WENDOVER PRODUCTIONS, LLC, et al., v. PAYPAL INC, et al.
Case No. 5:24-cv-09470-BLF
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION
November 21, 2025
ORDER GRANTING MOTION TO DISMISS FIRST AMENDED COMPLAINT [Re: ECF No. 204]
For the reasons described below, the Court GRANTS the motion.
I. BACKGROUND
This case involves the affiliate marketing industry. FAC ¶¶ 50-53. Plaintiffs are bloggers, podcasters, and other social media influencers (“Affiliate Marketers“) who use their websites and social media platforms to promote products sold by e-commerce merchants (“Merchants“) to their online audiences. Id. ¶¶ 3, 9-35. The Honey Browser Extension (“Honey“), purchased by PayPal for $4 billion in 2020,1 is a free web browser extension that enables consumers to scan the internet
The basic structure of the affiliate marketing ecosystem is relatively straightforward: Affiliate Marketers—often acting through affiliate network platforms (“Affiliate Networks“)—enter into agreements with Merchants in which Affiliate Marketers generate traffic and leads to Merchants’ online storefronts in exchange for commissions from each resulting sale. Id. ¶¶ 54-56. Generally, Merchants provide partnering Affiliate Marketers with “affiliate links,” hyperlinks that direct consumers to Merchants’ online storefronts and contain identifiers that are unique to each Affiliate Marketer (“Affiliate IDs“), which in turn are used to track referrals and assign commissions. Id. ¶¶ 62-63. The Affiliate ID is a “custom alphanumeric string that Merchants use to identify the associated Affiliate Marketer.” Id. ¶ 70. By clicking on an affiliate link, a consumer is redirected to a Merchant‘s product page and prompted to make a purchase: Clicking on the affiliate link also causes a tracking code or cookie containing the Affiliate Marketer‘s Affiliate ID to be stored on the consumer‘s web browser for a set amount of time and log the consumer‘s purchasing activity so that that any purchase resulting from clicking on the affiliate link is attributed to the referring Affiliate Marketer. Id. ¶¶ 65-66, 74.
The predominant attribution method used by the affiliating marketing industry is “last click attribution,” wherein “the Affiliate Marketer who provided the last affiliate link used prior to purchase gets credit for the sale.” Id. ¶ 66; see also id. ¶¶ 87-89. Consumers are generally aware of this arrangement, and many Affiliate Marketers specifically advise their audiences that “following their affiliate links compensates Affiliate Marketers and allows them to produce the
Plaintiffs allege that “PayPal has been stealing for itself Affiliate Commissions that properly belong to [them] . . . [by] replac[ing] the Affiliate Marketer[s‘] Affiliate ID[s] with PayPal‘s own Affiliate ID during the consumer[s‘] checkout process, thus diverting the Affiliate Commission[s] to itself.” Id. ¶ 3. According to Plaintiffs, PayPal engages in “cookie stuffing“—when a consumer engages with Honey in any way, the browser extension surreptitiously creates a hidden tab, iframe, or refresh that reloads the Merchant‘s website that replaces Plaintiffs affiliate links with PayPal‘s own affiliate link, “which signals to the Merchant that PayPal, rather than the Affiliate Marketer who created the business opportunity, should receive the Affiliate Commission.” Id. ¶¶ 112-15. This practice allegedly allows PayPal to take credit for a sale even when Honey played no role in driving the consumer to ultimately make the purchase, id. ¶ 131, since it takes place regardless of whether Honey in fact offers consumers any coupons or discounts, cashback rewards, or the option to pay with PayPal, id. ¶ 152.
II. LEGAL STANDARD
A party may challenge the Court‘s subject matter jurisdiction by bringing a motion to dismiss under
A court has discretion to allow leave to amend the complaint pursuant to
III. DISCUSSION
A. Standing
“[T]he ‘irreducible constitutional minimum’ of standing consists of three elements.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). The plaintiff bears the burden of establishing that he or she “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id.; see also FW/PBS, Inc. v. Dallas, 493 U.S. 215, 231 (1990). “To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.‘” Spokeo, 578 U.S. at 339 (quoting Lujan, 504 U.S. at 560).
