Hi CIPAWorld!
Sometimes a privacy case gets decided before anyone argues about privacy. This is one of those.
On September 1, 2026, Judge Paul A. Engelmayer dismissed a putative class action against mParticle, Inc. and its parent, Rokt US Corp., under Rule 12(b)(1). Hayward v. mParticle, Inc., No. 25 Civ. 8173 (PAE), 2026 WL 2582794 (S.D.N.Y. Sept. 1, 2026). No injury in fact. And because the Court found no standing, it never reached the 12(b)(6) arguments at all.
Here’s how it went.
Here’s what was alleged.
Three California plaintiffs — Hayward, Garcia, and Ybarra — used online services including Venmo, Peacock, and the NBC App. Those services ran mParticle’s “IDSync” software.
The Second Amended Complaint alleged that mParticle quietly assigned each plaintiff a unique mParticle ID, intercepted their email addresses, names, phone numbers, and device and advertising identifiers as they logged in and transacted, and built a persistent profile anchored to that ID. The profiles were then enriched with age, gender, address, and event data reflecting what the user actually did.
And the SAC did not stop there. It alleged mParticle tells clients how to configure their CNAME records so mParticle traffic looks like first-party traffic, defeating ad blockers, Safari, Firefox, and Do Not Track. It alleged machine-learning models generating “Predictive Attributes.” It alleged forwarding to Google, Meta, and Adobe, plus cookie syncing with partners. It alleged Rokt paid roughly $300 million for mParticle in January 2025 precisely because of that real-time data feed.
Claims were brought under California common law, the California Constitution, and CIPA.
Sounds like a lot. I know. But it wasn’t enough.
It’s the transfer that decided the case.
Hayward filed originally in the Northern District of California. Defendants moved to transfer under § 1404, Judge Donato granted it, and the case landed in the Southern District of New York.
Which raised a question neither side briefed: whose standing law applies now?
The Court answered it anyway. Questions of state substantive law — choice-of-law rules, for example — come from the jurisdiction where the action was filed. Questions of federal law come from the transferee circuit. Van Dusen v. Barrack, 376 U.S. 612, 639 (1964); Menowitz v. Brown, 991 F.2d 36, 40–41 (2d Cir. 1993). And Article III standing, the Court held, is a quintessential question of federal law.
So the Second Circuit precedent governed. Not Ninth Circuit precedent. Plaintiffs filed in San Francisco and got their standing analysis run under McMorris, Cooper, Liau, and Xu.
That was effectively the ballgame.
Device IDs identify devices.
First, the mParticle IDs, device IDs, and advertising IDs. Courts have rejected the idea that those are personally identifiable information, because they identify devices rather than particular individuals. Quoting Afriyie v. NBCUniversal Media, LLC, 775 F. Supp. 3d 791, 809 (S.D.N.Y. 2025), the Court noted that without something more, like a name or address, “the device remains anonymous—a nameless and faceless device among a million others.” Same for the user profile identifiers, which as pled did not reveal anyone’s identity. See also Wilson v. Triller, Inc., 598 F. Supp. 3d 82, 92 (S.D.N.Y. 2022).
Emails and phone numbers are the “less sensitive” tier
Second, the email addresses and phone numbers collected from Hayward and Ybarra. Under McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295, 303 (2d Cir. 2021), the question is whether the data exposed is sensitive enough to create a high risk of identity theft or fraud. Emails and phone numbers are the “less sensitive data” that Cooper v. Bonobos, Inc., No. 21 Civ. 854, 2022 WL 170622, at *3 (S.D.N.Y. 2022), found insufficient, and that Liau v. Weee! Inc., No. 23 Civ. 1177, 2024 WL 729259, at *4–5 (S.D.N.Y. Feb. 22, 2024), found unlikely to be susceptible to misuse. Nowhere near Social Security numbers, medical information, passports, or driver’s licenses.
The Venmo data was closer, and still not enough
Third, and this is the interesting one — the Venmo names, unique Venmo IDs, payment amounts, recipient names, profile types, and the “note” field that accompanies a payment.
Plaintiffs pitched this as more sensitive. The Court agreed it was the strongest piece and dismissed it anyway. The SAC never pled a concrete future risk of harm from it. No allegation of how this data enables a future theft the way credit card numbers or bank passwords would. No Venmo passwords were captured. And no allegation that plaintiffs had incurred or would incur mitigation expenses. See Zhizhi Xu v. Reuters News & Media Inc., No. 24 Civ. 2466, 2025 WL 488501, at *3 (S.D.N.Y. Feb. 13, 2025).
The Court put the payment data in the same bucket as the “order amount” and “order comments” that Liau held to be relatively quotidian private information.
Intrusion upon seclusion fared no better
Same information, same result. Applying Restatement (Second) of Torts § 652B, the Court noted that this District finds a cognizable injury only where the complaint alleges interference with records concerning a plaintiff’s most sensitive private affairs — Social Security numbers, health care information, banking information, family details. Am. Fed’n of Gov’t Emps., AFL-CIO v. U.S. Off. of Pers. Mgmt., 786 F. Supp. 3d 647, 679 (S.D.N.Y. 2025).
The Venmo notes came closest again. But the SAC never pled what any note actually said, or that notes by their nature carry private content rather than “split the dinner check.”
Note footnote 3, which is worth the price of admission for defense counsel: the CNAME theory failed because the SAC pled only that mParticle offered instructions on configuring CNAME records. Not that it was the default. Not that any client actually followed them as to these plaintiffs.
And the device-burden theory
The SAC’s last swing was device impact — tracking technologies “similar to mParticle” consuming an extra 15% in power and 899 KB per page in bandwidth. Too vague and speculative. The named plaintiffs never alleged they experienced any of it: no bandwidth problem, no battery problem, nothing.
Here’s what I’d keep in mind from this case:
Venue is not a housekeeping issue: A § 1404 transfer moved the federal-law analysis from the Ninth Circuit to the Second. If you are defending a tracking case filed in California and a transfer motion is realistically available, the standing consequences alone may justify the effort.
Plead-the-specifics wins standing fights: Nearly every theory here failed on specificity, not on legal theory. Generalized allegations about what the technology can do, without allegations about what happened to these plaintiffs, do not create injury in fact in the Second Circuit.
“PII” is a label, not an allegation: The Court said so plainly: the SAC called it PII, but the concrete allegations underlying that term fell short.
Dismissal was without prejudice: Carter v. HealthPort Techs., LLC, 822 F.3d 47, 54–55 (2d Cir. 2016). Which means these claims are not dead. A federal court holding that plaintiffs lack Article III standing is also an invitation to state court, where that requirement doesn’t apply and California courts have been considerably more receptive to CIPA claims. Expect a refiling.
We’ll keep you posted, CIPAWorld!