Hi, CIPAWorld! Kelly Sandberg here, with a case on the importance of properly pleading data privacy claims.
In Annabel Kady, et al., v. Opencare Inc., Plaintiff Annabel Kady and Plaintiff Taylor (“Plaintiffs”) brought action against Defendant Opencare Inc., (“Opencare”) for installing third party tracking tools on their website that allegedly collected Plaintiffs private information. Annabel Kady, et al., v. Opencare Inc., No. 4:25-CV-05037-KAW, 2026 WL 2574336 (N.D. Cal. Aug. 31, 2026). Plaintiffs alleged multiple causes of action, including violations of the Electronic Communications Privacy Act (“ECPA”) and the California Invasion of Privacy Act (“CIPA”).
Ultimately, the United States District Court for the Northern District of California granted in part and denied in part Opencare’s motion to dismiss. However, they provided Plaintiffs with leave to amend their complaint.
Opencare connects patients to local dental providers through their website, https://www.opencare.com/. When a website user accesses Opencare’s services, they provide their location, email address, insurance information, when they last visited a dentist, whether they are experiencing a dental emergency, the nature of their dental problem(s) and further user data.
The website contains third party tracking tools that collect and transmit a user’s provided information to recipients such as Google, Facebook and Tik Tok. These recipients are then able to identify the user’s real-world identity and use the private information collected to sell targeted digital advertising to users based on their medical conditions.
In July 2023, Plaintiff Kady visited Opencare’s website to research conditions, find dentists and book her appointments. In March 2025, Plaintiff Taylor began using Opencare’s website to research dental conditions and treatments to find local dentists. After using the website, Plaintiffs began receiving unsolicited advertisements related to their disclosed medical conditions. Plaintiffs then brought action in June of 2025, and Opencare moved to dismiss the action under Federal Rule of Civil Procedure 12(b)(6).
Under Federal Rule of Civil Procedure 12(b)(6), a party may file a motion to dismiss based on the failure to state a claim upon which relief may be granted.
Opencare argued that Plaintiffs failed to state a claim under because “‘(i) the content at issue is not covered by the narrow statutory definition; (ii) Opencare was a party to the communication and cannot intentionally intercept its own communication []; and (iii) Plaintiffs consented to the communication….’” Annabel Kady, et al., v. Opencare Inc., No. 4:25-CV-05037-KAW, 2026 WL 2574336, at *8 (N.D. Cal. Aug. 31, 2026).
The Court only found Opencare’s second argument to be meritorious. The Court analyzed both the ECPA and CIPA together when analyzing each statutes party exemption rules, following the case of In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020).
“Both statutes contain an exemption from liability for a person who is a ‘party’ to the communication, whether acting under the color of law or not.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 607.
The Court found that because Opencare was considered a party to the communications, they could therefore not intercept their own communications under the ECPA. In regard to Plaintiffs CIPA claim, the Court followed Shah v. MyFitnessPal, Inc., requiring Plaintiffs to allege that a third party intercepted their communications on Opencare’s website in order to have adequately plead a wiretapping claim. Plaintiffs’ allegations that Opencare merely tracked their communications on the website was not sufficient.
The Court also dismissed Plaintiffs seventh cause of action for the unlawful use of a pen register or trap and trace device in violation of California Penal Code §638.51 as to Plaintiff Kady individually.
Kady’s claims were barred by CIPA’s one year statute of limitations because she had accessed Opencare’s website in July 2023, and Plaintiffs had not filed their claims until June 2025.
Despite Plaintiff Kady’s contention that the delayed discovery rule applied and her claim was therefore not barred, the Court found that the operative complaint did not allege specific facts to support the imposition that the delayed discovery rule applied.
The important takeaway to note here is that plaintiffs must allege more than mere internet tracking of communications in data privacy claims, meaning they must provide greater detail of a third party’s interception in order to succeed on such claims.