CIPA Lawsuit
Tracker 2026

European Wax Center agreed to a $5M settlement over waxcenter.com firing the Meta Pixel, Attentive Mobile, LinkedIn and Snap tags on page load — before consent — transmitting booking-related data to ad partners. Claims stacked CIPA §631, ECPA and Florida's FSCA. Class covers all US residents who visited Jun 30 2023 – Apr 2 2026; browsing alone qualifies. Up to $10/claimant pro rata. Notable because the tracking stack is the exact config on thousands of eCommerce/service sites.

The LA Times agreed to a $3.85M settlement over claims that tracking technologies on its website and mobile app collected California visitors' information without consent between Jan 2023 and Dec 2025. Valid claims by May 20, 2026 eligible for pro-rata cash. Final approval hearing held June 26, 2026 — order pending.

The court held CIPA's pen register / trap-and-trace provisions reach telephone communications only — not ordinary software on a commercial website. Treated as an issue of first impression; leaned on statutory construction and §638.52's court-order process. Dismissal with prejudice gives operators a clean rebuttal to the pen-register theory, though it leaves §631 wiretapping and pre-consent timing theories untouched.

Multiple claims survived where plaintiffs alleged transmission of highly sensitive data to third parties: employment status, citizenship, bank account type, credit approval/denial outcomes, FICO segments, income bands, names, emails, phones. Court distinguished routine browsing-data disputes due to the extraordinary sensitivity. Reinforces that defendants face greater difficulty challenging standing when sensitive financial data is disclosed.

§631 wiretapping claim dismissed (plaintiffs failed to describe their actual website activities). But the §638.51 pen register claim survived in one of the most comprehensive federal analyses yet on whether CIPA's pen register provision reaches internet tracking — concluding it does, since CA adopted a federal pen register definition Congress expanded to internet tracking in 2001. A strong federal endorsement of the pen register theory.

ECPA federal claim dismissed under the party exception. CIPA pen register claim survived because AEG's third-party cookies activated immediately on landing — before the consent banner appeared and before any opt-out existed. The court emphasized a banner shown after tracking has begun is only a disclosure notice, not valid consent. A warning for orgs whose trackers fire before consent interaction.

Complete dismissal with prejudice. Widely cited by Fisher Phillips and others as the definitive template for defensible consent configuration: clickwrap requiring affirmative acceptance before access. The counter-example to Nourish's browsewrap — Bosley's affirmative clickwrap defeated the claims entirely.

Dismissed for lack of Article III standing. Court drew a sharp line between genuinely sensitive data (medical, financial, personal communications) and routine behavioural metadata from ad-targeting pixels on a free streaming platform. Vague allegations that pixels collected 'personal information' were insufficient — plaintiffs must identify specific sensitive data actually disclosed. Standing framework now cited across districts as a first-line defence for non-sensitive content sites.

Both the ECPA wiretapping claim and the CIPA §631 claim survived dismissal. The problem was consent architecture: unlike Bosley (clickwrap requiring affirmative acceptance before access), Nourish relied on browsewrap — a buried notice users were deemed to accept by visiting. Courts are increasingly hostile to browsewrap; the court found it inadequate. The ECPA claim survived via the HIPAA crime-tort exception — significant for health/wellness sites. Fisher Phillips called it 'the most straightforwardly bad decision in the set for businesses.' Takeaway: browsewrap is not defensible consent; affirmative clickwrap or an enforced CMP is the standard.

Sutter Health agreed to a $21.5M settlement over deploying third-party tracking pixels on its patient portal and marketing site, transmitting protected health information to vendors without patient consent. Provides $90 per class member. Healthcare faces elevated CIPA exposure due to the sensitivity of medical data.

Inova Health settled for $3.1M over tracking pixels on its healthcare website transmitting patient data to third-party vendors without HIPAA authorisation or consumer consent. Part of the broader healthcare pixel litigation wave affecting hospitals and health systems nationwide.

Plaintiffs sought to certify a far broader class at certification than the complaint contemplated — from people whose tax-filing data appeared in Meta's systems to anyone whose any data appeared. The court found this expansion raised individualized questions overwhelming common ones, defeating predominance under Rule 23(b)(3). Underlying CIPA claims remain alive; the MDL continues without a certified class for now. Standing must be proven by a preponderance at certification, not just pleading-level.

Dismissed without leave to amend a claim that DDI's 6Sense data-broker SDK (geolocation, device, browser-cookie data to de-anonymize visitors) was an illegal trap-and-trace device. Judge Carter found cookies do not satisfy §638.51, since trap-and-trace covers signaling data identifying the source of a communication, not routine web-tracking metadata. With no plausible violation, the out-of-state defendant had no CA minimum contacts and personal jurisdiction failed.

