Vishal Shah, et al. v. MyFitnessPal, Inc.

1                                                                         
2                                                                         
3                                                                         
4                      UNITED STATES DISTRICT COURT                       
5                     NORTHERN DISTRICT OF CALIFORNIA                     
6                                                                         
7    VISHAL SHAH, et al.,             Case No.  25-cv-04430-PCP           

8              Plaintiffs,                                                
                                      ORDER GRANTING MOTION TO            
9          v.                         DISMISS IN PART                     

10    MYFITNESSPAL, INC.,              Re: Dkt. No. 50                     
               Defendant.                                                 
11                                                                         

12                                                                         
13        Defendant MyFitnessPal (MFP) moves to dismiss Vishal Shah and Christine Wiley’s 
14   amended complaint alleging that MFP violated their privacy rights by placing certain cookies on 
15   their devices even though they had expressly opted out of receiving such cookies. For the reasons 
16   stated below, MFP’s motion to dismiss is granted in part.             
17                              BACKGROUND                                 
18        The Court previously granted in part and denied in part MFP’s motion to dismiss 
19   plaintiffs’ previous complaint. See Shah v. MyFitnessPal, Inc., 

824 F. Supp. 3d 906

 (N.D. Cal. 
20   2026). The Court held that plaintiffs stated claims for intrusion upon seclusion, invasion of 
21   privacy, and unjust enrichment. The Court held that plaintiffs had not pleaded claims for unlawful 
22   wiretapping, unlawful use of a pen register, common law fraud, and trespass to chattels.  
23        Plaintiffs thereafter filed an amended complaint adding facts and re-pleading their claims 
24   for invasion of privacy; intrusion upon seclusion; wiretapping in violation of the California 
25   Invasion of Privacy Act (CIPA); use of a pen register in violation of CIPA; common law fraud, 
26   deceit, and/or misrepresentation; and unjust enrichment. The amended complaint does not include 
27   a claim of trespass to chattels.                                      
1   like themselves wanted to opt out of being tracked online by third-party data brokers and 
2   advertisers, they could.1 But even after users opted out of tracking cookies on MFP’s website, 
3   MFP “nonetheless caused multiple third parties” to track users browsing activities. Amended 
4   Complaint ¶ 3. MFP’s website includes a search wherein users can enter queries to search for 
5   information on MFP’s website. Amended Complaint ¶¶ 48–51. For example, a search query 
6   including the term “obesity” was sent to a company called Comscore, Inc. Amended Complaint 
7   ¶ 51.                                                                 
8        Plaintiffs also plead more information about their experiences with defendant’s websites. 
9   Plaintiff Vishal Shah visited MFP “on one or more occasions during the last four years, including 
10   in or around February 2023.” Amended Complaint ¶ 108. Shah opted out of all tracking cookies 
11   except for required cookies he could not reject. Amended Complaint ¶ 111. After rejecting 
12   optional cookies, Shah read about MFP’s mobile application, and he alleges MFP shared his 
13   “interest in health applications” with third parties. Amended Complaint ¶ 114. Shah also browsed 
14   the “MyFitnessPal blog” on MFP’s website and “clicked on the ‘Recipes’ button which navigated 
15   him to the ‘Meal Planning & Recipes webpage.” Amended Complaint ¶ 115. Shah alleges that this 
16   browsing information was also shared with third parties.              
17        Plaintiff Christine Wiley visited MFP’s website “on one or more occasions during the last 
18   four years, including in or around January 2023.” Amended Complaint ¶ 120. Wiley opted out of 
19   optional cookies. Amended Complaint ¶ 123. Wiley tried the MFP application, “proceed[ing] 
20   through portions of the sign up process, during which she inputted personal information such as 
21   her name and gender, and [] selected options reflecting health goals, such as ‘lose weight,’ before 
22   discontinuing the process.” Amended Complaint ¶ 126. MFP shared Wiley’s browsing activity 
23   with third parties. Amended Complaint ¶ 126.                          
24                            LEGAL STANDARD                               
25        Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include a “short and plain 
26   statement of the claim showing that the pleader is entitled to relief.” Federal Rule of Civil 
27                                                                         
1   Procedure 12(b)(6) allows a defendant to move to dismiss a complaint for failure to state a claim 
2   upon which relief can be granted. Dismissal is required if the plaintiff fails to allege facts allowing 
3   the Court to “draw the reasonable inference that the defendant is liable for the misconduct 
4   alleged.” Ashcroft v. Iqbal, 