PayPal argues that Plaintiffs have not alleged an Article III injury for two related reasons. Mot. at 5. First, PayPal urges that Plaintiffs’ alleged harm (i.e., the lost commissions) is not traceable to Honey but instead to the last-click attribution system, which PayPal does not control. Second, PayPal argues that Plaintiffs fail to plead sufficient factual allegations that PayPal received any commissions that Plaintiffs were in fact entitled to under their contracts with the Merchants. Plaintiffs respond that they have sufficiently alleged loss of commissions that they were entitled to and would have received but for PayPal‘s alleged illegal actions, seeking to analogize this case to a recent decision in the U.S. District Court for the Eastern District of Virginia, where the court found that plaintiffs had established standing under similar circumstances. See Opp. at 4 (citing In re Capital One Fin. Corp., No. 25-cv-00023-AJT, 2025 WL 1570973 (E.D. Va. June 2, 2025)).
Turning first to traceability, PayPal argues that “having elected to participate in the affiliate marketing system, [Plaintiffs] are not harmed by subjecting themselves to its rules,” contending that assigning full credit to the last affiliate is simply a feature of the last-click attribution system, which Plaintiffs agreed to in their agreements with the merchants. Mot. at 5. In other words, PayPal‘s theory is that Plaintiffs’ alleged injury is just as traceable to the merchants, who execute agreements with both PayPal and Plaintiffs and control the allocation or distribution of commissions. Plaintiffs respond that “the Complaint alleges the industry standard is that credit is given to the ‘last click’ where multiple legitimate clicks exist, while PayPal manufactures illegitimate clicks.” Opp. at 5. Plaintiffs further argue that PayPal is characterizing an industry practice outside the scope of the FAC and that they are entitled to the Court‘s inferences in their favor. See id. at 6. Plaintiffs’ emphasis on the relevant industry standard misses the mark. Plaintiffs cannot establish a cognizable injury by conclusorily alleging that they were denied commissions due to them under an industry standard when the FAC alleges that the commissions were due under their contracts with the merchants.
At bottom, the problem with the FAC—regardless of how Plaintiffs or PayPal choose to characterize the precise contours of the last-click attribution system—is that it does not establish that Plaintiffs were in fact entitled to those commissions pursuant to their contracts with the merchants. Indeed, the FAC does not contain any allegations at all about the terms of Plaintiffs’ agreements with the merchants, distinguishing it from Capital One, where the court‘s entire traceability analysis was based on the plaintiffs in that case establishing “a causal connection between the injury and the conduct claimed of” based on the terms of the contracts. Capital One, 2025 WL 1570973, at *6 (quoting Lujan, 504 U.S. at 560); see also id. (“The merchants’ agreements cited in the Complaint demonstrate that Plaintiffs are entitled to the commission once a consumer (i) navigates to the merchant‘s website through the Plaintiffs’ affiliated link, (ii) does not subsequently navigate to the website through another affiliate link, and (iii) makes a purchase.“).
Apart from failing to plausibly allege that PayPal is responsible for causing Plaintiffs to miss out on commissions they were otherwise due, the FAC also relies on a “highly attenuated chain of possibilities” in place of alleging a concrete and particularized injury. Clapper v. Amnesty Int‘l USA, 568 U.S. 398, 410 (2013). The FAC purports to establish a concrete injury to Plaintiffs in two ways—by providing (1) a “representative sample” of what happens when Plaintiff Justin Tech Tips‘s affiliate link for a product sold by third-party Adorama is clicked and (2) a Monte Carlo simulation showing that there is a 97.2% change that Honey stole at least one commission from each Plaintiff. Id. ¶¶ 163-64, 258-64. These allegations fail to plausibly allege that PayPal harmed each of the named Plaintiffs by siphoning commissions away from them. See Murthy v. Missouri, 603 U.S. 43, 61 (2024).
