Clarin v. Proper Hospitality, LLC

and that Meta uses the intercepted data for advertising, analytics, and other independent commercial purposes. (Id. at ¶¶ 4, 20–23, 35, 40–44, 85.) On these allegations, the Complaint asserts two causes of action on behalf of Plaintiff and a putative class of California Facebook users who booked travel on the Website: (1) violation of CIPA, Penal Code section 631; and (2) invasion of privacy under Article I, section 1 of the California Constitution. (Complaint, ¶¶ 68–95.) The Complaint prays for class certification, statutory and other damages, injunctive and declaratory relief, and attorney’s fees. (Id. at p. 23.)

B. Procedural Plaintiff filed the Complaint on February 28, 2025. Defendant moved to transfer venue to Los Angeles County Superior Court, and this Court denied that motion on February 4, 2026. Following meet-and-confer efforts (Declaration of Raymond O. Aghaian, ¶¶ 4–7), Defendant filed the instant demurrer under Code of Civil Procedure section 430.10(e). Defendant demurs on three grounds: (1) Plaintiff lacks statutory standing under CIPA because he has not alleged a concrete injury; (2) Plaintiff fails to state a CIPA claim because he does not allege the interception of the contents of a communication in transit, any use of information by Meta, or the scienter required for aiding-and-abetting liability; and (3) Plaintiff fails to state a constitutional privacy claim because he alleges no reasonable expectation of privacy and no “highly offensive” conduct, and because that provision does not permit monetary damages. (Dem., pp. 2–3.)

Plaintiff opposes each ground and alternatively requests leave to amend. (Opp., pp. 1–2, 15.)

II.

Legal Standard

A demurrer tests the legal sufficiency of the pleading and may be sustained only where the defects appear on the face of the complaint or from matters judicially noticeable. (Code Civ. Proc., § 430.30(a).) The Court accepts as true all material facts properly pleaded, together with all reasonable inferences that may be drawn from them, but does not assume the truth of contentions, deductions, or conclusions of law. (Blank v. Kirwan (1985) 39 Cal.3d 311, 318.)

The allegations must be liberally construed, with a view to substantial justice between the parties. (Code Civ. Proc., § 452.) The Court is mindful that the parties have submitted a large volume of federal trialcourt authority. Those decisions are persuasive only, and as discussed below, many apply the Article III “concrete injury” requirement and the Rule 12(b)(6) plausibility standard, neither of which governs a California demurrer.

III. Statutory Standing Under CIPA Defendant first contends that Plaintiff lacks statutory standing under CIPA because he has not pleaded a “concrete and particularized injury,” relying principally on Popa v. Microsoft Corp. (9th Cir. 2025) 153 F.4th 784 (Popa), and a line of federal district-court decisions dismissing tracking-pixel claims for lack of Article III standing. (Dem., pp. 3–7; Reply, pp. 1– 4.) Plaintiff responds that California courts do not import federal standing doctrine, and that Penal Code section 637.2(c) provides that it “is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages.” (Opp., pp. 2–5.)

The Court agrees with Plaintiff at the pleading stage. California has no case-orcontroversy clause, and California courts do not apply federal-style standing requirements. (See Jasmine Networks, Inc. v. Superior Court (2009) 180 Cal.App.4th 980, 991 [California standing turns on whether the action is prosecuted by the real party in interest under Code Civ. Proc., § 367].) The federal decisions Defendant puts forth, such as Popa, rest on Article III’s injury-in-fact requirement, a constraint on federal judicial power that does not bind this Court.

Penal Code section 637.2 confers a private right of action on any “person who has been injured by a violation” of CIPA, and subdivision (c) makes clear that actual damages are not a prerequisite. Read together, the statute treats the violation of the enumerated privacy interest as the cognizable injury; the Legislature fixed statutory damages of $5,000 per violation precisely to relieve plaintiffs of the burden of proving pecuniary harm. Defendant’s reading – that section 637.2(a)’s “injured by a violation” language silently engrafts the federal concrete-injury

test onto subdivision (c) – would render subdivision (c) largely inoperative and is not the most natural construction of the statute. Defendant’s reliance on the requirement that a plaintiff plead a violation “of his” rights (Reply, pp. 3–4) is better understood as a merits question (i.e., whether Plaintiff has alleged that his own communications were intercepted) rather than a jurisdictional standing bar. On this point, Plaintiff alleges that he personally booked an overnight stay at Defendant’s San Francisco location in or about May 2024, that he maintained an active Facebook account at all relevant times, that he entered his destination, travel dates, room selection, and checkout information, and that his own “offsite activity report” from his Facebook account confirms that his information was transmitted to Meta. (Complaint, ¶¶ 5–9, 67; Opp., 4–5.)

