Hi CIPAWorld!
In Malko v. GNC Holdings, LLC, No. 2:26-cv-01833-MCS-AJR, 2026 WL 2218133 (C.D. Cal. July 29, 2026), the United States District Court for the Central District of California dismissed an eight count putative class action for lack of Article III standing. The data at issue was the sort almost every retail website collects, and the only product Plaintiff bought was a pre-workout supplement.
Plaintiff Anthony Malko alleged that GNC’s website captured his cookie IDs, device IDs, IP addresses, and browser metadata along with the full-string URLs of the pages he viewed, which showed the products he looked at and that he was shopping for health-related items. He alleged GNC used that data to “enrich persistent profiles” it shared with its parent company, Harbin Pharmaceutical Group. On one visit he searched for and bought a product called LIT On-The-Go Pre-Workout. From that came eight claims: (1) violation of the Electronic Communications Privacy Act (“ECPA”), (2) violation of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 631; (3) violation of CIPA, Cal. Penal Code § 632; (4) unjust enrichment; (5) invasion of privacy in violation of the California Constitution; (6) intrusion upon seclusion under California common law; (7) violation of the Comprehensive Computer Data and Access and Fraud Act, Cal. Penal Code § 502; and (8) violation of California’s Unfair Competition Law, Cal. Bus. & Prof. Code § 17200.
In the Ninth Circuit, standing under data privacy statutes turns on whether the plaintiff alleged disclosure of “embarrassing, invasive, or otherwise private information.” Popa v. Microsoft Corp., 153 F.4th 784, 791 (9th Cir. 2025). Malko never alleged GNC collected his name, address, phone number, or email, or linked any of those to the data it did collect. So the only data in play was his identifiers and the page URLs, and “internet users have no expectation of privacy in the IP addresses of the sites they visit.” United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008). The persistent profile theory had a different problem. Malko alleged GNC enriched profiles with his data, but he never alleged what else was in them. Plaintiffs who have successfully alleged an intrusion into privacy pleaded tracking across thousands of websites, profiles tied to email addresses and other personal identifiers, or decades of offline records added to the profile. Without any of that, the conduct alleged looked like a retailer watching a customer walk the aisles, which Popa places outside the injury requirement.
Malko also argued that the URL data GNC collected and transmitted “revealed [an] interest in health-related products.” The Court accepted that tracking can be offensive where sensitive medical information is involved, but held that shopping for a health product does not reveal medical information about the shopper. Browsing a supplement retailer says no more about a buyer than searching publicly available information about a disease, and a pre-workout tub reveals nothing about Plaintiff’s own health. The Court, however, said that other GNC products such as vitamins and supplements might reveal sensitive health information about the buyer.
Plaintiff’s economic injury theories failed too. Unjust enrichment requires that the defendant’s conduct be unjust, and because the privacy injury failed, nothing GNC earned from the data was unjustly earned. On benefit of the bargain, the Court called the allegation that class members would not have purchased had they known their privacy would not be respected conclusory, because it did not show that Plaintiff bought anything because of a representation GNC made about data collection, or that GNC’s data practices were part of the bargain at all. Under McGee v. S-L Snacks National, 982 F.3d 700, 706 (9th Cir. 2020), a plaintiff must show he did not receive a benefit he actually bargained for, not merely one he assumed he was getting. Overpayment theory was not successful either, because Malko never alleged the pre-workout he bought had a hidden defect or was worth objectively less than he paid for it.
The takeaway from Malko is that standing in these tracking cases turns on what the data reveals about the plaintiff. The volume collected is not the question. Identifiers and page URLs that are not tied to a name, and that come with no description of the profile they supposedly built, will not show an injury. Whether the data is sensitive health information depends on what the plaintiff actually bought.
We will keep you posted, CIPAWorld!