Good Morning CIPA World! I’m back with yet another cookies case. This time the health oriented fitness tracking application, MyFitnessPal (“MFP”), moved to dismiss Plaintiffs’ Shah’s and Wiley’s (“Plaintiffs”) amended complaint.
In Shah v. MyFitnessPal, Inc., No. 25-CV-04430-PCP, 2026 WL 2908824 (N.D. Cal. Sept. 28, 2026), Plaintiffs alleged that MFP’s website falsely represented that users could opt out of being tracked by online third-party data brokers and advertisers. They further alleged that multiple third parties tracked their browsing activities while using MFP’s website–even after opting out of tracking cookies. This blog will go over each of the grounds on which MFP attempted to dismiss Plaintiffs’ claims and explain the court’s rationale in granting or denying the Motion.
Timing
MFP moved to dismiss Plaintiffs’ CIPA, invasion of privacy, and unjust enrichment claims as untimely. MFP argued that Plaintiffs should have brought their CIPA claims by February of 2024 and their invasion of privacy claims by February of 2025, given the statute of limitations associated with each claim. However, Plaintiffs’ complaint stated that Plaintiffs visited MFP’s website at some point during the last four years. The Court read this as including the last one or two years, making it possible that the plaintiffs’ claims were brought on time.
The court therefore denied MFP’s Motion to Dismiss on timeliness grounds.
Wiretapping
Next, MFP moved to dismiss plaintiffs’ wiretapping claim, arguing that Plaintiffs did not properly plead that third parties violated the second clause of the provision. Clause 2 of California Penal Code section 631(a) prohibits any person from “read[ing], or attempt[ing] to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit.” Cal. Penal Code § 631 (West). Here, the term “content” is defined as the substance or intended message of a communication.
Shah alleged that his browsing information was shared with third parties after visiting MFP’s meal planning and recipes webpage. Wiley alleged that she attempted to use MFP’s application and input personal information such as her name, gender, and health goals, which MFP then shared with third parties.
The Court found that only Wiley’s allegations supported a viable wiretapping claim. It reasoned that Shah’s browsing activity while navigating to the meal planning and recipes webpage did not constitute a communication. Wiley’s website activity, on the other hand, was deemed a communication because she directly informed the website of her personal information when trying the MFP application.
Accordingly, MFP’s Motion to Dismiss Plaintiffs’ wiretapping claim was denied with regard to Wiley and granted with regard to Shah.
Pen Register
California Penal Code § 638.51(a) prohibits “install[ing] or us[ing] a pen register” without a court order under specific circumstances. Cal. Penal Code § 638.51 (West). A “pen register” is defined as “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Cal. Penal Code § 638.50(b) (West)
Unlike Shah, Wiley stated a plausible claim under this provision because she sufficiently alleged that she communicated with MFP’s website by entering her personal information and preferences. Shah’s mere allegation that his browsing activity had been tracked did not meet the definition of a communication and therefore was not a sufficiently pleaded claim.
It was also important that Plaintiffs alleged that the third parties collected “UDP port numbers, protocol-level metadata, and HTPP request header metadata”, which are the mechanisms by which internet traffic is directed and electronic communications are managed. This helped support Plaintiffs’ claims that the cookies were recording routing and signaling information, as required by the Pen Register provision.
Additionally, the court was not convinced by MFP’s argument that Plaintiffs inadequately alleged scienter, which requires an individual to act with intent or knowledge of their wrongdoing. The court found Plaintiffs satisfied the scienter requirement by alleging that MFP disregarded its website visitors’ decision to opt out of cookies and continued to share their information with third parties.
For these reasons, the court granted MFP’s Motion to Dismiss the Pen Register claim as to Shah and denied it as to Wiley.
Common Law Fraud, Deceit, and Misrepresentation
In California, a fraud claim requires a showing of (1) misrepresentation; (2) scienter; (3) intent to defraud; (4) justifiable reliance; and (5) resulting damages. In addition to these requirements, the fraud claim must be pleaded with particularity, which means addressing the who, what, where, when, and how of the alleged misconduct.
In its Motion to Dismiss Plaintiffs’ fraud, deceit, and misrepresentation claim, MFP argued that Plaintiffs failed to plead the “when” with sufficient particularity. The court did not agree. Plaintiffs identified the specific months in which they visited MFP’s website, which, according to the court, was specific enough. MFP knows what cookies were used and how they were used during the months Plaintiffs alleged. As such, knowing the months during which Plaintiffs used the website provided MFP with the information necessary to focus their inquiry and address Plaintiffs claims.
As a result, MFP’s Motion to Dismiss Plaintiff’s Common Law Fraud, Deceit, and Misrepresentation claim was denied.
Thanks for tuning in and see you soon!