Peter C. Hayward, Kelly Garcia, and Matthew Ybarra, individually and on behalf of all others similarly situated v. mParticle, Inc., and Rokt US Corp.

UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 

PETER C. HAYWARD, KELLY GARCIA, and 
MATTHEW YBARRA, individually and on behalf of all          25 Civ. 8173 (PAE) 
others similarly situated, 
                                                      OPINION & ORDER 
                         Plaintiffs, 
                       -V- 
MPARTICLE, INC., and ROKT US CORP., 
                         Defendants. 

PAUL A. ENGELMAYER, District Judge: 
     This case is brought on behalf of a putative class of consumers whose personally 
identifiable information (“PII”) was allegedly intercepted, harvested, and monetized by 
defendants mParticle, Inc. and Rokt US Corp. (collectively, “mParticle’”) in violation of, inter 
alia, California common law tort law, the California Constitution, and the California Invasion of 
Privacy Act (“CIPA”). 
     Defendants move to dismiss plaintiffs’ Second Amended Complaint (“SAC”).  Under 
Federal Rule of Civil Procedure 12(b)(1), they argue that the routine collection of “innocuous 
contact information” as alleged in the SAC does not plead an injury in fact supporting the named 
plaintiffs’ standing.  Under Rule 12(b)(6), they argue that the SAC fails to state a claim.  For the 
reasons that follow, the Court grants defendants’ motion under Rule 12(b)(1). 

1.     Background 
     A.     Factual Background 
           1.     Parties 
     mParticle, Inc. is  a Delaware corporation that builds and sells user profiles to mobile 
applications, websites, and other customers.  Dkt. 52 (“SAC”) 9] 43-48.  mParticle, Inc. has a 
principal place of business in New York, New York.  Jd. ¥ 43. 
     Rokt US Corp. (“Rokt”), mParticle’s parent corporation,  is an Al-powered e-commerce 
marketing platform that specializes in offering targeted advertisements for both the publishers 
who host its advertisements and the advertisers whose products are advertised.  Jd.   51, 53~54. 
Rokt is also a Delaware corporation headquartered in New York, New York.  Id. § 50, 57. 
     At all relevant times, plaintiff Peter Hayward was a resident of Los Angeles County, 
California, id. J 12; plaintiff Kelly Garcia was a resident of American Canyon, California, id. 
{ 23; and plaintiff Matthew Ybarra was a  resident of Santa Clara County, California, id. J 31. 
Each plaintiff alleges that he or she used online services or applications—such as Venmo, 
Peacock, and the NBC App—that implemented mParticle’s “IDSync” software; that mParticle, 
unbeknownst to each plaintiff, assigned each a unique “mParticle ID”; and that mParticle 
intercepted, without plaintiffs’ consent, certain information, including their email addresses, 
names, phone numbers, and device and advertising identifiers, as they logged into and transacted 
on these services.  See id. JJ 12-42. 
           2.‘    mParticle’s Business Model 
     In 2017, mParticle, Inc.,  a company specialized in “build[ing] comprehensive user- 
specific profiles,” launched IDSync.  Jd. {[ 2, 44-47.  [DSync offers a persistent, unique, cross- 
platform identifier to “unify real-time customer interactions” for machine-learning purposes.  Id.

{{ 69-70.  mParticle uses this technology and others to profile users, their devices, and their 
behavior by collecting “every piece of data” about them.  Id. § 70. 
                 a.     mParticle ID and User Profiles 
     The SAC alleges that mParticle builds these user profiles in a three-step process.  Id. 
4 71.  First, whenever a user opens a website or app that uses mParticle software, an identity 
request is immediately transmitted to mParticle.  Id.  This identity request consists of an 
mParticle software development kit (“SDK”) or HTTP application programming interface 
(“API”}—two automated technological methods—that intercept a user’s request and capture 
their “email, customer ID[], or device identifier.”  Jd.  Second, mParticle compares those 
identifiers against existing records in mParticle’s system to search for a matching user profile. 
Id.  Third, to the extent a match exists, mParticle transmits that profile to its client; if no match 
exists, it creates a new profile and assigns it  a new mParticle ID to enable future identification. 
Id. §§ 71, 73.  Plaintiffs allege that this identification process repeats at the start of a session, at 
login, and at logout, and that mParticle continues to aggregate newly discovered identifying 
information—such as an email address entered after a user visits  a page—to the existing profile. 
Id.  ¥ 72. 
     The mParticle ID is alleged to be “a 64-bit signed integer” that is used to uniquely 
identify a user for purposes of processing identity and profile data, and serves as the “anchor” of 
each user’s profile.  /d. § 74.  Using the unique mParticle ID, an mParticle client can retrieve a 
user’s complete profile.  Jd.   75.  An mParticle client can also retrieve a user’s complete profile 
using “any other known identifier like [an] email address, customer ID, or device ID.” Id.    □□□ 
76.  Separate from such information, plaintiffs allege that mParticle tracks a “user’s IP address 
and the first and last time it has ‘[s]een’ the user on websites or apps incorporating its SDK.”  Jd. 
4 77.

     mParticle integrates additional data to these user profiles from “new inbound data 
streams.”  Jd.  4 78 (cleaned up).  This data can include a user’s age, full name, gender, phone 
number, address, city, state, zip code, and country, plus event data reflecting specific actions the 
user has taken and the advertising audiences and campaigns to which the user has been assigned. 
Id. {§ 78-79.  To the extent a client retains mParticle’s SDK (i.e., it continues to host mParticle’s 
interception technology on its website or app), mParticle continues to collect behavioral data and 
automatically update the profile to reflect newly obtained identifying information.  Jd. { 80. 
     Finally, mParticle “enriches” raw user data it receives through its SDK, API, and other 
means.  Jd. J] 88-89 (cleaned up).  During “data processing,” mParticle compares that data batch 
to the matching “user profile[,] and adds additional information” about the user before 
transmitting it to “third parties through integrations.”  Jd. { 88.  For example, before the raw data 
“enrichment,” mParticle may know that a customer using the ID “Bob” purchased a  t-shirt for 
$20 and that his favorite food is pizza.  Id. J] 88-90.  Comparing this “data batch” to an existing 
user profile for “Bob”—which includes his email address and favorite drink (beer)—mParticle is 
able to enrich the user profile for Bob to reflect: 
         e   CustomerID: Bob 
         e   Email: bob@example.com 
         e   User Attributes: Favorite Food: Pizza; Favorite Drink: Beer 
     Id. at 17. 
                 b.     CNAME Cloaking 
     A feature of mParticle’s software, the SAC alleges, is its ability to circumvent ordinary 
barriers to tracking, such as a consumer’s using private browsing, declining cookies, or enabling 
Apple’s “Do Not Track” feature.  Id. {§ 81-82.  mParticle achieves this mainly by manipulating