556 U.S. 662, 678

 (2009). “Dismissal under Rule 12(b)(6) is 
5   appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support 
6   a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 

521 F.3d 1097, 1104

 (9th 
7   Cir. 2008).                                                           
8        To survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a 
9   claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 

550 U.S. 544, 570

 (2007). 
10   In considering a Rule 12(b)(6) motion, the Court must “accept all factual allegations in the 
11   complaint as true and construe the pleadings in the light most favorable” to the non-moving party. 
12   Rowe v. Educ. Credit Mgmt. Corp., 

559 F.3d 1028, 1029-30

 (9th Cir. 2009). While legal 
13   conclusions “can provide the [complaint’s] framework,” the Court will not assume they are correct 
14   unless adequately “supported by factual allegations.” Iqbal, 

556 U.S. at 679

. Courts do not “accept 
15   as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable 
16   inferences.” In re Gilead Scis. Secs. Litig., 

536 F.3d 1049, 1055

 (9th Cir. 2008) (quoting Sprewell 
17   v. Golden State Warriors, 

266 F.3d 979, 988

 (9th Cir. 2001)).         
18                               ANALYSIS                                  
19   I.   Plaintiffs’ claims are timely.                                   
20        MFP moves to dismiss plaintiffs’ CIPA, invasion of privacy, and unjust enrichment claims 
21   as untimely. Shah alleges that he visited the MFP website “on one or more occasions during the 
22   last four years, including in or around February 2023.” Amended Complaint ¶ 108. And Wiley 
23   alleges that she visited the website “on one or more occasions during the last four years, including 
24   in or around January 2023.” Amended Complaint ¶ 120. MFP argues that plaintiffs should have 
25   brought their CIPA claims by January or February 2024 and their invasion of privacy claims by 
26   January or February 2025, given the one- and two-year statutes of limitations for those claims. For 
27   plaintiffs’ unjust enrichment claim, plaintiffs argue that the statute of limitations is one year based 
1   (N.D. Cal. 2023).                                                     
2        Because the statute of limitations is “generally an affirmative defense,” statutes of 
3   limitations do not provide a basis for dismissal under Rule 12(b)(6) unless plaintiffs have pleaded 
4   themselves out of a claim by “admit[ing] all the ingredients of an impenetrable defense.” See 
5   Durnford v. MusclePharm Corp., 

907 F.3d 595

, 604 n.8 (9th Cir. 2018). Where the defendant 
6   moves to dismiss a claim as untimely under the applicable statute of limitations, the motion can be 
7   granted “only when ‘the running of the statute is apparent on the face of the complaint.’” Von 
8   Saher v. Norton Simon Museum of Art at Pasadena, 

592 F.3d 954, 969

 (9th Cir. 2010) (quoting 
9   Huynh v. Chase Manhattan Bank, 

465 F.3d 992, 997

 (9th Cir. 2006)). Here, as with plaintiffs’ 
10   previous complaint, plaintiffs’ complaint does not admit the ingredients of an impenetrable statute 
11   of limitations defense. “The face of the complaint,” Huynh, 

465 F.3d at 997

, establishes that 
12   plaintiffs visited MFP’s website at some point during the “last four years” which could include the 
13   last one or two years, so it is entirely possible, from the face of the complaint, that plaintiffs’ 
14   claims are timely.” Shah, 824 F. Supp. 3d at 915.                     
15        MFP argues that the plaintiffs’ broad language about visiting MFP’s website at some point 
16   during the “last four years” should be disregarded in favor of the more specific dates plaintiffs 
17   have included in their complaint. Motion to Dismiss at 5–6. But MFP does not provide binding 
18   authority establishing such a rule for interpreting pleadings and doing so would be at odds with the 
19   liberal pleading standards for the Federal Rules.                     
20        Even assuming that the more general visit allegations should be discarded, plaintiffs have 
21   pleaded an entitlement to tolling under the doctrine of fraudulent concealment. At the pleadings 
22   stage, the Court considers “whether the complaint, liberally construed in light of our ‘notice 
23   pleading’ system, adequately alleges facts showing the potential applicability of the equitable 
24   tolling doctrine.” Cervantes v. City of San Diego, 

5 F.3d 1273, 1277

 (9th Cir. 1993). “The doctrine 
25   of fraudulent concealment tolls the statute of limitations where a defendant, through deceptive 
26   conduct, has caused a claim to grow stale.” Aryeh v. Canon Bus. Sols., Inc., 

