[Enforcement library](/enforcement)

# Rodriguez v. Autotrader: a plaintiff who sought out the tracking had no expectation of privacy to lose

This case is about the plaintiff side: who can sue, and on what evidence. A federal judge held that a plaintiff who visited a site expecting to be tracked, so that she could sue, suffered no injury. Notice what both sides lacked: neither put the cookie banner's details in the record.

US District Court, Central District of California · CIPA §631 and §638.51 · Dismissed with prejudice for lack of standing, 14 March and 4 April 2025

## The problem

Rebeka Rodriguez alleged that autotrader.com installed third-party tracking software on page load, before visitors could respond to the privacy policy. She also alleged that the site's search bar, run by an unnamed third-party provider, passed search terms to Google, Facebook, Pinterest and other advertisers ([order of 14 March 2025](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.45.0.pdf), p. 2). Her complaint described her as "a consumer privacy advocate who works as a 'tester'" ([SAC ¶ 4](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.34.0.pdf)). The court never decided whether Autotrader's tracking happened as alleged.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, Central District of California (Judge R. Gary Klausner) |
| Case number | 2:24-cv-08735-RGK-JC; removed from Los Angeles Superior Court No. 24STCV13149 |
| Parties | Rebeka Rodriguez v. Autotrader.com, Inc. |
| Counsel | Plaintiff: Pacific Trial Attorneys. Defendant: Orrick, Herrington & Sutcliffe LLP (\[docket\](https://www.courtlistener.com/docket/69248139/rebeka-rodriguez-v-autotradercom-inc/)) |
| Laws | CIPA §631 and §638.51 |
| Stage | Dismissed with prejudice; case closed 4 April 2025. The docket shows no later filing |
| Amount | None |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| CIPA §631 (search terms) | Third party reads contents in transit without consent; site aids it | Search for "White SUV's safe for autistic 4 year old" routed to a search provider and advertisers (SAC ¶ 108) | January 2025: dismissed without prejudice, query not described. March 2025: dismissed with prejudice, no expectation of privacy |
| CIPA §638.51 (trackers) | Pen register or trap and trace device without court order or user consent | Trackers collected IP address, operating system, browser, geolocation and email address before any consent (FAC, as summarised at Dkt. 25, p. 1) | January 2025: survived. April 2025: dismissed with prejudice, no standing |

## Technical issue

- **Tools or vendors:** an unnamed third-party search provider. The complaint says URLs containing search terms went to Google Analytics, Facebook, 7SeaSky, Pinterest, ScorecardResearch and Good Ad Services (SAC ¶¶ 102–107).
- **Where:** autotrader.com, including its search results pages, where "the search phrase is added to the URL" (SAC ¶ 100).
- **When:** the complaint alleged data was shared "immediately upon webpage loading, preceding any opportunity for visitors to consent to or decline the Website's privacy policy or cookie banner" (SAC ¶ 56).
- **The banner:** Autotrader argued its banner told visitors their information would be shared. The court could not weigh that: "Plaintiff does not allege any details about the banner. Nor does Defendant provide any details about the banner via judicial notice" ([order of 8 January 2025](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.25.0.pdf), p. 6). The privacy policy Autotrader filed "says nothing of the banner's conspicuousness or contents" (p. 6 n.3).
- **How it came to light:** the complaint relies on "Plaintiff's investigation of the Website via a computer expert" (SAC ¶¶ 56, 99), illustrated with a search for "Cars for Sale in Los Angeles, CA" (SAC ¶ 101).

**Inth's technical interpretation:** two separate flows are alleged. A search query written into the page URL is copied by every tag that reports the URL. A third-party search widget also receives the query directly. Whatever the legal outcome, an operator who cannot show what its banner said, when it appeared and what loaded before it is arguing from the plaintiff's screenshots.

Illustrative pattern, not the defendant's code.

```js
// Bad: the search term rides along with every page-view beacon
location.assign(`/cars-for-sale/searchresults?keyword=${encodeURIComponent(q)}`);
// later, on the results page, tags report the full URL
gtag('event', 'page_view', { page_location: location.href });
fbq('track', 'PageView'); // Meta reads document.location itself
```

Illustrative pattern, not the defendant's code.

```js
// Fixed: keep the query out of third-party URLs and log what the visitor saw
history.replaceState(null, '', '/cars-for-sale/searchresults'); // query kept in app state
gtag('event', 'page_view', { page_location: location.origin + location.pathname });
auditLog.record({ event: 'banner_shown', version: BANNER_VERSION, at: Date.now() });
```

## Timeline

| Date | Event |
| --- | --- |
| 24 May 2024 | Complaint filed in Los Angeles Superior Court; removed 10 October 2024 (\[docket\](https://www.courtlistener.com/docket/69248139/rebeka-rodriguez-v-autotradercom-inc/)) |
| 8 January 2025 | §631 dismissed without prejudice; §638.51 survives (\[Dkt. 25\](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.25.0.pdf)) |
| 23 January 2025 | Second amended complaint adds the search query and "tester" description |
| 4 March 2025 | Autotrader's request for reconsideration or interlocutory appeal denied |
| 14 March 2025 | §631 dismissed with prejudice; order to show cause on §638.51 standing (\[Dkt. 45\](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.45.0.pdf)) |
| 4 April 2025 | §638.51 dismissed with prejudice; case closed (\[Dkt. 49\](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.49.0.pdf)) |

## Outcome

In January 2025 the court kept the §638.51 claim. It held the statute is not limited to telephones and that the visitor, not the website, is the "user" whose consent counts (Dkt. 25, pp. 6–8). It also said the advertising companies did not appear to be mere tools of the site, so the party exception did not clearly apply (p. 5).

