Gabrielli v. Insider, Inc.

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK JONATHAN GABRIELLI, individually and on behalf of all others similarly situated, Plaintiff, OPINION & ORDER – against – 24-cv-01566 (ER) INSIDER, INC., Defendant. RAMOS, D.J.: Jonathan Gabrielli brings suit against Insider, Inc. (“Insider”), alleging that Insider violated California’s Invasion of Privacy Act (“CIPA”) by installing software on his computer that shared his IP address with a third-party. Doc 19 ¶ 2–4; California Penal Code § 638.51. Before the Court is Insider’s motion to dismiss for lack of subject matter jurisdiction and failure to state a claim upon which relief can be granted. Doc. 23. For the reasons discussed below, the motion is GRANTED. I. BACKGROUND A. Factual Background Parties Insider is an online business news site that allows users to access published content on its website, https://businessinsider.com (the “Website”). Doc 19 ¶ 1. Gabrielli is a California resident. Id. ¶ 6. Insider’s Alleged IP Address Collection Gabrielli alleges that he visited Insider’s Website on his personal computer multiple times between March 2020 and December 2023. Id. ¶ 57. In order for Gabrielli and other users to access Insider’s Website, the user must send an “HTTP request” to Insider’s Website. Id. ¶ 20. In response to the request, Insider’s Website server sends an “HTTP response” back to the user’s browser which installs code that allows the Website content to be displayed on the user’s computer. Id. ¶ 21. Gabrielli alleges that in addition, the HTTP response from Insider installed a third-party tracker operated by Audiencerate (the “Tracker”) on his browser. Id. ¶ 22. �ird-party trackers like the one alleged here are sometimes installed or integrated into a website’s code for the purpose of collecting user data. Id. ¶ 43. Gabrielli alleges that he never consented to Insider’s installation or use of the Tracker. Id. ¶ 49. Gabrielli alleges that after visiting Insider’s Website, the Tracker sent his IP address to Audiencerate. Id. ¶ 75. Gabrielli does not allege that the Tacker captured any information other than his IP address. Id. ¶ 76. An IP address is a unique identifier for a device that is expressed as four sets of numbers separated by periods. Id ¶ 23. �e first two sets of numbers indicate the network the device is connected to, and the second two sets of numbers identify the specific device. Id. By identifying the network and device from which Gabrielli’s internet request is sent, the IP address allows his device to communicate with Insider’s Website server. Id. ¶ 24. Although Insider needs Gabrielli’s IP address to communicate the Website information to him, Insider does not need to install the Tracker to do so. �rough an IP address, the specific location of the device, including the state, city, and zip code, can be determined. Id. ¶ 25. Gabrielli alleges that Insider uses the Tracker to collect the IP addresses of visitors to the Website which Audiencerate then provides to Insider and other clients. Id. ¶ 48. Specifically, Gabrielli alleges that the geographic information gathered by Audiencerate is used to target customers in specific geographic areas for more effective advertising and marketing. Id. ¶¶ 27, 59. For example, “businesses who are trying to reach college-aged demographics can target devices on college campuses by sending advertisements to IP addresses associated with college-wide Wi-Fis.” Id. ¶ 28. Gabrielli alleges that Insider’s installation of the Tracker that sent his IP address to Audiencerate is a violation of the CIPA, California Penal Code § 638.51(a). Doc. 19 ¶ 4. Section 638.51(a) prohibits “a person” from “install[ing] or us[ing] a pen register … without first obtaining a court order.” California Penal Code § 638.51 (“Section 638.51”). A pen register is “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” California Penal Code § 638.50(b); Doc. 29 at 16. Gabrielli also alleges that Insider’s collection of his IP address in violation of the CIPA constitutes an invasion of privacy. Doc. 19 ¶ 50. B. Procedural History Gabrielli filed the instant suit on February 29, 2024, Doc. 1, and filed an amended complaint on June 11, 2024. Doc. 19. On August 1, 2024, Insider filed its motion to dismiss for lack of subject matter jurisdiction and failure to state a claim pursuant to Rules 12(b)(1) and 12(b)(6). Doc. 23. II. LEGAL STANDARDS A. Rule 12(b)(1) Pursuant to Rule 12(b)(1), a court must dismiss an action for lack of subject matter jurisdiction if it “lacks the statutory or constitutional power to adjudicate it.” Makarova v. United