Beverly Hills Trial Attorneys and CIPA: Inside Azar Mouzari’s Website Privacy Litigation

A review of complaints and docket records involving Champion, Vuori, REI, Nespresso and other businesses shows the firm’s website-tracking claims, the outcomes that can be verified, and the legal questions that remain. If you’ve received a data privacy lawsuit from Beverly Hills Trial Attorneys let our data privacy software engineering team remediate your website with our software tools that lower the probability of receiving a demand letter for a privacy violation. So get help and protect against CIPA litigation and claims by using Captain Compliance’s software. 

On October 20, 2026, Beverly Hills Trial Attorneys lawyers Azar Mouzari and Nilofar Nouri filed a privacy complaint against ABG-Champion LLC concerning activity on champion.com. The pleading lists claims under California’s wiretapping provision, Penal Code §631(a), as well as intrusion upon seclusion and invasion of privacy under the California Constitution. It alleges that website communications reached outside technology vendors before meaningful consent.

That recent complaint is part of a broader set of website-privacy cases associated with the Beverly Hills firm. Earlier filings against retailers and restaurant businesses frequently centered on a different provision of the California Invasion of Privacy Act, or CIPA: §638.51, which governs pen registers and trap-and-trace devices.

The distinction is especially relevant after California enacted SB 690, which will restrict private enforcement of certain online §638.51 claims beginning January 1, 2027. Businesses evaluating a demand or lawsuit from the firm need to identify the actual causes of action and the operative complaint. A defense aimed at the pen-register theory does not, by itself, answer a separately pleaded wiretapping or intrusion claim.

Below is what the top of a demand letter or CIPA notice might look like:

Azar Mouzari and Nilofar Nouri: the attorneys on the pleadings

Mouzari is the founder and principal of Beverly Hills Trial Attorneys. According to her Beverly Hills Bar Association biography, she graduated summa cum laude from the University of Ottawa’s law school in 2007 and subsequently clerked for Justice Marshall Rothstein of the Supreme Court of Canada. Her prior litigation positions included Gibson, Dunn & Crutcher and Irell & Manella.

The firm’s website also describes her undergraduate background in electrical engineering and research involving satellite communications. Nouri’s biography identifies her as a Pepperdine University School of Law graduate with a dispute-resolution certificate from the Straus Institute. It describes earlier work in insurance defense and at BARBRI before she joined the firm’s civil litigation practice.

California’s State Bar lists both Mouzari, bar number 263461, and Nouri, bar number 311871, as active. Mouzari was admitted in 2009; Nouri was admitted in 2016. Both attorneys are named on the publicly reproduced Champion complaint and several of the earlier CIPA pleadings reviewed for this article.

The earlier website claims focused on collection at page load

A December 1, 2025 complaint against Bloomingdales.com, LLC provides an example of the earlier pleading approach. Filed for Armin Matisen, it alleges that tracking technologies activated when a visitor loaded the website, captured browsing activity and transmitted information without the necessary consent or authorization. Its caption identifies §638.51, while the introduction also invokes §§631(a) and 632.7.

The complaint’s technology descriptions include pixels, scripts, software development kits, session-replay tools, cookies and fingerprinting code. Its allegations encompass URLs, search queries and interaction data. These are allegations in the pleading, rather than independently established findings about the website. The complaint’s existence and filing date were verified; a later disposition of that particular action was not established in the sources reviewed.

The timing allegation gives the claims their operational focus. A business may disclose analytics or advertising in a privacy notice while a claimant alleges that transmission occurred before the visitor could see or accept that disclosure. Resolving that dispute requires evidence of execution and transmission, not simply a copy of the policy. The same review must establish which technologies actually ran; a list of tools in a complaint is not a substitute for that investigation.

Past cases, contested proceedings and the latest filing

The following state-court matters illustrate the firm’s privacy litigation. The entries distinguish an entered dismissal from a pending pleading dispute. They also identify where the publicly available record stops, rather than treating a scheduled hearing as a verified decision.

