Cantu v. Barclays Bank Delaware

Parties who intend to submit on this tentative must send an email to the Court at [email protected] indicating intention to submit on the tentative, and copying all parties in the email communication. Please be advised that if you submit on the tentative and elect not to appear at the hearing, the opposing party may nevertheless appear at the hearing and argue the matter. Unless you receive a submission from all other parties in the matter, you should assume that others might appear at the hearing to argue. If the Court does not receive emails from the parties indicating submission on this tentative ruling and there are no appearances at the hearing, the Court will adopt the tentative as the final order, or take the matter off calendar at its discretion.

Defendant Barclays Bank Delaware's demurrer to the First Amended Complaint is SUSTAINED WITH LEAVE TO AMEND as to the First and Second causes of action. Plaintiffs shall file a Second Amended Complaint within 20 days. The Case Management Conference is continued to December 17, 2026 at 8:30 a.m.

Introduction

On April 4, 2025, Plaintiff Tanya Cantu filed a Complaint against Defendant Barclays Bank Delaware arising out of Defendant's alleged use of third-party tracking cookies and software code on its website, www.barclaycardus.com, to collect and transmit website visitors' information to third parties without consent, in violation of the California Invasion of Privacy Act (Penal Code Sec. 638.51). On March 18, 2026, Plaintiff filed a First Amended Complaint, adding a second cause of action for intrusion upon seclusion.

On April 21, 2026, Defendant filed the instant Demurrer to Plaintiff's First Amended Complaint. On August 7, 2026, Plaintiff filed an Opposition. Request for Judicial Notice Defendant requests judicial notice of (Exhibit 1) a chart summarizing the case names, numbers, filing dates, and dispositions of complaints Plaintiff has filed since September 2024; (Exhibit 2) two complaints filed by Plaintiff and her counsel in this court (Cantu v. Nordstrom, Inc., No. 24STCV23724, and Cantu v. Nintendo of America Inc., No. 24STCV24416); and (Exhibit 3) minute orders entered by other departments in Rodriguez v.

First American Financial Corp., No. 24STCV05383, and Palacios v. Fandom, Inc., No. 24STCV11264. The court grants the request as to Exhibits 1 and 2 and takes judicial notice of the existence and filing of those court records. Meet and Confer Before filing a demurrer or a motion to strike, the demurring or moving party is required to meet and confer with the party who filed the pleading demurred to or the pleading that is subject to the motion to strike for the purposes of determining whether an agreement can be reached through a filing of an amended pleading that would resolve the objections to be raised in the demurrer. (CCP Sec.Sec. 430.41) The Declaration of Rebecca Clary, executed on April 21, 2026, sets forth the meet and confer efforts of counsel for the Defendant, and counsel's attempts to resolve the discovery dispute informally by telephone.

The declaration satisfies the requirement of Code of Civil Procedure section 430.41.

Legal Standard

A demurrer for sufficiency tests whether the complaint states a cause of action.¿ (Hahn v. Mirda (2007) 147 Cal.App.4th 740, 747.)¿When considering demurrers, courts read the allegations liberally and in context.¿ (Wilson v. Transit Authority of City of Sacramento (1962) 199 Cal.App.2d 716, 720-21.)¿In a demurrer proceeding, the defects must be apparent on the face of the pleading or via proper judicial notice.¿(Donabedian v. Mercury Ins. Co. (2004) 116 Cal.App.4th 968, 994.)¿"A demurrer tests the pleading alone, and not on the evidence or facts alleged." (E-Fab, Inc. v. Accountants, Inc. Servs. (2007) 153 Cal.App.4th 1308, 1315.) As such, the court assumes the truth of the complaint's properly pleaded or implied factual allegations. (Id.) The only issue a demurrer is concerned with is whether the complaint, as it stands, states a cause of action. (Hahn, supra, 147

Cal.App.4th at 747.) First Cause of Action: Violation of Penal Code Section 638.51 (Trap and Trace) Penal Code section 638.51, subdivision (a), provides that, except as otherwise permitted, "a person may not install or use a pen register or a trap and trace device without first obtaining a court order." A "trap and trace device" is "a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication." (Pen.