States, 201 F.3d 110, 113 (2d Cir. 2000) (citing Fed. R. Civ. P. 12(b)(1)). In 12(b)(1) motions, the party who is claiming subject matter jurisdiction bears the burden of proving it exists by a preponderance of the evidence. Makarova, 201 F.3d at 113 . To resolve 12(b)(1) disputes over subject matter jurisdiction, a court may reference evidence outside of the pleadings to make a determination. Gonzalez v. Inn on the Hudson LLC, No. 20-cv-9196 (ER), 2022 WL 974384 , at *2 (S.D.N.Y. Mar. 30, 2022). B. Rule 12(b)(6) When considering a motion to dismiss pursuant to Rule 12(b)(6), a court accepts all factual allegations in the complaint as true and draws all reasonable inferences in the plaintiff’s favor. Koch v. Christie’s International PLC, 699 F.3d 141, 145 (2d Cir. 2012). But “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Iqbal, 556 U.S. at 678 (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. �is standard “is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556 ). To state a plausible claim, the plaintiff must “ ‘raise a reasonable expectation that discovery will reveal evidence’ of the wrongdoing alleged, ‘even if it strikes a savvy judge that actual proof of those facts is improbable.’ ” Citizens United v. Schneiderman, 882 F.3d 374, 380 (2d Cir. 2018) (quoting Twombly, 550 U.S. at 556 ). If the plaintiff has not “nudged [the] claims across the line from conceivable to plausible, [the] complaint must be dismissed.” Twombly, 550 U.S. at 570 . III. DISCUSSION Insider moves to dismiss the action for lack of subject matter jurisdiction pursuant to Rule 12(b)(1), and failure to state a claim pursuant to Rule 12(b)(6). When a defendant moves to dismiss a case pursuant to rules 12(b)(1) and 12(b)(6), the Court must consider the 12(b)(1) motion first before it makes a decision on the merits. See Baldessarre v. Monroe-Woodbury Century School Dist., 820 F. Supp. 2d 490, 499 (S.D.N.Y. 2011), aff’d sub nom. Baldessarre ex rel. Baldessarre v. Monroe-Woodbury Century School Dist., 496 F. App’x 131 (2d Cir. 2012). Accordingly, the Court will first address whether it has subject matter jurisdiction. A. Standing Article III of the Constitution only gives federal courts the power to resolve “Cases” and “Controversies.” TransUnion LLC v. Ramirez, 594 U.S. 413 , 423 (2021). One element of the case or controversy requirement is that plaintiffs must establish that they have standing, or a personal stake, in a case. Id. To establish standing, plaintiffs must show that they have suffered an injury in fact that is (1) concrete and particularized; and (2) actual or imminent. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). Plaintiffs must also show that the injury is traceable to the defendant’s alleged conduct and that it is likely that the injury is redressable by judicial relief. Id. at 560–61. As “[t]he party invoking federal jurisdiction,” Gabrielli bears the burden of establishing Article III standing. Id. at 561 . Article III standing requires that “[o]nly those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.” TransUnion, 594 U.S. at 427. To allege a concrete harm, a plaintiff must allege an injury that “has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.” Id. at 424 (quoting Spokeo, Inc. v. Robins, 578 U.S. 330 , 341 (2016)). Although “an exact duplicate in American history and tradition is not required,” Spokeo is not an “open-ended invitation for federal courts to loosen Article III based on contemporary, evolving beliefs about what kinds of suits should be heard in federal courts.” TransUnion, 594 U.S. at 424–25. Traditional harms can include both tangible harms, such as physical and monetary harms, and intangible harms. Id. at 425. To evaluate whether an alleged intangible harm is concrete, the Court must ask whether the plaintiff has “identified a close historical or common-law analogue for their asserted injury.” Id. at 424. Traditional examples of intangible harms include “reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. at 425. Statutory violations alone typically do not satisfy the concrete harm requirement. Id. at 426; see also Casillas v. Madison Avenue Associates, Inc., 926 F.3d 329, 332 (7th Cir. 2019) (“Article III grants federal courts the power to redress harms that defendants cause plaintiffs, not a freewheeling power to hold defendants accountable for legal infractions.”). Merely alleging a statutory violation is typically insufficient to confer standing because plaintiffs must still show that they have been “concretely harmed by a defendant’s statutory violation.” TransUnion, 594 U.S. at 427 (explaining