55 Cal. 4th 1185

, 
27   1192 (2013). “A plaintiff alleging fraudulent concealment must establish that its failure to have 
1   & Co. (U.S.A.), Inc., 

858 F.2d 499, 505

 (9th Cir. 1988). MFP argues that the heightened pleading 
2   standard of Federal Rule of Civil Procedure 9(b) applies to the fraudulent concealment doctrine. 
3   Reply at 7. In support MFP cites Thibodeaux v. Teamsters Local 853, 

263 F. Supp. 3d 772

, 778 
4   (N.D. Cal. 2017), which in turn relied on the Ninth Circuit’s decision in Conmar Corp. v. Mitsui & 
5   Co., 

858 F.2d 499

 (9th Cir. 1988). But Conmar did not establish that heightened pleading 
6   standards apply to the fraudulent concealment doctrine; indeed, it did not have occasion to address 
7   those standards because the case involved an appeal from a grant of summary judgment in the 
8   defendant’s favor. Id. at 500. Fraudulent concealment is different from a fraud cause of action 
9   because the “doctrine of fraudulent concealment applies to any type of case, not just civil actions 
10   for fraud ….” Cmty. Cause v. Boatwright, 

124 Cal. App. 3d 888, 900

 (1981). Because fraudulent 
11   concealment is not a standalone cause of action or a component of such a cause of action, Rule 
12   9(b) does not apply. See Vess v. Ciba-Geigy Corp. USA, 

317 F.3d 1097

, 1103–04 (9th Cir. 2003). 
13        Here, plaintiffs pleaded facts that give rise to a plausible inference of fraudulent 
14   concealment because they allege that MFP misled users as to the import of opting out of non-
15   essential cookies. Based on plaintiffs’ complaint, users of MFP’s website would not have had any 
16   reason to know they were being misled as to the fact that cookies would be placed on their devices 
17   even if they declined non-essential cookies. Both plaintiffs allege that they do “not know how the 
18   [MFP] Website is programmed, which can change over time, and … do[] not have the technical 
19   knowledge necessary to test whether the Website honors users’ requests to opt out of, decline, or 
20   reject all non-required cookies and tracking technologies….” Complaint ¶¶ 119, 130. Thus 
21   plaintiffs have not pleaded themselves out of the fraudulent concealment doctrine and their claims 
22   establish a potential entitlement to such tolling. MFP’s motion to dismiss on timeliness grounds is 
23   therefore denied.                                                     
24   II.   Wiretapping                                                     
25        MFP moves to dismiss plaintiffs’ wiretapping claim, arguing that plaintiffs again have not 
26   plausibly pleaded that third parties violated Clause 2 of Section 631(a), which is a predicate for 
27   UMI’s alleged violations of Clauses 3 and 4, and that plaintiffs have not pleaded that any 
1        Clause 2 of California Penal Code section 631(a) prohibits any person from “read[ing], or 
2   attempt[ing] to read, or to learn the contents or meaning of any message, report, or communication 
3   while the same is in transit.” “Contents” refers to the substance or “intended message conveyed” 
4   by a communication, rather than “record” or routing information associated with the 
5   communication. Cf. In re Zynga Priv. Litig., 

750 F.3d 1098, 1106

, 1108–09 (9th Cir. 2014) 
6   (distinguishing the “contents” of a communication from record information and explaining that a 
7   URL containing a search term may constitute content, whereas one that “includes only basic 
8   identification and address information” does not); Yoon v. Lululemon USA, Inc., 

