California District Court Relies on Popa v. Microsoft to Deny Class Certification, Finding Individualized Questions of Class Member Standing in CIPA Action

On July 20, the court in Edward Lewis et al. v. Magnite, Inc., No. 2:25-cv-03448 (C.D. Cal.), relied on the Ninth Circuit’s recent decision on Article III standing, Popa v. Microsoft Corporation, to find that individualized inquiries into whether each putative class member suffered a concrete injury from alleged violations of the California Invasion of Privacy Act (“CIPA”) would predominate, defeating class certification under Rule 23(b)(3). This appears to be one of the first decisions applying Popa to Article III standing issues at the class certification stage, and represents a significant development for companies defending adtech and data privacy class actions.

Overview of Popa v. Microsoft Corporation

In Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. Aug. 26, 2025), plaintiff Ashley Popa brought a putative class action against Microsoft and Pet Supplies Plus, alleging that Microsoft’s session-replay technology deployed on petsuppliesplus.com violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act and the common law tort of intrusion upon seclusion. Popa alleged that Microsoft’s session-replay technology tracked over 30 categories of data, including the date a user visited the website, information regarding the user’s device, browser, and operating system, and the country where the user accessed the website, as well as the user’s mouse movements, screen swipes, user-inputted text, and scroll depth.

Popa alleged that when she visited petsuppliesplus.com, the session-replay technology tracked her mouse movements and click data, which products she viewed, and the mailing address she entered, though the street number and zip code were omitted. Popa argued that she was injured by this tracking of her actions on the website, but the district court dismissed the complaint for lack of Article III standing. The Ninth Circuit affirmed the dismissal, holding that Popa lacked Article III standing because she failed to allege a concrete injury.

Applying TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), and Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), the Ninth Circuit held that a bare statutory violation does not automatically confer Article III standing. As the court explained, “TransUnion clearly cautions courts not to treat an injury as concrete for Article III purposes based only on Congress’s say-so.” Rather, a court must “assess whether an individual plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal system.” The court expressly rejected a “broad theory that the common law protected privacy rights” as a basis for standing. “In short,” the court held, “there existed no free-roaming privacy right at common law” but rather four discrete privacy torts: intrusion upon seclusion, appropriation of another person’s name or likeness, publicity given to another person’s private life, and publicity that places one in a false light. To confer standing, a harm must be “similar to those protected by these torts.”

Popa attempted to analogize her harm to that at issue in the traditional torts of intrusion upon seclusion and public disclosure of private facts. However, the court found that she failed to assert an analogous harm because she “identifie[d] no embarrassing, invasive, or otherwise private information collected” by the website, as is required under those common law torts.

The Lewis v. Magnite, Inc. Decision

Defendant Magnite is an advertising platform that gathers information by installing a cookie on the browser of individuals who access a website or app that uses Magnite’s technology. Through that cookie, Magnite collects information such as the date and time of a user’s website visits, any search terms the user enters, the user’s click data, location information, device information, and browsing and interaction data.

Plaintiffs Edward Lewis and Patricia Castillo (“Plaintiffs”) alleged that Magnite used this cookie to track users without consent, in violation of CIPA and the federal wiretapping act, and asserted related claims for unjust enrichment and invasion of privacy. The plaintiffs moved to certify two California classes and one nationwide class, but on July 20, the district court denied certification on typicality, predominance, and superiority grounds. As relevant here, one basis for denial was the district court’s finding that individual issues regarding Article III standing predominated.

First, the court squarely rejected the plaintiffs’ argument that a violation of CIPA automatically conferred Article III standing, applying TransUnion, Spokeo, and Popa for the principle that a bare violation of CIPA does not automatically confer Article III standing—a concrete injury is still required. This distinction is significant for CIPA claims because class-action plaintiffs often allege statutory violations arising from routine online activity that many would not consider injurious.  