Mixed ruling. Court dismissed CIPA pen register and wiretapping claims, finding CCPA/CPRA governs website data collection and the legislature could not have intended to criminalise under CIPA what it regulated under CCPA. But a common law invasion of privacy claim survived — capture/transmission of credit card and medical data could be a highly offensive intrusion. The CIPA/CCPA preemption argument gains traction.

A SDNY judge denied CNN's motion to dismiss a CIPA class action over third-party trackers on CNN.com. Court found Article III standing — aggregation of tracking data into comprehensive user profiles bears a close relationship to traditional privacy torts. Rejected CNN's argument that trackers collected only routing info rather than communication content.

Fandom agreed to a $1.2M settlement over GameSpot deploying unauthorized third-party trackers without prior consent to track California visitors. Described by commentators as 'the blueprint for thousands of pending pixel lawsuits' — established that a consent banner dismissal without explicit Accept is not valid consent.

Case survived on the §638.51 pen register theory. Court noted most cases in this and other districts recognise website-based trackers can plausibly constitute a pen register. Significant precedent for retail e-commerce sites using standard advertising pixels; demonstrates the theory's viability even as other courts reject it.

§638.51 pen register claim dismissed for lack of Article III standing. Collection of generic device/browser metadata — IP addresses, device type, browser version — did not constitute the 'embarrassing, invasive, or otherwise private' info needed for concrete injury. Popa v. Microsoft standing framework applied. Metadata alone is insufficient.

Ninth Circuit reversed dismissal. Court found plaintiffs adequately alleged FullStory intercepted the 'contents' of communications — names, addresses, credit card info entered at checkout — while in transit, not merely post-transmission. Real-time interception satisfied by FullStory's keystroke and form capture. Now in discovery.

Ninth Circuit affirmed dismissal. Papa John's was a party to its own visitors' communications — a party cannot eavesdrop on its own conversation. The direct party exception under §631 bars direct liability. But the court noted plaintiff hadn't pleaded aiding-and-abetting against FullStory specifically, leaving that avenue open — and plaintiffs have since pivoted to it.

Motion to dismiss denied. Case proceeds on claims that Flixbus's website chat tool intercepted customer communications and transmitted them to a third-party vendor without disclosure or consent. Adds to a growing body where integrated chat tools with third-party backends create viable §631 exposure distinct from first-party chat.

Summary judgment for the defendant. Court held §631 requires evidence a party actually read or attempted to read communication contents while in transit — mere data capture during a session is insufficient. Session replay that reassembles data only after transmission does not satisfy real-time interception. One of the most significant defendant-friendly rulings — narrows §631 liability substantially.

Dismissed with prejudice for lack of standing. Court was skeptical of tester-style pleading — a plaintiff who visits specifically to document a CIPA violation cannot claim injury when her expectations were met. Courts increasingly scrutinise whether serial plaintiffs suffered genuine harm, applying stricter Article III analysis. Significant for serial plaintiff cases.

Plaintiff alleges he visited VeryWellHealth.com in Dec 2024, entering search terms for STI symptoms/treatment, and that the site's advertising platform intercepted and transmitted this sensitive health data — search terms, navigation history, device metadata — to third-party advertisers in real time without consent. Highlights risk for health/wellness sites with search functionality.

Court found FullStory could be characterised as a third-party eavesdropper rather than a tool of Nike. Focus was on the real-time nature of the data capture — FullStory receiving keystrokes and interactions as they occur, not after the session. Survived dismissal on the aiding-and-abetting theory under §631.

Court found a viable CIPA theory where search terms typed on a university athletics site were transmitted in real time to third-party vendors via analytics scripts. The real-time transmission of content (the search query) distinguished it from passive data collection. Survived on aiding-and-abetting. Significant for sites with search + analytics.

Court found FullStory was a direct party to communications when recording sessions, not a third-party interceptor. As a service provider integrated into Noom's infrastructure and operating as Noom's agent, the party exception applied. Illustrates how vendor configuration and contractual relationship significantly affect the outcome.

Court ruled Old Navy could not eavesdrop on its own chat communications — it was a party, not a third-party interceptor. Live chat deployed by the website owner itself falls under the party exception. Important for first-party chat/customer service tools. Plaintiffs have since focused on third-party chat providers (Intercom, Drift, Zendesk) to avoid this exception.

The chat tool was found to be an extension of the business itself — not an independent third-party interceptor — so the party exception applied. Lawsuit dismissed. Reinforces that integrated chat tools operating as the business's own agent do not create §631 liability, unlike third-party vendors that independently receive and process communication data.

