Massachusetts Court Enforces Choice-of-Law Provision to Dismiss California Website Tracking Privacy Class Action

A Massachusetts Superior Court Business Litigation Session (“BLS”) recently dismissed a putative privacy class action against Tripadvisor arising from alleged website tracking, holding that the plaintiff was bound by a choice-of-law provision selecting Massachusetts law. In D’Antonio v. Tripadvisor, LLC, the California plaintiff asserted claims under the California Invasion of Privacy Act (“CIPA”), alleging that a third-party tracker collected IP addresses and other identifiers from users of Tripadvisor’s website. The court held that Tripadvisor’s Terms of Use formed an enforceable contract and that the parties’ choice-of-law provision governed the dispute. Because the plaintiff acknowledged that his claims could not proceed under Massachusetts law, the court dismissed the action.

The decision is significant for Massachusetts businesses facing an influx of website tracking litigation based on California statutes. Like Vita v. New England Baptist Hospital, D’Antonio reflects scrutiny of efforts to extend state wiretapping statutes to commonplace website technologies. It also demonstrates that a well-designed online assent process and Massachusetts choice-of-law provision can provide important defenses to out-of-state privacy claims.

Background

The plaintiff, a California resident, alleged that Tripadvisor caused a third-party tracker to be installed on users’ web browsers. According to the complaint, the tracker collected IP addresses, device metadata, and unique identifiers linked to consumer profiles. The plaintiff alleged that this conduct violated CIPA Section 638.51(a), which regulates the installation or use of pen registers and trap-and-trace devices. He also asserted an unjust enrichment claim.

The plaintiff registered for a Tripadvisor account in July 2024. During registration, Tripadvisor twice displayed language stating that “by proceeding” the user agreed to its Terms of Use and Privacy and Cookie Statement, with hyperlinks to each. The Terms contained a Massachusetts forum-selection clause and a choice-of-law provision applying Massachusetts law to all disputes relating to the agreement. Tripadvisor’s Privacy and Cookie Statement also disclosed the collection, sharing, and sale of IP addresses and other identifiers.

The plaintiff initially sued in California Superior Court. That court dismissed the action after enforcing Tripadvisor’s Massachusetts forum-selection clause. The plaintiff then refiled his claims in Massachusetts.

The Court Enforced Tripadvisor’s Terms of Use

The BLS first held that the California court’s contract-formation ruling had preclusive effect. Although the California court addressed Tripadvisor’s forum-selection clause, that determination required it to decide whether the plaintiff had entered into a binding contract incorporating the Terms of Use. The plaintiff therefore could not relitigate contract formation when challenging a different provision in the same Terms.

The court also independently considered whether the Terms were enforceable under Massachusetts law and reached the same conclusion. Applying the SJC’s framework for online contract formation, the court examined whether Tripadvisor provided reasonable notice and whether the plaintiff reasonably manifested assent.

Tripadvisor’s registration process presented a closer question than other online contracting procedures Massachusetts courts have upheld. Tripadvisor did not require the plaintiff to open the Terms or check a box expressly confirming his agreement. The BLS observed: “Tripadvisor could have provided Plaintiff more conspicuous notice of its contract terms, by using larger font size, as sharply contrasted to the background as other text on the page, and disclosing those terms above rather than below the buttons that a user clicks to continue.” But the registration interface was uncluttered, hyperlinks to the Terms appeared on the same screen, and the plaintiff twice clicked to proceed after being told that doing so constituted agreement to the Terms. The court found those circumstances sufficient to establish reasonable notice and assent.

Massachusetts Law Governed the Plaintiff’s Claims

The plaintiff argued that the Massachusetts choice-of-law provision should not apply because California has a fundamental policy of protecting its residents’ privacy. The court rejected that argument.

Massachusetts had a substantial relationship to the dispute because Tripadvisor is headquartered there. The court also concluded that California did not have a materially greater interest than the parties’ chosen law. Although the plaintiff registered in California, Tripadvisor provided services from Massachusetts.

The court further rejected the contention that applying Massachusetts law would violate a fundamental California policy. Both states regulate unauthorized interception of communications, and the court found no material divergence between their laws concerning consent.

Because Massachusetts law governed, the plaintiff conceded his claims could not proceed. The court therefore dismissed the complaint and found amendment futile. Notably, the court did not decide whether the alleged tracking technology constituted a pen register or trap-and-trace device under CIPA or whether the complaint stated a viable CIPA claim.

Key Takeaways for Defendants

The decision has implications beyond the particular theory asserted in D’Antonio.

• Massachusetts choice-of-law provisions can provide a significant defense to out-of-state privacy claims. The court’s careful analysis prevented an attempt to circumvent the parties’ contractual selection of Massachusetts law by asserting a California statutory claim. Massachusetts businesses should consider whether existing choice-of-law provisions provide an early defense when plaintiffs invoke another state’s privacy statutes.
• Online assent procedures matter. A choice-of-law provision provides little protection if the underlying contract was not properly formed. Companies should review registration and account-creation flows to ensure users receive clear notice, view conspicuous hyperlinks, and take affirmative action clearly connected to assent.
• California privacy litigation increasingly has consequences outside California. California plaintiffs are bringing CIPA claims in Massachusetts and other jurisdictions due to forum-selection provisions and jurisdictional considerations. The resulting litigation illustrates the national consequences of California’s expansive statutory privacy regime.
• The decision does not eliminate CIPA risk for Massachusetts businesses. D’Antonio depends on a properly formed contract containing an enforceable Massachusetts choice-of-law provision. Companies without these protections may remain exposed to CIPA claims by out-of-state users. In addition, even if California Senate Bill 690 is signed into law and retroactively eliminates a private right of action for certain CIPA claims, litigation risk outside California is likely to persist because Section 631—which prohibits interception—is unaffected.

D’Antonio is an important and well-reasoned result for Massachusetts businesses confronting the expanding wave of website wiretapping litigation. But its holding depends on its contractual setting. The effect of choice-of-law provisions as a defense to CIPA claims warrants continued attention as California plaintiffs increasingly pursue CIPA theories outside California.