CIPA Cases

Inova Health agreed to a $3.15 million settlement over Meta and Google pixels on its public-facing websites — but the reason this case matters isn’t the number. It’s the law. The surviving claim was brought under the federal Electronic Communications Privacy Act (ECPA), and it cleared a motion to dismiss on a theory that reaches straight into HIPAA.

Penn Medicine agreed to a settlement of up to $9.5 million over Meta and Google tracking pixels on its myPennMedicine patient portal — and the claim wasn’t brought under California’s CIPA. It was brought under Pennsylvania’s own wiretap statute. This case is the clearest proof yet that pixel-as-wiretap theory is not a California problem.

BetterHelp is the case that put the most sensitive data of all — mental-health therapy information — at the centre of a federal enforcement action. The online-counseling firm paid $7.8 million to settle FTC charges that it shared what users disclosed while seeking therapy with Facebook, Snapchat, and other advertisers, after promising to keep it private.

A New York federal judge refused to dismiss a CIPA pen-register class action over the adtech trackers on CNN.com — and it was the second time the same judge told CNN the case could proceed. Where Rounds v. DDI shows how these claims die, D’Antonio shows how they survive.

A California federal judge refused to dismiss a CIPA pen-register class action over the TikTok and Microsoft Bing pixels on adidas.com — and delivered the lesson most sites still haven’t learned: privacy-policy links buried in your footer are not consent. This is the case that makes a real cookie banner non-negotiable.

The Ninth Circuit revived a CIPA wiretapping class action over the session-replay code on bloomingdales.com — rejecting the “record data” defense that had killed the case below — and five months later, Bloomingdale’s settled. It is the clearest arc in the whole tracker: survive dismissal, and you pay.

Meta lost the argument that it doesn’t “use” its own Pixel — then won the case anyway, on procedure. In March 2026 a federal court denied class certification after plaintiffs broadened their class definition and ran into CIPA’s one-year statute of limitations. It’s the most instructive defense win of the year, and the most dangerous one to misread.

Sutter Health paid $21.5 million over Google Analytics and the Meta Pixel running on a patient-portal login page. Nothing was tracked inside the portal. No usernames or passwords were shared. One page, before anyone logged in — and it produced one of the largest website-tracking settlements in US healthcare.

The difference between session cookies vs persistent cookies comes down to one thing: how long they live. But that single distinction decides whether a cookie needs consent, how it’s regulated, and whether it puts your website at legal risk. This guide explains both types clearly — plus how sessions differ from cookies, how to view them in Chrome, and the tools that scan and audit them.

European Wax Center agreed to pay $5 million to settle claims that its website ran the Meta Pixel, Attentive, LinkedIn, and Snap trackers — disclosing visitor data to advertising partners without consent. It’s a settlement, not a ruling, and that’s exactly what makes it a warning: the tracking stack that triggered it is running on thousands of ordinary business websites right now.

A federal court let both a CIPA §631 wiretap claim and a federal Wiretap Act claim survive dismissal against a telehealth provider — because the site relied on browsewrap consent that the court found inadequate. It’s one of 2026’s clearest warnings that a passive “notice on the page” is not consent.

The plaintiffs clicked “Disable All” — and, they allege, the tracking kept running anyway. A federal court dismissed their wiretapping claim but let the pen-register claim proceed, in one of the most thorough federal endorsements yet of the theory that cookies can be illegal “pen registers.” Here’s the full breakdown, and why the “Disable All” detail should worry every site with a consent banner.