FILED

NOT FOR PUBLICATION

JUN 20 2025

UNITED STATES COURT OF APPEALS MOLLY C. DWYER, CLERK

U.S. COURT OF APPEALS

FOR THE NINTH CIRCUIT ERICA MIKULSKY, individually and on No. 24-3564 behalf of all others similarly situated,

D.C. No.

Plaintiff-Appellant, 3:23-cv-00425-L-VET v.

MEMORANDUM* BLOOMINGDALE'S, LLC; BLOOMINGDALES.COM, LLC,

Defendants - Appellees. ERICA MIKULSKY, No. 24-3837

Plaintiff-Appellee, D.C. No.

3:23-cv-00425-L-VET v. BLOOMINGDALES.COM, LLC; BLOOMINGDALE’S, LLC,

Defendants - Appellants.

Appeal from the United States District Court

for the Southern District of California

M. James Lorenz, District Judge, Presiding

Argued and Submitted June 10, 2025

*

This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3.

Pasadena, California Before: BYBEE, IKUTA, and FORREST, Circuit Judges.

Erica Mikulsky appeals the district court’s order granting the motion of Bloomingdale’s, LLC and Bloomingdales.com, LLC (Defendants) to dismiss her second amended complaint for failure to state a claim under Rule 12(b)(6) of the Federal Rules of Civil Procedure. Defendants appeal the district court’s order denying their motion to dismiss for lack of personal jurisdiction. We have jurisdiction over the district court’s final order pursuant to 28 U.S.C. § 1291.

The district court did not err in denying the motion to dismiss for lack of personal jurisdiction. See Briskin v. Shopify, Inc., 135 F.4th 739, 751, 756 (9th Cir. 2025) (en banc). As alleged, Defendants’ website “appeals to, and profits from, an audience in” California, id. at 754 (quoting Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1231 (9th Cir. 2011)), and is used to collect information intentionally from users, knowing that privacy harms will be suffered in California, see id. at 756. Mikulsky’s alleged privacy injuries arise out of or relate to the website’s contacts with California, and Defendants have not shown that the exercise of jurisdiction over it would be unreasonable. Id. at 750–51. Therefore, Defendants are subject to personal jurisdiction in California. It was not an error to exercise jurisdiction over both Defendants where each was alleged to have engaged

2 in the same conduct and the allegations in the complaint were alleged collectively. See United States v. United Healthcare Ins. Co., 848 F.3d 1161, 1184 (9th Cir. 2016); Briskin, 135 F.4th at 762.

The district court erred in dismissing Mikulsky’s claim under the California Invasion of Privacy Act, section 631(a) of the California Penal Code. The complaint stated sufficient facts to allege that Defendants aided, agreed with, employed, or conspired with Session Replay Code providers to enable the providers to read, attempt to read, or to learn “the contents or meaning of any message, report, or communication while the same [was] in transit or passing over any wire, line, or cable, or [was] being sent from, or received at any place within this state,” without the consent of all parties. Cal. Penal Code § 631(a). The complaint alleged real-time capture of the contents of Mikulsky’s communications on Defendants’ website without her consent, not merely the real-time capture of information regarding the characteristics of the communications.

The district court properly dismissed Mikulsky’s claim for intrusion upon seclusion. Mikulsky failed to plead a “highly offensive” violation under California common law. See Hernandez v. Hillsides, Inc., 211 P.3d 1063, 1073 (Cal. 2009).

AFFIRMED IN PART AND REVERSED IN PART.

3