the user’s Canonical Name (“CNAME”) to “prevent blocking and ensure maximum data 
collection.”  Jd. □□ 101-02, 104. 
     mParticle gives its clients, who operate websites and mobile applications, guidance on 
how to configure their own respective CNAMEs to defeat device and browser-level protections 
designed to limit third party tracking.  Id. {{ 46, 101.  Whereas CNAME enables first party 
website operators to distinguish between services offered by their domain and those offered by 
third party domains, id. J] 102-03, mParticle’s website instructs clients how to configure their 
CNAME records so that their CNAME reflects that of mParticle (e.g. “mp.[domain].com”).  Id. 
q 104.  Once a client configures their CNAME as such, when a consumer visits an mParticle 
client’s platform, his device will transmit data as if mParticle is “part of the first party domain.” 
     105.  This configuration, the SAC alleges, undermines consumers’ abilities to protect 
themselves against entities like mParticle with which they had not knowingly interacted and 
ensures that “transmissions to mParticle are not blocked by ad blockers or browsers like Safari 
and Firefox that otherwise prevent third party tracking.”  Jd. J§ 103, 105. 
                 C.     Machine Learning and Predictive Attributes 
     mParticle also uses the data it intercepts to power machine-learning models.  Jd.    83- 
86.  It analyzes “thousands of behavioral signals” to predict which users are statistically most 
likely to “convert’—that is, to purchase a product or pay for a service offered by its clients.  Id. 
q{ 83-84.  It stores these predictive outputs in the user’s profile in a field labeled “Predictive 
Attributes”; these fields are automatically recalculated based on a user’s activity.  Id. JJ 83-86. 
mParticle builds “predictive audiences,” or groups of users whose behavior mParticle’s models 
predict will be similar.  Id. § 87. 

                                     □ 

                 d.     Integration with Third-Party Advertising Platforms 
     mParticle shares the user profiles it develops with advertising companies and other 
“identity providers,” such as Google, Meta, and Adobe, to support cross-platform targeting.  Id. 
4 92.  mParticle forwards user profile data to these companies and identity providers.  Jd. J] 93- 
99.  The data forwarding enables the recipients to add data to their machine learning systems.  Id. 
mParticle also engages in “cookie syncing,” in which it and participating clients exchange, in 
real time, the identifiers they use to recognize a user.  Id. § 99. 
     mParticle’s integration with Facebook, for example, would enable mParticle user data to 
be forwarded directly to a Facebook Ads Manager account.  Id. J] 94-96.  This user data 
includes email addresses, Facebook IDs, Google Advertising IDs, phone numbers, and 
behavioral “attributes” and event data.  Id.  This data is relayed directly, and within seconds, to 
that advertiser, either via a server or the user’s browser.  Jd. {9 92-95.  mParticle’s clients can 
combine this forwarded data with tools such as Facebook’s advanced matching features.  Jd. 
496.  That, in turn, enables Facebook to target the user based on specific attributes guided by 
Facebook’s machine learning advertising models.  Jd. 
     Similarly, in mParticle’s integration process with Google Ads, it forwards its user data to 
“Google Ads,” which “enable[s] Google to identify individuals based on email, phone numbers, 
or device IDs.”  Jd.    97.  mParticle can also “send physical address information” and “transmit[] 
event data, including ‘custom events’” to Google.  Jd.  Once it receives a user’s profile and data, 
Google’s advertising client can create a “Customer Match list” that empowers “hyper-specific 
targeted advertising.”  Id. 
     In sum, mParticle maintains an extensive library containing user data it has integrated 
from other advertising networks, data brokers, and demand-side platforms, including The Trade

Desk, Adobe, LiveRamp, Xandr, Snapchat, Pinterest, and Yahoo, and it promotes “cookie 
syncing” arrangements with its partners with whom it consolidates user data.  Id. JJ 96-99. 
           3.     Rokt Acquisition 
     In January 2025, Rokt acquired a 100% stake in mParticle Inc. for approximately $300 
million.  Id.  9957, 120.  The SAC alleges that Rokt’s acquisition of mParticle was motivated by 
the value of mParticle Inc.’s real-time feed of user data.  Id. {9 118-21.  Rokt’s CEO and co- 
founder stated that merging with mParticle enabled it to use mParticle’s user data to match and 
identify individual users and to send targeted advertisements to these users.  Jd.   121.  These 
“unified customer profiles” enable Rokt to secure “‘a larger share of enterprise ecommerce 
budgets.”  Id.  The SAC alleges that Rokt and MParticle unjustly benefit by using, in their 
machine learning algorithms, customer data they have acquired, because Rokt and mParticle are 
not entitled to such data.  Jd. { 122. 
     The SAC alleges that the data mParticle obtains and compiles is valuable, as reflected in 
the scale of the online advertising industry and the fair market sales value of datasets.  Id. J] 
117-19.  In 2023, it notes, the online advertising industry was estimated to be $200 billion.  Jd. 
4117.  And, a 10-million-record hashed-email dataset was marketed by “datarade.ai” for $5,000 
per month, and another dataset offered by “Strista,” which combined hashed emails and IP 
addresses, retailed for $9,500.  Id. J] 119-20. 
Il.     Procedural History 
     On April 23, 2025, Hayward filed the original complaint in the Northern District of 
California.  Dkt. 1.  On June 6, 2026, defendants moved, under 

28 U.S.C. § 1404

, to transfer 
venue to this District, or alternatively, to dismiss the complaint.  Dkt. 29.  On July 3, 2026, 
Hayward—now joined by Ybarra and Garcia—filed an amended complaint in that district.