The court then found that individualized issues existed as to what information Magnite collected from putative class members. It explained that, under Popa, the plaintiffs were required to explain how Magnite’s conduct caused a privacy harm “similar to the highly offensive interferences or disclosures” actionable at common law. But the plaintiffs neither explained how the court could evaluate such harms on a classwide basis, nor offered evidence of Magnite collecting personally identifying information. In fact, Magnite’s cookie policy explicitly provided that it did not collect identifying information such as names, addresses, phone numbers, or emails. The court concluded that “[w]ithout information as to the private information that Defendant transmitted or how the Court could evaluate those harms on a classwide basis, individualized standing issues prevail.”

Impact on Privacy Class Action Defense

Since its issuance in August 2025, Popa has been applied primarily at the motion to dismiss stage. This makes the Lewis v. Magnite decision notable, as it appears to be one of the first decisions to rely on Popa’s standing framework as a basis for denying class certification. Statistically speaking, many privacy class actions withstand motions to dismiss. Defendants in privacy class actions now have a concrete framework for arguing that individualized standing inquiries under Popa defeat predominance under Rule 23(b)(3), even where claims have survived past the pleading stage.

Under Popa, a plaintiff must show that the specific information collected caused a harm to class members similar to the highly offensive interferences actionable at common law—that is, harm analogous to established privacy torts such as intrusion upon seclusion or public disclosure of private facts. At the certification stage, the Magnite court held that Popa requires plaintiffs to make this showing on a classwide basis using common evidence. The implications of this decision are significant for the hundreds of CIPA class actions now pending in federal courts because whether an intrusion is highly offensive under the common law privacy torts depends on what specific information was gathered about an individual, the circumstances of that collection, and potentially each class member’s own expectations of privacy. Because tracking technologies often collect different categories of data depending on which websites a user visited and what consents or opt-outs applied, there is rarely a single fact pattern that can stand in for the entire class.

The Magnite decision highlights a subtle but important distinction between the Article III standing issues implicated by Popa and the line of cases that find a class may be certified under Rule 23(b)(3), even if a “de minimis” number of class members are uninjured. See, e.g., Olean Wholesale Grocery Coop., Inc. v. Bumble Bee Foods LLC, 31 F.4th 651, 668-69 (9th Cir. 2022). Those cases typically involve statistical models constructed with evidence common to the class that show an identified portion of class members were or may be uninjured (such as in Olean, an antitrust case, where defendants’ expert opined that the plaintiffs’ damages model could not establish that 28% of the class’s purchases were affected by the alleged conspiracy).¹ The Magnite court distinguished Olean from situations like the case before it, where determining whether each class member was injured or uninjured by the defendant’s conduct would have required individualized proof. The court held: “Though Rule 23 allows certification of a class that potentially includes more than a de minimis number of uninjured class members, individualized questions regarding putative class members’ injuries cannot predominate.”      

This dynamic could place plaintiffs in a difficult position going forward. The Magnite court’s application of Popa effectively asks plaintiffs to make a showing that the defendant’s conduct uniformly caused class members to suffer a common-law-equivalent privacy injury before a class is certified. Merely relying on common evidence that may demonstrate a bare statutory violation of CIPA or another privacy statute is insufficient. Plaintiffs who cannot supply expert methodologies or common proof capable of establishing injury are likely to face the same outcome reached in Magnite. The Magnite court’s decision thus opens a potentially significant door for defendants to exploit this evidentiary vulnerability to defeat class certification.

¹ The viability of the de minimis standard for uninjured class members has also been called into question, with the Supreme Court recently declining to decide the issue in Lab. Corp. of Am. Holdings v. Davis, No. 24-304. Justice Kavanaugh dissented from the Court’s per curiam order dismissing the writ of certiorari and would have held, consistent with the defendant’s position in the appeal, that “[f]ederal courts may not certify a damages class under Rule 23 when, as here, the proposed class includes both injured and uninjured class members.”