SELAY SHAHPUR LINDSEY SMITH v. ULTA SALON COSMETICS FRAGRANCE INC (2026)

ORDER DENYING MOTION TO DISMISS

Before the Court is Defendant Ulta Salon Cosmetics and Fragrance, Inc.'s Motion to Dismiss. ECF No. 38. Plaintiffs filed a putative class action Complaint against Ulta Salon Cosmetics and Fragrance, Inc., alleging Ulta's advertising e-mails violated the CPA and CEMA, a state statute prohibiting false and deceptive e-mail marketing. Ulta moved to dismiss for lack of specificity, failure to properly plead the claims, preemption of CEMA by a federal statute, and because it alleges CEMA is unconstitutional. As set forth below, Ulta's Motion to Dismiss is denied. The Amended Complaint plausibly pleads the CPA and CEMA claims with sufficient specificity; CEMA is not preempted by federal law; and CEMA does not violate the dormant Commerce Clause.

BACKGROUND

Plaintiffs Selay Shahpur and Lindsey Smith filed a putative class action lawsuit against Ulta Salon Cosmetics and Fragrance, Inc., in Spokane County Superior Court alleging violations of the Washington Commercial Electronic Mail Act (CEMA) and the Washington Consumer Protection Act (CPA). ECF No. 1 at 28-42. Defendants removed the case to the Eastern District of Washington. ECF No. 1. In October 2025, Plaintiffs filed an Amended Complaint. ECF No. 32.

The Amended Complaint describes numerous Ulta e-mails sent between December 2021 and March 2025 purportedly containing false or misleading subject lines. ECF No. 32, ¶¶ 42-79, ECF No. 32-1. Plaintiff Shahpur allegedly received two of those e-mails, including an October 18, 2024 e-mail stating “Your $10 off expires Saturday! [emoji].” ECF No. 32 at 19, ¶ 93. Shahpur also received a February 17, 2025 e-mail with the subject line, “Say bye to $10 off $50 or $20 off $100! [waving emoji].” The body of the e-mail said, “Offer ends Mon. February 17 at 11:59 pm CT.” ECF No. 32 at 20, ¶ 93. As to Plaintiff Smith, the Amended Complaint alleges she received one e-mail dated October 7, 2023, stating “TWO. MORE. DAYS. Get $10 off [heart emoji, bags emoji].” ECF No. 32 at 14, ¶ 64.j.; ECF No. 32 at 20, ¶ 93.

Ulta filed a Motion to Dismiss the Amended Complaint and a Notice of Constitutional Challenge. ECF No. 38, 39. Based on the stipulation of the parties, the Court granted the State of Washington's motion to intervene in the case. ECF No. 47. The Court also stayed discovery during the pendency of this motion. ECF No. 48.

ANALYSIS

1. Sufficiency of the Pleading Under Rule 8

Ulta contends Plaintiffs have not met the requirements of Fed. R. Civ. P. 8(a)(2) by failing to adequately set forth the elements of their claims. Rule 8(a) requires a complaint contain “ ‘a short and plain statement of the claim showing that the pleader is entitled to relief,’ in order to ‘give the defendant fair notice of what the ․ claim is and the grounds upon which it rests.’ ” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955 (2007) (ellipsis in original) (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957)). In short, the requirement is a complaint must “fully set[ ] forth who is being sued, for what relief, and on what theory, with enough detail to guide discovery.” McHenry v. Renne, 84 F.3d 1172, 1177 (9th Cir. 1996).

Ulta contends Plaintiffs failed to plead sufficient concrete facts and the allegations of the Amended Complaint are conclusory. The Court disagrees. The Amended Complaint alleges Ulta “spammed Plaintiffs Shahpur and Smith with commercial e-mails whose subject lines contain false or misleading statements.” ECF No. 32, ¶ 92. It also specifically alleges Ulta sent Plaintiff Shahpur two e-mails: one on October 18, 2024 and one on February 17, 2025; and one e-mail to Plaintiff Smith on October 7, 2023. ECF No. 32, ¶ 93. According to the Amended Complaint, the e-mails received by Shahpur and Smith “were false or misleading in violation of CEMA for misrepresenting the availability and timing of deals” and “those e-mails subject lines contained false statements of fact as to the ‘duration or availability of a promotion.’ ” ECF No. 32, ¶¶ 94, 95. In other words, the Amended Complaint clarifies Ulta's e-mails met the requirements of CEMA because the subject lines created a false sense of urgency based on inaccurate representations regarding the length of promotions. This is sufficient to withstand a challenge under Rule 8.