Dkt. 32.  On August 1, 2026, defendants renewed their motions to transfer or dismiss.  Dkt. 39. 
On September 18, 2025, U.S. District James Donato granted the motion to transfer.  Dkt. 46. 
     On October 15, 2025,  in light of the capacity for the transfer to a new District to shape 
plaintiffs’ factual allegations or legal theories, this Court authorized plaintiffs to file  a second 
amended complaint.  Dkt. 50.  On October 29, 2025, plaintiffs did so.  Dkt. 52 (“SAC”).  The 
SAC, the operative complaint today, seeks damages and injunctive relief.  Jd. at 43.  On 
November 12, 2025, the Court, in granting defendants’ motion to extend the time in which to 
answer or move, set a briefing schedule in the event plaintiffs, following a motion to dismiss, 
sought to file a third amended complaint.  Dkt. 58.  On December 3, 2026, defendants moved to 
dismiss the SAC, Dkt. 61, and attached a memorandum of law in support, Dkt. 62 (““Mem.”). 
Plaintiffs elected not to file  a new amended complaint but, instead, on January 14, 2026, opposed 
defendant’s motion.  Dkt. 63 (““Opp’n”).  On February 4, 2026, defendants replied.  Dkt. 65 
(“Reply”). 
     On July 16, 2026, defendants moved to stay discovery, in light of the pending motion to 
dismiss.  Dkt. 68 at 1.  On July 21, 2026, plaintiffs opposed.  Dkt. 70.  On August 3, 2026, the 
Court substantially granted the motion to stay, save for limited discovery queries plaintiffs had 
propounded to clarify the nature and scope of defendants’ records and dealings with third parties. 
Dkt. 71. 
Il.    Discussion 
     Defendants move to dismiss under Rule 12(b)(1) for lack of subject matter jurisdiction, 
arguing that plaintiffs lack Article II standing.  Mem. at 3-7.  For the reasons below, the Court 
grants this motion, finding that the SAC does not plausibly plead, as to any claim, that the named 
plaintiffs suffered a cognizable injury in fact.  The Court accordingly does not reach defendants’ 
alternative grounds to dismiss, under Rule 12(b)(6), for failure to state a claim. See Ross v. Bank

of Am., N.A., 

524 F.3d 217

, 222 n.1 (2d Cir. 2008); Brown v. Nat’l Football League, Inc., 

825 F. Supp. 3d 265

, 272 (S.D.N.Y. 2026) (Engelmayer, J.). 
     A.     Applicable Legal Standards 
           1.      Rule 12(b)(1) 
     A court must dismiss a claim for lack of subject matter jurisdiction under Rule 12(b)(1) 
when it “lacks the statutory or constitutional power to adjudicate it, such as when . .  . the plaintiff 
lacks constitutional standing to bring the action.”  Cortlandt St. Recovery Corp. v. Hellas 
Telecomms., S.a.r.1., 

790 F.3d 411, 416-17

 (2d Cir. 2015) (citation omitted).  “A plaintiff 
asserting subject matter jurisdiction has the burden of proving by a preponderance of the 
evidence that [jurisdiction] exists.”  Makarova v.  United States, 

201 F.3d 110, 113

 
(2d Cir. 2000).  In resolving a motion to dismiss for lack of subject matter jurisdiction, “the court 
must take all facts alleged in the complaint as true,” Nat. Res. Def Council v. Johnson, 

461 F.3d 164

, 171 (2d Cir. 2006) (citation omitted), but “jurisdiction must be shown affirmatively, 
and that showing is not made by drawing from the pleadings inferences favorable to the party 
asserting it,” Shipping Fin. Servs. Corp. v. Drakos, 

140 F.3d 129, 131

 (2d Cir. 1998); see also 
Amidax Trading Grp v. S.W.ILF.T. SCRL, 

671 F.3d 140, 145

 (2d Cir. 2011) (per curiam); APWU 
 y. Potter, 

343 F.3d 619

, 623 (2d Cir. 2003).  On such a motion, a court may consider evidence 
outside the pleadings, such as affidavits and exhibits.  See Makarova, 

201 F.3d at 113

. 
           2.     Article III Standing 
     Article III of the Constitution limits the federal judicial power to the resolution of “cases” 
and “controversies.”  U.S. Const. art. IIL, § 2.  An “essential and unchanging part” of this 
limitation is that a plaintiff has standing to sue.  Lujan v. Defs. of Wildlife, 

504 U.S. 555, 560

 
(1992).  A plaintiff must “demonstrate standing for each claim and form of relief sought.”

Cacchillo y. Insmed, Inc., 

638 F.3d 401, 404

 (2d Cir. 2011) (quoting Baur v.  Veneman, 

352 F.3d 625

, 642 n.15 (2d Cir. 2003)). 
     The “irreducible constitutional minimum” of standing is that a plaintiff “(1) suffered an 
injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that 
is likely to be redressed by a favorable judicial decision.”  Spokeo, Inc. v. Robins, 

578 U.S. 330, 338

 (2016) (quoting Lujan, 

504 U.S. at 560-61

).  That requires that a plaintiffs injury be 
“concrete”—that is, “real, and not abstract.”  Jd. at 340 (cleaned up).  The injury-in-fact 
requirement—which figures substantially in this case—is meant to “ensure that the plaintiff has a 
personal stake in the outcome of the controversy.”  Susan B. Anthony List v. Driehaus, 

573 U.S. 149

 (2014) (citation omitted).  This requirement “ensures that federal courts decide only ‘the 
rights of individuals’ .. . [and] exercise ‘their proper function in a limited and separated 
government.’”  TransUnion LLC v. Ramirez, 

594 U.S. 413, 423

 (2021) (quoting Marbury v. 
Madison, 

1 Cranch 137, 170

 (1803); John G. Roberts, Jr., Article II Limits on Statutory 
Standing, 42 DUKEL.J. 1219, 1224 (1993)). 
     Certain harms “readily qualify as concrete.”  Jd at 425.  “The most obvious” of these 
“are traditional tangible harms, such as physical harms and monetary harms.”  Jd. at 425. 
Financial loss is a “classic pocketbook injury sufficient to give [plaintiff] standing.”  Tyler v. 
Hennepin Cnty., Minnesota, 

598 U.S. 631

, 636 (2023) (citing TransUnion, 

594 U.S. at 425

); see 
also Moreira v. Société Générale, S.A., 125 F 4th 371, 385 (2d Cir. 2025) (same).  As to 
intangible harms, the Constitution identifies the contours of such injuries, which bear a close 
relationship to harms traditionally recognized as providing a basis for lawsuits in American 
courts that are “concrete.”  See, e.g., TransUnion, 

594 U.S. at 425

.  Concrete intangible harms 

                                     19 

also include those such as reputational harm, disclosure of private information, and intrusion 
upon seclusion.  

Id.

