EFREN RAMOS v. THE GAP, INC.
Case No. 23-cv-04715-HSG
United States District Court, Northern District of California
July 29, 2025
HAYWOOD S. GILLIAM, JR., United States District Judge
ORDER GRANTING SECOND MOTION TO DISMISS; Re: Dkt. No. 49
I. BACKGROUND
Plaintiff Efren Ramos initially filed this putative class action in September 2023. See Dkt. No. 1. Defendant moved to dismiss the complaint in its entirety, and the Court granted the motion. See Dkt. No. 40. In October 2024, Plaintiff filed an amended complaint. See Dkt. No. 41 (“FAC“). As before, Plaintiff alleges that Defendant invades customers’ privacy through the use of third-party tracking software. See generally id. Defendant is a clothing retailer that, as relevant to this lawsuit, sends its customers periodic marketing emails that contain hyperlinks to products on Defendant‘s website.1 See id. at ¶ 2.
According to the FAC, Defendant contracts with a third party, Bluecore, Inc., to embed “invisible pixels” and URLs in Defendant‘s marketing emails. See id. at ¶¶ 3, 5, 18–19. Plaintiff
Plaintiff alleges that Bluecore also uses JavaScript and other “persistent cookies” to continue to monitor customers as they navigate on Defendant‘s website “throughout their purchase journey.” See id. at ¶¶ 22, 36–38. According to the FAC, Bluecore aggregates the data from a customer‘s interaction with Defendant‘s emails and website to create a “highly detailed personal profile” of each customer. See id. at ¶¶ 5, 38.
Based on these allegations, Plaintiff brings causes of action against Defendant for (1) violations of the California Invasion of Privacy Act (“CIPA“),
II. LEGAL STANDARD
Federal Rule of Civil Procedure 8(a) requires that a complaint contain “a short and plain statement of the claim showing that the pleader is entitled to relief.”
In reviewing the plausibility of a complaint, courts “accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Nevertheless, courts do not “accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quoting Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)).
III. DISCUSSION
A. CIPA
Plaintiff alleges that Defendant‘s conduct constitutes an illegal wiretap under CIPA
(i) “by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps . . . any telegraph or telephone wire, line, cable, or instrument“;
(ii) “willfully reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit“; (iii) “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained“; and
(iv) “aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above.”
i. Direct Liability
A party to the communication cannot be held liable under
First, Plaintiff suggests that Defendant tapped “the private communications between Plaintiff and the Class Members (on the one hand) and their respective email providers (on the other)” by tracking when a Class Member opened one of Defendant‘s marketing emails. Dkt. No. 51 at 3. This theory is not alleged in the FAC, and Plaintiff‘s attempt to rewrite this allegation in the opposition is improper. See, e.g., FAC at ¶ 3 (“Bluecore wiretaps and intercepts Plaintiff‘s and Class Members’ email communications with Defendant.“) (emphasis added). But even if Plaintiff had adequately alleged this theory, the Court does not find it plausible. As the Court previously explained, email open rates are not content. See Dkt. No. 40 at 8–9. Plaintiff‘s theory, if
Second, Plaintiff suggests that Defendant tapped third-party emails whenever a Class Member forwarded one of Defendant‘s marketing emails to another person. See Dkt. No. 51 at 4. In the order granting the first motion to dismiss, the Court suggested that Plaintiff may be able to allege a plausible claim giving rise to direct liability under
The Court therefore GRANTS the motion to dismiss to the extent Plaintiff attempts to hold Defendant directly liable under
ii. Communications over the Internet: Clause One
The first clause of
iii. Protected Content: Clauses Two through Four
Clauses two and three of
Defendant argues that the FAC—like the original complaint—does not allege the wiretapping of protected “contents” under CIPA. See Dkt. No. 49 at 9–10. Plaintiff‘s theories are difficult to pin down, and Plaintiff appears to go out of his way to avoid identifying with any specificity the purported communications at issue here. But as best as the Court can discern, Plaintiff contends that (1) a user‘s “click” on a URL contained within Defendant‘s marketing emails is itself content; and (2) the URLs reveal the content of Defendant‘s marketing emails such that Bluecore can somehow “read” the actual marketing emails. The Court is not persuaded by either theory.