2. Failure to State a Claim Under Rule 12(b)(6)

Rule 12(b)(6) allows a party to move for dismissal if the plaintiff fails to state a claim upon which relief can be granted. FRCP 12(b)(6). The standard for dismissal under this rule is exacting. When considering a 12(b)(6) motion, the Court accepts the allegations in the complaint as true and construes the pleading in the light most favorable to the party opposing the motion. Lazy Y Ranch Ltd. v. Behrens, 546 F.3d 580, 588 (9th Cir. 2008). A defendant's request for relief under 12(b)(6) will be granted only if there is either a “lack of a cognizable legal theory” or “the absence of sufficient facts alleged under a cognizable legal theory.” Taylor v. Yee, 780 F.3d 928, 935 (9th Cir. 2015); Balistreri v. Pacifica Police Dep't, 901 F.2d 696, 699 (9th Cir. 1990).

a. CEMA Claim

Ulta contends Plaintiffs did not sufficiently plead the elements of their CEMA claim. CEMA provides:

(1) No person may initiate the transmission, conspire with another to initiate the transmission, or assist the transmission, of a commercial electronic mail message from a computer located in Washington or to an electronic mail address that the sender knows, or has reason to know, is held by a Washington resident that ․ (b) Contains false or misleading information in the subject line.

RCW 19.190.020(1). Thus, CEMA requires Plaintiffs to plausibly allege Ulta (1) initiated a commercial e-mail; (2) with a false or misleading subject line; (3) to an address the sender knew or had reason to know was held by a Washington resident. RCW 19.190.020(1)(b). There is no dispute Ulta initiated commercial e-mails. The remaining elements are considered in turn.

i. Knowledge of Residency

Ulta contends the Amended Complaint's allegations about Ulta's knowledge that recipients of its e-mails are Washington residents is “conjecture” and “speculation.” ECF No. 38 at 379-80. “Factual allegations must be enough to raise a right to relief above the speculative level,” Twombly, 550 U.S. at 555 (2007), and a “pleading that offers labels and conclusions or a formulaic recitation of the elements of a cause of action will not do.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 555).

CEMA provides: “For purposes of this section, a person knows that the intended recipient of a commercial electronic mail message is a Washington resident if that information is available, upon request, from the registrant of the internet domain name contained in the recipient's electronic mail address.” RCW 10.190.020(2). The Amended Complaint alleges Ulta knew Plaintiffs and putative class members were Washington residents because “such ‘information is available, upon request, from the registrant of the internet domain name contained in the recipient's electronic mail address.’ ” ECF No. 32, ¶ 111. This allegation, if true, would establish the residence element of CEMA. Plaintiffs' claim does not fail in this regard.

The Amended Complaint also alleges multiple methods by which Ulta could know or have reason to know Plaintiffs and potential class members are Washington residents: (1) Ulta's “sheer volume of e-mail marketing” puts it on notice Washington residents would receive its e-mails; (2) Ulta may obtain location information when consumers purchase from Ulta's website or self-report to Ulta; (3) Ulta may obtain location information by tracking IP addresses of devices used to open e-mails and correlating them to physical locations; (4) Ulta “appears to use” Salesforce Marketing Cloud to manage e-mail marketing campaigns which would allow identification of persons who receive Ulta e-mails and is “likely” able to infer the “general geographic location of e-mail recipients by state” based on their IP addresses; (5) Ulta may obtain location information by purchasing consumer data from commercial data brokers; (6) Ulta may obtain location information by using “identity resolution services” which can connect e-mail addresses to physical location; (7) Ulta may obtain information upon request from the registrant of Internet domain names contained in e-mail address; and (8) Ulta can learn the residence of consumers when they place orders shipping to a certain state or when the customer provides location information when registering an account. ECF No. 32, ¶¶ 82-90. These potential methods of obtaining residence information, if viewed in the light most favorable to Plaintiffs, support the claim Ulta has “reason to know” the residency of the recipients of its marketing e-mails. RCW 19.190.020(1).