 
     B.     Application 
     In moving to dismiss, defendants contend that the SAC, which alleges that defendants 
obtained and monetized plaintiffs’ “personally identifiable information,” does not plead a 
cognizable injury in fact.  Mem. at 3-11.  Plaintiffs counter principally that the SAC pleads two 
privacy-related harms traditionally recognized as adequate to confer standing: invasion of their 
privacy, referred to at common law as public disclosure of “private facts,” and “intrusion upon 
seclusion.”  See Opp’n at 4-9.  They also rely upon the SAC’s allegations that defendants 
harmed plaintiffs’ electronic device “resources.”  Jd. at 15-16. 
           1.     What Law Governs the Court’s Standing Analysis? 
     The Court must first determine the law governing its Article III standing analysis. 
Although the parties debate whether California or New York law governs the substantive claims, 
they are silent as to whether, in assessing standing, the Court must draw upon precedents from 
the Ninth Circuit, from which this case was transferred, or the Second Circuit, where it currently 
is being litigated.  See, e.g., Mem. at 17 n.5; Opp’n. at 20, 23—24; Reply at 9. 
     Second Circuit precedent governs the Article III standing analysis here.  For a case 
transferred under 

28 U.S.C. § 1404

(a), whether the transferee court relies on the law of its Circuit 
or that of the transferor court turns on whether the issue concerns a matter of state substantive 
law or federal law.  See Van Dusen v. Barrack, 

376 U.S. 612, 639

 (1964).  Questions of state 
substantive law—-such as choice-of-law rules—are drawn from the law of the jurisdiction where 
the action was filed.  See id.; Menowitz v. Brown, 

991 F.2d 36, 40

 (2d Cir. 1993) (“[T]he 
‘accident’ of federal diversity jurisdiction does not enable a party to utilize a transfer to achieve a 
result in federal court which could not have been achieved in the courts of the State where the 

                                     11 

action was filed.”).  But the transferee court applies the law of its circuit when interpreting 
questions of federal law or the U.S. Constitution.  In re Methyl Tertiary Butyl Ether (“MTBE”) 
Prods. Liab. Litig., No. 00 MDL 1898, 

2005 WL 106936

, at *2 (S.D.N.Y. Jan. 18, 2005); see 
Menowitz, 

991 F.2d at 40-41

 (“[A] transferee federal court should apply its interpretations of 
federal law, not the constructions of federal law of the transferor circuit.”); Desiano v. Warner- 
Lambert & Co., 

467 F.3d 85, 91

 (2d Cir. 2006), aff'd sub nom. Warner-Lambert Co., LLC vy. 
Kent, 

552 U.S. 440

 (2008) (“[U]nder Menowitz, we are obligated to answer independently 
questions of federal law” using the law of our Circuit).! 
     Whether there is Article III standing is a quintessential question of federal law.  See 
Hollingsworth y. Perry, 

570 U.S. 693, 715

 (2013).  Accordingly, the case law as to standing of 
the Second Circuit controls.  See, e.g., Inre Google Digital Advert. Antitrust Litig., No. 21 Civ. 
3446, 

2025 WL 3012840

, at *3 (S.D.N.Y. Oct. 27, 2025); Sharette v. Credit Suisse Int’l, 

127 F. Supp. 3d 60, 68, 73

 (S.D.N.Y. 2015); Koehler v. Reefs Beach Club Ltd., No. 98 Civ. 4370, 

1999 WL 377856

, at *2 (S.D.N.Y. June 8, 1999). 
           2.     Does the SAC Adequately Plead an “Invasion of Privacy” Injury? 
     Plaintiffs’ principal asserted injury—underpinning each claim—is that defendants’ 
interception, collection, and monetization of information relating to them, which they term their 
“PII,” violated their “privacy” rights.  Opp’n at  4-5.  The SAC’s factual allegations along these 
lines, however, do not plead a cognizable injury in fact. 
                 a.     The SAC’s Pleadings as to “Personally Identifiable Information” 
     The Court’s inquiry focuses on the standing, based on the facts pled, of the three named 
plaintiffs: Hayward, Garcia, and Ybarra.  In a putative class action, the named plaintiffs “must 

' Both the transferor (Ninth Circuit) and transferee courts (Second Circuit) in this case so hold. 
See Menowitz, 

991 F.2d at 40

; Newton v. Thomason, 

22 F.3d 1455, 1460

 (9th Cir. 1994). 

                                     19 

allege and show that they personally have been injured, not that the injury has been suffered by 
other, unidentified members of the class to which they belong and which they purport to 
represent.”  Lewis v. Casey, 

518 U.S. 343, 357

 (1996) (citation omitted).  Accordingly, for every 
named defendant, there must be a named plaintiff who can “assert a claim directly against [that] 
defendant” that he or she was injured in a “personal and individual” way.  NECA-IBEW   Health 
& Welfare Fund v. Goldman Sachs & Co., 

693 F.3d 145, 159

 (2d Cir. 2012) (citation omitted); 
Ross v. AXA Equitable Life Ins. Co., 

115 F. Supp. 3d 424, 432

 (S.D.N.Y. 2015) (same), aff'd, 

680 F. App’x 41

 (2d Cir. 2017) (summary order).  Put differently, it insufficient for a plaintiff to 
allege that an absent member of the putative class experienced a cognizable injury.  Menking ex 
rel. Menking v. Daines, 

287 F.R.D. 174, 178-79

 (S.D.N.Y. 2012). 
     The personal information that the SAC alleges mParticle obtained from the named 
plaintiffs falls short of that required to make out an injury in fact. 
     As to Hayward, the SAC alleges that, without his consent, mParticle intercepted his email 
address, Venmo name, phone number, mParticle ID, mParticle device ID, “advertising IDs,” and 
a “unique customer ID set by Venmo.”  SAC ff 14-18.  It alleges that when he made 
transactions on Venmo, mParticle intercepted: (1) that he was making a payment; (2) the 
recipient’s name; (3) the recipient’s username; (4) that the profile type was “personal”; (5) the 
amount of the transaction; and (6) the “note” a user enters to accompany the payment.  

Id.

 4 19. 
He terms this his “personally identifiable information.”  Jd. § 22. 
     As to Garcia, the SAC alleges that she used several online services, including Venmo, 
that “implemented mParticle’s IDSync” technology.  Id. § 24.  The SAC alleges that when she 
used the Venmo app, her “communications” and “information” were sent to mParticle.  Id. § 26. 
With the exception of her “mParticle ID,” she does not specify the “communications” and 