The plaintiff's own pleading then decided the case. In March the court held: "as a tester seeking to file lawsuits for invasions of her privacy, she had no expectation of privacy, and thus, no injury in fact" (Dkt. 45, pp. 3–4). It distinguished *Havens Realty* testers, whose injury did not depend on their expectations. In April it applied the same reasoning to §638.51 on its own motion: "as a tester that visited and entered information into Defendant's website expecting the information to be accessed, recorded, and disclosed, she cannot claim an injury when her expectations were ultimately met" (Dkt. 49, p. 2). Her argument that she also used the site as a real shopper did not change the result (p. 2 n.2).

These are unpublished district court orders and bind no other court.

## What it cost

| Item | Record |
| --- | --- |
| Damages or settlement | None; dismissed with prejudice |
| Fees or costs awarded | Not stated in the cited record |

## Why it matters

- **The tester defence has limits.** Other judges in the same district let self-described testers proceed when they plead genuine interest in the site. In *Garcia v. Anschutz Entertainment Group* (C.D. Cal. 5 May 2026), a plaintiff who rejected all cookies through the banner and was "genuinely interested" in the site kept her §638.51 claim ([Dkt. 30](https://storage.courtlistener.com/recap/gov.uscourts.cacd.985294/gov.uscourts.cacd.985294.30.0_1.pdf)). Complaints now plead that language, as in [Limas v. Wayfair](/enforcement/limas-v-wayfair).
- **Standing after Popa and Cook.** [Popa](/enforcement/popa-v-microsoft) asks for harm traditionally actionable at common law; this order adds that the plaintiff's own expectations count. In state court, where Article III does not apply, a Los Angeles judge sustained a demurrer against the same plaintiff in [Rodriguez v. Fountain9](/enforcement/rebeka-rodriguez-v-fountain9), reading CIPA's damages provision (§637.2) to require an injury.
- **The merits rulings still stand as reasoning.** The January order's holding that the visitor is the §638.51 "user" was cited in [Camplisson v. Adidas](/enforcement/camplisson-v-adidas) and [Limas v. Wayfair](/enforcement/limas-v-wayfair). SB 690 (Stats. 2026, ch. 976), signed 30 September 2026 and operative 1 January 2027 (the default effective date for a 2026 statute), makes private §638.51 website and app claims Attorney General only, retroactive to pending claims in actions filed on or after 1 January 2025; §631, §632 and §632.7 are untouched ([bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)). This case was filed in May 2024 and closed in April 2025.

## How Inth catches this

This case turned on the plaintiff's standing, not on what the site did, so Inth's role here is evidence: records that let an operator answer a specific allegation with dated facts.

- **Website audit:** keeps timestamped observations of which scripts and domains loaded on each page, in which region and consent state. That is the record of "what loaded before the banner" that neither party produced here.
- **Consent banner:** each consent record shows the visitor's choice, country and the policy that applied, so an operator can show what a visitor was offered and chose. Inth's default California policy is opt-out, so tags run until the visitor opts out; holding them until a choice in California needs an opt-in policy, which is a configuration choice.
- **Code audit:** keeps the history of when a tracker or search integration entered the codebase, with the pull request and approval.
- **Evidence:** together these answer questions a demand letter or complaint raises: was this vendor present on that date, before or after a choice, under which policy.

Records show what your systems did; they do not decide standing, and they cannot show what a vendor did with data after receipt.

## Checks for your own systems

### In the repository

- Find where site-search terms enter URLs and which third-party scripts can read them.
- Version your banner copy and configuration so you can show what it said on a given date.

### In the browser and network

- Search for a test phrase and list every third-party request whose URL or body contains it.
- Record the time the banner renders relative to the first third-party request, and keep the capture.

### With the people responsible

- Agree who keeps dated screenshots, configuration exports and runtime observations, and for how long.
- When a demand letter arrives, ask for the visit date, page and captures it relies on, and compare them with your own records for that date.

## Sources and limits

- [Order of 8 January 2025 (Dkt. 25)](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.25.0.pdf)
- [Second amended complaint, 23 January 2025 (Dkt. 34)](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.34.0.pdf)
- [Order of 14 March 2025 (Dkt. 45)](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.45.0.pdf)
- [Order of 4 April 2025 (Dkt. 49)](https://storage.courtlistener.com/recap/gov.uscourts.cacd.944277/gov.uscourts.cacd.944277.49.0.pdf)
- [Docket, 2:24-cv-08735 (CourtListener)](https://www.courtlistener.com/docket/69248139/rebeka-rodriguez-v-autotradercom-inc/)
- [Garcia v. Anschutz Entertainment Group, order of 5 May 2026](https://storage.courtlistener.com/recap/gov.uscourts.cacd.985294/gov.uscourts.cacd.985294.30.0_1.pdf)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Autotrader.com, Inc.'s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Rodriguez v. Fountain9](/enforcement/rebeka-rodriguez-v-fountain9) · [Mitchener v. Talkspace](/enforcement/mitchener-v-talkspace) · [Shah v. Crain Communications](/enforcement/shah-v-crain-communications) · [Demand letters](/enforcement/demand-letters)