One of the many data firms being sued in
class actions in California is Klaviyo Inc. The company is fighting a suit filed by Qui Nguyen in August 2025, alleging that it tracked his online activity without permission in violation of the
California Invasion Of Privacy Act (CIPA).
But the sides have gained some time to deal with the complicated issues. Late in May, they agreed to delay their “initial alternative
dispute resolution session” by 75 days from June 8 to August 21 in the name of efficiency.
Earlier, the opposing parties had consented to participate in private mediation as an
alternative dispute resolution process, but then determined that “mediation would not be productive at this time.”
From the looks of it, this is likely to end up costing
Klaviyo some money, although not as much as an assessment by a hostile jury. It illustrates what other marketing defendants can expect when sued.
advertisement
advertisement
The lawsuit alleges that
Klaviyo “surreptitiously collects information on the products consumers are browsing and purchasing in real time” without consent.
The complaint
continues, “Klaviyo collects a consumer’s website activity information such as the product name, product price, product category, URL corresponding with the product image, and the
descriptive web page URL.”
Klaviyo then engages in “further data matching by using its identity resolution product whereby Klaviyo creates '360'
customer profiles that [go] way beyond contact info.”
Here’s one more charge: that Klaviyo “utilizes a feature called
‘anonymous visitor activity backfill’ that allows it to correlate previously anonymous Consumer Web Activity with an identified consumer.”
Why is
the company taking these alleged actions?
“The purpose of collecting Consumer Web Activity is simple: to allow Klaviyo to send consumers marketing emails and text
messages,” the complaint states. “Klaviyo’s promotional messages entice consumers to make a purchase based on the products they previously browsed and/or
purchased.”
Now most of this seems like normal marketing activity -- indeed, the information in the complaint seems to come right out of Klaviyo’s own
promotional pieces. And it does not appear that the plaintiff suffered any actual harm, unless you accept that he suffered in the abstract.
In its
answer, Klaviyo denies that it has surreptitiously collected and analyzed Consumer Web Activities. It also filed a motion to dismiss, asserting that the plaintiff had no standing to
pursue a case.
“Here we have a plaintiff who the central recurring thread through all these claims is lack of consent, that plaintiff visited a single website
[everymanjack.com], a single time, allegedly had something intercepted without his consent. There is no allegation he’s going to revisit any website, there’s no allegation he's again even
revisiting EveryManJack or intends to visit any other website.”
But U.S. Judge Eumi K. Lee said, “I will be frank, I think I am most likely
denying the motion to strike as being premature.” Indeed, a month later the judge denied the motion to dismiss, saying, “Plaintiff’s allegations are sufficient to establish he has
standing to seek injunctive relief under CIPA”.
Lee also cited “a risk of continuing collection and use of his existing data.”
Don’t
expect a quick resolution.
The case is on file with the U.S. District Court for the Northern District of California, San Jose Division.