549 F. Supp. 3d 9

   1073, 1082–83 (C.D. Cal. 2021) (finding that Section 631(a) protects the substantive content of 
10   communications, not routine identifying information such as “keystrokes, mouse clicks, pages 
11   viewed, and shipping and billing information . . . [and] the date and time of the visit, the duration 
12   of the visit, Plaintiff’s IP address, her location at the time of the visit, her browser type, and the 
13   operating system on her device”).                                     
14        Plaintiffs’ amended complaint, unlike their original complaint, now adequately alleges that 
15   information about their own visits to MFP’s website was sent to third parties. After he rejected 
16   non-essential cookies, Shah read about MFP’s mobile application, and MFP proceeded to share his 
17   “interest in health applications” with third parties. Amended Complaint ¶ 114. Shah also browsed 
18   the “MyFitnessPal blog” on MFP’s website and “clicked on the ‘Recipes’ button, which navigated 
19   him to the ‘Meal Planning & Recipes webpage.” Amended Complaint ¶ 115. Shah alleges that this 
20   browsing information was also shared with third parties. Wiley too opted out of optional cookies. 
21   Amended Complaint ¶ 123. Wiley tried the MFP application, “proceed[ing] through portions of 
22   the sign up process during which she inputted personal information such as her name and gender 
23   and [] selected options reflecting health goals, such as ‘lose weight,’ before discontinuing the 
24   process.” Amended Complaint ¶ 126. MFP allegedly shared Wiley’s activity with third parties. 
25   Amended Complaint ¶ 126.                                              
26        Only Wiley’s allegations support a viable wiretapping claim. As the Court has previously 
27   noted, “A third party may violate § 631(a) by tracking website interactions, user input data, 
1   through the URL title) if the tracking of such data conveys information about the website user’s 
2   communications with the website.” D’Antonio v. Smith & Wesson Inc., 

2026 WL 2653811

, at *3 
3   (N.D. Cal. Sept. 8, 2026) (emphasis added). Shah alleges that his accessing of MFP’s “Recipes” 
4   page was the relevant communication, but this merely involved browsing MFP’s public website. 
5   By contrast, Wiley began the sign-up process for the MFP application, which included selecting 
6   options attesting to her individual health goals such as “lose weight,” as well as “input[ing] 
7   personal information such as her name and gender.” Unlike Shah, who alleges the disclosure only 
8   of “record” information relating to his browsing, Wiley alleges that she communicated with 
9   MFP’s website by directly informing the website of her preferences and personal information. 
10   See D’Antonio, 

2026 WL 2653811

, at *3. Wiley has therefore addressed the deficiency in the prior 
11   complaint.                                                            
12        MFP also argues that plaintiffs have not shown that their communications were intercepted 
13   while “in transit.” But plaintiffs have alleged that MFP caused cookies to be stored on users’ 
14   devices which in turn “permitted the Third Parties to track and collect data in real time ….” 
15   Amended Complaint ¶ 4. Whether the communications were intercepted while in transit is a 
16   factual issue better resolved at a later stage in this case. Plaintiffs have alleged tracking and 
17   collecting of data “in real time,” which suffices to allege interception in real time at the pleadings 
18   stage here.                                                           
19        Accordingly, MFP’s motion to dismiss plaintiffs’ wiretapping claim is denied as to Wiley 
20   and granted as to Shah.                                               
21   III.   Pen Register                                                   
22        California Penal Code § 638.51(a) prohibits “install[ing] or us[ing] a pen register” without 
23   a court order under specific circumstances. Section 638.50(b) defines a “pen register” as “a device 
24   or process that records or decodes dialing, routing, addressing, or signaling information 
25   transmitted by an instrument or facility from which a wire or electronic communication is 
26   transmitted, but not the contents of a communication.”                
27        The Court previously dismissed plaintiffs’ pen register claim for failing to allege that any 
1   with MFP were tracked. See Shah, 824 F. Supp. 3d at 920–21. But as discussed above, Wiley now 
2   sufficiently alleges that she communicated with MFP’s website because she conveyed personal 
3   information and preferences to MFP, while Shah still has not alleged any communications that 
4   MFP tracked. Plaintiffs also allege in greater detail that third parties collected “TCP and/or UDP 
5   port numbers,” protocol-level metadata, and “HTPP request header metadata,” all of which 
6   function to direct internet traffic, manage electronic connections with third parties, and provide 
7   information about a destination request. Amended Complaint ¶¶ 98–100. Other metadata 
8   associated with plaintiffs’ devices include “destination IP address, port identifiers …, and related 
9   connection and session attributes, including connection initiation and termination timestamps, 
10   connection duration, and identifiers such as the protocol used (TCP or UDP), the source IP 
11   address, the source port, the destination IP address, and the destination port.” Amended Complaint 
12   ¶ 101.                                                                
13        MFP argues that plaintiffs’ new allegations are too general to sustain plaintiffs’ claims. 
14   While the metadata and other information alleged by plaintiffs could include a broad range of 
15   connections between a device and a website, plaintiffs need not plead exactly how the metadata 
16   regarding their communications was tracked. Such a level of specificity is not required at the 
17   pleading stage. See Wiley, 826 F. Supp. 3d at 1138 n.4 (noting that Rule 9(b) does not apply to 
18   CIPA claims). Instead, whether the cookies installed on plaintiffs’ devices enabled the tracking of 
19   information falling within the pen register statute is best determined on the basis of a complete 
20   factual record regarding not only what was tracked but also where the purported pen register 
21   device was installed and whether it tracked the “dialing, routing, addressing, or signaling 
22   information” for outgoing communications from that device.            
23        MFP also argues that plaintiffs have inadequately alleged scienter. But plaintiffs have 
24   alleged that MFP systematically disregarded users’ decisions to opt out of nonessential cookies 
25   and continued to place cookies on users’ devices to track users and share their activity with third 
26   parties. At the pleading stage, considering the fact-intensive nature of assessing allegations of 
27   scienter, the Court takes factual inferences in plaintiffs’ favor and concludes that plaintiffs have 
1        Accordingly, the Court grants MFP’s motion to dismiss the pen register claim as to Shah 
2   but denies it as to Wiley.                                            
3   IV.   Common Law Fraud, Deceit and/or Misrepresentation               
4        Common law fraud in California requires “(a) misrepresentation (false representation, 
5   concealment, or nondisclosure); (b) knowledge of falsity (or ‘scienter’); (c) intent to defraud, i.e., 
6   to induce reliance; (d) justifiable reliance; and (e) resulting damage.” Kearns v. Ford Motor Co., 
7   

