Ninth Circuit Precedent Casts a Long Shadow
The judge rejected plaintiffs’ argument that no “independent injury” is needed because CIPA violations inherently infringe privacy rights. He pointed to the Ninth Circuit’s August ruling in Popa v. Microsoft, which held that a statutory violation alone does not establish concrete harm.
Sabraw noted that the Ninth Circuit has repeatedly required “more than just a statutory violation” to clear the injury threshold.
Facebook Tracking Case Not a Lifeline
The plaintiffs also tried to argue that their harm resembled the injury recognized in In re Facebook Internet Tracking Litigation, where Facebook allegedly harvested user data even after logout and fused it with sensitive browsing histories. But Sabraw said the analogy failed: Lowe’s was not accused of anything comparable, and the alleged harms were fundamentally different.
“These differences take this case outside the holding of Facebook,” he concluded.
Jurisdiction Fails for Parent Company
The judge sided with Lowe’s parent company on another major front: specific jurisdiction. Because the parent company did not operate the website, Sabraw ruled the court could not assert jurisdiction over it. Plaintiffs argued its affiliation with the website was enough, but the judge dismissed that logic, noting that prior cases they relied on involved defendants whose control over the websites was undisputed.
