Background
Demetrius Smith and Maia Williams alleged that Rack Room Shoes used tracking technologies on its website to intercept visitors’ identities and shopping activity. They sought class certification on claims under the federal Wiretap Act and California Invasion of Privacy Act sections 631 and 632.
The record showed that a Meta tracking tool was active on Rack Room’s site and had captured activity from browsers associated with the plaintiffs’ Facebook accounts in earlier years. But there was no evidence that the recorded activity belonged to the plaintiffs or that any tracker collected personally identifiable data during their relevant 2024 visits and purchases.
The Court’s Holding
The court dismissed the three proposed class claims without prejudice for lack of Article III standing and denied class certification. At that stage, allegations were not enough: the named plaintiffs had to establish standing by a preponderance of the evidence. The mere presence of functioning tracking code did not permit a reasonable inference that their own information was intercepted.
The plaintiffs alternatively argued that an attempted interception was itself an injury. The court concluded that ordinary shoe browsing was not shown to be sensitive enough for the attempted observation, without actual collection, to resemble the traditionally actionable privacy tort of intrusion upon seclusion. Remaining individual claims under Penal Code section 502 and common-law invasion of privacy were left for further proceedings.
Key Takeaways
- At class certification, named plaintiffs must prove standing with evidence rather than rely on complaint allegations.
- Proof that tracking technology existed and operated generally does not prove it captured a particular plaintiff’s activity.
- An attempted intrusion without collection may require especially sensitive or private circumstances to qualify as concrete harm.
- Standing analysis can differ claim by claim, and dismissal of proposed class claims need not end the entire action.
Why It Matters
Businesses facing website-tracking suits should examine device, account, and event-level evidence rather than assume the case turns on whether a pixel was installed. Plaintiffs, meanwhile, need a reliable evidentiary chain connecting their own visit to transmitted data and identifying what information actually left the site.
The ruling is particularly relevant to California privacy class actions after discovery. A theory that may survive pleading can fail at certification when browser records, expert evidence, or platform data do not establish an injury to the named representatives themselves.
For case planning, counsel should separate four propositions that are often collapsed: code was installed, code was active, information was transmitted, and the transmitted information belonged to the plaintiff. Each step may require different technical evidence. Account association can be misleading when several people or devices use the same browser session. The order also cautions against assuming every attempted observation resembles a traditional privacy harm. The context and sensitivity of the communication matter. Healthcare, financial, or intimate browsing may present a materially different injury analysis from ordinary retail activity, even when the same tracking technology is involved.
Read the full opinion (PDF) · Court docket