that “an injury in law is not an injury in fact.”). Insider argues that Gabrielli does not satisfy the injury in fact requirement because he has failed to allege a concrete injury arising out of Insider’s alleged violation of the CIPA. Doc. 24 at 6. In response, Gabrielli argues that Insider’s alleged violation of the CIPA concretely harmed him because he suffered the intangible harm of an invasion of privacy. Specifically, he argues that Insider invaded his privacy when it installed the Tracker on his browser and sent his IP address to Audiencerate without his consent, that Insider used this information to profit from targeted advertising and marketing strategies, and that these allegations resemble historically recognized harms. Doc. 19 ¶¶ 50–51; Doc. 29 at 4. Gabrielli also argues that the CIPA, California Penal Code § 638.51, codifies a substantive privacy right and thus he only needs to allege a violation of the statute to confer Article III standing. Doc. 29 at 5. Public Disclosure of Private Facts Gabrielli argues that because the common-law understanding of privacy recognizes an individual’s control of information concerning his or her person, Doc. 29 at 4, he has sufficiently alleged an injury that bears a close relationship to a traditionally recognized harm. Gabrielli cites cases where courts have found that the sharing of certain private information to third-parties “b[ears] some relationship to a wellestablished common-law analog: public disclosure of private facts.” Salazar v. National Basketball Association, 118 F.4th 533 , 541 (2d Cir. 2024) (quoting Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276 , 285 (2d Cir. 2023)). Public disclosure of private facts is triggered when one “gives publicity to a matter concerning the private life of another, … if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.” Salazar, 118 F.4th at 541 (quoting Restatement (Second) Torts § 652D (Am. Law Inst. 1977)). While plaintiffs are not required to prove each element of a common-law analogue to confer standing, they must show that the harm caused by the disclosure of their information bears a “close relationship” to the traditionally recognized harm. See TransUnion 594 U.S. at 433 (“[T]he harm from being labeled a ‘potential terrorist’ bears a close relationship to the harm from being labeled a ‘terrorist’ … [which] bears a sufficiently close relationship to the harm from a false and defamatory statement.”); I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034 , 1049–50 (N.D. Cal. 2022) (“[C]ourts must examine the nature of the specific information at issue to determine whether privacy interests were implicated at all. Otherwise every data breach … would confer standing, regardless of whether private information is exposed.”). Moreover, this Court has recognized that “where a key element of the analogous common-law or historical harm is missing, the plaintiff lacks standing.” Sputz v. Alltran Financial, LP, No. 21-cv-4663 (CS), 2021 WL 5772033 , at *3 (S.D.N.Y. Dec. 5, 2021) (quoting Kola v. Forster & Garbus LLP, No. 19cv-10496 (CS), 2021 WL 4135153 , at *6 (S.D.N.Y. Sept. 10, 2021)). Accordingly, Gabrielli must show that the disclosure of his IP address, without more, bears a sufficiently close relationship to the above defined public disclosure of private facts. Gabrielli alleges that Insider sent his IP address to a third-party which provides the general location— state, city, and zip code —of the device he was using at the time. Doc. 19 ¶ 25. Despite Gabrielli’s conclusory labeling of the information collected as “personally identifying,” Doc. 19 ¶ 50, he does not allege that anyone could actually identify him from the IP addresses allegedly collected by the Tracker. Rather, he merely alleges that this information could show that a device from a general area had visited the Website. Doc. 36 at 2. Not only does an IP address fail to identify the actual individual user, but the geographic information that can be gleaned from the IP address is only “as granular as a zip code.” Doc. 29 at 7. Accordingly, the Court finds that the disclosure of an IP address does not bear a sufficiently close relationship to a “matter concerning the private life of another … that would be highly offensive to a reasonable person.” Restatement (Second) Torts § 652D (Am. Law Inst. 1977). �is conclusion is consistent with the general understanding that in the Fourth Amendment context a person has no reasonable expectation of privacy in an IP address. See, e.g., United States v. Kidd, 394 F. Supp. 3d 357 , 362 (S.D.N.Y. 2019) (“[M]ost courts have adopted a