ii. False or Misleading Subject Lines

Ulta contends the Amended Complaint fails to plead facts showing the subject lines in the three e-mails they received were false or misleading, so their CEMA claim fails and should be dismissed. For the reasons set forth above, the Court disagrees. The crux of Plaintiffs' claim is Ulta's promotional e-mails were false or misleading because the subject lines said or implied promotions were for a limited time, but the same or similar offers were extended or reinstated. The Amended Complaint therefore alleges sufficient facts to withstand the Motion to Dismiss.

b. Consumer Protection Act Claim

Ulta contends Plaintiffs' CPA claim must be dismissed because the Amended Complaint does not allege all required elements for a CPA claim. This argument fails as a matter of law. By statute, a violation of CEMA is a violation of the CPA. RCW 19.190.030; see Harbers v. Eddie Bauer, LLC, 415 F. Supp. 3d 999, 1003 (W.D. Wash. 2019); State v. Heckel, 143 Wash. 2d 824, 828 (2001). Furthermore, while the CPA requires a showing of damages, the Washington Supreme Court has recognized an e-mail received in violation of CEMA constitutes an injury. Certification from United States Dist. Ct. for W. Dist. of Washington in Brown v. Old Navy, LLC, 4 Wash. 3d 580, 592 (2025) (“the injury is receiving the e-mail that violates CEMA”).¹

3. CAN-SPAM PREEMPTION

Ulta contends Plaintiffs' CEMA claim fails because it is expressly preempted by the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM). 15 U.S.C. §§ 7701-13. A number of courts have considered and rejected this argument. See e.g., Kempf v. Fullbeauty Brands Operations, LLC, 2026 WL 395677 (W.D. Wash. Feb. 12, 2026); Ma v. Nike, Inc., 2026 WL 100731 (W.D. Wash. Jan. 14, 2026); Harrington v. Vineyard Vines, LLC, -- F. Supp. 3d --, 2025 WL 3677479 (W.D. Wash. Dec. 18, 2025); Gordon v. Impulse Mktg. Grp., Inc., 375 F. Supp. 2d 1040, 1045-46 (E.D. Wash. 2005). The Court agrees with these decisions.

Congress enacted CAN-SPAM in 2003 to “curb the negative consequences of spam and spamming practices without stifling legitimate commerce.” Gordon, 375 F. Supp. 2d at 1045. CAN-SPAM expressly allows States to prohibit by “statute, regulation, or rule” either “falsity or deception” in “any portion of a commercial electronic mail message or information attached thereto.” 15 U.S.C. § 7707(b)(1). CEMA's subject-line provision, RCW 19.190.020(1)(b), falls within this exception: it imposes liability for sending a commercial e-mail that “[c]ontains false or misleading information in the subject line” to Washington residents. Id. Because CEMA's subject-line provision applies only to false or misleading information, it is not preempted by CAN-SPAM. See Gordon, 375 F. Supp. 2d at 1045-46; Ferguson v. Quinstreet, Inc., 2008 WL 3166307, at *9 (W.D. Wash. Aug. 5, 2008), aff'd, 348 F. App'x 255 (9th Cir. 2009) (noting “claims actually alleging falsity or deception under CEMA would not be preempted”).

Ulta relies heavily on Gordon v. Virtumundo, Inc., 575 F.3d 1040 (9th Cir. 2009). Virtumundo involved consideration of CEMA preemption based on a different subsection of CEMA. Id. at 1063 (referencing RCW 19.190.020(1)(a)). Virtumundo did not address whether CAN-SPAM preempts the e-mail subject line subsection of CEMA because in that case, the plaintiff “failed to identify or describe any specific e-mail or subject line text” allegedly violating CEMA's subject-line provision. Id. at 1058. Additionally, Virtumundo acknowledged CAN-SPAM legislative intent that “a State law “prohibiting fraudulent or deceptive headers, subject lines, or content in commercial e-mail would not be preempted.” Id. at 1062 (quoting S. Rep. No.108-102, at 21 (2003) (emphasis added)).