Foundational case establishing that an SDK embedded in apps could constitute a pen register under CIPA. Court rejected the argument that an SDK was categorically not a pen register. Opened the door to claims against advertising SDKs, fingerprinting, and cross-site tracking. Still considered the most important §638.51 precedent in website tracking litigation.

Flo Health, Google and Flurry agreed to a $59.5M settlement (Google $48M, Flo $8M, Flurry $3.5M) resolving claims that the period/pregnancy-tracking app shared users' confidential in-app health data with third parties via in-app SDKs without consent. Preliminary approval was granted Apr 22, 2026 (Judge Donato, N.D. Cal.); claims deadline Oct 15, 2026; final approval hearing Oct 29, 2026. Meta declined to settle and went to trial, where a unanimous San Francisco jury found it liable under CIPA §632 for capturing confidential health data via its SDK without consent — the first major CIPA jury verdict in history. The court denied Meta's post-trial motions (Sept 17, 2025); the liability finding stands and damages are not yet set, with Meta continuing to challenge.

Paid $12.25M to settle a consolidated class action covering ~2.5M patients — one of the largest exposed populations in the healthcare pixel wave; the litigation began with the health system’s own self-reported breach to HHS.

The $18.4M settlement that helped start the healthcare pixel wave — an eight-figure payout over cookies and pixels on public hospital websites, finalised in early 2022, before the wave.

Up-to-$9.5M settlement over Meta and Google pixels on the myPennMedicine patient portal — brought under Pennsylvania’s WESCA wiretap law, not California’s CIPA. Preliminary approval; final hearing Nov 12, 2026.

The online-therapy firm paid $7.8M to settle FTC charges that it shared users’ mental-health intake data with Facebook, Snapchat and others for advertising; the first FTC action to return funds for health data, plus a ban on sharing health data for ads.

Two matters: a landmark $1.5M FTC action (first-ever Health Breach Notification Rule enforcement, final) and a separate private class action the court has twice declined to approve ($25M→$32M proposals). Prescription data shared via Meta, Google, Criteo pixels and SDKs.

Proposed class action alleging Toyota.com kept tracking visitors via fingerprinting even after they clicked 'Decline' on the cookie banner, de-anonymizing them and sharing data for cross-device advertising. Framed as an 'outrageous privacy bait-and-switch' under CIPA's trap-and-trace provision. Lead plaintiff Brittany Conner; Pacific Trial Attorneys (Scott Ferrell, Victoria Knowles).

Nationwide proposed class action alleging NFL.com deployed 182 third-party trackers — including session recording and four canvas-fingerprinting scripts — that captured browsing behavior, IP and device data in real time and transmitted it to third parties, continuing even after opt-out. Alleges the consent banner gave a 'false and misleading sense of security.' No. 26CV197596; rep. Potter Handy.

Consolidated multi-theory class action alleging Meta and Google tracking technologies on Banner websites and the MyBanner patient portal disclosed patient data without consent. Class ~1,028,000 portal users (Jun 2020–Nov 2023). Proposed relief includes $20/class-member cash plus a year of CyEx Privacy Shield Pro. No. 2026CV30182; claims/opt-out deadline Sep 5, 2026. (LifeStance was consolidated in but settled separately.)

LifeStance agreed to a non-reversionary $3,027,874.44 settlement over third-party pixels on its public website/booking tool that allegedly collected and disclosed patient information to Meta and Google without authorization. Two subclasses ($1,203,405 / $1,824,469.44). Includes a 5-year discontinuation of non-HIPAA-compliant trackers (injunctive relief). No. 2:23-cv-00682-KML; prelim. approval May 12, 2026; claims deadline Sep 29, 2026.

Wellstar Health System agreed to a $4.25M settlement over Meta and Google tracking tools on its website and MyChart patient portal that allegedly captured logged-in patient activity — appointment scheduling, condition searches, click-to-call — and shared it with third parties. Class ~870,000 (Feb 2020–Jul 2026). A federal judge had allowed some claims to proceed, finding the system allegedly went 'beyond the scope of patients' permission.' Filed in N.D. Ga.; suit began Apr 2024.

Concord Hospital agreed to an $800,000 common-fund settlement over Google Analytics and Geonetric pixels on its web properties, brought under New Hampshire's Wiretapping and Electronic Surveillance Act and NH Patient Privacy Law — a state-wiretap theory outside California. No. 217-2024-CV-00295; no-proof claims.

Telehealth provider Call-On-Doc agreed to a $1.8M settlement over tracking-pixel use alleged to violate California privacy law (CIPA), notably litigated in Illinois state court. No. 2026LA000403.