                                     132 

“information” mParticle obtained; she alleges generally that these “include[ed] her unique 
identifiers” and “transaction information.”  Jd.   427.  She likewise terms the “communications” 
and “information” that mParticle collected her “personally identifiable information.”  Id. § 30. 
     As to Ybarra, the SAC alleges that he used online services, including Venmo and the 
NBC App, that “implemented mParticle’s IDSync” technology.  Jd. 432.  From the NBC App, 
mParticle intercepted his name, email address, mParticle ID, an app user ID, his advertising IDs 
(such as “IDF V”  and/or “AAID”), video title IDs, and video IDs.  Jd. § 35.  From the Venmo 
website, mParticle intercepted his Venmo name, phone number, mParticle device ID, and a 
“unique customer ID set by Venmo.”  Jd. 4 38.  mParticle thus learned (1) that Ybarra was 
making a payment; (2) the recipient’s name; (3) the recipient’s username; (4) that the profile type 
was “personal”; (5) the amount of the transaction; and (6) the “note” a user enters to accompany 
the payment.  Jd. { 39.  He likewise terms this his “personally identifiable information.” Id. J 42. 
                 b.     Legal Principles 
     A plaintiff claiming injury from the disclosure of her personal information must either 
demonstrate “actual injuries” resulting from the disclosure or “a substantial risk of harm.”  See 
FritzCo LLC v.  Verizon Commce’ns Inc., No. 21 Civ. 10432, 

2026 WL 734776

, at *4 (S.D.N.Y. 
Mar. 16, 2026) (cleaned up).  Because the SAC does not allege actual injuries to any name 
plaintiffs, the latter standards governs here.  Under it, the critical inquiry is “whether the type of 
data that has been exposed is sensitive such that there is a high risk of identity theft or fraud,” 
i.e., whether the “private information” disclosed constituted “highly sensitive” personal 
information.  McMorris v. Carlos Lopez & Assocs., LLC, 

995 F.3d 295, 303

 (2d Cir. 2021). 
     Courts in the Second Circuit have held that the disclosure of addresses, telephone 
numbers, email addresses, device identifiers, and the like are insufficient to support finding a 
cognizable injury.  See, e.g., Cooper v. Bonobos, Inc., No. 21 Civ. 854, 

2022 WL 170622

, at *6 

                                     14 

(S.D.N.Y. 2022) (“Cooper”); Liau v. Weee! Inc., No. 23 Civ. 1177, 

2024 WL 729259

 (PAE), at 
*5 (S.D.N.Y. Feb. 22, 2024) (“Liaw”); Zhizhi Xu v. Reuters News & Media Inc., No. 24 Civ. 
2466, 

2025 WL 488501

 (PAE), at *3 (S.D.N.Y. Feb. 13, 2025) (‘Xu’). 
     In Cooper, Judge Furman applied this line of case law to a plaintiff who claimed his data 
had been intercepted by Bonobos, a chain of men’s clothing stores, and disclosed following a 
data breach.  

2022 WL 170622

, at *6.  The disclosed data included the plaintiffs addresses, 
telephone numbers, email addresses, order history, Internet Protocol (“IP”) addresses, encrypted 
passwords, and partial credit card numbers.  Jd. at  *1~2.  Judge Furman held that the plaintiff had 
not pled an injury in fact supporting his state statutory or common law claims, given the nature 
of this data and its age.  Jd. at *1,4.  He distinguished between the disclosure of plaintiff’s “less 
sensitive data” (addresses, phone numbers, email addresses, and IP addresses) and his “partial 
credit card numbers” and “password histories.”  Jd. at *3-4.  As to the former, he found the risk 
of harm “entirely speculative, if not fanciful, and thus insufficient to support standing.”  Jd. at *4. 
And as to the latter, he found the disclosure unlikely to cause an injury that was “certainly 
impending” or suggesting a “substantial risk the harm will occur” in light of the fragmented 
nature of the data and the age of the information (e.g. old passwords) that was captured.  Jd. 
at *6. 
     This Court held similarly in Liau, finding customers’ names, email addresses, and phone 
numbers not to constitute sensitive information to support standing.  

2024 WL 729259

, at *8.  In 
that case, a customer of Weee!, an online grocery-delivery service specializing in Chinese and 
Hispanic ingredients, suffered a data breach resulting in the disclosure of “[his] name, address, 
email address, phone number, order number, order amount and order comments.”  Jd. at *1-2. 
Relevant here, despite allegations the exposed information included plaintiffs’ “order amount” 

                                     15 

and “order comments,” the Court found such to be “relatively quotidian private information” of 
the sort that will not support standing.  Jd. at *5; see also McMorris, 

995 F.3d at 298-301

 
(finding disclosure of home addresses, dates of birth, telephone numbers, educational degrees, 
and dates of hire did not support finding injury in fact); Yankovich v. Applus Techs., Inc., 

621 F. Supp. 3d 269

, 272-74 (D. Conn. 2022) (declining to find standing where plaintiffs alleged dates 
of births, addresses, and Social Security numbers could have been exposed but did not plead with 
particularity the “extent to which” they actually had been). 
     And in Xu, this Court found the disclosure of a plaintiff's IP address, collected by. 
unconsented-to trackers, insufficient to support standing.  

2025 WL 488501

, at *2-6.  Ku’s 
complaint did not allege facts supporting that Reuters collected or disclosed any information 
concerning his “private life”; the Court accordingly, held that Xu had fallen short of pleading 
that Reuters “collected sensitive or personally identifying information data that could be used to 
steal [his] identity or inflict similar harm.”  Jd. at *3; see also Gabrielli v. Insider, Inc., No. 24 
Civ. 1566, 

2025 WL 522515

, at *3—6 (S.D.N.Y. Feb. 18, 2025) (finding allegation that defendant 
sent plaintiff's IP address to a third-party does not bear a sufficiently close relationship to the 
disclosure of private facts so as to support standing); United States v. Kidd, 

394 F. Supp. 3d 357

, 
362-68 (S.D.N.Y. 2019) (no reasonable expectation of privacy in JP-related information). 
     In contrast, in Cooper v. Slice Techs., Inc., No. 17 Civ. 7102, 

2018 WL 2727888

, at *2—3 
(S.D.N.Y. June 6, 2018), Judge Oetken held that, where the defendant sold the content of 
plaintiffs’ emails, the information disclosed was sufficiently sensitive to support standing on 
federal and state common law claims.  See also Bohnak v. Marsh & McLennan Co., Inc., 79 
F 4th 276, 281, 283-88 (2d Cir. 2023) (finding disclosure of plaintiffs “Social Security or other 
federal tax identification number[s] driver’s license or other government issued identification, 

                                     16 

and passport information” was sufficiently sensitive to support standing); In re Christie’s Data 
Breach Litig., 

767 F. Supp. 3d 12

, 16-18 (S.D.N.Y. 2025) (finding disclosure of plaintiffs’ full 
names, passport numbers, and driver’s license numbers sensitive enough to constitute injury in 
fact); □□ □□ USAA Data Sec. Litig., 

621 F. Supp. 3d 454

, 465-66 (S.D.N.Y. 2022) (same as to 
history of military service and driver’s license numbers); Jn re Unite Here Data Sec. Incident 
Litig., 

740 F. Supp. 3d 364

, 375 (S.D.N.Y. 2024) (same as to “union members’ personally 
identifiable information and protected health information, including their names, Social Security 
numbers, dates of birth, and medical information”). 
     Salient here, where a complaint has alleged the unauthorized disclosure of financial- 
related information, courts have required that this disclosure be linked to some future risk of 
harm.  In Fero v. Excellus Health Plan, Inc., for example, Judge Wolford found the alleged 
disclosure of “financial payment information (including credit card numbers)” insufficient to 
support standing where the plaintiffs had not adduced evidence of an “increased risk of identity 
theft,” or any additional monitoring cost.  

