A California federal judge has dismissed a proposed class action accusing Lowe’s of secretly feeding shoppers’ personal data to TikTok and Microsoft, ruling that the plaintiffs failed to show the kind of tangible harm needed to keep their case alive—even though their wiretap allegations were sufficiently laid out.

Claims Derailed—For Now

In a sweeping order issued Wednesday, U.S. District Judge Dana M. Sabraw gave plaintiffs Justin Bradshaw and Gustavo Lopez until Nov. 19 to rework their complaint. Their lawsuit targets Lowe’s Cos. Inc. and Lowe’s Home Centers LLC for allegedly violating the California Invasion of Privacy Act (CIPA). According to the suit, Lowe’s embedded TikTok and Microsoft tracking tools throughout its website, siphoning personal information from unsuspecting customers.

Judge Sabraw agreed the men had pled the necessary components of a wiretap claim—but the case veered off course due to Article III standing problems and questions of personal jurisdiction over Lowe’s parent company, which insisted it neither owned nor operated the website.

The Standing Struggle

The central issue: injury—or the lack thereof.

Under long-standing U.S. Supreme Court precedent, plaintiffs must show a concrete harm. Judge Sabraw concluded that Bradshaw and Lopez had not. Though intangible harms can suffice, they must mirror the types of injuries recognized in common-law torts.

Intrusion Upon Seclusion Argument Falls Short

The plaintiffs argued their situation resembled intrusion upon seclusion, which hinges on an intentional invasion of a space where privacy expectations are reasonable. But the judge found the complaint failed to show any such expectation tied to the core allegation: Lowe’s purportedly transmitted users’ IP addresses to TikTok and Microsoft via the TikTok Pixel and Microsoft Bat Bing Tracker.

“This information may fall within the scope of CIPA Section 638.50(b),” Judge Sabraw wrote, “but plaintiffs must still demonstrate a reasonable expectation of privacy in it.” He added that case law “overwhelmingly” rejects the idea that IP addresses are private.

Plaintiffs countered that IP addresses were just part of the data secretly captured—claiming unique identifiers, Microsoft IDs, timestamps, and device or browser details were also swept up. Judge Sabraw, however, said the operative complaint undermined that assertion and left unclear whether such data is even covered under the statute, which regulates “pen register” devices capable of logging certain routing or signaling information.

Without proving the data falls under Section 638.51(a), any harm tied to its collection cannot fuel a CIPA violation, he concluded.

Ninth Circuit Precedent Casts a Long Shadow

The judge rejected plaintiffs’ argument that no “independent injury” is needed because CIPA violations inherently infringe privacy rights. He pointed to the Ninth Circuit’s August ruling in Popa v. Microsoft, which held that a statutory violation alone does not establish concrete harm.

Sabraw noted that the Ninth Circuit has repeatedly required “more than just a statutory violation” to clear the injury threshold.

Facebook Tracking Case Not a Lifeline

The plaintiffs also tried to argue that their harm resembled the injury recognized in In re Facebook Internet Tracking Litigation, where Facebook allegedly harvested user data even after logout and fused it with sensitive browsing histories. But Sabraw said the analogy failed: Lowe’s was not accused of anything comparable, and the alleged harms were fundamentally different.

“These differences take this case outside the holding of Facebook,” he concluded.

Jurisdiction Fails for Parent Company

The judge sided with Lowe’s parent company on another major front: specific jurisdiction. Because the parent company did not operate the website, Sabraw ruled the court could not assert jurisdiction over it. Plaintiffs argued its affiliation with the website was enough, but the judge dismissed that logic, noting that prior cases they relied on involved defendants whose control over the websites was undisputed.

CIPA Claim Itself Survives—Barely

Despite the setbacks, plaintiffs won a partial victory. Judge Sabraw refused to toss their statutory CIPA claim altogether. Lowe’s had argued the TikTok and Microsoft trackers could not qualify as pen registers or trap-and-trace devices; that their use was lawful because Lowe’s consented; that the company did not act knowingly or intentionally; and that plaintiffs had not shown harm sufficient for statutory standing.

Sabraw rejected each argument, emphasizing that Article III standing differs from statutory standing: “Defendants’ Article III standing argument was not that plaintiffs failed to allege an injury,” he said. “Rather, they argued plaintiffs failed to allege a concrete injury, which is not required for statutory standing.”

Attorneys for both sides could not be reached for comment Friday.

Bradshaw and Lopez are represented by Avi Josefson, Michael Blatchley, Timothy Fleming, Jonathan D. Uslaner of Bernstein Litowitz Berger & Grossmann LLP, and Don Bivens and Teresita T. Mercado of Don Bivens PLLC.

Lowe’s is represented by Bethany G. Lukitsch, Michael A. Kushner, and Andrew C. Burnquist of BakerHostetler.