[Enforcement library](/enforcement)

# Wiley v. Universal Music: browsing data is not contents, but ignoring a decline still counts

Judge Pitts dismissed CIPA wiretap and pen-register claims with prejudice because URLs and device data are not the contents of a communication. Privacy and unjust enrichment claims over tracking after visitors declined cookies continue.

## Key facts

- **Regulator or court:** US District Court, Northern District of California
- **Jurisdiction:** California, US
- **Framework:** CIPA §§ 631 and 638.51; California constitutional privacy; intrusion upon seclusion; unjust enrichment
- **Record date:** 2026-09-14
- **Procedural status:** CIPA claims dismissed with prejudice; privacy and unjust enrichment claims proceed

Visitors who clicked decline on artist websites can keep suing over the tracking that followed. What they cannot do is call URLs and device data the contents of a communication under CIPA.

US District Court, N.D. California · CIPA and California privacy law · Order 14 September 2026

- The problem
- Case record
- What the court found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

Christine Wiley and Vishal Shah allege that Universal Music Investments (UMI) websites, including postmalone.com, imaginedragonsmusic.com and universalmusic.com, kept tracking them after they declined cookies, although UMI said declining would stop tracking. The court held that this alleged deceit supports standing, but that the browsing data collected is not "contents" under CIPA ([Order, Dkt. 68](https://docs.justia.com/cases/federal/district-courts/california/candce/5:2025cv03095/447589/68)).

## Case record

| Field | Record |
| --- | --- |
| Court | US District Court, N.D. California (Judge P. Casey Pitts) |
| Case number | 5:25-cv-03095-PCP |
| Parties | Christine Wiley and Vishal Shah v. Universal Music Investments, Inc. |
| Laws | CIPA §§ 631 and 638.51; California constitutional privacy; intrusion upon seclusion; unjust enrichment |
| Stage | Motion to dismiss amended complaint granted in part; CIPA claims dismissed with prejudice |
| Earlier ruling | 826 F. Supp. 3d 1121 (N.D. Cal. 2025) |
| Amount | None |
| Source review | 20 October 2026 |

## What the court found

| Claim | Question | Result |
| --- | --- | --- |
| Article III standing | Is tracking browsing data a concrete harm? | Yes at this stage. Under Popa v. Microsoft, deceit is a "plus" factor: UMI allegedly said declining cookies would stop tracking |
| CIPA § 631 (wiretap) | Were "contents" intercepted? | No. Full-string URLs, session and device information, button events and geolocation are record information. Plaintiffs expressly excluded search queries. Dismissed with prejudice |
| CIPA § 638.51 (pen register) | Same contents line | Dismissed with prejudice |
| Statute of limitations | Can fraudulent concealment toll it? | Adequately pleaded; Rule 9(b) does not apply to tolling |
| Constitutional privacy; intrusion; unjust enrichment | Do the remaining claims survive? | They continue |

The court contrasted cases where search terms or typed messages were captured, such as D'Antonio v. Smith & Wesson. Here the plaintiffs had pleaded the search queries out of the case.

## Technical issue

- **What data (alleged):** full-string URLs, session information, device information, button events and geolocation.
- **Where:** UMI-operated artist and label websites, including postmalone.com, imaginedragonsmusic.com and universalmusic.com.
- **Consent state:** collection allegedly continued after visitors declined cookies.

**Inth's technical interpretation:** a decline that only hides the banner leaves every tag running. The decline handler must change the consent state that the tag loader reads, and tags that already loaded must stop sending.

```javascript
// Decline closes the banner but changes nothing else
declineButton.onclick = () => banner.hide();

// Decline records the choice; tags check it before every send
declineButton.onclick = () => {
  consent.deny(['analytics', 'marketing']);
  banner.hide();
};
function send(event) {
  if (!consent.has('marketing')) return;
  vendor.track(event);
}
```

Illustrative pattern, not the defendant's code. Generic consent API, not a specific c15t call.

## Timeline

| Date | Event |
| --- | --- |
| 4 April 2025 | Complaint filed |
| 2025 | First dismissal ruling, 826 F. Supp. 3d 1121 |
| 14 September 2026 | Order granting in part motion to dismiss amended complaint (Dkt. 68) |
| 29 September 2026 | UMI answer filed (Dkt. 69, per a docket listing; not opened) |

## Outcome

The CIPA claims are gone with prejudice. Constitutional privacy, intrusion upon seclusion and unjust enrichment claims proceed. No class has been certified and no liability has been found.

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Damages or settlement | None | \[Order, Dkt. 68\](https://docs.justia.com/cases/federal/district-courts/california/candce/5:2025cv03095/447589/68) |
| Defence costs | Not stated in the cited record |  |

## Why it matters

- **A broken decline creates standing.** Saying a decline stops tracking and then tracking anyway is the "plus" factor that turned routine browsing data into a concrete harm.
- **CIPA has limits.** Without search terms or typed content, URL and device data did not support wiretap or pen-register claims in this court. Other N.D. Cal. judges have gone the other way on pen registers; compare [Asercion v. Ulta](/enforcement/asercion-v-ulta).
- **Common-law claims carry the case.** The privacy and unjust enrichment claims survived on the same facts.

Related law pages: [CIPA § 631](/enforcement/laws/cipa-631-wiretapping), [CIPA § 638.51](/enforcement/laws/cipa-638-51-pen-register), [Article III standing](/enforcement/laws/article-iii-standing).

## How Inth catches this

- **Consent banner:** records a decline as a denied state that tags read before loading or sending, and stops tags already on the page.
- **Website audit:** declines on each site in a clean profile and flags any third-party tracking request or cookie set afterwards.
- **Evidence:** consent records with choice, country and policy version, and post-decline network observations per site.

Limit: server-side forwarding after a decline is not visible from the browser.

## Checks for your own systems

### In the repository

- Read the decline handler: does it write a consent state, or only close the banner?
- Check every property sharing a tag container (artist and brand microsites) uses the same consent gate.

### In the browser and network

- Decline, browse three pages and search for requests to analytics and ad domains.
- Check whether search terms appear in URLs sent to vendors.

### With the people responsible

- Compare what the banner and privacy policy say a decline does with what the site does.
- Inventory microsites run by agencies or labels outside the main release process.

## Sources and limits

- [Order granting in part motion to dismiss, Dkt. 68](https://docs.justia.com/cases/federal/district-courts/california/candce/5:2025cv03095/447589/68), 14 September 2026

The complaint and the 2025 order were not opened; their details come from the 2026 order. The 29 September 2026 answer is taken from a docket listing and was not read. The vendors and tools involved are not identified in the cited order.

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Universal Music's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Popa v. Microsoft](/enforcement/popa-v-microsoft), [Asercion v. Ulta](/enforcement/asercion-v-ulta), [Failed opt-out controls](/enforcement/issues/failed-opt-out-controls).