PayPal urges that Plaintiffs’ theory of standing rests on the following chain of possibilities: “(1) at least one consumer clicks on one of Plaintiffs’ links; (2) that consumer has Honey downloaded; (3) Honey partners with the merchant website; (4) the consumer purchases the product without first clicking on another affiliate marketers’ link; (5) the consumer uses Honey when checking out; (6) Honey receives the commission rather than standing down based on its contractual agreements with merchants; and (7) Honey is not the sale‘s but-for cause.” Plaintiffs respond that the FAC establishes a plausible theory of harm based on the concrete facts of Plaintiff‘s affiliate marketing relationships, the number of existing Honey users, the representative example, and the statistical simulation. Plaintiffs’ theory at bottom amounts to no more than asking the Court to look at the state of the industry and guess as to how likely it is that PayPal has diverted commissions away from them. And, unlike the situation in Capital One, the representative example does not actually show that any Plaintiff in fact lost out on a commission. Cf. Capital One, 2025 WL 1570973, at *5 (“[W]hen the Extension was used as to [Plaintiffs], no commission was derived from the qualifying purchase; whereas, when the Extension was not used, [Plaintiffs] received commissions . . . .“).
The FAC does not plead a concrete injury traceable to PayPal. The Court accordingly finds that Plaintiffs lack standing and GRANTS PayPal‘s motion in its entirety.
B. Leave to Amend
1. Computer Fraud Claims
Plaintiffs’ claims under the Computer Fraud and Abuse Act (“CFAA“),
The permissions granted to the Honey Browser Extension are extensive and far beyond what would be needed to deliver a coupon-searching tool. . . [T]he Honey Browser Extension is able to access all domains—i.e., websites—that a consumer accesses, along with all “subdomains” on those sites. This means that the Honey Browser Extension, unbeknownst to the consumer, is able to operate in the background—accessing pages or, critically, creating pages—even where a consumer does not navigate to them. PayPal uses the Honey Browser Extension code to do at least the following:
- Cookies: Query and modify cookies, and be notified when they change;
- webRequest: observe and analyze web traffic, and block or modify incoming web;
- scripting: the Honey Browser Extension can execute script, meaning it can run a sequence of instructions, or code, or perform specific tasks (i.e., follow the steps provided for it in a piece of computer code);
- Storage: store, retrieve, and track changes to consumer data; and
- Alarms: schedule code to run periodically or at a specified time[.]
FAC ¶ 133. The problem for Plaintiffs is that each of the provisions of the CFAA and CDAFA cited in the FAC requires them to plead that PayPal either acted without authorization or exceeded
“‘Authorization’ is an affirmative notion indicating that access is restricted to those specially recognized or admitted.” hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195-96 (9th Cir. 2022). Here, the FAC expressly states that, in downloading Honey, consumers grant PayPal “extensive” permissions—for the purpose of the CFAA and CDAFA, it is of no consequence that Plaintiffs apparently believe that these authorizations are “far beyond what would be needed to deliver a coupon-searching tool.” FAC ¶ 133. If anything, this concession only confirms that these claims as pleaded must fail, since, absent any allegation of fraud or deception, it demonstrates that customers voluntarily and affirmatively granted authorization to PayPal to carry out the actions that Plaintiffs complain of in their Computer Fraud claims. In this manner, the case here is distinguishable from Capital One, where the court found that the defendant‘s privacy policy merely gave it permission to “measure” and “record” user interactions, not to modify cookies. 2025 WL 1570973, at *13.
Plaintiffs nonetheless argue that, even if the FAC concedes that customers granted PayPal a broad suite of permissions, its “tricks are far beyond anything authorized by consumers, as ‘even assuming consumers are authorizing some degree of modification via the ‘use’ of their cookie . . . consumers are not expressly authorizing [PayPal] to override Plaintiffs’ tracking codes.” Opp at 9 (alterations in original) (quoting Capital One, 2025 WL 1570973, at *13). The problem with this argument is that elsewhere the FAC admits that PayPal uses the very same permissions it was granted to carry out the challenged conduct. See, e.g., FAC ¶ 144 (“In reality, the Honey Browser Extension uses its permissions to surreptitiously open up a discrete, hard-to-see/hidden tab to the left of all other tabs, denoted by just a small icon . . . .” (emphasis added)). While Plaintiffs now argue that “Consumers authorize Honey to search for coupons . . . [and not] to surreptitiously inject hidden tabs and overwrite preexisting cookie data,” Opp. at 9, they did not plead as much. In any case, neither statute imposes any duty to disclose how permissions will be exercised, and Plaintiffs’ reasoning is foreclosed by the Supreme Court‘s decision in Van Buren v. United States, 593 U.S. 374 (2021), where the Court clarified that CFAA does not attach to authorized uses of
Accordingly, if Plaintiffs are able to show standing in the Second Amended Complaint, Plaintiffs will need to amend their Computer Fraud claims to survive a
2. Unjust Enrichment
Plaintiffs’ unjust enrichment claim is not currently pleaded with sufficient factual particularity to invoke this Court‘s equitable jurisdiction. See, e.g., In re Accellion, Inc. Data Breach Litig., 713 F. Supp. 3d 623, 648 (N.D. Cal. 2024), recon. denied, 2024 WL 4592367 (N.D. Cal. Oct. 28, 2024) (explaining that plaintiffs must demonstrate that they lack an adequate remedy at law to state a claim for unjust enrichment); Chiulli v. Am. Honda Motor Co., 690 F. Supp. 3d 1038, 1062 (N.D. Cal. 2023) (dismissing unjust enrichment claim for failure to plausibly allege inadequate remedy at law). The only invocation of the Court‘s equitable jurisdiction in the FAC is that the unjust enrichment claim is “in the alternative to those claims sounding in contract and seeking damages,” as well as the conclusory allegation that “there is no adequate remedy at law to address Defendants’ conduct.” FAC ¶ 364.