categorical approach holding that users have no reasonable expectation of privacy in such IP address information.”); United States v. Christie, 624 F.3d 558, 574 (3d Cir. 2010) (“[N]o reasonable expectation of privacy exists in an IP address … .”); United States v. Hood, 920 F.3d 87, 92 (1st Cir. 2019) (explaining that because “IP address data is merely a string of numbers associated with a device that had, at one time, accessed a wireless network,” the defendant had no reasonable expectation of privacy in his IP address). �e supplemental authority submitted by Gabrielli is not to the contrary. See Doc. 34. In Salazar v. National Basketball Association, the plaintiff alleged that the National Basketball Association (“NBA”) violated the Video Protection Privacy Act by disclosing the title of the video plaintiff watched, the video’s URL and the plaintiff’s Facebook ID— a number that is unique to the individual Facebook account. Salazar v. National Basketball Association, 118 F.4th 533 , 536–38 (2d Cir. 2024). �e Court concluded that the plaintiff alleged a concrete injury sufficient to confer standing because the core alleged harm—exposure of personally identifiable information to unauthorized thirdparties—was sufficiently similar to the public disclosure of private facts. Id. at 541–42. Salazar is distinguishable because there, the plaintiff alleged that the NBA had disclosed information to a third-party which allowed the third-party to specifically identify him by reference to his Facebook ID. Id. at 538. �e plaintiff in Salazar also alleged that the NBA disclosed the particular content that the plaintiff had accessed to a third-party. Id. at 537–38. �e disclosure of Salazar’s personally identifiable viewing information is conduct that lies within the scope of the common-law analogue of public disclosure of private facts. Id. at 541–44. Gabrielli’s IP address, by contrast, cannot personally identify him, nor does the Tracker disclose the content Gabrielli accessed in the Website. �is minimal disclosure is not one “that would be highly offensive to a reasonable person.” Restatement (Second) Torts § 652D (Am. Law Inst. 1977). Gabrielli also attempts to analogize the sharing of his IP address to cases from other jurisdictions where “[c]ourts have found the disclosure of web browsing information sufficient to confer standing.” Doc. 29 at 5. Gabrielli cites multiple cases where defendants installed trackers on plaintiffs’ computers that allowed them to monitor their web browsing across multiple websites and build detailed profiles based on their internet activity. See In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020); In re: Google Inc. Cookie Placement Consumer Privacy Litigation, 934 F.3d 316 (3d Cir. 2019); Mount v. PulsePoint, Inc., 684 F. App’x 32 (2d Cir. 2017). Gabrielli is correct that these cases support the proposition that the unauthorized collection of web browsing information can certainly implicate a legally protected privacy interest sufficient to confer standing. However, an IP address which cannot identify an individual user and at most conveys general geographic information does not justify the same conclusion. Compare In re Facebook, 956 F.3d at 599 (explaining that plaintiffs adequately alleged a concrete harm where the defendant was able to view individual users’ profiles and examine “an individual’s likes, dislikes, interests, and habits over a significant amount of time, without affording users a meaningful opportunity to control or prevent the unauthorized exploration of their private lives.”); In re: Google, 934 F.3d at 325 (finding a concrete injury where plaintiffs alleged that a third-party tracked their personal internet browsing information), with Heeger v. Facebook, 509 F. Supp. 3d 1182 , 1189 (N.D. Cal. 2020) (explaining that there was no concrete injury because “[p]laintiffs do not plausibly allege anything more than the collection of IP addresses, and there is no legally protected privacy interest in IP addresses.”). Because the Tracker installed by Insider “does not collect the contents of Plaintiff’s … communications with the Website,” Gabrielli fails to implicate privacy interests in the same manner that the collection of an individual’s private browsing and search histories does. Doc. 19 ¶ 76. Accordingly, Gabrielli fails to allege a harm that bears a close relationship to the well-established common-law analogue of public disclosure of private facts. Intrusion Upon Seclusion Gabrielli also fails to allege an invasion of privacy analogous to the common-law tort of intrusion upon seclusion. While public disclosure