Accepted as true, those allegations are particular to Plaintiff and sufficient at the demurrer stage. Accordingly, the demurrer for lack of statutory standing is OVERRULED.

IV. First Cause of Action – CIPA, Penal Code § 631 Section 631(a) reaches four categories of conduct, commonly labeled Clauses One through Four: (1) intentional wiretapping of a telegraph or telephone line; (2) willfully and without consent reading or learning the contents of a communication “while the same is in transit”; (3) using information so obtained; and (4) aiding, agreeing with, employing, or conspiring with another to do any of the foregoing. Plaintiff proceeds against Proper Hospitality under Clause Four, on the theory that Proper Hospitality aided and abetted Meta’s interception (Clause Two) and use (Clause Three) of Plaintiff’s communications via the Meta Tracking Pixel. (Complaint, ¶¶ 79–86; Opp., pp. 5–6.)

Plaintiff does not rely on Clause One, and the demurrer is sustained as unopposed to the extent the claim rests on Clause One. (Dem., p. 7; Reply, p. 4 & fn. 1.) Derivative Clause Four liability requires a predicate violation by Meta, so the Court addresses the predicate elements first.

A. Existence of a “Communication” Defendant contends Plaintiff pleads only “record information” (such as URLs, device data, and page-event telemetry) rather than the “contents” of any communication, invoking In

re Zynga Privacy Litigation (9th Cir. 2014) 750 F.3d 1098, 1106–1107, which distinguishes the substance of a message from record information about it. (Dem., pp. 8–9; Reply, pp. 4–5.) Plaintiff responds that information entered into a website’s forms and booking selections revealing where and when he intended to travel are “contents.” (Opp., pp. 6–8.) Here, the application of this distinction presents a factual question that cannot be resolved against Plaintiff on demurrer. Plaintiff does more than allege bare page visits.

He alleges that, as he moved through the booking flow, the Pixel captured his selected property and location, his check-in and checkout dates, his room selection, the “CONFIRM YOUR STAY” button-click event, and the name, email address, telephone number, and address he entered at checkout. (Complaint, ¶¶ 47–51, 66; Figs. 2–4.) Information a user affirmatively enters into a website’s form (and selections that reveal where and when the user intends to travel) may plausibly constitute “contents” because they convey the substance of what the user communicated.

Federal courts addressing hotel-booking pixel data have concluded likewise. (See Crano v. Sojern, Inc. (N.D. Cal. Sept. 19, 2025) 2025 WL 2689267, 2025 U.S. Dist. LEXIS 185031 (Crano) at *16 [booking details are “user created information—where and when Plaintiff was planning to and did stay at a hotel and how many rooms she booked,” not mere page visits].) At minimum, whether these data points are contents or record information is not something the Court can decide as a matter of law on the face of the pleading.

B. Interception “In Transit” This is the most significant of Defendant’s element-based challenges. Defendant correctly argues that the Complaint’s own description of the Pixel, Meta code that directs the browser to send a “separate” and “concurrent” transmission to Meta’s servers (Complaint, ¶¶ 32–34), describes two independent communications rather than the interception of the Plaintiff-to-Defendant communication. Defendant relies on Smith v. Facebook, Inc. (N.D. Cal. 2017) 262 F.Supp.3d 943, 951, and on Crano, which dismissed a hotel-booking pixel claim on precisely this “in transit” ground. (Dem., pp. 9–10; Reply, pp. 4–6.)

The authorities are genuinely divided, and that division is dispositive at this stage. A substantial body of authority holds that allegations of simultaneous, real-time duplication of a communication to a third party – particularly where supported by a description of the mechanism and by network-traffic screenshots – adequately plead in-transit interception to survive a pleading challenge. (See, e.g., D’Angelo v. FCA US, LLC (S.D. Cal. 2024) 726 F.Supp.3d 1179, 1198; Valenzuela v. Nationwide Mut.

Ins. Co. (C.D. Cal. 2023) 686 F.Supp.3d 969, 1078–1079; Esparza v. UAG Escondido A1 Inc. (S.D. Cal. Feb. 12, 2024) 2024 WL 559241, 2025 U.S. Dist LEXIS 24429 (Esparza); St. Aubin v. Carbon Health Technologies, Inc. (N.D. Cal. Oct. 1, 2024) 2024 WL 4369675, 2024 U.S. Dist. LEXIS 179067; see Opp., pp. 8–10.) Plaintiff alleges that the duplicate transmission occurs “within milliseconds,” “simultaneously and contemporaneously,” “at the same time” the communication is sent to Defendant, and Plaintiff supports those allegations with figures depicting the Pixel’s transmissions. (Complaint, ¶¶ 32–34, 47–51, Figs. 2–4.)

