CIPA Cases: Rulings, Settlements & Deep Dives

A CIPA class action claims Toyota.com kept tracking visitors — through fingerprinting — even after they clicked “Decline” on the cookie banner. It’s the clearest test yet of a simple promise: that saying no actually stops the tracking. Here’s the theory, why fingerprinting makes the “decline” button so dangerous, and what the case signals for every site running a consent banner.

A CIPA class action says NFL.com deployed 182 third-party trackers before a visitor could make any choice — and kept 186 running after opt-out, including canvas fingerprinting and a session recorder that allegedly captured keystrokes. It’s the most detailed “your opt-out did nothing” complaint of 2026. Here’s what forensic testing claims to have found, the legal theory behind it, and what it signals for every site with a consent banner.

The period-tracking case that produced two results at once: a $59.5M settlement from Google, Flo, and Flurry — and, against the one defendant that refused to settle, the first major CIPA jury verdict in the statute’s history, finding Meta liable for capturing women’s reproductive-health data without consent. Here’s how in-app data reached advertisers, both tracks of the outcome, and why every operator collecting sensitive data should read it.

One of Georgia’s largest health systems agreed to a $4.25M settlement after a class action alleged that Meta Pixel and Google tracking tools on its website and MyChart patient portal quietly transmitted roughly 870,000 patients’ health activity to advertisers. Here’s exactly how a patient portal leaks data, the theory that made it actionable, and what every operator — healthcare or not — should take from it.

GoodRx is the case that broadens the story beyond hospitals — and it is really two separate matters that are easy to confuse. One is a landmark $1.5 million FTC enforcement action, the first ever under the Health Breach Notification Rule, and it is final. The other is a private class action with a much larger headline number that a federal court has repeatedly declined to approve. Keeping them apart is the whole point.

Advocate Aurora Health paid $12.25 million to settle a consolidated class action covering roughly 2.5 million patients — one of the largest exposed populations in the healthcare pixel wave. And it began in an unusual way: not with a plaintiff’s discovery, but with the health system reporting the problem on itself to federal regulators.

Before “pixel litigation” was a category anyone tracked, Mass General Brigham paid $18.4 million to settle a class action over cookies and tracking pixels on its public informational websites. Finalised in early 2022, it was one of the first eight-figure healthcare tracking settlements — the case that showed the plaintiffs’ bar this theory could command serious money.

Inova Health agreed to a $3.15 million settlement over Meta and Google pixels on its public-facing websites — but the reason this case matters isn’t the number. It’s the law. The surviving claim was brought under the federal Electronic Communications Privacy Act (ECPA), and it cleared a motion to dismiss on a theory that reaches straight into HIPAA.

Penn Medicine agreed to a settlement of up to $9.5 million over Meta and Google tracking pixels on its myPennMedicine patient portal — and the claim wasn’t brought under California’s CIPA. It was brought under Pennsylvania’s own wiretap statute. This case is the clearest proof yet that pixel-as-wiretap theory is not a California problem.

BetterHelp is the case that put the most sensitive data of all — mental-health therapy information — at the centre of a federal enforcement action. The online-counseling firm paid $7.8 million to settle FTC charges that it shared what users disclosed while seeking therapy with Facebook, Snapchat, and other advertisers, after promising to keep it private.

A New York federal judge refused to dismiss a CIPA pen-register class action over the adtech trackers on CNN.com — and it was the second time the same judge told CNN the case could proceed. Where Rounds v. DDI shows how these claims die, D’Antonio shows how they survive.

A California federal judge refused to dismiss a CIPA pen-register class action over the TikTok and Microsoft Bing pixels on adidas.com — and delivered the lesson most sites still haven’t learned: privacy-policy links buried in your footer are not consent. This is the case that makes a real cookie banner non-negotiable.

The Ninth Circuit revived a CIPA wiretapping class action over the session-replay code on bloomingdales.com — rejecting the “record data” defense that had killed the case below — and five months later, Bloomingdale’s settled. It is the clearest arc in the whole tracker: survive dismissal, and you pay.

Meta lost the argument that it doesn’t “use” its own Pixel — then won the case anyway, on procedure. In March 2026 a federal court denied class certification after plaintiffs broadened their class definition and ran into CIPA’s one-year statute of limitations. It’s the most instructive defense win of the year, and the most dangerous one to misread.

Sutter Health paid $21.5 million over Google Analytics and the Meta Pixel running on a patient-portal login page. Nothing was tracked inside the portal. No usernames or passwords were shared. One page, before anyone logged in — and it produced one of the largest website-tracking settlements in US healthcare.

The difference between session cookies vs persistent cookies comes down to one thing: how long they live. But that single distinction decides whether a cookie needs consent, how it’s regulated, and whether it puts your website at legal risk. This guide explains both types clearly — plus how sessions differ from cookies, how to view them in Chrome, and the tools that scan and audit them.

European Wax Center agreed to pay $5 million to settle claims that its website ran the Meta Pixel, Attentive, LinkedIn, and Snap trackers — disclosing visitor data to advertising partners without consent. It’s a settlement, not a ruling, and that’s exactly what makes it a warning: the tracking stack that triggered it is running on thousands of ordinary business websites right now.

A federal court let both a CIPA §631 wiretap claim and a federal Wiretap Act claim survive dismissal against a telehealth provider — because the site relied on browsewrap consent that the court found inadequate. It’s one of 2026’s clearest warnings that a passive “notice on the page” is not consent.

The plaintiffs clicked “Disable All” — and, they allege, the tracking kept running anyway. A federal court dismissed their wiretapping claim but let the pen-register claim proceed, in one of the most thorough federal endorsements yet of the theory that cookies can be illegal “pen registers.” Here’s the full breakdown, and why the “Disable All” detail should worry every site with a consent banner.

The most important financial-data CIPA case of 2026 has two faces. The claims survived dismissal because the data at issue — credit outcomes, income, FICO segments — was genuinely sensitive. Then the class was denied because tracking harms are inherently individual. Here’s the full breakdown, and why both halves matter for your site.

A Los Angeles judge threw out a CIPA “pen register” class action over a third-party website SDK — ruling, in a first-of-its-kind decision, that CIPA’s pen-register and trap-and-trace provisions were written for telephones, not websites. Here’s the full breakdown: the technology, the theory, how the court reasoned, and what it means for your site.

A federal judge threw out a CIPA “trap-and-trace” class action over website cookies and a 6Sense tracking SDK — ruling that cookies simply aren’t a §638.51 device. Here’s the full breakdown: the technology, the theory, the two-part holding, and what it means for your site.