, Inc., 901 F.3d 1081, 1087–88 (9th Cir. 2018). The party opposing transfer bears the burden to show why the clause shouldn’t apply, and the “practical result is that a forum-selection clause should control except in unusual cases.” Bromlow v. D&M Carriers, LLC, 438 F. Supp. 3d 1021, 1027 (N.D. Cal. 2020) (quoting Atl. Marine, 571 U.S. at 64).
Plaintiff tried a creative argument to avoid the clause. She pointed to the Terms of Use’s choice-of-law provision, which applies Minnesota law except for the conflict of laws provisions that would indicate the application of the laws of any other jurisdiction. Plaintiff asserted that CIPA represents a fundamental policy of California, and because Minnesota has no comparable wiretapping statute, applying Minnesota law would leave the California subclass without a remedy.
With this in mind, Judge Orrick distinguished In re Facebook Biometric Information Privacy Litigation, 185 F. Supp. 3d 1155, 1169 (N.D. Cal. 2016), where a Court declined to enforce a California choice-of-law clause because it conflicted with Illinois’s fundamental policy embodied in the Illinois Biometric Information Privacy Act. But that case dealt with choice-of-law AFTER transfer, not whether transfer should occur in the first place. The forum selection clause and the choice-of-law clause are separate issues. As the Court noted that if the parties disagree about which state law is applicable, they may address this issue with the District of Minnesota. In other words, the CIPA claim isn’t gone; it’s just going to be litigated in Minnesota, where the choice-of-law issues can be addressed.
Plaintiff also argued that the Terms of Use didn’t apply because some data (IP address, geolocation, browser info) was collected before she agreed to them. But the Court found this unconvincing, as the sensitive health information at the heart of the Complaint was collected only after users agreed to the Terms of Use and Privacy Policy.
Balancing the traditional Jones v. GNC Franchising, Inc., 211 F.3d 495, 498–99 (9th Cir. 2000), transfer factors, the Court found that most were neutral or favored transfer. Plaintiff’s choice of forum, usually given great weight, was significantly diminished both because this is a class action (where the named plaintiff’s choice gets less deference) and because Plaintiff had agreed to the forum selection clause. Additionally, an essential part of the reasoning was that witness convenience favored transfer since all of CaringBridge’s employees and relevant witnesses are in Minnesota. The costs of litigation also favored transfer, given that most evidence is located in Minnesota.
So what are the key takeaways here?
First, forum-selection clauses remain powerful tools for defendants in CIPA litigation matters. Even when the venue is technically proper in California, a well-drafted forum-selection clause can send the case to another jurisdiction.
Second, the CIPA fundamental policy argument hasn’t necessarily vanished. Plaintiff raised a legitimate point: California has a strong interest in protecting its citizens’ privacy, and Minnesota lacks a comparable statute. That argument will have more traction in the choice-of-law context once the case is actually in Minnesota. This matter just held that it doesn’t prevent transfer.
Lastly, the Popa analysis on where interception occurs (at the browser vs. the server) remains good law for establishing venue, even if it didn’t ultimately save this particular case from transfer.
At bottom, we’ll keep watching to see how this case develops and whether Plaintiff can successfully assert that California law should apply.
As always,
Keep it legal, keep it smart, and stay ahead of the game.
Talk soon!
CIPAWorld 