Plaintiffs’ unjust enrichment claim fails for an additional reason that is closely intertwined with their lack of standing, namely, that from the face of the FAC it appears that the subject matter of the claim is governed by Plaintiffs relationships with third-party Merchants. See Talavera v. Glob. Payments, Inc., 670 F. Supp. 3d 1074, 1110 (S.D. Cal. 2023) (“[N]o action for unjust enrichment lies . . . where a legal remedy for the same wrong is available against a different party. . . .” (citations omitted)). Plaintiffs plead only that PayPal wrongfully appropriates for itself the commissions to which they are entitled under their contracts with partnering merchants, but it is a well-established principle of California common law that a plaintiff “may not plead the existence of an enforceable contract and maintain a quasi-contract claim at the same time, unless
3. Business Tort Claims
In addition to depriving them of Article III standing, Plaintiffs’ failure to allege any of the terms of their contracts with their Merchants is also fatal to their three claims for tortious interference with contracts or economic advantage. Each of these claims requires a showing that Plaintiffs’ relationships with the merchants were actually disrupted. Reeves v. Hanlon, 33 Cal. 4th 1140, 1148 (2004) (explaining that such claims require “actual disruption of the relationship” or “actual breach” of a contract); see also Redfearn v. Trader Joe‘s Co., 20 Cal. App. 5th 989, 1005 (2018). Here, the relationships and/or contracts that PayPal allegedly disrupted were the products of “agreements between Affiliate Marketers, Merchants, and affiliate networks,” FAC ¶ 1, but the FAC does not allege that PayPal actually received any commissions from Merchants that were otherwise due to Plaintiffs. In any case, determining whether PayPal disrupted Plaintiffs’ contracts “require[s] the . . . court to determine what contractual rights [Plaintiffs] possess[ed.]” United Nat. Maint., Inc. v. San Diego Convention Ctr., Inc., 766 F.3d 1002, 1009 (9th Cir. 2014) (emphasis added).
Plaintiffs’ claim for negligent interference fails for the independent reason that the FAC does not allege the breach of any duty of care. LiMandri v. Judkins, 52 Cal. App. 4th 326, 348 (1997) (The tort of negligent interference with economic relationship arises only when the defendant owes the plaintiff a duty of care.“); see also Barnes v. Black, 71 Cal. App. 4th 1473, 1478 (1999). At oral argument PayPal represented that there could be no duty of care because Plaintiffs and PayPal are competitors, but even if the Parties are not competitors the negligent interference claim would not survive the motion to dismiss stage because of the complete failure to allege any duty of care that was breached by PayPal. In the absence of such a pleading, the FAC shows that the Parties were at most strangers, such that a claim for negligence cannot lie.
4. Consumer Protection Claims
Plaintiffs’ consumer protection and unfair competition claims currently fail for many of the
IV. ORDER
For the foregoing reasons, the motion is GRANTED. The FAC is DISMISSED WITH LEAVE TO AMEND. Plaintiffs SHALL file an amended complaint within 45 days of the date of this order. No new claims or parties may be added without leave of the Court.
Dated: November 21, 2025
BETH LABSON FREEMAN
United States District Judge