A fresh California Invasion of Privacy Act (“CIPA”) opinion highlights a successful avenue to dismissing a complaint where the plaintiff alleges a violation of their protectable privacy interests, but fails to sufficiently outline what specific kinds of personal data were collected to constitute an infringement of CIPA.
In Bonkowski v. Maison Miru LLC, No. 2:25-CV-05546-MEMF-MAA, 2026 WL 2337889 (C.D. Cal. Aug. 12, 2026), plaintiff Robert Bonkowski brought a CIPA suit against jewelry company Maison Miru. Bonkowski alleged that information collected by Maison Miru and shared with TikTok, Facebook, Snapchat, and Pinterest violated his privacy interests. After browsing Maison Miru’s website, Bonkowski alleged that tracking pixels installed on the website by the aforementioned social media services captured information about his online behavior. This information included instances where a user added an item to a cart, the value of purchases, the type of content purchased, IP address, metadata, and other device information which would allow social media companies to link online activity to a user’s profile with the goal of improving targeted advertising.
Maison Miru moved to dismiss Bonkowski’s complaint on the grounds that he lacked Article III standing because he had not alleged a concrete harm, and thus could not state a claim for relief under CIPA. Bonkowski, a website tester who is a frequent CIPA litigator, contended that collection of his personal data using tracking pixels without his consent sufficiently constituted a violation.
The court noted that Bonkowski’s allegations were similar to those made by a plaintiff in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). In Popa, allegations that a website tracked information such as the date a user visited a website, the device and browser used, geographic user location, and information such as text input, clicks and scrolling did not constitute an infringement of a privacy interest. Although Bonkowski had similar information collected by tracking pixels, he did not explain what was “embarrassing, invasive, or otherwise private” about the information disclosed. Similarly, Bonkowski did not plead that Maison Miru’s website had exposed his “likes, dislikes, interests, and habits over a significant amount of time.”
In light of this, the court found that Bonkowski’s complaint did not establish liability for an invasion of privacy and therefore did not establish a concrete harm which would give rise to Article III standing. Maison Miru’s motion to dismiss was granted, with leave to amend.
The Bonkowski case provides a great example of how to respond to a complaint where a plaintiff establishes that data was collected, but does not sufficiently argue that the data collection represented an actual invasion of privacy. Simple allegations that trackers have collected data without an explanation of harm which could constitute a cause of action gives defendants a speedy avenue to dismissal.
Talk to you soon CIPAWorld! Stay compliant, and stay safe.