Code, Sec. 638.50, subd. (c).) A person injured by a violation may bring a civil action for the greater of $5,000 per violation or treble actual damages. (Pen. Code, Sec. 637.2, subds. (a), (c).) Whether Section 638.51 Reaches Website Tracking Technology Defendant's threshold argument is that a "trap and trace device" is a term of art limited to telephone surveillance, that the collection of IP addresses and similar device-level data falls outside the statute, and that any broader reading would "criminalize the Internet" and offend the rule of lenity.

Defendant relies principally on the mechanics of the law-enforcement order provisions (Pen. Code, Sec. 638.52), the statute's legislative history, and a number of trial-court orders reaching that conclusion. Plaintiff responds that the plain language of section 638.50, subdivision (c)--"device or process" capturing information identifying the source of "a wire or electronic communication"--is not limited to telephones, that the definitions were transplanted from the federal pen-register/trap-and-trace statute as amended by the USA PATRIOT Act to reach Internet traffic, and that the overwhelming majority of federal courts to consider the question have held that internet trackers can qualify.

At the pleading stage, the court declines to hold as a matter of law that section 638.51 categorically excludes website-based tracking technology. On its face, the definition in section 638.50, subdivision (c), is broad and is not by its terms confined to telephone lines; the telephone-specific references in section 638.52 govern the contents of a law-enforcement application for a court order and do not narrow the definition itself. (See Shah v. Fandom, Inc. (N.D. Cal. 2024) 754 F.Supp.3d 924, 930-931; Gabrielli v.

Motorola Mobility LLC (N.D. Cal. July 14, 2025, No. 24-cv-09533) 2025 WL 1939957, at *11 [noting the Legislature imposed telephone-specific limits elsewhere in CIPA, e.g., Pen. Code, Sec.Sec. 631, subd. (a), 632.7, when it wished to do so].) The court recognizes that other departments of this court have reached the contrary view, and that the question is the subject of a pending appellate proceeding. (See, e.g., Schallert v. Palo Alto Networks, Inc. (Cal. Super. Mar. 6, 2026, No. 25STCV17109) [CIPA does not extend to website communications]; Sanchez v.

Cars.com (Cal. Super. Jan. 27, 2025, No. 24STCV13201).) These are non-binding trial-court orders, however, and the court is not persuaded that the statute is so egregiously ambiguous that the rule of lenity controls its construction. (People v. Manzo (2012) 53 Cal.4th 880, 889 [rule of lenity is a tie-breaking principle reserved for cases of egregious ambiguity].) The demurrer is therefore not sustained on this ground. Sufficiency of Allegations The demurrer is well taken on a narrower, and dispositive, ground.

By its express terms, a trap and trace device captures signaling information "but not the contents of a communication." (Pen. Code, Sec. 638.50, subd. (c).) It follows that a device or process that captures the contents of a communication is, by definition, not a trap and trace device, and allegations that the challenged technology captures content defeat the claim. (Kishnani v. Royal Caribbean Cruises Ltd. (N.D. Cal. June 24, 2025, No. 25-cv-01473) 2025 WL 1745726, at *5; Mitchener v. CuriosityStream, Inc. (N.D.

Cal. Aug. 6, 2025, No. 25-cv-01471) 2025 WL 2272413, at *5; Price v. Headspace, Inc. (Cal. Super. Apr. 1, 2025, No. 24STCV19921) [if the device captures the content of communications, it is definitionally not a trap and trace device].) Here, the incorporated factual allegations define the information the challenged cookies and software collect - Plaintiff's "Private Communications" - to include, among other things, "User Input Data: The information the user entered into the Website's form fields, including search queries, the user's name, age, gender, email address, location, and/or payment information." (FAC P. 6; see also P.P. 19, 21.)

Search terms a user enters and information a user types into a website's form fields are the contents of the user's communications with the Website, not mere routing or signaling data. (See Greenley v. Kochava, Inc. (S.D. Cal. 2023) 684 F.Supp.3d

1024, 1051-1052 [search terms entered into a website are the "contents" of a communication]; Kishnani, supra, 2025 WL 1745726, at *4 [information the visitor inputs is the content of the visitor's communication with the website].) The first cause of action incorporates all preceding paragraphs (FAC P. 112) and alleges that the third parties' "cookies and the corresponding software code" are "each a 'trap and trace device.'" (FAC P. 117.) Although paragraph 119 alleges that "some of the information collected ... does not constitute the content of Plaintiff's electronic communications," that qualified allegation concedes that the same challenged devices and processes also capture content.