The Virtumundo court also acknowledged the construction of CEMA was unsettled at that time and observed, “state courts may ultimately mold CEMA's broad language” to conform to federal legislation. 575 F.3d at 1059. The Washington State Supreme Court recently did so in Brown v. Old Navy, 4. Wash. 3d 580. In Brown, the court noted CEMA's subject line provision does not prevent technical errors or “mere puffery” and held CEMA's subject line provision addresses deceptive “representations of fact – like the duration or availability of a promotion, its terms and nature, the cost of goods, and other facts Washington resident would depend on in making their consumer decisions.” Id. at 595. Ultimately, Virtumundo does not support Ulta's argument for express preemption.

Ulta further argues the “falsity or deception” exception to CAN-SPAM refers to “traditionally tortious or wrongful conduct,” again citing Virtumundo, 575 F.3d at 1062. Ulta argues that Plaintiffs must therefore plead the essential elements of fraud or deceit to complete its CEMA claim: material misrepresentation, reliance, actual injury, or deceptive intent, and that Plaintiffs have not met the heightened particularity requirements for claims alleging fraud or misrepresentation under Rule 9(b). Ulta's argument fails because CEMA does not “sound in fraud.” Gordon, 375 F. Supp. 2d 1048. Furthermore, Congress opted not to use the word “fraud” in crafting the CAN-SPAM exception. The use of the words “falsity or deception” indicates Congress intended the CAN-SPAM exception to apply more broadly than claims of fraud. See Asis Internet Servs. v. Consumerbargaingiveaways, LLC, 622 F. Supp. 2d 935, 942 (N.D. Cal. 2009).

Ulta also argues conflict preemption bars Plaintiffs' CEMA claim. The Court disagrees. There is no obstacle to businesses complying with both CAN-SPAM and CEMA. Furthermore, because CAN-SPAM specifically allows for state regulation of false or deceptive e-mails, Plaintiffs' CEMA claim does not undermine Congress's intent in enacting CAN-SPAM.

4. CONSTITUTIONALITY

Ulta contends CEMA imposes liability whenever the sender knows an address is held by a Washington resident, regardless of where the sender is or transaction occurs, which means CEMA controls commerce occurring wholly outside of Washington. Ulta asserts the practical effect is CEMA applies to any message sent to a Washington resident regardless of physical location, extending CEMA nationwide. According to Ulta, this is a per se violation of the dormant Commerce Clause. ECF No. 38 at 23 (citing Nat'l Collegiate Athletic Ass'n v. Miller, 10 F.3d 633,640) (9th Cir. 1993); ECF No. 49 at 12 (citing Daniels Sharpsmart, Inc. v. Smith, 889 F.3d 608, 614-16 (9th Cir. 2018)).

The dormant Commerce Clause has three “key strands,” Flynt v. Bonta, 131 F.4th 918, 923 (9th Cir. 2025), which involve (i) a non-discrimination principle, (ii) an “extraterritoriality” principle, and (iii) a burden balancing test under Pike v. Bruce Church, Inc., 397 U.S. 137, 90 S.Ct. 844 (1970). The Washington Supreme Court has already held CEMA does not violate the dormant Commerce Clause. Heckel, 143 Wash. 2d at 839 (“In sum, we reject the trial court's conclusion that the Act violates the dormant Commerce Clause.”). There have been no cases or changes of law since Heckel which suggests a different result. See Kempf, 2026 WL 395677, at *5-6. Furthermore, the United State Supreme Court has rejected similar arguments regarding a per se violation of the dormant Commerce Clause. Nat'l Pork Producers Council v. Ross, 598 U.S. 356, 374, 143 S.Ct. 1142 (2023). Nonetheless, the Court considers Ulta's arguments in turn.

