Cookie Consent Lawsuits: the full 2026 landscape
Where website tracking turns into litigation — the US pixel & CIPA wave, the EU cookie-banner fines, and every case and guide in one place.
Informational, not legal advice.
The cases & guides, in one place
Every lawsuit asset we maintain — pick the thread that matches your risk.
By tracker & tool
Meta Pixel Lawsuits
How the Meta (Facebook) Pixel became the single most-named tracker in US privacy litigation, and what triggers a claim.
Read → GoogleGoogle Analytics & CIPA
Whether GA4 and its data-sharing settings create California wiretap exposure, the cases that named it, and the config fixes.
Read → TikTokTikTok Pixel Lawsuits
How TikTok Pixel CIPA cases swung from dismissals to a federal-court split after Camplisson v. Adidas — and what it means for agencies.
Read → Session replaySession Replay: Hotjar, Clarity, FullStory
Why session-recording tools are the clearest CIPA fact pattern, what each one captures, and how to cut the exposure.
Read →By topic
Healthcare Pixel Settlements
Why hospital and patient-portal pixels drew some of the largest settlements (Kaiser, Sutter, Advocate Aurora), and the data behind them.
Read → EU · GDPRGDPR Cookie Consent Rules
What an EU cookie banner must actually do to collect valid consent — and the design traps regulators fine for.
Read → Why banners failA Consent Platform Isn't Enough
Most sued sites already had a banner. The claims turned on what fired before anyone clicked — the gap a banner alone leaves open.
Read → Tool · FreeFree Tracker Scanners
Compare the free tools that show which trackers fire on your site before consent — the exact fact pattern behind these cases.
Compare scanners →The US wave vs. the EU fines
"Cookie consent lawsuits" is really two systems pointing at the same behaviour.
Wiretapping & pixel suits
Plaintiffs argue session-replay tools and third-party pixels "wiretap" visitors when they capture activity before consent. CIPA allows $5,000 per violation under Cal. Penal Code §637.2 — which is what makes these attractive to file at scale.
2026 update — SB 690: signed September 30, 2026, it removed the private right of action for the §638.51 "pen register" theory on websites (now AG-only), but left §631/§632 wiretapping intact — and plaintiffs are recasting claims under those. The exposure shifted theories; it didn't disappear.
Cookie-banner enforcement
No class actions — regulator fines. France's CNIL issued €150M against Google and €60M against Facebook (now Meta) in December 2021, not for using cookies but for making them harder to refuse than to accept.
2026 update — EDPB: Binding Decision 1/2026 stopped a national regulator from dismissing mass cookie-banner complaints on procedural grounds, so more must now be heard on their merits. If you serve EU visitors, see the GDPR requirements guide.
The 10 most significant CIPA cases
The largest disclosed settlements and outcomes, as reported in court filings — not statements about any company's current practice. Full list of 55 in the tracker.
A cookie banner doesn't make you lawsuit-proof
A banner shows intent; the cases turn on behaviour — what actually fired, and when. Many defendants had a banner and still got sued because tags loaded before anyone clicked. Knowing which of your tags sit in which tier is the whole game.
Cookie consent lawsuits — FAQ
Can a website really be sued just for using cookies?
Not for cookies themselves — for collecting or transmitting visitor data before the visitor consents. In the US that's framed as wiretapping (CIPA and similar laws); in the EU it's a regulator fine for an invalid consent banner. Informational, not legal advice.
How much can a cookie consent lawsuit cost?
In the US, CIPA allows statutory damages of $5,000 per violation under California Penal Code §637.2, which adds up quickly at class scale; disclosed settlements across the cases we track exceed $167M. In the EU, France's CNIL alone issued €150M (Google) and €60M (Facebook) cookie fines.
Did SB 690 make CIPA website lawsuits go away?
No. SB 690 (signed September 30, 2026) removed the private right of action for the §638.51 "pen register" theory on websites, routing those to the Attorney General. It left CIPA §631 and §632 — the wiretapping and eavesdropping theories most pixel and session-replay suits use — in place, and plaintiffs are recasting claims under them.
Does a cookie banner protect me from these lawsuits?
A banner alone often isn't enough. Many sued sites had one; the claims turned on trackers firing before consent. What matters is whether tags are actually held until the visitor agrees — not whether a banner is displayed. Informational, not legal advice.
Which trackers get sites sued most often?
Session-replay tools (Hotjar, Microsoft Clarity, FullStory), advertising/analytics pixels (Meta, TikTok, Google), and live-chat widgets — anything that can capture or transmit visitor activity before consent.
How do I find out if my site is at risk?
Scan your pages to see what fires before consent. A free scan flags session-recording tools and pixels loading pre-consent, which is the pattern behind these cases.
🗓️ Last updated: October 2026
Disclaimer: ConsentPixel is an information provider, not a law firm. This page summarises publicly available court-record and regulatory information for general educational purposes and is not legal advice. Cases and figures change; verify against primary sources and consult qualified counsel before relying on them. Named cases reflect allegations and reported outcomes in the public record, not statements about any company's current practices.