Armin Matisen is the named plaintiff in seven of the eight state privacy matters discussed here, including the Bloomingdales.com filing. Nasrin Khodadadian brought the Nespresso action. The repeated names establish a recurring plaintiff-and-counsel combination in this selection; they do not establish the plaintiffs’ motives, the validity of the claims or the firm’s total filing volume.

What the completed cases actually establish

The Vuori docket records an entered dismissal with prejudice on June 16, 2026. It also refers to conditional-settlement proceedings. The available material does not establish a payment amount or provide the complete settlement terms. Describing this as a disclosed damages award would go beyond the record.

The REI matter likewise ended with an entered dismissal with prejudice, on August 13, 2026. The Burger Lounge action ended differently: the plaintiff requested dismissal without prejudice, which the docket records as entered on June 30, 2026.

Those distinctions belong in any assessment of the firm’s track record. A requested dismissal does not explain, by itself, whether money changed hands, why the plaintiff stopped pursuing the action, or whether the defendant’s tracking practices were lawful. None of these disposition entries supplies a trial finding that the business violated CIPA. They also do not establish a judicial rejection of the underlying website-tracking theory.

The contested cases include amended complaints and procedural defenses

In Khodadadian’s original Nespresso complaint, the plaintiff alleged that tracking tools intercepted and transmitted website communications before consent. The subsequent docket is more informative than the original allegations alone: Nespresso filed a motion to quash service or, alternatively, stay proceedings; the plaintiff filed an amended complaint and opposition on August 26, 2026; and a September 4 stipulation and order addressed withdrawal of a motion and adjournment of the case management conference. That sequence does not establish a merits victory for either side.

In the Levi Strauss case, an amended complaint was filed on August 17, followed by the defendant’s September 15 demurrer. A demurrer challenges the legal sufficiency of a pleading. The docket listed an October 22 hearing, but the entered ruling and any later disposition were not available for verification in this review. The case therefore should not be described here as either a confirmed plaintiff win or a confirmed final defense judgment.

The Brinker case also developed beyond its original complaint. The available docket records an amended complaint and opposition to a motion to quash on September 16, 2026. It then records the removal of scheduled motion hearings from the calendar and a stipulated continuation of the case management conference to November 24. Taking a motion off calendar is a procedural event, not a finding that the original allegations were proved.

For a company comparing its own demand with these cases, the operative complaint is essential. An introductory paragraph from an original filing may not describe the claims being litigated after amendment. The records reviewed establish that amendments occurred; this article does not assume that every original cause of action remained unchanged.

SB 690 changes the pen-register route beginning in 2027

Governor Gavin Newsom signed SB 690 on September 30, 2026. The chaptered legislation amends §637.2, CIPA’s civil-remedies provision. Beginning January 1, 2027, an action under that section against a private actor for a §638.51 violation arising from conduct on a website, online application or mobile application may be brought only by the Attorney General. The January effective date follows California’s ordinary rule for regular-session statutes.

The amendment expressly reaches qualifying pending claims in actions commenced within the two years before its operative date. That makes the dates of these 2025 and 2026 filings relevant if claims remain pending when the provision becomes operative. Counsel must assess that language against the particular action and its current pleadings. The amendment does not eliminate private §631 claims or automatically dispose of separately pleaded common-law and constitutional privacy claims.

The October 20 Champion complaint illustrates the distinction: its listed causes of action are §631(a), intrusion upon seclusion and California constitutional privacy, rather than a standalone §638.51 count. That is an observable difference from several earlier captions. The public documents do not establish counsel’s reason for choosing those claims. They do show why businesses should review the legal theories actually pleaded instead of assuming that reform of one CIPA provision ends the dispute.

The legal theories require different evidence

Under the statutory definitions, pen-register and trap-and-trace processes concern dialing, routing, addressing or signaling information, excluding communication contents. That is different from a theory that a third party learned the substance of a message. A pleading that mentions both IP addresses and search terms raises different questions about what each transmission contained and which provision could apply.

Section 638.51 also contains exceptions for specified uses by communications-service providers, including where the service user’s consent has been obtained. A complaint’s reference to the absence of a court order should therefore be evaluated alongside the statutory exceptions and the facts relevant to them. The statute does not make every routine network transmission unlawful merely because the business lacks a court order.