567 F.3d 1120, 1126

 (9th Cir. 2009) (emphasis removed). A state law fraud claim being pursued 
8   in federal court must also satisfy Federal Rule of Civil Procedure 9(b)’s particularity requirement 
9   by pleading “the who, what, when, where, and how of the misconduct alleged.” 

Id. at 1126

. One of 
10   the purposes of the specificity required of Rule 9(b) is to “provide defendants with adequate notice 
11   to allow them to defend the charge and deter plaintiffs from the filing of complaints as a pretext 
12   for the discovery of unknown wrongs.” 

Id. at 1125

 (internal quotation marks omitted). The Court 
13   previously dismissed plaintiffs’ fraud claim for failing to plead with particularity the “when … of 
14   the misconduct alleged” because plaintiffs did not plead any particular dates on which they visited 
15   MFP’s website. See Shah, 824 F. Supp. 3d at 921. MFP argues that plaintiffs have continued to 
16   fail to plead the “when” of the alleged misconduct with sufficient particularity.  
17        Plaintiffs’ allegations in the amended complaint provide sufficient detail to satisfy Rule 
18   9(b). Claims sounding in fraud require particularity but can still provide for ranges of time in 
19   which plaintiffs allege misconduct occurred. In United States v. United Healthcare Insurance Co., 
20   

848 F.3d 1161

 (9th Cir. 2016), for example, the Ninth Circuit held that a timeframe of two years 
21   was sufficient to satisfy Rule 9(b). 

Id.

 at 1180–81. The ultimate metric is whether plaintiffs plead 
22   enough detail to provide notice to the opposing party of their wrongdoing. The particularity 
23   requirement “may be relaxed as to matters within the opposing party’s knowledge.” Evans v. Sleep 
24   No. Corp., 

2025 WL 1093332

, at *4 (E.D. Cal. Apr. 11, 2025) (citing Moore v. Kayport Package 
25   Exp., Inc., 

885 F.2d 531

, 540 (9th Cir. 1989)).                       
26        Plaintiffs’ amended complaint includes sufficiently specific allegations of fraud to the 
27   extent it identifies specific months in which they visited MFP’s website. MFP has the knowledge 
    ]    visits to MFP’s website occurring in January and February 2023, allege that MFP made 
    2  ||  misleading statements at that time, and explain why the statements were misleading. MFP 
    3  || therefore now has notice sufficient to target their factual inquiry and address plaintiffs’ fraud 
    4    claims. Therefore, MFP’s motion to dismiss plaintiffs’ common law, fraud, and/or 
    5  || misrepresentation claim is denied. 
    6                                     CONCLUSION 
    7          For the above reasons, MFP’s motion to dismiss is granted as to Shah’s wiretapping and 
    8  || pen register claims and otherwise denied. 
    9          IT IS SO ORDERED. 
   10  || Dated: September 28, 2026 
   1] 
   2                                                    _   hag  bam 
                                                         P. Casey Pitt 
=    13                                                    United States District Judge 

   14 

  15 
   16 

   (17 


Z    18 
   19 
   20 
   21 
   22 
   23 
   24 
   25 
   26 
   27 
   28