Whether those transmissions are two separate communications outside the reach of Clause Two (as Defendant argues), or a contemporaneous interception of a single communication in transit (as Plaintiff argues), is a factual and technical question about how the Pixel actually operated on Defendant’s Website. It is not resolvable in Defendant’s favor on the face of the Complaint under the required liberal construction. The Court accordingly declines to follow Crano’s contrary conclusion at the pleading stage on this record, without prejudice to Defendant renewing the argument on a factual record.

C. Use of Information (Clause Three) Defendant argues that Plaintiff fails to allege that Meta “read” or “used” the information while in transit, and points to the absence of any allegation that Plaintiff received targeted advertising. (Dem., p. 10; Reply, p. 6.) Clause Three, however, reaches use “in any manner” or “for any purpose.” Plaintiff alleges that Meta processes, analyzes, and assimilates the intercepted data into Core and Custom Audiences, and uses it for ad targeting, analytics, content personalization, and product development. (Complaint, ¶¶ 35, 40–44; Opp., p. 10.) While a targeted-advertisement allegation may strengthen a standing showing, its absence is

not fatal to a Clause Three predicate at the pleading stage. The Complaint’s allegations of use are sufficient to survive demurrer, particularly given that Clause Three’s viability here rises or falls with the Clause Two predicate addressed above.

D. Aiding and Abetting / Scienter (Clause Four) Defendant contends Plaintiff fails to plead that Proper Hospitality acted with the knowledge and intent required to aid and abet a CIPA violation. (Dem., p. 11; Reply, pp. 6–8.) Plaintiff responds that the statutory language contains no express intent requirement and that, in any event, his allegations satisfy the common-law standard. (Opp., pp. 10–12.) Courts are divided over whether Clause Four incorporates a common-law aiding-and-abetting intent standard or is governed by the broader statutory language (“aids, agrees with, employs, or conspires with”).

The Court need not resolve that dispute now, because Plaintiff’s allegations are sufficient even under the more demanding common-law formulation. Plaintiff alleges that Proper Hospitality intentionally embedded and configured the Meta Pixel on its booking Website; that it did so pursuant to an arrangement with Meta “for the purpose of improperly increasing the advertising efficiency and, by extension, profits of both parties”; and that Proper Hospitality intended to help Meta learn the meaning of the content in the URLs and the content the visitor requested. (Complaint, ¶¶ 47, 65, 82–83.)

Courts have found similar allegations (that a website operator knowingly programmed third-party tracking technology into its site for advertising purposes and profit) sufficient to plead aiding-andabetting at the pleading stage. (See Mata v. Zillow Group, Inc. (S.D. Cal. Dec. 18, 2024) 2024 WL 5161955, 2024 U.S. Dist. LEXIS 229061; Esparza, supra, 2024 U.S. Dist. LEXIS 24429, *15–17.) The Court does not rely on Plaintiff’s alternative “presumed to know the law” theory, which would not by itself establish knowledge of wrongful conduct; the specific allegations of knowing installation and a profit-driven arrangement carry the pleading.

Accordingly, because Plaintiff has adequately alleged the predicate elements and Proper Hospitality’s derivative participation, the demurrer to the First Cause of Action is OVERRULED.

V. Second Cause of Action – Constitutional Invasion of Privacy To state a claim for invasion of privacy under the California Constitution, a plaintiff must allege (1) a legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3) conduct constituting a serious invasion of the protected interest—that is, an intrusion so serious in nature, scope, and actual or potential impact as to constitute an egregious breach of social norms. (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 35–37, 39–40 (Hill).)

A. Legally Protected Interest and Reasonable Expectation of Privacy Plaintiff grounds his protected interest in Civil Code section 53.5, which prohibits a hotel operator from disclosing “all or any part of a guest record” to a third party absent a courtissued subpoena, warrant, or order, and defines “guest record” broadly to include “any record that identifies an individual guest ... including, but not limited to,” name, address, telephone number, and similar identifiers. (Civ. Code, § 53.5(a), (c); Opp., pp. 12–14.)

Defendant responds (relying on Crano, Snyder v. G6 Hospitality LLC (C.D. Cal. Apr. 14, 2025) 2025 WL 1254382, 2025 U.S. Dist. LEXIS 717192, and So v. Hyatt Hotels Corp. (N.D. Ill. May 5, 2026) 2026 WL 1235036, 206 U.S. Dist. LEXIS 98893) that booking selections such as dates, destination, and room choice are not “guest records,” and that a user has no reasonable expectation of privacy in interactions with a public-facing booking site. (Dem., pp. 12–13; Reply, pp. 8–10.) Whether the specific information transmitted here falls within section 53.5(c) is a contested question, but the Court cannot resolve it against Plaintiff on demurrer.