of private facts addresses the harms associated with the disclosure of one’s private information to third-parties, intrusion upon seclusion concerns situations where the intrusion into one’s private life is the harm itself. See e.g., Mills v. Saks.com LLC, No. 23-cv-10638 (ER), 2025 WL 34828 , at *4–5 (S.D.N.Y. Jan. 6, 2025) (explaining that unlike the public disclosure of private facts, certain substantial invasions into one’s privacy can be held “comparable to common-law intrusion on seclusion … regardless of whether [that information is] disseminated elsewhere.”); Sptiz v. Caine & Weiner Company, Inc., No. 23-cv-7853 (PKC) (CLP), 2024 WL 69089 , at *5 (E.D.N.Y. Jan. 5, 2024) (“As for intrusion upon seclusion, it ‘requires the intrusion to have caused an injury, not a subsequent disclosure of the information gained from the intrusion.’ ” (quoting Devitt v. Portfolio Recovery Associates, LLC, No. 21-cv-0567 (ARR) (ARL), 2022 WL 1460278 , at *6 n.10 (E.D.N.Y May 9, 2022))). �e intrusion upon seclusion tort states that “[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” Restatement (Second) of Torts § 652B (Am. Law Inst. 1977). �erefore, the tort is aimed at a violation or invasion into matters that a person would deem deeply private, personal, and confidential. Mills v. Saks.com LLC, No. 23-cv-10638 (ER), 2025 WL 34828 , at *4 (S.D.N.Y. Jan. 6, 2025). In this case, Gabrielli does not deny that he voluntarily provided his IP address when he accessed Insider’s website. Doc. 19 ¶ 24. In fact, an IP address is necessary to access Insider’s website because an IP address enables an individual’s web browser to communicate with the website server. Id. Because it was Gabrielli that sought to access the Website, and Insider needed Gabrielli’s IP address to communicate with Gabrielli’s device, he cannot argue that Insider “intentionally intrude[d]” upon the seclusion of his private affairs. Restatement (Second) of Torts § 652B (Am. Law Inst. 1977). Even if Gabrielli had not voluntarily provided his IP address when he accessed Insider’s Website, for the same reasons discussed above, the Court finds that the collection of an IP address would not be considered an intrusion that would be “highly offensive to a reasonable person.” Restatement (Second) of Torts § 652B (Am. Law Inst. 1977). Unjust Enrichment Gabrielli also argues that his allegations “go far beyond the mere collection of IP addresses” because the data shared with Audiencerate is used by Insider to maximize its revenue. Doc. 29 at 6; Doc. 19 ¶ 56. Gabrielli argues that this harmed him because Insider profited off the non-consensual sharing of his personal information. Doc. 29 at 7. Although Gabrielli does not cite the decision for this proposition, in In re Facebook, Inc. Internet Tracking Litigation the Ninth Circuit recognized a concrete injury based on a theory of unjust enrichment, reasoning that because states recognize unjust enrichment harms at common-law, a plaintiff whose “sensitive and valuable information” is nonconsensually sold to advertisers for a profit has sufficiently alleged a state law interest that satisfies the injury in fact requirement of standing. In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 , 599–601 (9th Cir. 2020) (explaining that to establish standing based on unjustly earned profits plaintiffs must allege they retain a stake in the profits gained from their personal information); but see Heeger v. Facebook, 509 F. Supp. 3d 1182 , 1191 (finding that plaintiffs lacked Article III standing for the unjust enrichment claim because they did not allege that they retained any stake in the profits resulting form the collection of their IP addresses). Instead, Gabrielli only cites Boelter v. Hearst Communications, Inc. where the court found that the plaintiffs had standing because the defendant disclosed their personal information by selling it to third-parties. Boelter v. Hearst Communications, Inc., 192 F. Supp. 3d 427, 438 (S.D.N.Y. 2016). �e plaintiffs in Boelter brought two claims: First, they alleged that the defendants disclosed plaintiffs’ personally identifying information in violation of the Michigan Video Rental Privacy Act. Id. at 436 . Second, they alleged that the defendants were unjustly enriched by selling plaintiffs’ personal data because that benefit was not reflected in the price of the magazine subscription, i.e., they did not receive a discounted price on the subscription by providing their personal data. Id. �e defendant argued that the plaintiffs lacked standing because they had not suffered a concrete injury. Id. �e court concluded that the