Judge Kerry Bensinger, Case Number: 24STCV13276, Date: 2025-03-07 Tentative Ruling

Plaintiff Dana Hughes (“Plaintiff”) brings this action against defendant Neiman Marcus Group, Inc. (“Defendant”) for violation of Penal Code section 638.61, otherwise known as the California Invasion Privacy Act (“CIPA”). As alleged by Plaintiff, Defendant operates https://www.neimanmarcus.com (the “Website”). Defendant installed TikTok Software for the purposes of fingerprinting and de-anonymization. The TikTok Software is a trap and trace device within the meaning of Penal Code section 638.50(c). Defendant installed and used the technology without first obtaining Plaintiff’s consent.

On May 28, 2024, Plaintiff filed a Complaint against Defendant for violations of the California Trap and Trace Law (Cal. Penal Code § 638.51). Plaintiff seeks injunctive relief and statutory damages pursuant to CIPA, among other relief.

Before the court are two motions: (1) Defendant’s Motion for Judgment on the Pleadings, and (2) Plaintiff’s Motion for Preliminary Injunction. The court addresses these motions in turn.

Defendant requests judicial notice of six (6) committee analyses of Assembly Bills concerning trap and trace devices. The unopposed request is GRANTED. (Evid. Code, § 452(c).)

Plaintiff requests judicial notice of five (5) court orders issued in other trap and trace cases. The unopposed request for judicial notice is GRANTED. (Evid. Code, § 452(d).)

“A motion for judgment on the pleadings performs the same function as a general demurrer, and hence attacks only defects disclosed on the face of the pleadings or by matters that can be judicially noticed.¿ [Citations.]”¿ (Burnett v. Chimney Sweep (2004) 123 Cal.App.4th 1057 1064.) The court must assume the truth of all properly pleaded material facts and allegations, but not contentions or conclusions of fact or law.¿ (Blank v. Kirwan (1985) 39 Cal.3d 311, 318; Wise v. Pacific Gas and Elec. Co. (2005) 132 Cal.App.4th 725, 738.)¿ “A judgment on the pleadings in favor of the defendant is appropriate when the complaint fails to allege facts sufficient to state a cause of action.¿ (Code Civ. Proc., § 438, subd. (c)(3)(B)(ii).)”¿ (Kapsimallis v. Allstate Ins. Co. (2002) 104 Cal.App.4th 667, 672.)¿ “Presentation of extrinsic evidence is therefore not proper on a motion for judgment on the pleadings.¿[Citation.]”¿ (Cloud v. Northrop Grumman Corp. (1998) 67 Cal.App.4th 995, 999.)¿ “The common law ground for a motion for judgment on the pleadings is identical to the statutory ground[.]” (Korchemny v. Piterman (2021) 68 Cal.App.5th 1032, 1055.) Allegations are to be liberally construed. (Code Civ. Proc., § 452.)

If the motion for judgment on the pleadings is granted, it may be granted with or without leave to amend. (Code Civ. Proc., § 438, subd. (h)(1).) “Where a demurrer is sustained or a motion for judgment on the pleadings is granted as to the original complaint, denial of leave to amend constitutes an abuse of discretion if the pleading does not show on its face that it is incapable of amendment.” (Virginia G. v. ABC Unified School Dist.¿(1993) 15 Cal.App.4th 1848, 1852 (emphasis added).)

Defendant argues the motion should be granted for four reasons: (1) Penal Code section 638.51[1] applies only to telephones communications, not website technologies; (2) the TikTok Software is not a trap and trace device; (3) Defendant is exempted from liability as a provider of an electronic communication service; and (4) Plaintiff fails to plead that the other statutorily permissible purposes for utilizing a trap and trace device do not apply. The court addresses the arguments in turn.

Section 638.51(a) provides, “(a) Except as provided in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order pursuant to Section 638.52 or 638.53.” (§ 638.51(a).)

Section 638.50(c) defines a trap and trace device as “a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.”

Defendant points out the definition of “trap and trace device” does not expressly state whether it includes general website technologies that capture incoming information from a website visitor’s device, the cross-referenced provisions in the statute, sections 638.52 and 638.53, confirm that it does not.” (Mot., p. 10:7-10.) Plaintiff argues the TikTok Software is sufficiently pleaded as a trap and trace device.

