Antitrust Law Daily Wrap Up, PRIVACY—N.D. Cal.: Fast food brand owners must face claims data tracking suit, (Jun 10, 2026)

By George Basharis, J.D.

Claims challenging cookie consent practices survived, while wiretapping allegations and certain untimely claims under state privacy laws did not.

Consumers challenging website tracking practices across several restaurant brands plausibly alleged that the companies continued collecting information after users rejected cookies, allowing most of their privacy, fraud, and unjust enrichment claims to move forward. The federal court in San Francisco largely denied a motion to dismiss by Inspire Brands Inc., Arby’s Restaurant Group Inc., Jimmy John’s Franchisor SPV LLC, Sonic Industries Services LLC, and Dunkin’ Brands Inc., permitting the case to proceed on a broad range of claims arising from the alleged collection of user data through cookies and related technologies despite consumers’ opt-out choices. However, the ruling dismissed certain California Invasion of Privacy Act (CIPA) claims as untimely and a wiretapping claim (De Ayora v. Inspire Brands, Inc., No. 3:25-cv-03645-AGT (N.D. Cal. Jun. 8, 2026)).

Standing. Inspire Brands argued that the consumers lacked standing to sue the company. The amended complaint alleged that Inspire helped operate the restaurant websites, managed technology infrastructure related to data collection and privacy compliance and was identified in the websites’ privacy policies through an Inspire email address. Although Inspire argued that those allegations failed to show any misconduct by the company, the court concluded that they were sufficient at the pleading stage to establish standing.

Fraud. The companies also argued that the consumers failed to plead fraud with sufficient specificity. Although the court previously found that the complaint did not adequately identify when and where the alleged misrepresentations occurred, the amended complaint provided narrower date ranges and identified the specific cookie-banner versions on which each consumer relied. The court concluded that those allegations provided sufficient notice of the alleged misconduct.

The court also allowed the consumers’ common-law fraud claim to proceed, finding that allegations that consumers relied on cookie banners indicating that they could reject cookies but were tracked anyway after declining them, together with assertions regarding knowledge, reliance, and damages, adequately stated a fraud claim.

Unjust enrichment. Likewise, the court allowed the consumers’ unjust enrichment claim to proceed. Although the companies argued that the consumers failed to identify any unjustly retained benefit, the complaint alleged that tracking technologies and third-party cookies generated value by facilitating data collection, targeted advertising, website performance improvements, and analysis of user behavior. The court concluded that those allegations sufficiently connected the challenged tracking practices to benefits received by the companies.

Privacy claims. The companies also renewed their challenge to the consumers’ common-law privacy claims, arguing that the consumers lacked standing and failed to state viable causes of action. The court rejected those arguments and emphasized that allegations involving the loss of privacy interests were sufficient to support standing at this stage of the litigation.

CIPA. The ruling produced a mixed result for claims brought under CIPA. One consumer asserted claims against Baskin Robbins, Dunkin’, and Jimmy John’s based on website visits that allegedly occurred outside the applicable limitations period. The consumer relied on a demand letter and a JAMS arbitration proceeding to support equitable tolling, but the court found that neither effort provided notice to those companies because the demand letter was sent only to Inspire and the arbitration demand named only Inspire and Arby’s. The court also rejected arguments based on fraudulent concealment and delayed discovery, concluding that the complaint itself showed the claims were untimely. Therefore, it dismissed the claims against Baskin Robbins, Dunkin’, and Jimmy John’s.

Another consumer faced a partial statute-of-limitations challenge involving claims against Arby’s. The consumer visited the Arby’s website in August or September 2021. The court found that the complaint did not support delayed discovery or fraudulent concealment because it failed to explain when the violations were discovered or what efforts were undertaken to uncover them. Consequently, the Arby’s-related claims were deemed untimely and dismissed. However, the court refused to dismiss that consumer’s claims against Baskin Robbins, Dunkin’, Jimmy John’s, and Sonic, concluding that the complaint did not establish untimeliness on its face.

Wiretapping. The consumers were less successful on their claim alleging unlawful wiretapping under CIPA. The court previously dismissed the claim because the complaint failed to show that communications were intercepted while in transit. The amended complaint alleged that cookies tracked information such as browsing history, website interactions, user input data, demographic information, shopping behavior, device information, and geolocation data.

Although the court acknowledged that some of those categories could potentially qualify as communication content, it found that the complaint failed to identify any communications whose contents were intercepted. Instead, it alleged only that tracking occurred after the consumers attempted to decline cookies and did not identify any communications with the websites or other interactions involving content that could have been intercepted. Accordingly, the court concluded that the complaint alleged the collection of record information rather than the interception of communication contents and dismissed the wiretapping claim.

Pen register. The consumers achieved a different result on their separate CIPA claim involving the alleged use of pen registers. Although the companies argued that the complaint failed to identify the type of dialing, routing, addressing, or signaling information required under the statute, the court concluded that allegations that the websites tracked users’ IP addresses were sufficient to state a claim under CIPA’s pen register provisions because IP addresses constitute addressing information.

The Case is No. 3:25-cv-03645-AGT.

Judge: Tse, A.

Attorneys: Todd M. Kennedy (Gutride Safier LLP) for Benjamin Paul de Ayora. Alexis Bastian Cruz (Baker & Hostetler LLP) for Inspire Brands, Inc.

Companies: Inspire Brands, Inc.

Cases: Privacy CyberPrivacyFeed PolicyIndustryPractices CaliforniaNews