As presently pleaded, the FAC does not allege that the specific devices or processes on which the section 638.51 claim rests capture only non-content record information. Instead, it ties the claim to an omnibus definition of "Private Communications" that expressly includes content. The pleading is therefore internally inconsistent as to the dispositive element of the claim. Plaintiff's contention that different cookies transmit different data, such that she may rest the trap-and-trace claim only on those trackers that transmit record information, is sound as a matter of pleading theory. (see Walsh v.

Dollar Tree Stores, Inc. (N.D. Cal. Oct. 16, 2025, No. --) 2025 WL 2939229, at *18). However, the FAC does not presently make that differentiation. Rather, it lumps "the Third Parties' (or other third parties') cookies and the corresponding software code" together (FAC P. 117) and links them to the broad "Private Communications" definition that sweeps in content. Because the defect is one of pleading and appears curable, the demurrer to the first cause of action is sustained on this ground with leave to amend.

The demurrer is SUSTAINED, with leave to amend. Second Cause of Action: Intrusion Upon Seclusion To plead intrusion upon seclusion, Plaintiff must allege (1) that Defendant intentionally intruded into a place, conversation, or matter as to which Plaintiff had a reasonable expectation of privacy, and (2) that the intrusion was highly offensive to a reasonable person. (Hernandez v. Hillsides, Inc. (2009) 47 Cal.4th 272, 286; Shulman v. Group W Productions, Inc. (1998) 18 Cal.4th 200, 231.) Defendant first argues it cannot intrude upon a communication to which it was a party.

That principle does not, standing alone, dispose of the claim, because the FAC frames the intrusion as Defendant enabling third parties - who were not parties to the communications and were "not invited, welcomed, or authorized" - to access Plaintiff's communications through cookies Defendant caused to be placed on her device. (FAC P.P. 126-127.) The court therefore does not sustain the demurrer on that basis. The claim fails, however, on the "highly offensive" element. As alleged, the collection of IP addresses, device and browser characteristics, and browsing activity for advertising and analytics purposes is, in the main, the kind of routine commercial data collection that courts have generally declined to characterize as a highly offensive intrusion. (Hammerling v.

Google LLC (N.D. Cal. 2022) 615 F.Supp.3d 1069, 1090; Hubbard v. Google LLC (N.D. Cal. July 1, 2024, No. 19-cv-07016) 2024 WL 3302066, at *7.) Plaintiff's theory that Defendant's alleged deceit - its cookie-banner representation that users could "Reject All" non-essential cookies - supplies the "plus factor" needed to render the intrusion highly offensive is a recognized route to the element. However, as pleaded, that theory is in tension with the FAC's own allegations that the third-party cookies were downloaded and operational "immediately upon loading of the Website" and that collection began "the moment that Plaintiff landed on the Website" - before Plaintiff encountered, relied upon, or was deceived by the banner. (FAC P.P. 2, 104, 108.)

The FAC also does not identify with particularity what content of Plaintiff's, if any, was actually accessed. On this record, the FAC does not adequately allege a highly offensive intrusion. Because the deficiency may be curable, the demurrer to the second cause of action is SUSTAINED with leave to amend.

Conclusion

Defendant Barclays Bank Delaware's demurrer to the First Amended Complaint is SUSTAINED WITH LEAVE TO AMEND as to the First and Second causes of action.

Plaintiffs shall file a Second Amended Complaint within 20 days. The Case Management Conference is continued to December 17, 2026 at 8:30 a.m. Moving party to give notice. Parties who intend to submit on this tentative must send an email to the Court at [email protected] indicating intention to submit on the tentative, and copying all parties in the email communication. Please be advised that if you submit on the tentative and elect not to appear at the hearing, the opposing party may nevertheless appear at the hearing and argue the matter.

Unless you receive a submission from all other parties in the matter, you should assume that others might appear at the hearing to argue. If the Court does not receive emails from the parties indicating submission on this tentative ruling and there are no appearances at the hearing, the Court will adopt the tentative as the final order, or take the matter off calendar at its discretion. | Home -->)" -->