Defendant’s reliance on Sections 638.52 and 638.53 is misplaced. These sections permit law enforcement to seek an ex parte order for the use of a trap and trace device if certain conditions are met. Section 638.52(d) details specific information that must be included in a court order authorizing the use of a trap and trace device. Such information must include “[t]he identity, if known, of the person . . . in whose name is listed the telephone line to which the . . . trap and trace device is to be attached.” (§ 638.52(d)(1).) The order must also include “[t]he number and, if known, physical location of the telephone line to which the . . . trap and trace device is to be attached.” (§ 638.52(d)(3).) Furthermore, subdivision (c) states that a trap and trace device shall not include the physical location of the targeted individual “except to the extent that the location may be determined from the telephone number.” (§ 638.52(c).) On their face, sections 638.52 and 638.53 directly concern law enforcement and the requirements they must satisfy to obtain authorization for use of a trap and trace device. By contrast, Plaintiff is a private individual (i.e., not law enforcement) and is not seeking an ex parte order to use a trap and trace device. More to the point, there is nothing in sections 638.52 and 638.53 which suggests the definition of a trap and trace device is limited to a telephone line.

The correct starting point is the definition of a trap and trace device as provided under Section 638.50. Stated once again, a trap and trace device is defined as a “device or process” without referencing attachment to anything, including telephone lines. (See § 638.50(c).) And as pertinent here, a trap and trace device is broadly defined as a “device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication.” (Id.) Moreover, “electronic communication” is itself broadly defined as “any transfer of signs, signals, writings, images, sounds, data, or intelligence of any nature in whole or in part by a wire, radio, electromagnetic, photoelectric, or photo-optical system.” (§ 629.51(a)(2).) If a trap and trace device must be attached to a telephone line, there would be no reason to include “electronic communication”—which encompasses a broad range of transfers not limited to telephone lines—as part of its definition. Moreover, the court agrees with Plaintiff that the TikTok Software, as pled, falls within these definitions. The Complaint alleges that TikTok Software carries out a powerful “fingerprinting process” that instantly captures incoming “electronic impulses” and “signals” from anonymous visitors’ devices as soon as they land on a Website page, and each time they click on such pages. (Complaint, ¶¶ 12, 2-16.) This process is used to identify every visitor to the Website. (Id., ¶¶ 12-15.) The electronic impulses and signals allow the TikTok Software to “the gather[ ] browser information, geographic information, referral tracking, [ ] url tracking,” and user interests among other data. (Id. ¶ 13.) “TikTok Software collects as much data as it can about an otherwise anonymous visitor to the Website and matches it with existing data TikTok has acquired and accumulated about hundreds of millions of Americans.” (Id. ¶ 12.) Plaintiff’s allegations are consistent with the plain language of section 638.51. Because the statutory language is a reliable indicator of Legislature’s intended purpose, the court need not resort to other indicators of legislative intent such as the legislative history of the statute.[2] [3]

2. The TikTok Software is Sufficiently Alleged as a Trap and Trace Device or Process.

Defendant next argues that even if website technologies can be trap and trace devices, the TikTok Software is not such device because unlike a trap and trace device, the TikTok Software captures the contents of a communication.

The court returns to the definition. Section 638.50(c) defines a trap and trace device as “a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.” (Emphasis added.) The “contents” of a communication “refer[] to the intended message conveyed by the communication, and do[] not include record information regarding the characteristics of the message that is generated in the course of the communication.” (In re Zynga Privacy Litigation (9th Cir. 2014) 750 F.3d 1098, 1106 (In re Zynga).)

Here, Defendant contends the TikTok Software, as alleged, collects the content of a communication in two ways. First, Plaintiff alleges that when a user “clicks on a page” on the Website, information is sent to the Website, such as the URL of the webpage. (Complaint, ¶¶

13, 17.) Defendant contends that “[i]n this context, courts hold that when website software collects the URLs of the webpages a user visits, the software is collecting the contents of a communication.” (Mot., p. 17:12-13.) Defendant misstates the law. For instance, in In re Zynga, the Ninth Circuit held that URLs of Facebook webpages to which plaintiffs had navigated prior to clicking on ads or icons that initiated data collection did not constitute “contents” under a federal privacy statute. (Id. at 1107.) The court rejected the plaintiffs’ argument that those URLs represented “contents” because the webpages plaintiffs had visited provided information about their personal interests and other matters. (Id.) The court likewise agrees with Plaintiff that the remaining cases upon which Defendant relies are inapposite for the reasons stated in the opposition. (See Opp., p. 14:13-18.)

