Wiley v. Universal Music: browsing data is not contents, but ignoring a decline still counts

Visitors who clicked decline on artist websites can keep suing over the tracking that followed. What they cannot do is call URLs and device data the contents of a communication under CIPA.

US District Court, N.D. California · CIPA and California privacy law · Order 14 September 2026

CIPA claims dismissed with prejudice; privacy and unjust enrichment claims proceed

Regulator or court: US District Court, Northern District of California
Jurisdiction: California, US
Framework: CIPA §§ 631 and 638.51; California constitutional privacy; intrusion upon seclusion; unjust enrichment
Order: 14 September 2026

Failed opt-out controls · Cookies before choice or after refusal

The problem

Christine Wiley and Vishal Shah allege that Universal Music Investments (UMI) websites, including postmalone.com, imaginedragonsmusic.com and universalmusic.com, kept tracking them after they declined cookies, although UMI said declining would stop tracking. The court held that this alleged deceit supports standing, but that the browsing data collected is not "contents" under CIPA (Order, Dkt. 68).

Case record

Court: US District Court, N.D. California (Judge P. Casey Pitts)
Case number: 5:25-cv-03095-PCP
Parties: Christine Wiley and Vishal Shah v. Universal Music Investments, Inc.
Laws: CIPA §§ 631 and 638.51; California constitutional privacy; intrusion upon seclusion; unjust enrichment
Stage: Motion to dismiss amended complaint granted in part; CIPA claims dismissed with prejudice
Earlier ruling: 826 F. Supp. 3d 1121 (N.D. Cal. 2025)
Amount: None
Source review: 20 October 2026

What the court found

Wiley v. Universal Music rulings
Claim	Question	Result
Article III standing	Is tracking browsing data a concrete harm?	Yes at this stage. Under Popa v. Microsoft, deceit is a "plus" factor: UMI allegedly said declining cookies would stop tracking
CIPA § 631 (wiretap)	Were "contents" intercepted?	No. Full-string URLs, session and device information, button events and geolocation are record information. Plaintiffs expressly excluded search queries. Dismissed with prejudice
CIPA § 638.51 (pen register)	Same contents line	Dismissed with prejudice
Statute of limitations	Can fraudulent concealment toll it?	Adequately pleaded; Rule 9(b) does not apply to tolling
Constitutional privacy; intrusion; unjust enrichment	Do the remaining claims survive?	They continue

The court contrasted cases where search terms or typed messages were captured, such as D’Antonio v. Smith & Wesson. Here the plaintiffs had pleaded the search queries out of the case.

Technical issue

What data (alleged): full-string URLs, session information, device information, button events and geolocation.
Where: UMI-operated artist and label websites, including postmalone.com, imaginedragonsmusic.com and universalmusic.com.
Consent state: collection allegedly continued after visitors declined cookies.

Inth’s technical interpretation: a decline that only hides the banner leaves every tag running. The decline handler must change the consent state that the tag loader reads, and tags that already loaded must stop sending.

// Decline closes the banner but changes nothing else
declineButton.onclick = () => banner.hide();

// Decline records the choice; tags check it before every send
declineButton.onclick = () => {
  consent.deny(['analytics', 'marketing']);
  banner.hide();
};
function send(event) {
  if (!consent.has('marketing')) return;
  vendor.track(event);
}

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

4 April 2025Complaint filed
2025First dismissal ruling, 826 F. Supp. 3d 1121
14 September 2026Order granting in part motion to dismiss amended complaint (Dkt. 68)
29 September 2026UMI answer filed (Dkt. 69, per a docket listing; not opened)

Outcome

The CIPA claims are gone with prejudice. Constitutional privacy, intrusion upon seclusion and unjust enrichment claims proceed. No class has been certified and no liability has been found.

What it cost

Wiley v. Universal Music costs
Item	Amount	Source
Damages or settlement	None	[Order, Dkt. 68](https://docs.justia.com/cases/federal/district-courts/california/candce/5:2025cv03095/447589/68)
Defence costs	Not stated in the cited record

Why it matters

A broken decline creates standing. Saying a decline stops tracking and then tracking anyway is the "plus" factor that turned routine browsing data into a concrete harm.
CIPA has limits. Without search terms or typed content, URL and device data did not support wiretap or pen-register claims in this court. Other N.D. Cal. judges have gone the other way on pen registers; compare Asercion v. Ulta.
Common-law claims carry the case. The privacy and unjust enrichment claims survived on the same facts.

Related law pages: CIPA § 631, CIPA § 638.51, Article III standing.

How Inth catches this

Consent banner: records a decline as a denied state that tags read before loading or sending, and stops tags already on the page.
Website audit: declines on each site in a clean profile and flags any third-party tracking request or cookie set afterwards.
Evidence: consent records with choice, country and policy version, and post-decline network observations per site.

Limit: server-side forwarding after a decline is not visible from the browser.

Checks for your own systems

In the repository

Read the decline handler: does it write a consent state, or only close the banner?
Check every property sharing a tag container (artist and brand microsites) uses the same consent gate.

In the browser and network

Decline, browse three pages and search for requests to analytics and ad domains.
Check whether search terms appear in URLs sent to vendors.

With the people responsible

Compare what the banner and privacy policy say a decline does with what the site does.
Inventory microsites run by agencies or labels outside the main release process.

Sources and limits

Order granting in part motion to dismiss, Dkt. 68, 14 September 2026

The complaint and the 2025 order were not opened; their details come from the 2026 order. The 29 September 2026 answer is taken from a docket listing and was not read. The vendors and tools involved are not identified in the cited order.

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Universal Music’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.