CIPA Lawsuit
Tracker 2026

The LA Times agreed to a $3.85M settlement over claims that tracking technologies on its website and mobile app collected California visitors' information without consent between Jan 2023 and Dec 2025. Valid claims by May 20, 2026 eligible for pro-rata cash. Final approval hearing held June 26, 2026 — order pending.

Dismissed without leave to amend a claim that DDI's 6Sense data-broker SDK (geolocation, device, browser-cookie data to de-anonymize visitors) was an illegal trap-and-trace device. Judge Carter found cookies do not satisfy §638.51, since trap-and-trace covers signaling data identifying the source of a communication, not routine web-tracking metadata. With no plausible violation, the out-of-state defendant had no CA minimum contacts and personal jurisdiction failed.

The court held CIPA's pen register / trap-and-trace provisions reach telephone communications only — not ordinary software on a commercial website. Treated as an issue of first impression; leaned on statutory construction and §638.52's court-order process. Dismissal with prejudice gives operators a clean rebuttal to the pen-register theory, though it leaves §631 wiretapping and pre-consent timing theories untouched.

Multiple claims survived where plaintiffs alleged transmission of highly sensitive data to third parties: employment status, citizenship, bank account type, credit approval/denial outcomes, FICO segments, income bands, names, emails, phones. Court distinguished routine browsing-data disputes due to the extraordinary sensitivity. Reinforces that defendants face greater difficulty challenging standing when sensitive financial data is disclosed.

§631 wiretapping claim dismissed (plaintiffs failed to describe their actual website activities). But the §638.51 pen register claim survived in one of the most comprehensive federal analyses yet on whether CIPA's pen register provision reaches internet tracking — concluding it does, since CA adopted a federal pen register definition Congress expanded to internet tracking in 2001. A strong federal endorsement of the pen register theory.

ECPA federal claim dismissed under the party exception. CIPA pen register claim survived because AEG's third-party cookies activated immediately on landing — before the consent banner appeared and before any opt-out existed. The court emphasized a banner shown after tracking has begun is only a disclosure notice, not valid consent. A warning for orgs whose trackers fire before consent interaction.

Dismissed for lack of Article III standing. Court drew a sharp line between genuinely sensitive data (medical, financial, personal communications) and routine behavioural metadata from ad-targeting pixels on a free streaming platform. Vague allegations that pixels collected 'personal information' were insufficient — plaintiffs must identify specific sensitive data actually disclosed. Standing framework now cited across districts as a first-line defence for non-sensitive content sites.

Both the ECPA wiretapping claim and the CIPA §631 claim survived dismissal. The problem was consent architecture: unlike Bosley (clickwrap requiring affirmative acceptance before access), Nourish relied on browsewrap — a buried notice users were deemed to accept by visiting. Courts are increasingly hostile to browsewrap; the court found it inadequate. The ECPA claim survived via the HIPAA crime-tort exception — significant for health/wellness sites. Fisher Phillips called it 'the most straightforwardly bad decision in the set for businesses.' Takeaway: browsewrap is not defensible consent; affirmative clickwrap or an enforced CMP is the standard.

European Wax Center agreed to a $5M settlement over waxcenter.com firing the Meta Pixel, Attentive Mobile, LinkedIn and Snap tags on page load — before consent — transmitting booking-related data to ad partners. Claims stacked CIPA §631, ECPA and Florida's FSCA. Class covers all US residents who visited Jun 30 2023 – Apr 2 2026; browsing alone qualifies. Up to $10/claimant pro rata. Notable because the tracking stack is the exact config on thousands of eCommerce/service sites.

Plaintiffs sought to certify a far broader class at certification than the complaint contemplated — from people whose tax-filing data appeared in Meta's systems to anyone whose any data appeared. The court found this expansion raised individualized questions overwhelming common ones, defeating predominance under Rule 23(b)(3). Underlying CIPA claims remain alive; the MDL continues without a certified class for now. Standing must be proven by a preponderance at certification, not just pleading-level.

Sutter Health agreed to a $21.5M settlement over deploying third-party tracking pixels on its patient portal and marketing site, transmitting protected health information to vendors without patient consent. Provides $90 per class member. Healthcare faces elevated CIPA exposure due to the sensitivity of medical data.

Inova Health settled for $3.1M over tracking pixels on its healthcare website transmitting patient data to third-party vendors without HIPAA authorisation or consumer consent. Part of the broader healthcare pixel litigation wave affecting hospitals and health systems nationwide.

Mixed ruling. Court dismissed CIPA pen register and wiretapping claims, finding CCPA/CPRA governs website data collection and the legislature could not have intended to criminalise under CIPA what it regulated under CCPA. But a common law invasion of privacy claim survived — capture/transmission of credit card and medical data could be a highly offensive intrusion. The CIPA/CCPA preemption argument gains traction.

A SDNY judge denied CNN's motion to dismiss a CIPA class action over third-party trackers on CNN.com. Court found Article III standing — aggregation of tracking data into comprehensive user profiles bears a close relationship to traditional privacy torts. Rejected CNN's argument that trackers collected only routing info rather than communication content.

Plaintiff alleges he visited VeryWellHealth.com in Dec 2024, entering search terms for STI symptoms/treatment, and that the site's advertising platform intercepted and transmitted this sensitive health data — search terms, navigation history, device metadata — to third-party advertisers in real time without consent. Highlights risk for health/wellness sites with search functionality.