Defendant’s second argument fares no better. Defendant points to paragraph 15 of the Complaint where Plaintiff alleges that the TikTok Software “requests, validates, and transmits . . . a website visitor’s phone numbers and email addresses.” Defendant contends “the only way that the Software could collect phone numbers and email addresses is if a user inputs that information into the Website, such as when the user places an order for a product.” (Mot., p. 18-9-11.) But Defendant’s speculation on the Software’s method of collection is plainly extrinsic to the Complaint. The court cannot consider extrinsic matters when not the proper subject of judicial notice. For this reason, Defendant’s argument fails.

There are five express statutory exemptions from liability under section 638.51. “A provider of electronic or wire communication service may use a pen register or a trap and trace device for any of the following purposes: [¶](1) To operate, maintain, and test a wire or electronic communication service. [¶](2) To protect the rights or property of the provider. [¶](3) To protect users of the service from abuse of service or unlawful use of service. [¶](4) To record the fact that a wire or electronic communication was initiated or completed to protect the provider, another provider furnishing service toward the completion of the wire communication, or a user of that service, from fraudulent, unlawful, or abusive use of service. [¶](5) If the consent of the user of that service has been obtained.” (§ 638.51(b).)

Defendant argues it is exempt from liability because it is a provider of a communication service that used or installed a trap and trace device and a user of the communication service which consented to the use of the device. The argument lacks merit. If a provider of a communication servicer can simultaneously be the user of its own service and consent to the use of a trap and trace device, the statute would be a nullity. Moreover, the Defendant’s argument relies on allegations that do not appear in the Complaint. As alleged, Defendant is a company with a website, not a provider of a communication service. (Complaint, ¶ 11.) Further, Plaintiff and not Defendant is the user of the website. (Complaint, ¶ 29.) The Complaint does not fail on this ground.

Last, Defendant argues that Plaintiff must plead whether all five statutorily permissible purposes for utilizing a trap and trace device do not apply. However, Defendant’s position finds no support in the statute itself nor is the court aware of any authority which requires a plaintiff to allege the inapplicability of all exemptions under section 638.51 in order to state a valid cause of action for violation of the CIPA. The Complaint does not fail on these grounds.[4]

On November 14, 2024, Plaintiff filed this Motion for Preliminary Injunction. Plaintiff seeks to enjoin Defendant from using TikTok Software on its website.

Defendant’s unopposed request for judicial notice is GRANTED. (Evid. Code, § 452(c), (d).)

1. Plaintiff’s declaration wherein Plaintiff states she never consented to be tracked by TikTok Software by going onto Defendant’s website (Hughes Decl., ¶ 2);

2. An article published by the Department of Defense titled “Leaders Say TikTok is Potential Cybersecurity Risk to U.S.” (Amended Tauler Decl., Ex. A); and

3. The report of expert David Zargado opining on the purpose of TikTok’s Software (Amended Tauler Decl., Ex. B).

2. A screenshot of the Cookie Preferences pop up page as captured on January 27, 2025 in the context of the website (DeLorenzo Decl., Ex. 10);

3. the declaration of Stephanie Griffith (Defendant’s Manger of Paid Social) who states that TikTok is used on the Website for advertising and marketing;

4. the declarations of Connie Olinde (Defendant’s Senior Manager of Marketing Technology, Customer Master Data & Customer Data Platform) and Krish Nallamothu (Defendant’s Senior Director of Enterprise Data & Business Intelligence) who establish there is no record of Plaintiff interacting with Defendant’s website for the purpose of making an online purchase;

5. the declaration of Andrew Elkins (Defendant’s Senior Manager of Web Analytics Implementation for Neiman Marcus) who states the purpose of installing TikTok software is to help measure the effectiveness of Defendant’s TikTok ad campaigns and to better target audiences based on their behavior on the website;

Plaintiff submits several objections to the Expert Report of Sandeep Chatterjee, Ph.D. The objections are not properly formatted. They are not numbered nor is the objected-to material quoted. Accordingly, the court declines to rule on the objections.

In determining whether to issue a preliminary injunction, the trial court considers two factors: (1) the reasonable probability that the plaintiff will prevail on the merits at trial; and (2) a balancing of the “irreparable harm” that the plaintiff is likely to sustain if the injunction is denied compared to the harm that the defendant is likely to suffer if the court grants a preliminary injunction. (Code Civ. Proc., § 526(a); 14859 Moorpark Homeowner’s Assn. v. VRT Corp. (1998) 63 Cal.App.4th 1396, 1402; Pillsbury, Madison & Sutro v. Schectman (1997) 55 Cal.App.4th 1279, 1283.)

