Ninth Circuit Favors Robust Privacy Protections Under CIPA

In Mikulsky v. Bloomingdale's (June 2025), the U.S. Court of Appeals for the Ninth Circuit reversed the dismissal of a California Invasion of Privacy Act (CIPA) class action, holding that the plaintiff sufficiently alleged Bloomingdale's disclosed the "contents" of website communications to a third-party session-replay vendor. The court found prior user consent was not properly obtained and affirmed California's jurisdiction over the retailer.

This decision marks a shift in the Ninth Circuit's CIPA approach by lowering the pleading threshold, reinforcing the need for prior consent, and affirming California jurisdiction over companies collecting data from residents. It broadens CIPA exposure for companies using tracking technologies without clear, upfront user notice and consent.