Fandom agreed to a $1.2M settlement over GameSpot deploying unauthorized third-party trackers without prior consent to track California visitors. Described by commentators as 'the blueprint for thousands of pending pixel lawsuits' — established that a consent banner dismissal without explicit Accept is not valid consent.

Case survived on the §638.51 pen register theory. Court noted most cases in this and other districts recognise website-based trackers can plausibly constitute a pen register. Significant precedent for retail e-commerce sites using standard advertising pixels; demonstrates the theory's viability even as other courts reject it.

§638.51 pen register claim dismissed for lack of Article III standing. Collection of generic device/browser metadata — IP addresses, device type, browser version — did not constitute the 'embarrassing, invasive, or otherwise private' info needed for concrete injury. Popa v. Microsoft standing framework applied. Metadata alone is insufficient.

Ninth Circuit reversed dismissal. Court found plaintiffs adequately alleged FullStory intercepted the 'contents' of communications — names, addresses, credit card info entered at checkout — while in transit, not merely post-transmission. Real-time interception satisfied by FullStory's keystroke and form capture. Now in discovery.

Ninth Circuit affirmed dismissal. Papa John's was a party to its own visitors' communications — a party cannot eavesdrop on its own conversation. The direct party exception under §631 bars direct liability. But the court noted plaintiff hadn't pleaded aiding-and-abetting against FullStory specifically, leaving that avenue open — and plaintiffs have since pivoted to it.

Motion to dismiss denied. Case proceeds on claims that Flixbus's website chat tool intercepted customer communications and transmitted them to a third-party vendor without disclosure or consent. Adds to a growing body where integrated chat tools with third-party backends create viable §631 exposure distinct from first-party chat.

Summary judgment for the defendant. Court held §631 requires evidence a party actually read or attempted to read communication contents while in transit — mere data capture during a session is insufficient. Session replay that reassembles data only after transmission does not satisfy real-time interception. One of the most significant defendant-friendly rulings — narrows §631 liability substantially.

Dismissed with prejudice for lack of standing. Court was skeptical of tester-style pleading — a plaintiff who visits specifically to document a CIPA violation cannot claim injury when her expectations were met. Courts increasingly scrutinise whether serial plaintiffs suffered genuine harm, applying stricter Article III analysis. Significant for serial plaintiff cases.

Class action certified in 2025. A California subclass certified for claims under §632 (confidential communications). Involves a health-tracking app that allegedly shared sensitive reproductive health data with advertising platforms. One of the first CIPA class certifications in femtech — may set precedent for health app developers and their analytics integrations.

Court found FullStory could be characterised as a third-party eavesdropper rather than a tool of Nike. Focus was on the real-time nature of the data capture — FullStory receiving keystrokes and interactions as they occur, not after the session. Survived dismissal on the aiding-and-abetting theory under §631.

Court found a viable CIPA theory where search terms typed on a university athletics site were transmitted in real time to third-party vendors via analytics scripts. The real-time transmission of content (the search query) distinguished it from passive data collection. Survived on aiding-and-abetting. Significant for sites with search + analytics.

Foundational case establishing that an SDK embedded in apps could constitute a pen register under CIPA. Court rejected the argument that an SDK was categorically not a pen register. Opened the door to claims against advertising SDKs, fingerprinting, and cross-site tracking. Still considered the most important §638.51 precedent in website tracking litigation.

Court found FullStory was a direct party to communications when recording sessions, not a third-party interceptor. As a service provider integrated into Noom's infrastructure and operating as Noom's agent, the party exception applied. Illustrates how vendor configuration and contractual relationship significantly affect the outcome.

Court ruled Old Navy could not eavesdrop on its own chat communications — it was a party, not a third-party interceptor. Live chat deployed by the website owner itself falls under the party exception. Important for first-party chat/customer service tools. Plaintiffs have since focused on third-party chat providers (Intercom, Drift, Zendesk) to avoid this exception.

The chat tool was found to be an extension of the business itself — not an independent third-party interceptor — so the party exception applied. Lawsuit dismissed. Reinforces that integrated chat tools operating as the business's own agent do not create §631 liability, unlike third-party vendors that independently receive and process communication data.

Complete dismissal with prejudice. Widely cited by Fisher Phillips and others as the definitive template for defensible consent configuration: clickwrap requiring affirmative acceptance before access. The counter-example to Nourish's browsewrap — Bosley's affirmative clickwrap defeated the claims entirely.

Paid $12.25M to settle a consolidated class action covering ~2.5M patients — one of the largest exposed populations in the healthcare pixel wave; the litigation began with the health system’s own self-reported breach to HHS.

The $18.4M settlement that helped start the healthcare pixel wave — an eight-figure payout over cookies and pixels on public hospital websites, finalised in early 2022, before the wave.

Up-to-$9.5M settlement over Meta and Google pixels on the myPennMedicine patient portal — brought under Pennsylvania’s WESCA wiretap law, not California’s CIPA. Preliminary approval; final hearing Nov 12, 2026.

The online-therapy firm paid $7.8M to settle FTC charges that it shared users’ mental-health intake data with Facebook, Snapchat and others for advertising; the first FTC action to return funds for health data, plus a ban on sharing health data for ads.

Two matters: a landmark $1.5M FTC action (first-ever Health Breach Notification Rule enforcement, final) and a separate private class action the court has twice declined to approve ($25M→$32M proposals). Prescription data shared via Meta, Google, Criteo pixels and SDKs.