The court’s determination is guided by a “mix” of the potential-merit and interim-harm factors; the greater the plaintiff’s showing on one, the less must be shown on the other to support an injunction. (Butt v. State of California (1992) 4 Cal.4th 668, 678 (Butt).) However, a trial court may not grant a preliminary injunction, regardless of the balance of interim harm, unless there is some possibility that the plaintiff would ultimately prevail on the merits of the claim. (Ibid.)

The court must consider both factors. The two factors are a sliding scale – the stronger the showing of probability of prevailing, the lesser showing is required for irreparable harm. (Butt, 4 Cal.4th at p. 678; The Right Side Coalition v. Los Angeles Unified School District (2008) 160 Cal.App.4th 336 (reversing denial of preliminary injunction based solely on balancing of hardships without considering probability of prevailing). The plaintiff must make some showing of each factor. (Jessen v. Keystone Savings & Loan Assn. (1983) 142 Cal.App.3d 454, 459.) A court may not issue a preliminary injunction if the plaintiff cannot possibly prevail on the merits even if a strong showing of irreparable harm has been made. (Butt, 4 Cal.4th at pp. 677-78.)

The court’s ruling on a preliminary injunction is not an adjudication of the merits, is not a trial, and does not require a statement of decision. (Cohen v. Board of Supervisors (1985) 40 Cal.3d 277, 286; People v. Landlords Professional Services, Inc. (1986) 178 Cal.App.3d 68, 70-71.) The court is not required to state its reasons for granting or denying a preliminary injunction; a cursory statement is sufficient. (City of Los Altos v. Barnes (1992) 3 Cal.App.4th 1193, 1198.)

After consideration of the relevant factors and evidence submitted, the court finds Plaintiff is not entitled to a preliminary injunction to enjoin Defendant from using TikTok Software.

Plaintiff brings a single cause of action for “Violations of the California Trap and Trace Law…Cal. Penal Code § 638.51.” Accordingly, the injunction sought in the instant application is based on Plaintiff establishing a reasonable probability of prevailing on this cause of action.¿¿

Section 638.50(c) provides that “trap and trace device” means “a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.” Section 638.51(a) provides that “[e]xcept as provided in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order pursuant to Section 638.52 or 638.53.”

Plaintiff alleges that “Defendant uses a trap and trace process on its Website by deploying the TikTok Software on its Website, because the software is designed to capture the phone number, email, routing, addressing and other signaling information of website visitors. As such, the TikTok Software is solely to identify [sic] the source of the incoming electronic and wire communications to the Website...Defendant did not obtain consent from Plaintiff before using trap and trace technology to identify users of its Website, and has violated Section 638.51.” (Complaint, ¶¶ 28-29.)

Plaintiff cites to Penal Code section 637.2, subdivision (b), which provides that “[a]ny person may, in accordance with Chapter 3 (commencing with Section 525) of Title 7 of Part 2 of the Code of Civil Procedure, bring an action to enjoin and restrain any violation of this chapter, and may in the same action seek damages as provided by subdivision (a).” Plaintiff asserts that he is “likely to prevail on the merits of his claim against Defendant for violation of CIPA.” (Mot., p. 6:12-13.) First, Plaintiff argues that “it has already been determined that the TikTok Software can be a trap and trace device.” (Mot., p. 6:26-27.) But in support of this assertion, Plaintiff cites to Moody v. C2 Educ. Sys. (C.D. Cal. July 25, 2024, No. 2:24-cv-04249-RGK-SK) 2024 U.S.Dist.LEXIS 132614, a non-binding federal district court case.

Next, Plaintiff argues that “[a]s the Expert Report of David Zagardo explains, a step-by-step technical analysis demonstrates that the TikTok Software, as it appears on the Website, is a ‘trap and trace device’ under Penal Code§ 638.50(c).” (Mot., p. 7:3-5.) However, Defendant launches a meritorious challenge to the competency of Mr. Zagardo’s opinion regarding whether the TikTok software constitutes a trap and trace device. At deposition, Mr. Zagardo could not provide a technical definition for what “signals” means in the context of his own Report’s statement that the TikTok Software collects “signaling information”. The pertinent testimony is as follows:

A. What does ‘signals’ mean. Signals can -- oh, okay. Sure. Signals, what does ‘signals’ mean. Signals, it, again, depends on the context and the software engineering or in physics. But here, I would just -- or even in, like, some form of method of communication. But signals, I would say, would just mean a way to communicate information or capture information about a subject.