plaintiffs had standing because the defendant disclosed their “protected information” to data miners and other third-parties without their written consent. Id. at 438 . �e protected information included plaintiffs’ full names, titles of magazines subscribed to, home addresses, gender, age, ethnicity, income, religion, parental status, and political affiliation. Amended Complaint ¶ 2, Boelter v. Hearst Communications, Inc., 192 F. Supp. 3d 427, 438 (S.D.N.Y. 2016) (No. 15-cv03934 (AT)). Given the nature of the information disclosed, the court found that the “[d]efendant deprived Plaintiffs of their right to keep their information private, subjected them to unwanted solicitations and the risk of being victimized by ‘scammers,’ and unjustly retained the economic benefit the value of that information conferred.” Hearst, 192 F. Supp. 3d at 438 . �e court also recognized that the plaintiffs suffered an economic harm because had they known that the defendant would disclose their information, they would have paid less, if anything, for defendant’s services. Id. According to the court, these harms were sufficient to confer Article III standing. Id. �e circumstances that established standing in Boelter simply are not present here. �e “protected information” collected and sold in Boelter was highly personalized and clearly implicated legally protected privacy interests. Id. Gabrielli is correct that the court in Boelter relied on unjust enrichment in its standing analysis. However, the court in Boelter did not conclude that plaintiffs had standing merely because the defendant profited off information associated with plaintiffs. Id. Rather, the disclosure of plaintiffs’ highly personalized information to third-parties resulted in multiple violations of their legally protected privacy interests. Id. �e court thus had no trouble concluding that plaintiffs had suffered a concrete injury after alleging multiple harms—one of which was unjust enrichment—that resulted from the disclosure of plaintiffs’ “protected information.” Id. Unjust enrichment alone is not sufficient to confer standing. Gabrielli would still have to show that Insider’s profiting off the disclosure of his IP address bears a “close relationship” to the traditional understanding of unjust enrichment. See TransUnion LLC v. Ramirez, 594 U.S. 413 , 424 (2021). �is he cannot do. Unjust enrichment has historically required that a person is “unjustly enriched at the expense of another.” Restatement (�ird) of Restitution and Unjust Enrichment § 1 (2011). Although “at the expense of the other” traditionally occurs when a benefit on one side of the transaction corresponds to an observable loss on the other, it can also mean “in violation of the other’s legally protected rights,” without the need to show that the plaintiff has suffered a loss. Restatement (�ird) of Restitution and Unjust Enrichment § 1 cmt. a (2011). As the Court has already explained above, the nature of the information contained in Gabrielli’s IP address does not implicate a legally protected privacy interest, nor does Gabrielli allege that he has suffered any observable loss because of Insider’s conduct. Accordingly, Gabrielli fails to allege a concrete injury based on the argument that that Insider has been unjustly enriched at his expense. Per Se Statutory Violation Finally, Gabrielli argues that that the CIPA is a wiretapping statute that codifies substantive privacy rights and that alleging a violation of this statute satisfies the concrete injury requirement. Doc. 29 at 4–5. Although TransUnion held that merely alleging a statutory violation is insufficient to confer standing because plaintiffs must still show that they have been “concretely harmed,” TransUnion, 594 U.S. at 427, courts have recognized that where a statute codifies a substantive privacy right, a violation gives rise to a concrete injury sufficient to confer standing. In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 , 598 (9th Cir. 2020). Whether a statute confers a substantive privacy right depends on whether the harm the statute seeks to prevent bears a close relationship to harms that have traditionally provided a basis for a lawsuit. Campbell v. Facebook, Inc., 951 F.3d 1106 , 1117–18 (9th Cir. 2020) (“When … a statutory provision identifies a substantive right that is infringed any time it is violated, a plaintiff bringing a claim under that provision ‘need not allege any further harm to have standing.’ ” (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979 , 983–84 (9th Cir. 2017))). Gabrielli argues that the CIPA is a wiretapping statute that codifies the commonlaw right to control one’s personal information. Doc. 29 at 5. For support, Gabrielli cites Ninth Circuit decisions that found §§ 631 and 632 of the CIPA codified substantive privacy rights because they were wiretapping statues that sought to prevent traditionally recognized privacy harms such as intrusion upon seclusion and disclosure of private facts. See In re Facebook, 956 F.3d at 598; Yockey v. Salesforce, Inc., 688 F. Supp. 3d 962 (N.D. Cal. 2023). Section 638.51 of the CIPA, however, is not a wiretapping statute that codifies a substantive privacy right. Unlike §§ 631 and 632 which prohibit persons from intercepting the contents of a message, report, or communication while in transit, § 638.51 merely limits the manner in which Insider can collect Gabrielli’s information. California Penal Code §§ 631, 632, 638.51. Indeed, § 638.51 does not codify the right for Gabrielli to control his information, but instead requires that Insider obtain a court order before using certain statutorily defined mechanisms to collect Gabrielli’s voluntarily provided information. California Penal Code § 638.51; Doc. 19 ¶ 24. �is kind of statutory violation is “a bare procedural violation, divorced from any concrete harm.” See Spokeo, Inc. v. Robins, 578 U.S. 330 , 341 (2016) (explaining that because a bare procedural violation may result in no harm, a plaintiff must allege a concrete harm in addition to the procedural violation to confer standing); see also Mills v. Saks.com LLC, No. 23-cv-10638 (ER), 2025 WL 34828 , at *4 (S.D.N.Y. Jan. 6, 2025). Because § 638.51 does not codify a substantive privacy right that bears a close relationship to a traditionally recognized harm, and because Gabrielli has failed to allege a concrete harm resulting from Insider’s alleged violation, Gabrielli fails to satisfy the injury in fact requirement of Article III standing and this Court lacks subject matter jurisdiction over his claim. B. Merits �e Court will not address whether the Gabrielli has failed to state a claim because the Court has determined that the Court lacks subject matter jurisdiction over Gabrielli’s claim. C. Leave to Amend Finally, Gabrielli requests leave to amend his complaint. Doc. 29 at 18. Rule 15 provides that leave to amend should be “freely give[n] ... when justice so requires.” Fed. R. Civ. P. 15(a)(2). A district court may deny leave to amend, however, based on “futility of amendment.” Ruotolo v. City of New York, 514 F.3d 184, 191 (2d Cir. 2008) (quoting Forman v. Davis, 371 U.S. 178, 182 (1962)). �e fundamental problem with Gabrielli’s complaint, as discussed above, is that he has not suffered a concrete harm sufficient to confer Article III standing. Moreover, because Gabrielli has conceded that no information besides his IP address was collected or disclosed, Doc. 19 ¶¶ 31, 76, it is unlikely that an amendment would cure his standing defects, and thus dismissal with prejudice is warranted. See Ruffalo v. Oppenheimer & Co., 987 F.2d 129 , 131 (2d Cir. 1993) (“Where it appears that granting leave to amend is unlikely to be productive, however, it is not an abuse of discretion to deny leave to amend.”). In addition, Gabrielli has already had an opportunity to amend his complaint with notice of Insider’s Article III standing challenges. In Insider’s letter motion to the court seeking leave to file a motion to dismiss, it alerted Gabrielli to the fact that he had failed to allege a concrete injury in fact. See Doc. 14. Gabrielli then filed an amended complaint in accordance with Rule 15(a)(1)(B). Doc. 19. Nonetheless, Gabrielli’s amended complaint fails today for similar reasons to those previously raised by Insider, which is further evidence that amendment is futile. See City of Pontiac Policemen’s & Firemen’s Retirement System v. UBS AG, 752 F.3d 173, 188 (2d Cir. 2014) (affirming denial of leave to amend when plaintiffs had an opportunity to amend after being provided notice of pleading deficiencies); Tamar v. Mind C.T.I., Ltd., 723 F. Supp. 2d 546, 554 (S.D.N.Y. 2010) (“Leave to amend is appropriately denied where the plaintiff has already had an opportunity to replead after specific warnings as to a complaint’s deficiencies.”). Because the defects in Gabrielli’s complaint cannot be cured with an amendment, the Court declines to grant Gabrielli leave to amend his complaint. IV. CONCLUSION For the foregoing reasons, Insider’s motion is GRANTED. The Clerk of the Court is respectfully directed to terminate the motion, Doc. 23, and close the case. It is SO ORDERED. Dated: February 18, 2024 □ } New York, New York a \ Din EDGARDO RAMOS, U.S.D.J.