236 F. Supp. 3d 735, 744-751

 (W.D.N.Y. 2017).  In 
contrast, in FritzCo LLC v. Verizon Commce’ns Inc, Judge Oetken found that the disclosure of 
plaintiff's credit card information—which, along with other purloined personal information, 
enabled third parties to complete unauthorized transactions—supported standing in a case 
involving state-law claims arising from a widespread data breach.  

2026 WL 734776

, at *4 
(S.D.N.Y. Mar. 16, 2026).  Courts in the main have not recognized a freestanding privacy 
interest in the non-disclosure of financial information.  See, e.g., Whalen, 153 F. Supp. 3d at 583 
(finding against standing based on increased risk of future harm where plaintiff alleged that 
“fraudulent use of cards might not be apparent for years” and did not allege any out of pocket 
costs resulting from data breach).  And, in an out-of-Circuit case alleging the improper disclosure 

                                     17 

of plaintiff's “Venmo password,” the District Court of Nevada found such insufficient to support 
standing where the plaintiff did not allege “an injury-in-fact arising from actual access or misuse 
of her Venmo.”  Prestby v. A&A Servs. LLC, No. 24 Civ. 204, 

2026 WL 26128

, at *9 (D. Neb. 
Jan. 5, 2026). 
                C.     Application 
     Measured against these standards, the SAC’s allegations relating to the three named 
plaintiffs do not plead the disclosure of sensitive information.  Although the SAC terms what 
was disclosed as “PII,” its concrete allegations underlying that term fall short. 
     First, as to each plaintiff, the SAC alleges disclosure of their mParticle ID, mParticle           
device ID, and “advertising IDs.”  SAC 4 14-18, 27, 38.  But courts have rejected that such 
identifiers constitute “personally identifiable information,” finding such identifies only “devices, 
not particular individuals.” Afriyie v. NBCUniversal Media, LLC, 

775 F. Supp. 3d 791

, 809 
(S.D.N.Y. 2025) (“[W]ithout more information, such as a name or an address, no one can 
identify the particular individual using a particular device. For all intents and purposes, the 
device remains anonymous—a nameless and faceless device among a million others.”).  The 
same is so for plaintiffs’ user profile identifiers, which, as pled, do not reveal the “identity of a 
particular individual.”  Jd.; see also Wilson v. Triller, Inc., 

598 F. Supp. 3d 82

, 92 (S.D.N.Y. 
2022) (finding a user profile identifier not PII where the complaint “contain[ed] no allegation as 
to what information was actually included on [plaintiffs] profile nor how that information could 
be used by a third party to identify [plaintiff]”).  Such information is akin to an IP address, whose 
collection, without more, does not give rise to a cognizable injury.  See, e.g., Xu, 

2025 WL 488501

, at *2-6.; Gabrielli Inc., 

2025 WL 522515

, at *3; Kidd, 394 F. Supp. 3d at 362; Smidga 
v. Spirit Airlines, Inc., No. 22 Civ. 1578, 

2024 WL 1485853

, at *4 (W.D. Pa. Apr. 5, 2024) 

                                     18 

(“[C]ourts have held that even the collection of basic contact information by [ ] software or 
where the plaintiffs merely visited the website are not [ ] concrete harms.”). 
     Second, for Hayward and Ybarra, the SAC alleges that mParticle collected their email 
addresses and phone numbers.  Jd. J] 14-19, 34-38.  Such, however, is the “less sensitive data” 
that Cooper, synthesizing the case law, held insufficient to support standing, 

2022 WL 170622

, 
at *3, and that Liau found unlikely to be “susceptible to misuse,” Liau, 

2024 WL 729259

, at *4— 
5.  It is short of the medical information, Social Security numbers, passport information, driver’s 
license numbers, and the like that courts have held highly sensitive.  See In re Christie’s Data 
Breach Litig., 767 F. Supp. 3d at 16-18; In re USAA Data Sec. Litig., 

621 F. Supp. 3d 454

, 465— 
66 (S.D.N.Y. 2022); In re Unite Here Data Sec. Incident Litig., 

740 F. Supp. 3d 364

, 375 
(S.D.N.Y. 2024).  Courts outside this Circuit have generally rejected claims that the disclosure of 
email or IP addresses, without more, represents a cognizable injury.  See, e.g., United States v. 
Forrester, 

512 F.3d 500, 510

 (9th Cir. 2008) (“Internet users have no expectation of privacy in.  . 

. the IP addresses of the websites they visit because they should know that this information is 
provided to and used by Internet service providers for the specific purpose of directing the 
routing of information.”); Bradshaw v. Lowe’s Cos., No. 25 Civ. 742, 

2025 WL 3171740

, at *5 
(S.D. Cal. Nov. 12, 2025) (collecting cases and finding that the combination of browser 
information with other information captured by tracking pixels did not plead a concrete injury to 
show Article III standing). 
     Third, as to Hayward and Ybarra, the SAC alleges mParticle collected their Venmo 
names, unique Venmo IDs, and data relating to their Venmo payments, such as the date, amount, 
recipient name, profile type (e.g., “personal” or “business”), and “note” accompanying the 
payment.  SAC ff 19, 39.  Plaintiffs cast this information as more sensitive.  But the SAC does 

                                     190 

not concretely plead a future risk of harm as to this data.  It does not allege how this disclosure 
would enable a future theft from these plaintiffs, in the manner that disclosure of credit card 
information or bank account passwords could threaten.  See Fero, 

236 F. Supp. 3d at 751

.  The 
Venmo data disclosed does not, for example, include any plaintiff’s passwords to the platform. 
See Prestby, 

2026 WL 26128

, at *9.  The data allegedly captured by mParticle is akin to the 
“order amount” and “order comments” held insufficient to support standing in Liau.  

