Hi CIPAWorld!
Picture the whole thing starting with a lamp.
An individual named Joseph Limas goes to wayfair.com looking for furniture, like most of us have. Home decor, lighting fixtures, bedding, bath, some outdoor stuff, maybe a shelving unit. Normal Tuesday night browsing. He’s a real shopper — he says so in the complaint, and the Court took him at his word.
What he alleges he didn’t know is that six other companies were in the room with him. Including TikTok, Meta, Pinterest, Snapchat, Twitter/X and Reddit. All of them sitting inside Wayfair’s website in the form of pixels, allegedly reading the pages he clicked, matching him to his social accounts, and shipping the whole picture off to be turned into better ads.
No cookie banner. No privacy policy in his face. Just a lamp search and, allegedly, six strangers taking notes.
So he sued.
Two claims: CIPA section 631(a), and section 638.51.
And on August 13, Chief Judge Dolly M. Gee ruled on Wayfair’s motion to dismiss. Limas v. Wayfair LLC, No. CV 25-11185-DMG (Ex), 2026 WL 2351592 (C.D. Cal. Aug. 13, 2026).
Here’s the part worth reading.
Wayfair did not phone this motion in. They brought everything. Nine or ten separate theories, some of them genuinely creative, stacked one on top of the other in the hope that one would land. And the Court walked down the line and knocked over almost every single one.
The encryption gambit. Wayfair argued that if a message gets encrypted, it isn’t the “same” communication anymore, and it wasn’t intercepted “in transit.” Clever. If it worked, half the CIPA docket evaporates overnight. The Court wasn’t buying. Judge Gee went to the plain text and found that “same” in section 631(a) is just doing grammar work, it points back to the earlier list of message, report, or communication so the statute doesn’t have to repeat itself. It is not a requirement that the data stay in identical form the whole way down the wire. The Court also noted Wayfair was leaning on unreported district court decisions, including one where the court basically said it agreed with defendants and moved on. That’s not much to build a novel statutory reading on.
The “you didn’t say what you searched” argument: Wayfair said Limas never pled which specific queries he typed or what came back. The Court said the FAC does something even better. It walks through each tool, shows sample pages, shows the code sitting on the site, and explains exactly what each one grabs. At the pleading stage, that’s enough.
Snapchat, the odd one out: Every tool in this case allegedly links you to your social account except Snapchat’s. Wayfair leaned on that. And the Court agreed that IP addresses alone don’t carry a reasonable expectation of privacy, the Ninth Circuit settled that. But the Snapchat tool, as alleged, tracks what products you looked at, follows you across your devices, and matches all of it against data Snapchat already holds on millions of people. Different animals. Claim survives.
The service provider exemption: This one is my favorite. Wayfair argued it qualifies as a “provider of electronic or wire communication service” because — wait for it — it owns and operates a website. The Court’s response was essentially: if that’s the test, every website in America is exempt and the statute means nothing. An online furniture company is not in the business of providing communication service. And even if it were, Wayfair never explained how ad-improvement pixels fit into any of the five qualifying purposes the statute lists.
Rule of lenity: Rejected. You need a real, egregious ambiguity to invoke it, and Wayfair didn’t identify one.
Canon against absurd results: Also rejected. The argument was basically that too many websites are getting sued. The Court noted that isn’t a canon, it’s a complaint, and the Legislature already built consent-based off-ramps into CIPA.
The First Amendment: This is where it gets a little brutal. Wayfair argued the duplicated transmissions were its own speech. The Court couldn’t figure out what protected expression Wayfair had engaged in at all, the transmissions are the user’s, and Wayfair has no role in duplicating them. Then the line that will get quoted in every opposition brief for the next year: installing software cannot reasonably constitute protected expression.
So Wayfair went 0-for-basically-everything.
Except one.
The pen register claim under section 638.51 got dismissed. Without leave to amend. Gone.
Not because pen register theory is bad. Not because the Court found the tools weren’t pen registers. The Court never reached the merits at all.
Wayfair challenged the pen register claim on pages 16 to 17 of its motion. Plaintiff’s opposition ran through the CIPA arguments and simply never answered it. Didn’t defend it, didn’t distinguish the cases, didn’t mention it. And under settled law in the district, failing to respond to an argument raised in an opening brief is waiver.
So the Court deemed it conceded and dismissed it for the reasons stated in Wayfair’s motion. Dead on the page. No amendment.
Meanwhile the trap and trace claim under the same statutory section sailed right through incoming impulses, reasonably likely to identify, alternative pleading, all of it fine.
Think about that for a second. Wayfair spent twenty-some pages constructing arguments about encryption and the First Amendment and the rule of lenity and lost every one of them. The only thing they won, they won because nobody wrote a response.
Wayfair’s answer to the First Amended Complaint is due August 28, 2026.
We’ll keep you posted, CIPAWorld!