SAN FRANCISCO (LN) — U.S. District Judge Rita F. Lin on Thursday denied in part a motion to dismiss a putative class action in which plaintiff Ethan Allison alleged that PHH Mortgage secretly installed code-based tracking devices on its website to surreptitiously share users’ personal and financial information with third parties like Google and Blend.
The court’s order in Allison v. PHH Mortgage (Case No. 25-cv-05323-RFL) preserves claims under the California Consumer Privacy Act, the federal Wiretap Act, and California’s Invasion of Privacy Act, while dismissing a negligence per se claim without leave to amend and several other claims with leave to amend.
Plaintiff Ethan Allison alleged that PHH, which recently rebranded as Onity Mortgage, configured its website to transmit individualized user data—including loan application activities, browsing habits, and identity markers like IP addresses—to third parties without customers’ knowledge or consent.
The complaint asserts that PHH used these trackers to gather and share information about customers to market its services and bolster profits, effectively diverting user data to third parties like Google to save on marketing costs.
PHH moved to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(6), arguing that Allison had consented to the data collection and sharing by agreeing to the company’s Privacy Contracts, which included its Privacy and Security Policy, Terms & Conditions, and CCPA Disclosure.
Judge Lin rejected the argument that consent was established as a matter of law, finding that the Privacy Contracts contained conflicting provisions that a reasonable user could interpret as prohibiting the collection of individualized user activity.
The court pointed specifically to the Terms & Conditions, which stated that PHH’s website “does not covertly capture information regarding the specific activities of any particular user” and only produces reports in “anonymous or aggregated form.”
“Based on these representations, a reasonable user could interpret the Privacy Contracts in their entirety as disclosing only that PHH collects and shares user information in the aggregate but not information organized by particular users,” Lin wrote.
The judge noted that while other provisions in the Privacy Contracts permitted sharing personal information with non-affiliates for marketing, they did not clarify whether that information was individualized or aggregated, nor did they explicitly notify users of the specific practice at issue.
Accordingly, the court denied PHH’s motion to dismiss the negligence, CCPA, breach of express contract, and federal Wiretap Act claims, finding that Allison had adequately alleged injury and that the company’s conduct fell outside the scope of any consent.
The court also revived the claim under Section 632(a) of California’s Invasion of Privacy Act, ruling that Allison plausibly alleged PHH intentionally recorded confidential communications without consent and acted with the purpose of committing an invasion of privacy tort to reduce marketing costs, triggering the crime-tort exception to the Wiretap Act’s consent defense.
However, the judge granted PHH’s motion to dismiss the negligence per se claim without leave to amend, noting that the Federal Trade Commission and Gramm-Leach-Bliley Acts relied upon by Allison do not provide private rights of action.
The court also dismissed claims under Sections 502(c)(2) and (8) of California’s Comprehensive Computer Data Access and Fraud Act, finding Allison lacked standing because he did not allege that trackers were introduced into his computer or that they accessed data from his device.
A claim under Section 502(c)(1)(B) of the CDAFA survived, as the court found that PHH’s alleged unjust profit of Allison’s personal information could constitute a “damage or loss” under the statute.
Claims for breach of implied contract, unjust enrichment, and breach of confidence were dismissed with leave to amend, as the court found these quasi-contract claims could not lie where a valid express contract covered the same subject matter.
The California Unfair Competition Law claim also survived, with the court finding that Allison’s allegation that he lost the benefit of his bargain by paying for a mortgage without receiving the reasonable privacy protections he expected was sufficient to establish standing.
If Allison wishes to file an amended complaint correcting the deficiencies identified in the order, he must do so by June 4, 2026.