(Sones Decl. ¶ 9, Ex. 8 (“Zagardo Tr.”), pp. 72:18-19; 73:4-13; see Amended Tauler Decl., ¶ 3, Ex. B (“Zagardo Rep.”) ¶ 13.c.) Similarly, as Defendant also points out, Mr. Zagardo cannot explain concepts behind technical phrases used in his Report. For example:

Q. That same sentence says, in part, “indicating the TikTok Software is used for capturing signaling information to identify the source of incoming web traffic.” … In that context, is the source of incoming web traffic the human user?

A. That seems like a very vague and broad question that touches on the – I guess, like, the philosophy of human computer interaction … I honestly don't have a good answer for you there.

Q. Okay. So you … don't have an opinion on whether the source of incoming web traffic is the human user or the user’s device? That's not something you have an opinion on.

In short, Mr. Zagardo’s testimony lacks credibility on this issue, which undermines the validity of his Report. Without it, Plaintiff fails to establish that TikTok Software is a trap and trace device. Plaintiff does not offer any other evidence to establish that the TikTok Software is a trap and trace device. Based on the foregoing, the court finds that Plaintiff does not demonstrate a likelihood of success on the merits. This finding alone is fatal to Plaintiff’s motion. “A trial court may not grant a [restraining order], regardless of the balance of interim harm, unless there is some possibility that the plaintiff would ultimately prevail on the merits of the claim.” (Church of Christ in Hollywood v. Superior Court (2002) 99 Cal.App.4th 1244, 1252.)

Plaintiff argues that “a balancing of hardships favors a preliminary injunction.” (Mot., pp. 8:12-9:15.) Plaintiff notes that in IT Corp. v. County of Imperial (1983) 35 Cal.3d 63, 70, the California Supreme Court found that when a court determines a plaintiff “will probably succeed at trial in proving a statutory violation,” the court is “justified in presuming that public harm will result if an injunction is not issued.” But here, the court does not find that Plaintiff has demonstrated he will probably succeed at trial in proving a statutory violation.

Plaintiff also argues in the motion that he “will continue to suffer interim harm, specifically an invasion of his privacy, if the Court does not order Defendant to cease sending Plaintiff’s identifiable information to TikTok.” (Mot., p. 9:16-17.) But Plaintiff does not provide any evidence to support this assertion. Plaintiff’s declaration in support of the motion simply provides that “I visited Defendant's website www.neimanmarcus.com on February 5, 2024. At that time, I did not know that TikTok was tracking me. I never comnsented [sic] to have my information be tracked by TikTok just by going to the Neiman Marcus website. I would like to visit the website in the future, but I do not wish to be tracked by TikTok if and when I do so” [sic]. (Hughes Decl., ¶¶ 2-3.) Plaintiff also contends that “[o]nce Defendant unlawfully discloses Plaintiff’s data, TikTok will store and use it to further build an extensive profile on Plaintiff-an injury to Plaintiff that cannot be undone.” (Mot., p. 8:18-20.) But again, Plaintiff does not cite any evidence to support this argument.

Based on the foregoing, the court finds that Plaintiff has not demonstrated she will suffer irreparable injury or interim harm if an injunction is not issued pending an adjudication of the merits.

Kerry Bensinger

Judge of the Superior Court

[1] All statutory references hereinafter are to the Penal Code unless otherwise indicated.

[2] Even if the court were to consider Defendant’s reference to legislative history, that history centers only on section 638.52 and the requirements for obtaining an ex parte order for use of a trap and trace device by law enforcement. That legislative history does not address or otherwise limit the definition of trap and trace device as set forth in section 638.50.

[3] Defendant also invokes the rule of lenity which requires courts to “interpret an ambiguous criminal statute in the

defendant’s favor.” (See People v. Mutter (2016) 1 Cal.App.5th 429, 436.) However, the court is not persuaded section 638.50 is ambiguous. The rule of lenity therefore does not apply.

[4] Defendant also advanced a separate but related argument that the other exemptions applied because the TikTok Software essentially captures IP addresses for cybersecurity purposes. Plaintiff correctly argued that Defendant relied on factual allegations not before the court.