First, Plaintiff contends that a user‘s “click” on the embedded URLs within the marketing emails is a communication or “response” to Defendant that Bluecore intercepted. See Dkt. No. 51 at 8, 12–13. Plaintiff contends that clicking on the URL is the equivalent of a user saying, “I am interested in learning more about this shirt, please send me more information.” Dkt. No. 51 at 8;
The Court simply is not convinced by Plaintiff‘s characterization of the click of the embedded URL as a communication between Plaintiff and Defendant. As alleged, the marketing emails contain hyperlinked text and images that, when clicked, allow users to navigate to a specific webpage on Defendant‘s website (e.g., to a specific article of clothing). See FAC at ¶¶ 2, 30, 38. As such, and as the Court previously explained, the URLs appear to serve a tracking or routing function. See Dkt. No. 40 at 10. Under Plaintiff‘s new theory, however, any “click” on a URL would be a communication that the user is interested in the information linked in the URL. But the Ninth Circuit has not drawn such sweeping conclusions.
To the contrary, in Zynga, the Ninth Circuit disagreed with the plaintiffs that information obtained by clicking on a web address fell within the definition of protected “content.” See Zynga, 750 F.3d at 1106–09. Zynga was a game developer that offered free social gaming applications on Facebook‘s platform. See id. at 1101–02. To play, a user would click on a link to the game application from a Facebook webpage. See id. According to the plaintiffs, Zynga programmed its gaming applications to collect information about users from this click, including the user‘s Facebook ID and the address of the Facebook webpage that the user was viewing when he or she clicked on the game link. See id. Zynga then sent this information to third-party advertisers. See id. at 1102. But the Ninth Circuit held that this information was not protected content. See id. at 1106–09. The court reasoned that the Facebook ID only “function[ed] as a ‘name’ or a ‘subscriber number or identity.‘” Id. at 1107. And likewise, the webpage “identifie[d] the location of a webpage a user [was] viewing on the internet, and therefore function[ed] like an ‘address.‘” Id.
The Ninth Circuit contrasted this with examples in which a plaintiff sends “an email message saying ‘here‘s my Facebook ID number,’ or ‘you have to check out this website‘” or fills
Plaintiff attempts to distinguish Zynga in a single sentence. He asserts that here, “clicking on any of the URLs contained in the Email discloses why a customer arrived at the exact subpage on Defendant‘s Website (due to their response to Defendant‘s private email communication) rather than how they arrived to the Website (without revealing any other substantive information).” See Dkt. No. 51 at 11 (emphasis in original). But Plaintiff‘s attempt to distinguish between “why” a user arrived on a webpage and “how” he arrived there seems purely a matter of semantics. One could just as easily argue that in Zynga, clicking on the application revealed “why” a user arrived at the specific online game: the user was interested in that game and clicked on a link from a specific webpage. At bottom, Plaintiff offers nothing more than his unsupported assertion that clicking on the URLs in the marketing emails here—which direct the user to Defendant‘s website—constitutes a communication from Plaintiff to Defendant.3 This is not enough. See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 604–05 (9th Cir. 2020) (distinguishing between URLs collected in Zynga, “which revealed only that a Facebook user had clicked on a
Plaintiff‘s second argument seems even more contrived. Plaintiff argues that the URLs in the marketing emails allowed Bluecore to “read” the substance of Defendant‘s marketing emails because “the URLs are merely proxies for the specific image or words clicked on by the recipient.” See FAC at ¶ 27. Plaintiff repeats this allegation in several different ways:
- “The URLs and pixels are connected to the images that the customer or prospective customer sees in the Email such that when a customer clicks on the image within the Email to navigate to Defendant‘s website, the URL is transmitted to Bluecore, which corresponds to the image within the Email.” See id. at ¶ 3.
- “[B]y embedding a unique URL behind the hyperlinked text and images, when Plaintiff clicked on a hyperlink, Bluecore could identify the exact image or text that Plaintiff clicked on (e.g., a specific shirt) . . . .” Id. at ¶ 12.
- “The invisible URL links allow Bluecore to identify the particular contents of the email the customer or prospective customer clicked on, as well as which specific customer clicked on it.” Id. at ¶ 19.
- “Bluecore embeds hidden URL links within the clickable images and words of an email (i.e., the email‘s content because the hidden URL corresponds to the specific hyperlinked image or words contained within the body of the email).” Id. at ¶ 38.