a. Non-Discrimination

Ulta first argues CEMA discriminates by providing differential treatment of in-state and out-of-state economic interests, benefiting the in-state interests and burdening the out-of-state interests. According to Ulta, CEMA's resident-triggered liability forces out-of-state competitors to build out Washington-specific segmentation for interstate e-mail campaigns, while retailers operating exclusively in Washington can adopt CEMA as a default rule to avoid retooling costs. Ulta calls this “disparate treatment.” ECF No. 38 at 21. Yet, implicit in the argument is in-state and out-of-state retailers must all comply with CEMA when e-mailing Washington residents. See Heckel, 143 Wash. 2d at 833 (“The Act applies evenhandedly to in-state and out-of-state spammers”); Kempf, 2026 WL 395677, at *6 (“Regardless of where the sender is located ․ the sender faces potential liability). Further, in expressly giving the states the right to regulate false and misleading e-mail transmissions, Congress was apparently satisfied state legislation would not impose an undue burden on interstate commerce. This argument is not persuasive.

b. Extraterritoriality

Next, Ulta argues CEMA improperly controls commerce occurring wholly outside of Washington in violation of the extraterritoriality principle. In support, Ulta poses a hypothetical: from its headquarters in Illinois, Ulta could e-mail a Washington resident away at college in California. The transaction would occur completely outside of Washington, yet CEMA would govern it. According to Ulta, this shows there is no neutral in-state standard and is direct regulation of out-of-state marketing in violation of the dormant Commerce Clause, with Washington's rules effectively exported into every other state. However, Ulta's hypothetical ignores that CEMA regulates activities targeting Washington residents, who remain Washington residents even if they are temporarily out of state.

Further, the Supreme Court has acknowledged “[i]n our interconnected national marketplace, many (maybe most) state laws have the ‘practical effect of controlling’ extraterritorial behavior.” Nat'l Pork Producers, 598 U.S. at 374. A rule against such laws would “cast a shadow over laws long understood to represent valid exercises of the States' constitutionally reserved powers” and would “invite endless litigation and inconsistent results.” Id. at 375.

c. Pike Burden Analysis

Third, Ulta contends CEMA violates the dormant Commerce Clause because it creates a lack of national uniformity which impedes the flow of interstate goods. Under the Pike balancing analysis, “[s]tate laws that regulate even-handedly to effectuate a legitimate local public interest ․ will be upheld unless the burden imposed on such commerce is clearly excessive in relation to the putative local benefits.” See Flynt, 131 F.4th at 925 (internal quotations and citations omitted). However, a plaintiff must first “demonstrate that a challenged law imposes a ‘substantial’ or ‘significant’ burden on interstate commerce before Pike balancing can occur.” Id.

According to Ulta, CEMA's subject line requirements impose burdens in states outside of Washington for a minimal local benefit, forcing companies like Ulta to investigate regulatory schemes state by state and then eliminate e-mail addresses for Washington residents to circumvent penalties. However, increased costs to comply with state regulation alone do not suffice to establish a substantial burden on interstate commerce. Nat'l Pork Producers, 6 F.4th at 1032; Ward v. United Airlines, Inc., 986 F.3d 1234, 1241-42 (9th Cir. 2021). Ulta has identified no substantial or significant burden on interstate commerce under CEMA; the Court need not weigh the local public interests against the burden imposed on commerce.

Accordingly, IT IS ORDERED:

1. Ulta's Motion to Dismiss, ECF No. 38, is DENIED. The Amended Complaint meets plausibility and specificity requirements. CEMA is not preempted by CAN-SPAM and does not violate the dormant Commerce Clause.

2. The Court's order staying discovery, ECF No. 48, is LIFTED.

3. The Court will issue a notice setting a scheduling conference by separate filing.

IT IS SO ORDERED. The District Court Executive is directed to file this Order and provide copies to counsel.

FOOTNOTES

1.   In Brown v. Old Navy, LLC, a federal district court certified the following question to the Washington State Supreme Court: “Does RCW 19.190.020(1)(b) prohibit the transmission of a commercial e-mail with a subject line containing any false or misleading information, or is the prohibition limited to subject lines containing false or misleading information about the commercial nature of the email message?” 2023 WL 12071921 (W.D. Wash. Nov. 29, 2023) (emphasis in original). The Washington Supreme Court held the statute prohibits sending Washington residents commercial e-mails containing any false or misleading information in the subject lines. 4 Wash. 3d at 596.

REBECCA L. PENNELL UNITED STATES DISTRICT JUDGE