A fresh California Invasion of Privacy Act (“CIPA”) opinion highlights a successful avenue to dismissing a complaint where the plaintiff alleges a violation of their protectable privacy interests, but fails to sufficiently outline what specific kinds of personal data were collected to constitute an infringement of CIPA.
In Bonkowski v. Maison Miru LLC, No. 2:25-CV-05546-MEMF-MAA, 2026 WL 2337889 (C.D. Cal. Aug. 12, 2026), plaintiff Robert Bonkowski brought a CIPA suit against jewelry company Maison Miru. Bonkowski alleged that information collected by Maison Miru and shared with TikTok, Facebook, Snapchat, and Pinterest violated his privacy interests. After browsing Maison Miru’s website, Bonkowski alleged that tracking pixels installed on the website by the aforementioned social media services captured information about his online behavior. This information included instances where a user added an item to a cart, the value of purchases, the type of content purchased, IP address, metadata, and other device information which would allow social media companies to link online activity to a user’s profile with the goal of improving targeted advertising.
Maison Miru moved to dismiss Bonkowski’s complaint on the grounds that he lacked Article III standing because he had not alleged a concrete harm, and thus could not state a claim for relief under CIPA. Bonkowski, a website tester who is a frequent CIPA litigator, contended that collection of his personal data using tracking pixels without his consent sufficiently constituted a violation.
The court noted that Bonkowski’s allegations were similar to those made by a plaintiff in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). In Popa, allegations that a website tracked information such as the date a user visited a website, the device and browser used, geographic user location, and information such as text input, clicks and scrolling did not constitute an infringement of a privacy interest. Although Bonkowski had similar information collected by tracking pixels, he did not explain what was “embarrassing, invasive, or otherwise private” about the information disclosed. Similarly, Bonkowski did not plead that Maison Miru’s website had exposed his “likes, dislikes, interests, and habits over a significant amount of time.”
In light of this, the court found that Bonkowski’s complaint did not establish liability for an invasion of privacy and therefore did not establish a concrete harm which would give rise to Article III standing. Maison Miru’s motion to dismiss was granted, with leave to amend.
The Bonkowski case provides a great example of how to respond to a complaint where a plaintiff establishes that data was collected, but does not sufficiently argue that the data collection represented an actual invasion of privacy. Simple allegations that trackers have collected data without an explanation of harm which could constitute a cause of action gives defendants a speedy avenue to dismissal.
Talk to you soon CIPAWorld! Stay compliant, and stay safe.
Jeweler Successfully Dismisses CIPA Suit For Lack Of Article III Standing
A fresh California Invasion of Privacy Act (“CIPA”) opinion highlights a successful avenue to dismissing a complaint where the plaintiff alleges a violation of their protectable privacy interests, but fails to sufficiently outline what specific kinds of personal data were collected to constitute an infringement of CIPA.
In Bonkowski v. Maison Miru LLC, No. 2:25-CV-05546-MEMF-MAA, 2026 WL 2337889 (C.D. Cal. Aug. 12, 2026), plaintiff Robert Bonkowski brought a CIPA suit against jewelry company Maison Miru. Bonkowski alleged that information collected by Maison Miru and shared with TikTok, Facebook, Snapchat, and Pinterest violated his privacy interests. After browsing Maison Miru’s website, Bonkowski alleged that tracking pixels installed on the website by the aforementioned social media services captured information about his online behavior. This information included instances where a user added an item to a cart, the value of purchases, the type of content purchased, IP address, metadata, and other device information which would allow social media companies to link online activity to a user’s profile with the goal of improving targeted advertising.
Maison Miru moved to dismiss Bonkowski’s complaint on the grounds that he lacked Article III standing because he had not alleged a concrete harm, and thus could not state a claim for relief under CIPA. Bonkowski, a website tester who is a frequent CIPA litigator, contended that collection of his personal data using tracking pixels without his consent sufficiently constituted a violation.
The court noted that Bonkowski’s allegations were similar to those made by a plaintiff in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). In Popa, allegations that a website tracked information such as the date a user visited a website, the device and browser used, geographic user location, and information such as text input, clicks and scrolling did not constitute an infringement of a privacy interest. Although Bonkowski had similar information collected by tracking pixels, he did not explain what was “embarrassing, invasive, or otherwise private” about the information disclosed. Similarly, Bonkowski did not plead that Maison Miru’s website had exposed his “likes, dislikes, interests, and habits over a significant amount of time.”
In light of this, the court found that Bonkowski’s complaint did not establish liability for an invasion of privacy and therefore did not establish a concrete harm which would give rise to Article III standing. Maison Miru’s motion to dismiss was granted, with leave to amend.
The Bonkowski case provides a great example of how to respond to a complaint where a plaintiff establishes that data was collected, but does not sufficiently argue that the data collection represented an actual invasion of privacy. Simple allegations that trackers have collected data without an explanation of harm which could constitute a cause of action gives defendants a speedy avenue to dismissal.
Talk to you soon CIPAWorld! Stay compliant, and stay safe.
| # | Наименование новости | Тональность | Информативность | Дата публикации |
|---|---|---|---|---|
| 1 | TRACKED AND TRACED?: C.D. Cal. Lets CIPA Claims Against Wayfair Move Forward, But Tosses Pen Register Claim | 0 | 10.13 | 01-01-1970 |
| 2 | Chatrie + the Shrinking Third-Party Doctrine: What Data Custodians Should Watch | 0 | 7 | 09-07-2026 |
| 3 | Data Brokers Beware: California Settlement Highlights Risks in High-Friction Opt-Out Processes | 0 | 8.82 | 01-01-1970 |
| 4 | Californians' data deletion requests, DROP, become enforceable Aug. 1 | 0 | 13.35 | 30-07-2026 |
| 5 | Philadelphia Casino Data Breach: Some Claims Win, Others Lose | 0 | 10.42 | 01-01-1970 |
| 6 | Pinterest pins users’ data down - without consent! | 0 | 5.18 | 22-10-2024 |
| 7 | CJEU: Meta must "minimise" use of personal data for ads | 0 | 5.9 | 04-10-2024 |
| 8 | Schadensersatz für die Datenverarbeitung durch Business Tools: Ihre Ansprüche | 0 | 5 | 05-04-2026 |
| 9 | Powerful Tool, but Not an Attorney: Massachusetts Court Rejects Work Product Protection for AI-Generated Documents | 0 | 8.98 | 01-01-1970 |
| 10 | Pa. Hospital Must Face Bulk Of Website Pixel Tracking Row | 0 | 7 | 16-07-2026 |