District Court’s Ruling Could Signal New Wave Of CCPA Litigation

When the CCPA was first enacted, it was seemingly clear that its right to private action would be limited to traditional data breaches. Over the past two years, however, some courts have called this interpretation into question by expanding the CCPA’s private right of action clause beyond the traditional breach scenario—and instead into alleged privacy violations. A recent holding from the Northern District of California could signal that more of those claims could be tacked onto the wiretap cases that are already flooding dockets.

In many ways, Allison v. PHH Mortgage is a fairly standard website tracking case predicated on allegations that tracking devices on a business’s website disclosed users’ personal information without their knowledge or consent. However, in addition to CIPA, ECPA, and the usual accompanying claims, the plaintiffs also brought a claim under the CCPA. On March 27, 2026, the Northern District of California denied PHH Mortgage’s motion to dismiss the CCPA claim,