- “The embedded URLs convey the intended message within the Email communications because they permitted Bluecore to identify the exact image or text (e.g., a specific shirt) that Plaintiff and the Class Members received and clicked on before their computers were redirected to the web page they originally sought to navigate to (i.e., the exact subpage of the precise items being clicked on within the emails).” Id. at ¶ 59.
Despite the repetition, this appears to be just another way of saying that the embedded
This is further reinforced by Plaintiff‘s description of the information actually conveyed by the URLs at issue here. Plaintiff broadly alleges that a URL can be broken down into the scheme, domain name, path, and query parameters. See id. at ¶¶ 28, 30. However, none of these elements allegedly “read” the contents of the email such that they intercept the actual “substance, purport, or meaning” of Defendant‘s emails. Zynga, 750 F.3d at 1104; see also Dkt. No. 40 at 10–11.
- Scheme: A scheme “[s]pecifies the method used to access the resource (e.g., http, https).” Id. at ¶ 28.
- Domain: A domain is “[t]he address of the server where the resource is hosted.” See id. at ¶ 28. In this context, the domain is the Banana Republic Factory website, https://bananarepublicfactory.gapfactory.com/. See id. at ¶¶ 13, 30.
- Path: The path is “[t]he specific location of the resource on the server.” See id. at ¶ 28. This is the specific webpage on the Banana Republic Factory website containing the specific article of clothing. See id. at ¶¶ 30, 38.
- Parameters: Parameters include “[a]dditional contextual data passed to the server.” See id. at ¶ 28. Here, Plaintiff suggests that this may include information such as the “source of the [website] traffic,” such as the marketing email; the “campaign” for which the email was sent (e.g., a “fall sale” clothing campaign); “which part of the email was clicked“; and “[a] unique identifier for the recipient” of the email.
Plaintiff‘s bare contrary assertion that Bluecore‘s software allows it to “read” the marketing emails is not enough to state a plausible claim.
To the extent the FAC suggests that Bluecore actually knows what Defendant‘s marketing emails say, it is not because of the information allegedly contained in and shared through the URLs. Rather, Plaintiff alleges that Bluecore helps create the marketing emails. See id. at ¶ 25 (“Emails embedded with Bluecore‘s spyware are created either by Defendant‘s marketing team or Bluecore, who create the design and layout of the Email (including text, images, buttons, and other visual assets).“). The emails are uploaded to Bluecore‘s “Visual Template Editor,” which embeds the URLs into the emails, and then the emails are ultimately sent through Bluecore‘s own platform. See id. at ¶¶ 19–20, 25–26, 29, 31, 40. Plaintiff also acknowledges that Bluecore “retains a visual copy of the Emails” on its own servers. See id. at ¶ 27. In other words, Bluecore creates both the emails and the URLs. Given this framework, even as alleged Bluecore has no need to recreate the marketing emails by piecing together information from the link(s) that Plaintiff may click on.4
And the cases that Plaintiff cites do not support his theory. For example, in Campbell v. Facebook, Inc., the plaintiff alleged that Facebook “scanned” the content of private messages that users sent to each other on Facebook‘s social media website. 315 F.R.D. 250, 255 (N.D. Cal. 2016). According to the complaint, Facebook was scanning the messages for links to other webpages. Id. Facebook would treat the link as a “like” of the webpage, and would further share this data with third parties to compile user profiles to deliver “targeted advertising.” See id. at 255–57.
Plaintiff also cites In re Meta Pixel Healthcare Litigation, in which Meta allegedly obtained health information about the plaintiffs from their health providers’ online patient portals. See 647 F. Supp. 3d 778, 784, 795–96 (N.D. Cal. 2022). According to the plaintiffs, their health providers used the “Meta Pixel” on their websites, which would send information back to Meta. See id. at 784–85. The Pixel enabled Meta to obtain information about patient status by capturing when a user logged into the patient portal and the URL from the patient portal. See id. at 785–86, 791-92. The Pixel also sent information to Meta about what the patient browsed on the patient portal, including doctors, medical conditions, and appointments. See id. The plaintiffs further alleged that Meta monetized this information by using it for targeted advertising on and off Facebook. See id. at 785–86. The plaintiffs’ expert, for example, explained that within two hours of searching for information on ulcerative colitis on the hospital‘s website, he was shown advertisements related to ulcerative colitis on Facebook. See id. at 786.