Unlike the plaintiff in Crano, Plaintiff here alleges the transmission not only of trip dates and destination but of his name, email address, telephone number, and physical address entered at checkout, along with identifiers (including a Facebook ID) that allegedly permit him to be identified by name. (Complaint, ¶¶ 50, 54, 66.) Those enumerated identifiers map onto the statutory definition. Section 53.5 also reflects a legislative judgment that guest-record information remains confidential “by electronic or any other means,” which bears directly on the objective

reasonableness of Plaintiff’s expectation. Construing the allegations liberally, Plaintiff has adequately pleaded a legally protected interest and a reasonable expectation of privacy. Defendant’s “intended business purpose” argument under section 53.5 likewise raises factual issues. (Dem., p. 12.) Plaintiff alleges that the disclosure was made to a third-party advertising platform for that platform’s own independent commercial use, not merely to service Plaintiff’s reservation. (Complaint, ¶¶ 44, 52, 65–66; Opp., pp. 13–14.) Whether the business-purpose exception applies cannot be decided in Defendant’s favor on the face of the Complaint.

B. Serious and “Highly Offensive” Invasion A line of authority holds that routine commercial data collection and disclosure (even of personal information) does not rise to the level of an “egregious breach of social norms” required for a constitutional privacy claim. (See, e.g., Hammerling v. Google LLC (N.D. Cal. 2022) 615 F.Supp.3d 1069, 1090; Low v. LinkedIn Corp. (N.D. Cal. 2012) 900 F.Supp.2d 1010, 1025; In re iPhone Application Litig. (N.D. Cal. 2012) 844 F.Supp.2d 1040, 1063; Shah v. Capital One Financial Corp. (N.D.

Cal. 2025) 768 F.Supp.3d 1033, 1047; see Dem., pp. 13– 14; Reply, pp. 8–9.) Our Supreme Court has confirmed that where the pleaded facts describe non-egregious conduct, the seriousness element may be resolved on the pleadings. (Hernandez v. Hillsides, Inc. (2009) 47 Cal.4th 272, 286–287.) Under that line of authority, a demurrer could be sustained here. Nevertheless, on balance, the Court concludes the element should not be resolved against Plaintiff at this stage, for two reasons. First, whether an intrusion is sufficiently serious and offensive is ordinarily a fact-intensive, context-dependent inquiry that courts are reluctant to resolve at the pleading stage. (Hill, supra, 7 Cal.4th at pp. 36–37; see Opp., p. 14 [collecting authority].)

Second, and distinguishing much of the authority Defendant cites, Plaintiff does not rest on generic browsing data. He alleges the disclosure of information the Legislature has specifically designated as confidential guest-record information under section 53.5, transmitted to an advertising platform without notice or consent. (Complaint, ¶¶ 90–94; Opp., pp. 14–15.) That statutory backdrop is a relevant social norm bearing on whether the alleged intrusion is “highly offensive,” and it materially differentiates this case from the routine-analytics

decisions. The Aguirre court, on parallel allegations, declined to resolve the seriousness element on demurrer, observing that although the plaintiff “may very well face difficulty actually showing” a serious invasion, “it cannot be said at this stage that it will not be established.” The Court therefore concludes that Plaintiff has narrowly stated a constitutional privacy claim sufficient to survive demurrer. The Court emphasizes that this ruling reflects the deferential pleading standard, not a view that the claim is strong; Defendant remains free to test the “serious invasion” element on a developed factual record.

C. Monetary Damages Defendant correctly observes that Article I, section 1 of the California Constitution supports injunctive relief but not damages. (Clausing v. San Francisco Unified School Dist. (1990) 221 Cal.App.3d 1224, 1237; Dem., p. 14.) Plaintiff concedes the point and clarifies that the Second Cause of Action seeks only injunctive relief. (Complaint, ¶ 95; Opp., p. 15.) The issue is therefore moot and provides no basis to sustain the demurrer. To the extent the prayer could be read to seek damages on this count, the Court construes the count as limited to injunctive and declaratory relief consistent with Plaintiff’s concession. Accordingly, the demurrer to the Second Cause of Action is OVERRULED.

VI.

Conclusion

For the reasons stated, the Court OVERRULES the demurrer in its entirety. Defendant shall file and serve its answer within the time provided by California Rules of Court, rule 3.1320(j). The prevailing party shall prepare the order in accordance with California Rules of Court, rule 3.1312.

- oo0oo -

10