Allison v. PHH Mortgage
Summary
This is an amended Rule 12(b)(6) order (May 14, 2026) in Allison v. PHH Mortgage (N.D. Cal.) granting in part and denying in part PHH's motion to dismiss. Several privacy-related claims survive the pleading challenge (including CCPA, UCL, certain CDAFA and wiretap/CIPA §632 claims), while others were dismissed (some with leave to amend). The court allowed plaintiff leave to amend certain dismissed claims by June 4, 2026.
Litigation Status
Procedural Posture
Plaintiff filed a putative class action alleging website tracking and data disclosure. Defendant moved to dismiss under Federal Rule of Civil Procedure 12(b)(6). The court issued an amended order on May 14, 2026 granting in part and denying in part the motion and setting a deadline (June 4, 2026) to file an amended complaint where indicated.
Reported Holding
The court granted in part and denied in part PHH's Rule 12(b)(6) motion to dismiss. The court allowed several claims to proceed (including negligence, UCL, CCPA, a CIPA Section 632(a) claim, the federal Wiretap Act claim, and a CDAFA claim under Cal. Penal Code §502(c)(1)(B)), while dismissing other claims (including negligence per se without leave to amend; CDAFA §502(c)(2) and §502(c)(8); breach of implied contract; unjust enrichment; breach of confidence; and CIPA §631(a)) with leave to amend on specified claims.
What the Court Decided
The court GRANTED IN PART and DENIED IN PART the defendant PHH's motion to dismiss. It denied dismissal of the negligence claim, UCL claim, CCPA claim, the federal Wiretap Act claim, CIPA §632(a) claim, CDAFA §502(c)(1)(B) claim, and declaratory judgment claim. The court dismissed negligence per se (without leave), CDAFA claims under §502(c)(2) and §502(c)(8), breach of implied contract, unjust enrichment, breach of confidence, and CIPA §631(a) but in most of those instances granted leave to amend. The court gave plaintiff leave to file an amended complaint by June 4, 2026.
What the Court Did Not Decide
The court did not resolve merits beyond the Rule 12(b)(6) standard and did not reach certain alternative bases for dismissal of the Wiretap Act claim other than consent and the crime-tort exception. The court also did not finally rule on the substantive merits of the surviving claims.
Significance
Generally viewed as plaintiff-favorable. Characterizations of significance describe how the matter has generally been discussed in tracked public sources; individual holdings are often narrow, procedural, or fact-specific, and this page does not state or imply broader holdings than the sources support.
What This Page Does and Does Not Say
This page reports what our tracked public sources say about this matter — including, where identified, the procedural posture (for example, a ruling on a motion to dismiss is not a final merits decision). It does not report legal conclusions beyond those sources, does not predict outcomes, and does not constitute legal advice.
Technologies at Issue
- website_tracking
- third-party_tracking
- session_replay_style_tracking
- form_activity_tracking
- Google_tracking
- HotJar
- Microsoft_tracking
- Yahoo_tracking
- Blend/Sentry.io
Third parties named or identified in tracked sources: Google, HotJar, Microsoft, Yahoo, Blend/Sentry.io.
Statutes Invoked
Claims Asserted
- negligence
- negligence per se
- Comprehensive Computer Data Access and Fraud Act (CDAFA) (Cal. Penal Code §502)
- Unfair Competition Law (UCL)
- California Consumer Privacy Act (CCPA)
- breach of express contract
- breach of implied contract
- unjust enrichment
- declaratory judgment
- breach of confidence
- California Invasion of Privacy Act (CIPA) (Cal. Penal Code §§631, 632)
- Electronic Communications Privacy Act / Wiretap Act (18 U.S.C. §2511)
What This Matter May Mean for Website Operators
California Invasion of Privacy Act (CIPA) is an all-party consent statute with a private right of action. Consent standard and private enforceability are the structural features that most shape where website tracking claims are filed and how they are valued.
For operators using similar technologies, the recurring factual questions in matters like this one are when session recording begins relative to consent and whether input masking covers every field; what page URLs and query strings analytics tools share with third parties. Our scanner tests these behaviors empirically.
Because this matter is pending, anything reported here is procedural — allegations and interim rulings, not final determinations.
Detection of a similar technology on a website is an informational risk indicator, not a legal conclusion, and nothing in this section is legal advice.
Related Intelligence
Sources
About This Page
Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.
How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.
Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.
Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website