The court in In re Metal Pixel concluded that the log-in buttons and descriptive URLs that Meta obtained constituted content for purposes of CIPA because they contained the “query string,” which included any searches the user may have done on the healthcare provider‘s website. See id. at 795–96, & n.10. As such, the court reasoned that they constituted the communication between the user and the patient portal. Id. Here, however, Plaintiff has not alleged that such communicative information was transmitted through the URLs to Bluecore. As discussed above, the URLs were either created by or with Bluecore, and linked (i.e., functioned like an address) to products on Defendant‘s website.5
iv. CIPA § 635
Because the Court agrees with Defendant that Plaintiff has failed to plead the interception of protected content under
B. Statutory Larceny
Plaintiff also alleges that Defendant‘s conduct here constitutes statutory larceny. See FAC at ¶¶ 72–84. Specifically, Plaintiff alleges that Defendant “stole, took, and/or fraudulently appropriated Plaintiff and the Class members’ personal information without their consent” and for Defendant‘s own financial benefit. See FAC at ¶¶ 81–82.
According to Defendant, “property” must be “capable of exclusive possession or control. . . .” See Dkt. No. 49 at 12 (quoting Lau v. Gen Digital Inc., No. 22-CV-08981-RFL, 2024 WL 1880161, at *4 (N.D. Cal. Apr. 3, 2024)) (emphasis added). Defendant argues that Plaintiff‘s online data, including his browsing history, “is shared with a variety of service providers that facilitate access to the website at issue,” and thus is not within anyone‘s exclusive possession or control. Id. Plaintiff does not appear to dispute that exclusive possession or control is necessary to allege a statutory larceny claim. See Dkt. No. 51 at 14–15; see also G.S. Rasmussen & Assocs., Inc. v. Kalitta Flying Serv., Inc., 958 F.2d 896, 903 (9th Cir. 1992) (noting
Plaintiff states that Defendant stole information “directly from his private email account.” See id. at 15. He urges that he “had a legitimate exclusivity claim in his email data . . . .” Id. He suggests that Bluecore‘s software “caused Plaintiff‘s email provider to communicate with Bluecore‘s domain without his consent—this is akin to a person hacking into a private email account and sending unauthorized emails.” See id. The Court finds Plaintiff‘s argument difficult to follow and unsupported by any authority. Like Plaintiff‘s CIPA claim, Plaintiff provides few citations to the FAC to support his assertions. Moreover, Plaintiff offers no explanation why the “email data” that Defendant allegedly took was property that could be exclusively possessed or controlled, beyond his ipse dixit conclusion. The Court GRANTS the motion to dismiss Plaintiff‘s statutory larceny claim.
C. Unfair Competition Law (UCL)
Lastly, Plaintiff alleges that Defendant violated the UCL. See FAC at ¶¶ 85–97. In response, Defendant raises both procedural and substantive arguments. See Dkt. No. 49 at 12–15. However, because the UCL claim is dependent on Plaintiff‘s CIPA and statutory larceny claims, Plaintiff‘s UCL claim similarly fails. Plaintiff suggests that even if his CIPA and statutory larceny claims fail, some aspect of his UCL claim—particularly under the “unfair” prong—could survive because “Defendant‘s business practices could nonetheless have violated other subsections of CIPA as well as other claims that Plaintiff could have plausibly raised in the FAC . . . .” See Dkt. No. 51 at 17. But the question is not whether Plaintiff could plead a UCL claim based on some other violations or unfair conduct, but whether he in fact did so. Plaintiff offers no explanation as to how the FAC, as drafted, adequately alleges a UCL claim if his CIPA and statutory larceny claims fail. Nor does he explain how he could amend the complaint to support such a claim if given leave to do so. In short, Plaintiff has not adequately alleged that Defendant‘s conduct violates the UCL, and the Court GRANTS the motion to dismiss on this basis.
IV. CONCLUSION
The Court GRANTS the motion to dismiss. Dkt. No. 49. Particularly given the expansive
IT IS SO ORDERED.
Dated: 7/29/2025
HAYWOOD S. GILLIAM, JR.
United States District Judge