Proposed class action alleging DraftKings used NextRoll, The Trade Desk and Comscore tracking plus fingerprinting in violation of CIPA's trap-and-trace provision. No court ruling — the California-resident plaintiff voluntarily dismissed the suit in mid-July 2026 (per Bloomberg Law). Logged as a dismissal/status data point, not a merits win.

Proposed class action alleging Ulta's website deployed the Meta Pixel and related trackers that intercepted the contents of visitors' communications — full URL strings and specific products/content viewed — and transmitted them to Meta and other third parties without consent. Stacks CIPA §631, ECPA, and California constitutional privacy/intrusion claims; alleges Ulta aided Meta's interception. Brought by Swigart Law Group and Shay Legal (among the most active CIPA filers).

A federal court declared one of the most prolific individual CIPA filers a vexatious litigant, requiring court permission before filing new CIPA or related digital-privacy suits in the district — citing ~29 proceedings since 2021 and seven near-identical §631(a) complaints in the prior seven months. Narrow: binds one filer, one district, prospectively; doesn't reach arbitration or decide the merits.

Wayfair threw ~a dozen theories at the complaint (including that encryption breaks the 'in transit' requirement) and the court knocked over almost all of them. §638.51 pen register dismissed without leave; §631(a) wiretapping and the trap-and-trace theory survived. Party exception didn't save Wayfair because the third-party tools weren't parties to the communication. Featured in Sept 2026 Case Watch.

First ruling to carry the CIPA wiretap theory beyond website pixels to an AI tool. Judge Lee let CIPA §631/§632, federal Wiretap Act and BIPA claims proceed (dismissing CFAA/CDAFA/WA Privacy Act). Rejected Otter's 'party exception' because Otter used the recordings for its own commercial purpose (training AI) — distinguishing Graham v. Noom — and distinguished Popa v. Microsoft, noting eavesdropping on whole conversations is 'materially more invasive than monitoring browsing.'

A separate Ulta matter from the Hartigan pixel suit, on session-replay tracking. Court held Ulta's privacy policy alone was not enough for CIPA consent — passive 'by continuing to browse' notice doesn't meet the affirmative opt-in standard. Part of a 2026 run (with the Variety Media tentative and Toyota 'decline' case) testing the exact mechanism a consent banner provides.

Proposed class action alleging poshpeanut.com embedded five advertising/marketing trackers (Meta Pixel, Google Analytics/DoubleClick, TikTok, Klaviyo, AppLovin) that captured customers' names, emails, phone numbers and purchase details and shared them with third parties without consent. Pleads ECPA, CIPA §631 & §632, CDAFA, and California constitutional privacy. Allegation stage; no settlement.

FTC enforcement action (joined by Utah and Los Angeles County) alleging the telehealth company shared consumers' health information — sexual wellness, mental health, weight loss — with ad platforms (Meta, Snap, Microsoft, Pinterest, Reddit, X) via tracking pixels and customer-list uploads, plus deceptive subscription billing. Claims under FTC Act §5, ROSCA, and the Health Breach Notification Rule. Not a CIPA case; company calls allegations baseless.

Proposed nationwide class action alleging Granola's AI note-taker silently captured meeting conversations through the user's device — with no visible bot in the call — without all-party consent, and trains AI models on captured audio by default. Claims under the federal Wiretap Act (ECPA, §2511) and CIPA §631/§632. Early stage; defendant not yet responded.

Singh v. The Moses H. Cone Memorial Hospital — $1,765,000 settlement (prelim. approval Jul 2026) over tracking pixels on Cone Health's website and MyChart patient portal that allegedly transmitted patient data to Meta and Google without consent. 375,027 class members; federal Wiretap Act (ECPA) + unlawful PHI disclosure. Not a CIPA case. Pro rata payout, no proof required.

Roberts v. The Charlotte-Mecklenburg Hospital Authority — $1,800,000 settlement over tracking pixels on Atrium Health websites and the MyAtriumHealth/MyCarolinas patient portals that allegedly disclosed patient data to third parties including Meta. Brought in North Carolina state court under HIPAA-informed state privacy law (not CIPA). Two-group class (earlier portal users + all portal-account holders).

Berman v. Forbes Media LLC — $10,000,000 non-reversionary settlement (prelim. approval Jun 2026) over LinkedIn Insight, Microsoft Bing UET, and Xandr trackers alleged to transmit visitors' IP addresses and identifiers to third parties without consent. Pleaded as a CIPA §638.51 pen-register claim; ~3.9M California class. Among the last big private §638.51 website settlements before SB 690 routes that theory to the AG (Jan 1, 2027).