The §631(a) language includes unauthorized connections, learning communication contents while in transit, use of information unlawfully obtained and assistance with prohibited conduct. For a website claim, a useful investigation identifies the alleged communication, its recipient, the point at which the recipient obtained it and the consent asserted to authorize that access. The presence of a familiar analytics brand does not resolve those questions.

Some earlier complaints also invoke §632.7, which expressly describes communications between specified combinations of cellular, cordless and landline telephones. Its applicability to the alleged communication requires its own analysis. Describing an interaction as wireless or involving a mobile device does not establish that every element of the provision is met.

Common-law intrusion has separate requirements. In Hernandez v. Hillsides, the California Supreme Court explained that the tort requires an intentional intrusion into a matter in which the plaintiff reasonably expects privacy, carried out in a manner highly offensive to a reasonable person. That general legal standard is relevant to the Champion pleading; it is not a ruling in that case. What the website collected, the sensitivity of the information, the disclosures and the surrounding circumstances remain important.

The damages provision helps explain the financial stakes. Section 637.2 authorizes the greater of $5,000 per violation or three times actual damages and states that actual damages are not a necessary prerequisite. Liability still must be established under the applicable law. The existence of multiple tags, requests or page views does not establish that each is an independently compensable violation, and no such multiplication should be presented as a verified award in these cases.

The firm’s broader consumer docket includes TCPA cases

Related consumer-privacy research can also surface claims under the Telephone Consumer Protection Act. In Khodadadian v. The Gap, Inc., No. 2:26-cv-05945, the Central District of California docket identifies Mouzari and Nouri as plaintiff’s counsel. The action was filed June 2, 2026, and the publicly reproduced docket records a July 24 notice of settlement. It does not disclose a settlement amount.

In Matisen v. Nowhere Holdco, LLC, No. 2:26-cv-06499, the available federal docket likewise identifies a TCPA action and both attorneys. The defendant filed an answer on August 4, 2026, and an August 5 entry scheduled a September conference. The reproduced docket stops at that point, so it does not establish the case’s disposition as of this article’s research date.

These are separate from the CIPA website cases. Their inclusion shows another part of the firm’s consumer practice without treating telephone-marketing claims, website interception claims and ordinary consumer-product litigation as interchangeable.

The practical response begins with the website evidence

A business receiving a demand from Beverly Hills Trial Attorneys should first establish what the demand actually alleges: the date and location of the visit, the particular page, the technology identified and the legal provision invoked. Preserve the relevant website and tag-manager versions, consent configuration, vendor settings and available logs. Work with counsel to preserve evidence while addressing any ongoing collection problem.

Technical review should compare a fresh visit before any choice with visits after acceptance, rejection and withdrawal where applicable. Record the requests sent, their destinations and the relevant payload fields. A consent log can establish that a choice was recorded; it does not establish, by itself, that every script followed it. Likewise, a scanner’s detection of a vendor does not establish that the vendor received the particular communication alleged in a complaint.

The content of a request deserves as much attention as the cookie inventory. A page URL can contain a search term or another value that changes what the recipient learns. A replay or form-analysis tool may receive interaction details that are absent from a simple list of cookies. Where collection continues through a company’s own endpoint, review any onward server-side transfers as well; a browser capture alone may not reveal them.

Configuration history matters because the relevant question often concerns an earlier visit. Testing today’s deployment can identify current problems and support remediation, but it does not reconstruct a past configuration automatically. Retaining dated scan results, consent records, published notices and change history gives legal and engineering teams a firmer basis for evaluating the allegation.

Captain Compliance’s monitoring tools, consent controls and supporting records can help teams carry out that work. Their purpose is to identify collection, apply the required settings and document behavior over time. The legal assessment still depends on the claim and the evidence. As this firm’s public docket shows, an older pen-register complaint, an amended wiretapping claim and an entered dismissal call for different responses.

Below is a list of common Data Privacy and ADA plaintiffs