2024 WL 729259

, at *8.  Nor does the SAC plead that plaintiffs have incurred or will reasonably incur 
expenses to mitigate a “substantial risk of future identity theft or fraud,” which could support 
standing.  See Xu, 

2025 WL 488501

, at *3.? 
     The SAC, although highlighting mParticle’s capability to enrich data and its use of such 
data in machine learning models, does not develop concretely how these capabilities could injure 
the named plaintiffs.  Nor does the SAC non-conjecturally allege how mParticle’s “Predictive 
Attributes,” which appear aimed at identifying fruitful targets for client marketing efforts, see 
SAC   84—85, present a risk of such injury to them.  See Hernandez v. Hernandez, No. 24 Civ. 
8614, 

2026 WL 318291

, at *6 (E.D.N.Y. Feb. 5, 2026) (citing Lujan, 

504 U.S. at 560

). 
     The SAC therefore does not adequately plead an injury in fact based on the disclosure of 
the named plaintiffs’ private data to mParticle’s clients. 
           3.     Does the SAC Adequately Plead an “Intrusion Upon Seclusion”? 
     The Supreme Court has recognized a harm closely related to, but distinct from, the 
disclosure of private facts which can support Article III standing: “intrusion upon seclusion.” 

* The SAC likewise alleges the collection of Ybarra’s NBC user ID, video title IDs, and video 
IDs,  

id.

 J 35, but it does not allege the disclosure of information linking him (as opposed to his 
device) to any video or video-watching history, cf Afriye, 775 F. Supp. 3d at 809-10. 

                                     20 

TransUnion LLC, 

594 U.S. at 425

; Packer on behalf of 1-800-Flowers.Com, Inc. v. Raging Cap. 
Memt., LLC, 

105 F.4th 46

, 51 (2d Cir. 2024). 
                 a.     Relevant Pleadings from the SAC 
     In alleging mParticle intruded upon plaintiffs’ seclusion, the SAC draws on much the 
same information as underlies its invasion of privacy claims.  Compare SAC Jf 147-52, with 

id. 13-39

.  As to users generally, it alleges that mParticle intruded on “private communications” 
and intercepted and used “private online communications, associated with their mParticle ID and 
user profile.”  Jd. 4] 147-49. 
     As to the named plaintiffs, it is sparse as to the communications that may have been 
intercepted.  As to Garcia, it alleges generally that “her communications and information were 
also sent to mParticle.”  Jd. 27.  As to Hayward, it alleges that mParticle intercepted “notes” 
accompanying his Venmo payments describing the purpose of the payment, that mParticle did so 
even where “user marked their profile as private, i.e. chose that their transactions should no be 
seen by anyone else other than the recipient,” 

id.

  { 19, and that mParticle transmitted user 
information to customers “regardless of whether [the user] declined cookies and regardless of 
whether he used private browsing mode or selected ‘Do Not Track’ on his mobile device.”  Jd. 
421.  As to Ybarra, the SAC makes similar allegations.  

Id.

 FJ 39, 41-42. 
                 b.     Legal Principles 
     The Supreme Court and the Second Circuit have not yet defined the showing necessary to 
plead such cognizable “intrusion upon seclusion.”  See, e.g., Bohnak, 79 F.4th at 284-86 
(recognizing “intrusion upon seclusion” and “disclosure of private information” as independent 
bases for standing in case challenging improper disclosure of PII, but, because former was well 
pled, not reaching latter); Salazar v. Nat'l Basketball Ass’n, 118 F 4th 533, 541 n.5 (2d Cir. 
2024) (not reaching issue), cert. denied, 

146 S. Ct. 880

 (2025).  In a summary order, the Circuit 

                                    21 

likewise recognized that the unauthorized “accessing and monitoring of plaintiffs’ web-browsing 
activity implicates harms similar to those associated with the common law tort of intrusion upon 
seclusion,” but it went no further.  Mount v. PulsePoint, Inc., 

684 F. App’x 32, 34-35

 (2d Cir. 
2017) (summary order). 
     Courts in this District to take up the question have drawn upon the formulation of the 
concept in the Restatement (Second) of Torts.  See, e.g., Am. Fed’n of Gov’t Emps., AFL-CIO v. 
U.S. Off of Pers. Mgmt., 

786 F. Supp. 3d 647

, 679 (S.D.N.Y. 2025) (citing Restatement 
§ 652B); Xu, 

2025 WL 488501

, at *5 (same); Gabrielli, 

2025 WL 522515

, at *6 (same); see also 
Melito v. Experian Marketing Sols., Inc., 

923 F.3d 85, 93

 (2d Cir. 2019) (citing § 652B in 
support of Article III standing analysis).  It defines intrusion upon seclusion as follows: 
     One  who  intentionally  intrudes,  physically  or  otherwise,  upon the  solitude  or             
     seclusion of another or his private affairs or concerns, is subject to liability to the 
     other for invasion of his privacy, if the intrusion would be highly offensive to a 
     reasonable person. 
Restatement (Second) of Torts § 652B (A. L. I. 1977).  It reaches the intrusion upon a person’s 
private records, but not “the examination of a public record concerning the plaintiff, or of 
documents that the plaintiff is required to keep and make available for public inspection.”  Id. 
s§ 652B cmt. c. 
     Accordingly, courts have found a cognizable injury of this nature only where a complaint 
alleges interference with records “concern[ing] the plaintiffs’ most sensitive private affairs.” 
Am. Fed’n of Gov’t Emps., AFL-CIO, 786 F. Supp. 3d at 679 (finding injury in fact based on 
intrusion upon seclusion theory where access to plaintiffs’ “social security numbers, health care 
information, banking information, and information about family members” was provided to third 
parties); Mills v. Saks.com LLC, No. 23 Civ. 10638, 

2025 WL 34828

, at *1 (S.D.N.Y. Jan. 6, 
2025) (finding injury in fact not well pled on this theory where complaint alleged that Saks, 

                                     99 

without her consent, collected data from its marketing emails); West v. City of Hartford, No. 20 
Civ. 1210, 

2022 WL 17850357

, at *8 (D. Conn. Dec. 22, 2022) (finding injury in fact not well 
pled on this theory where complaint alleged occasional text messages and phone calls to 
plaintiff, but fell short of pleading that such would be “highly offensive to a reasonable person”), 
aff'd, (2d Cir. May 14, 2024) (summary order); cf Sptiz v. Caine & Weiner Company, Inc., No. 
23 Civ. 7853, 

2024 WL 69089

, at *5 (E.D.N.Y. Jan. 5, 2024) (“As for intrusion upon seclusion, 
it ‘requires the intrusion to have caused an injury, not a subsequent disclosure of the information 
gained from the intrusion.’” (quoting Devitt v. Portfolio Recovery Associates, LLC, No. 21 Civ. 
567, 

