Khamooshi v. Politico LLC
3:24-cv-07836
| N.D. Cal. | May 13, 2025Background
- Plaintiffs are California residents who visited Politico’s website and allege their IP addresses and related browser/device data were shared with third-party trackers for analytics and advertising without consent.
- Plaintiffs assert claims under various California privacy and unfair competition statutes, seeking various remedies including statutory damages and injunctive relief.
- Plaintiffs filed the lawsuit in California state court; Defendant removed it to federal court, where the cases were consolidated.
- Politico moved to dismiss for lack of Article III standing, arguing that Plaintiffs’ alleged injuries are not sufficiently concrete for federal jurisdiction.
- The court focused on whether the disclosure of IP addresses alone gives rise to a concrete (non-abstract) injury sufficient for standing under federal law.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Concrete Privacy Injury | Disclosure of personal/IP info is an invasion of privacy; qualifies as concrete. | IP addresses and vague data are not legally protected privacy interests. | Disclosure of IP addresses alone is not concrete. |
| Statutory Violation (CIPA) | A violation of CIPA is a concrete injury, per Ninth Circuit precedent. | After TransUnion, statutory violation alone does not establish standing. | CIPA violation alone does not grant standing. |
| Economic Harm | Unjust enrichment from commercial use of plaintiffs’ data is concrete injury. | No unjust enrichment, as IP addresses are not private/sensitive information. | No plausible economic injury alleged. |
| Heightened Future Harm | Fear that information could be misused in future is concrete harm. | No facts supporting plausible future misuse/harm from disclosed data. | No standing based on future harm alleged. |
Key Cases Cited
- Spokeo, Inc. v. Robins, 578 U.S. 330 (concrete injury must be real, not abstract, to support standing)
- TransUnion LLC v. Ramirez, 594 U.S. 413 (Plaintiffs must show concrete harm, not just statutory violations, for Article III standing)
- Phillips v. U.S. Customs & Border Prot., 74 F.4th 986 (invasion of privacy is concrete, but depends on sensitivity of info disclosed)
- United States v. Forrester, 512 F.3d 500 (no expectation of privacy in IP addresses under the third-party doctrine)
- Carpenter v. United States, 585 U.S. 296 (no privacy expectation in data voluntarily provided to third parties)