CIPA Cases: Rulings, Settlements & Deep Dives

Atrium Health agreed to pay $1.8 million after tracking pixels on its websites and patient portals allegedly shared patients’ information with third parties like Meta. What sets this case apart is where and how it was brought — a North Carolina state court, under HIPAA and state privacy law, with no CIPA in sight. It’s proof the pixel theory doesn’t need California to work.

A hospital system agreed to pay $1.76 million after tracking pixels on its website and MyChart patient portal allegedly sent patients’ information to Meta and Google. The portal patients trusted to be private was running the same ad trackers as a retail checkout — and that’s the whole lesson.

Forbes agreed to a $10 million settlement over three ordinary advertising trackers on its websites — not for a data breach, but for a California wiretap theory that treats those trackers as illegal “pen registers.” It’s one of the last major private settlements of its kind before California’s SB 690 rewrites who can bring the claim.

An online children’s-clothing store gets sued over the five advertising trackers running on its checkout — Meta, Google, TikTok, Klaviyo, and AppLovin — under five different privacy laws at once. There is nothing exotic about this storefront, and that’s exactly why every direct-to-consumer brand should read the complaint.

Most tracking-pixel cases come from private plaintiffs. This one came from the federal government. The FTC — joined by Utah and Los Angeles County — sued Hims & Hers over pixels that allegedly shared patients’ sexual-health, mental-health, and weight-loss information with advertising platforms. It’s a reminder that pre-consent tracking isn’t only a lawsuit risk; it’s an enforcement risk, and the stakes climb sharply when the data is health data.

An AI note-taking app that quietly captures a meeting — with no bot visible in the participant list — is now facing a wiretap lawsuit for recording people who never agreed to be recorded. It’s the clearest sign yet that the “capture before consent” theory driving website litigation is jumping to AI tools.

A CIPA class action claims Toyota.com kept tracking visitors — through fingerprinting — even after they clicked “Decline” on the cookie banner. It’s the clearest test yet of a simple promise: that saying no actually stops the tracking. Here’s the theory, why fingerprinting makes the “decline” button so dangerous, and what the case signals for every site running a consent banner.

A CIPA class action says NFL.com deployed 182 third-party trackers before a visitor could make any choice — and kept 186 running after opt-out, including canvas fingerprinting and a session recorder that allegedly captured keystrokes. It’s the most detailed “your opt-out did nothing” complaint of 2026. Here’s what forensic testing claims to have found, the legal theory behind it, and what it signals for every site with a consent banner.

The period-tracking case that produced two results at once: a $59.5M settlement from Google, Flo, and Flurry — and, against the one defendant that refused to settle, the first major CIPA jury verdict in the statute’s history, finding Meta liable for capturing women’s reproductive-health data without consent. Here’s how in-app data reached advertisers, both tracks of the outcome, and why every operator collecting sensitive data should read it.

One of Georgia’s largest health systems agreed to a $4.25M settlement after a class action alleged that Meta Pixel and Google tracking tools on its website and MyChart patient portal quietly transmitted roughly 870,000 patients’ health activity to advertisers. Here’s exactly how a patient portal leaks data, the theory that made it actionable, and what every operator — healthcare or not — should take from it.

GoodRx is the case that broadens the story beyond hospitals — and it is really two separate matters that are easy to confuse. One is a landmark $1.5 million FTC enforcement action, the first ever under the Health Breach Notification Rule, and it is final. The other is a private class action with a much larger headline number that a federal court has repeatedly declined to approve. Keeping them apart is the whole point.

Advocate Aurora Health paid $12.25 million to settle a consolidated class action covering roughly 2.5 million patients — one of the largest exposed populations in the healthcare pixel wave. And it began in an unusual way: not with a plaintiff’s discovery, but with the health system reporting the problem on itself to federal regulators.

Before “pixel litigation” was a category anyone tracked, Mass General Brigham paid $18.4 million to settle a class action over cookies and tracking pixels on its public informational websites. Finalised in early 2022, it was one of the first eight-figure healthcare tracking settlements — the case that showed the plaintiffs’ bar this theory could command serious money.

Inova Health agreed to a $3.15 million settlement over Meta and Google pixels on its public-facing websites — but the reason this case matters isn’t the number. It’s the law. The surviving claim was brought under the federal Electronic Communications Privacy Act (ECPA), and it cleared a motion to dismiss on a theory that reaches straight into HIPAA.

Penn Medicine agreed to a settlement of up to $9.5 million over Meta and Google tracking pixels on its myPennMedicine patient portal — and the claim wasn’t brought under California’s CIPA. It was brought under Pennsylvania’s own wiretap statute. This case is the clearest proof yet that pixel-as-wiretap theory is not a California problem.

BetterHelp is the case that put the most sensitive data of all — mental-health therapy information — at the centre of a federal enforcement action. The online-counseling firm paid $7.8 million to settle FTC charges that it shared what users disclosed while seeking therapy with Facebook, Snapchat, and other advertisers, after promising to keep it private.

A New York federal judge refused to dismiss a CIPA pen-register class action over the adtech trackers on CNN.com — and it was the second time the same judge told CNN the case could proceed. Where Rounds v. DDI shows how these claims die, D’Antonio shows how they survive.

A California federal judge refused to dismiss a CIPA pen-register class action over the TikTok and Microsoft Bing pixels on adidas.com — and delivered the lesson most sites still haven’t learned: privacy-policy links buried in your footer are not consent. This is the case that makes a real cookie banner non-negotiable.

The Ninth Circuit revived a CIPA wiretapping class action over the session-replay code on bloomingdales.com — rejecting the “record data” defense that had killed the case below — and five months later, Bloomingdale’s settled. It is the clearest arc in the whole tracker: survive dismissal, and you pay.

Meta lost the argument that it doesn’t “use” its own Pixel — then won the case anyway, on procedure. In March 2026 a federal court denied class certification after plaintiffs broadened their class definition and ran into CIPA’s one-year statute of limitations. It’s the most instructive defense win of the year, and the most dangerous one to misread.

Sutter Health paid $21.5 million over Google Analytics and the Meta Pixel running on a patient-portal login page. Nothing was tracked inside the portal. No usernames or passwords were shared. One page, before anyone logged in — and it produced one of the largest website-tracking settlements in US healthcare.

The difference between session cookies vs persistent cookies comes down to one thing: how long they live. But that single distinction decides whether a cookie needs consent, how it’s regulated, and whether it puts your website at legal risk. This guide explains both types clearly — plus how sessions differ from cookies, how to view them in Chrome, and the tools that scan and audit them.

European Wax Center agreed to pay $5 million to settle claims that its website ran the Meta Pixel, Attentive, LinkedIn, and Snap trackers — disclosing visitor data to advertising partners without consent. It’s a settlement, not a ruling, and that’s exactly what makes it a warning: the tracking stack that triggered it is running on thousands of ordinary business websites right now.

A federal court let both a CIPA §631 wiretap claim and a federal Wiretap Act claim survive dismissal against a telehealth provider — because the site relied on browsewrap consent that the court found inadequate. It’s one of 2026’s clearest warnings that a passive “notice on the page” is not consent.