2022 WL 1460278

, at *6 n.10 (E.D.N.Y May 9, 2022)) (emphasis in original)). 
                 C.     Application 
     Measured against these developing standards, the SAC falls well short of alleging facts to 
support standing based on “intrusion upon seclusion.” 
     To begin, as reviewed above, the SAC does not plead that the information disclosed 
about the named plaintiffs implicated their “private affairs or concerns.”  Restatement (Second) 
of Torts § 652B.  The information allegedly disclosed—email addresses, phone numbers, device 
identifiers, and user identifiers—is appreciably different from “social security numbers, health 
care information, banking information, and information about family members.” Am. Fed’n of 
Gov’t Emps., AFL-CIO, 786 F. Supp. 3d at 679; Hartley v.  Urb. Outfitters, Inc., 

740 F. Supp. 3d 410

, 420-21 (E.D. Pa. 2024) (although the collection by “spy pixels” of “everything under the 
sun” would constitute an intrusion on seclusion, no such concrete injury was pled; defendant did 
not collect a “‘subscriber’s complete credit card information, medical history, or social security 
number”).  The closest plaintiffs come are the Venmo notes of plaintiffs Hayward and Ybarra 
describing the purposes served by particular payments.  But the content of these is not pled with 
specificity, let alone in a manner suggesting these notes, by nature, tended to conveyed private 

                                     923 

information, as opposed to quotidian matters such as that particular payments were for shared 
meals or travel.  See, e.g., SAC § 19 (alleging, as to Hayward, only that mParticle intercepted 
“the ‘note’ that accompanies the payment describing what the payment is for”); id. { 39 (same as 
to Ybarra); see Saks, 

2025 WL 34828

, at *5 (contrasting defendant’s noncognizable collection of 
information about plaintiff with the use of digital pixels to “trawl through the contents of 
unrelated personal messages, or to gain access to the camera of a subscriber’s device,” which 
would “likely” be held comparable to common-law intrusion upon seclusion (citation omitted)). 
The SAC does not allege intrusions into personal and intimate details about traditionally private     □ 
elements of the lives of the named plaintiffs.  Restatement (Second) of Torts § 652B cmt. d 
(A. L. I. 1977); see also Campos v. TJX Companies, Inc., No. 24 Civ. 11067, 

2025 WL 360677

, 
at *4 (D. Mass. Jan. 31, 2025) (not finding intrusion upon seclusion where defendants’ pixels, as 
alleged, did not collect information beyond “the email address, the subject of the email, when the 
email is opened and read, the recipient's location, how long the recipient spends reading an 
email, whether it is forwarded, whether it is printed, and what kind of email server the recipient 
uses”); cf. Delong v. PHE, Inc., No. 24 Civ. 5212, 

2025 WL 2447787

, at *3-4 (E.D. Pa. Aug. 25, 
2025) (not finding intrusion upon seclusion where complaint alleged that defendant disclosed to 
Google Analytics information about his “sexual interests, activities, and history”; court reasons 
that plaintiff did not have a reasonable expectation of privacy in his online shopping behavior).? 

3 To the extent the SAC pursues this theory of injury, it is separately problematic in that it pleads 
only that mParticle offered instructions to potential clients how to configure CNAME to defeat 
privacy protections, not that this was mParticle’s default configuration, or that mParticle’s clients 
in fact utilized instructions and thereby secured private information of the named plaintiffs.  See 
SAC 4 101-06.  These facts fall short of those found well pled in Mount, where the defendant 
actually “deployed code in ads that caused [plaintiff's] Safari browsers to ‘drop the default 
protection and accept tracking cookies.’”  Mount v. PulsePoint, Inc., No. 13 Civ. 6592, 

2016 WL 5080131

, at *4 (S.D.N.Y. Aug. 17, 2016); accord In re Google Inc. Cookie Placement Consumer 
Priv. Litig., 

806 F.3d 125, 134

 (3d Cir. 2015) (injury in fact pled based on “highly specific 

                                     IA 

     The SAC therefore does not plead a cognizable intrusion upon seclusion. 
           4.     Does the SAC Adequately Plead an “Impact” on Plaintiffs’ Devices 
                 and Systems? 
     The SAC next claims injury from the impact defendants’ actions allegedly had on the 
named plaintiffs’ electronic devices and computer systems.  See SAC {J 123-28. 
     This injury claim is too vague and speculative to support an Article HU injury-in-fact. 
The SAC states that “[t]racking technologies similar to mParticle” and “tracking domains like 
mParticle” have been reported to “result in an additional 15% power consumption for loading 
websites.”  

Id.

 {J 125-26.  And it alleges that “technologies similar to mParticle’s” take up, on 
average, “an additional 899 KB per webpage in bandwidth,” such that, but for “mParticle’s 
secretly embedded technology, Plaintiffs and Class Members would see bandwidth, CPU, data 
usage, and power consumption savings.”  Jd. 4127.  But it does not plead facts beyond these 
generalizations.  It does not allege that the named plaintiffs experienced any issues along these 
lines, whether involving bandwidth capacity, battery health, or otherwise.  See, e.g., Rudolph, 

2019 WL 2023713

, at *5 (“mere possibility” of future injury or damage “not enough” to support 
injury in fact); Mount, 

2016 WL 5080131

 at *9-10 (speculative or de minimis marginal effect on 
electronic device operation does not support finding harm); In re USAA Data Sec. Litig., 621 F. 
Supp. 3d at 466 (same). 
                                CONCLUSION 
      For the above reasons, the Court grants defendants’ motion to dismiss under Rule 
12(b)(1).  Because this dismissal is for lack of subject matter jurisdiction, it is without prejudice 
to plaintiffs’ ability to file  a new action with a proper jurisdictional basis.  See Carter v. 

allegations” that defendants took covert actions to circumvent privacy settings on Safari and 
other browsers in order to deposit third-party cookies). 

                                     AE 

HealthPort Techs., LLC, 

822 F.3d 47, 54-55

 (2d Cir. 2016) (“where a complaint is dismissed for 
lack of Article III standing, the dismissal must be without prejudice, rather than with prejudice”). 
     The Clerk of Court is respectfully directed to terminate the motions pending at docket 61 
and to close this case. 
     SO ORDERED.                                          as 
                                                    Lull   Crgh 
                                                    raAMK       A        / 
                                                   PAUL A. ENGELMAYE 
                                                   United States District Judge 

Dated: September 1, 2026 
     New York, New York 

                                     96