Hi, CIPAWorld! Kelly Sandberg here, with a recent complaint filed by Levi & Korsinsky, LLP, a law firm that has brought at least five other similar data privacy claims so far this year.
In Hodges v. United Parcel Service, Inc. et al., Plaintiff Julie Hodges brought action against Defendants alleging violations of common law invasion of privacy, intrusion upon seclusion, invasion of privacy under the California Constitution, California Invasion of Privacy Act (“CIPA”), the Wiretap Act, and common law fraud, deceit and/or misrepresentation. Complaint, Hodges v. United States Parcel Service, Inc. et al., No. 3:26-cv-11887 (N.D. Cal. Oct. 14, 2026), ECF No.1.
Defendants own and operate the website https://www.ups.com/, which allows users to send and track their packages, pay shipping bills, or open mailboxes. Defendants’ website provides a data privacy banner and a cookie preferences interface that allows users to control what data is shared with third parties.
Plaintiff visited the website in August of 2026 to track a package. She was presented with the website’s privacy banner and clicked the button “Essential Cookies Only” to reject non-necessary cookies. The sensitive information collected was then simultaneously transmitted to the third-party tracking entities including Google, Microsoft, The Trade Desk, and Tealium (the “Tracking Entities”), by each company’s tracking tools.
Plaintiff alleges that at the moment she visited the defendant’s website, transmitting cookies and other third-party tracking technologies began tracking her data prior to her ability to determine her cookie preferences or interact with the website’s privacy banner.
Plaintiff alleges that these Tracking Entities collected her data, including the webpages she viewed, her device type, operating system, browser type, and other personal identifiers that associate her with an individual profile.
Interestingly, Plaintiff defined this data collected as “Sensitive Information” without any further showing that the information collected was considered to be private or sensitive information.
In my opinion, if Microsoft v. Popa is applied here, the case may be dismissed for a lack of Article III standing because California courts have been requiring these allegations to provide a showing that “embarrassing, invasive, or otherwise private information [was] collected” Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025).
Read more about the use of Popa v. Microsoft here: NO STANDING, BUT NOT SO FAST: NerdWallet CIPA Case Heads Back to State Court After Popa.
Additionally, an argument I have not yet seen in other California data privacy complaints provided that because Plaintiff valued the privacy and exclusivity of her Sensitive Information “[i]t is plausible, and indeed likely, that Plaintiff would at some point have monetized her data by selling or licensing it through one of the many available channels.” Compl. ¶ 97, ECF No.1.
Assuming that this argument was provided to bolster Plaintiff’s claim for unjust enrichment, it would not be a bad one if California Courts have consistently allowed causes of action for unjust enrichment.
California courts have provided that they “[do] not recognize a separate cause of action for unjust enrichment.” Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 119 (N.D. Cal. 2020). Although the Ninth Circuit and the California Supreme Court have permitted independent claims of unjust enrichment to proceed, a plaintiff has to show “that the defendant received an unjustly retained [] benefit at the plaintiff’s expense.” Shah v. Cap. One Fin. Corp., 768 F. Supp. 3d 1033, 1051 (N.D. Cal. 2025) (citing Katz-Lacabe v. Oracle Am., Inc., 668 F. Supp. 3d 928, 945 (N.D. Cal. 2023).
And while the court in Shah determined that the plaintiff’s allegations could survive a motion to dismiss because they had pled that the defendant benefited from using plaintiff’s information, and that plaintiff’s remedies at law were inadequate, there is a strong argument here to dismiss Plaintiff’s unjust enrichment claim where they fail to allege that their remedy at law would be inadequate.
Realistically speaking, how much do you think the data collected when you track a package online from your most recent purchase is really worth?
Read more about how Shah here: CAPITAL ONE SUED: Plaintiffs Allege 17 Separate Causes of Action in New Website Tracking Case
Lastly, I think that the Court is likely to find that the party exception under CIPA § 631 is likely to apply here and will dismiss the claim – given that the argument is brought by defense counsel.
Because the complaint plainly provides that Plaintiff’s “communication” was made to Defendant’s website itself before being intercepted by third-party tracking tools, then the Court may find that Defendant was considered to be a party to the communication and would fall within the party exception.
I am excited to see how defense counsel responds and what the Court ultimately determines. There appear to be some strong arguments to dismiss multiple causes of action that were pled here, but we will keep an eye out on how these arguments turn out!