Cumor, Dunn v. European Wax Center, Inc.

What the case is about

Plaintiffs Jason Cumor and Sydney Dunn filed a class action against European Wax Center, Inc., alleging that its website, waxcenter.com, disclosed information about visitors to third parties through pixels, cookies, code, and analytics tools — without permission. According to the legal analysis of the complaint, the site loaded the Meta Pixel along with Attentive Mobile, LinkedIn, and Snap trackers, which captured visitor activity (including booking-related data) and transmitted it to advertising and marketing partners.

What makes this case matter isn't a novel legal theory or a landmark ruling — it's how ordinary the facts are. European Wax Center is a mainstream service business, not a data broker. The trackers at issue are the same ones marketing teams install on tens of thousands of eCommerce and appointment-based websites without a second thought. That's precisely why the outcome — a $5 million settlement — should get every website operator's attention: this is the standard configuration, and it cost $5 million to resolve.

The class is strikingly broad. It covers every US resident who visited waxcenter.com between June 30, 2023 and April 2, 2026 — with no requirement to have booked an appointment or bought anything. Simply visiting the site was enough to be a class member. Eligible claimants receive up to $10 each (pro rata) from the $5 million fund.

The legal theory — a multi-statute stack

The complaint didn't rely on a single law. It stacked four claims, which is now the standard structure of these pixel-tracking cases:

The strategic point of stacking is leverage. Even where a defendant has a strong argument against one theory, it must defend all of them — and any single surviving claim keeps the case (and its potential damages) alive. Here, the combination of a California wiretapping statute, its federal counterpart, and a Florida statute meant European Wax Center faced exposure on multiple fronts at once. That multi-front risk is a large part of why so many of these cases settle rather than litigate to a ruling.

Why it was worth $5 million to settle

European Wax Center denies any wrongdoing and never conceded it violated any law — it settled, in its own words, to avoid the "cost, disruption, and uncertainty" of continuing. So why pay $5 million to avoid a case you might win?

The answer is CIPA's damages math. CIPA carries statutory damages of $5,000 per violation, and in a class action that figure is multiplied across every affected visitor over a multi-year class period. For a site with the traffic of a national franchise, the theoretical exposure runs into the tens or hundreds of millions — a "bet-the-company" number. Against that, a $5 million settlement is a rational cost of removing catastrophic tail risk. This is the core dynamic driving the entire litigation wave: plaintiffs don't need to win; the sheer size of the potential exposure makes settling the economically sensible choice for defendants.

Where it stands (as of July 2026)

The case reached a $5 million class settlement, and is at the final stage of court approval:

• Settlement fund: $5,000,000, covering class payments, attorneys' fees, service awards, and administration costs.
• Class payment: up to $10 per valid claim, reduced pro rata if total claims exceed the available fund.
• Key deadline (passed): claims, opt-outs, and objections were due June 30, 2026.
• Final approval hearing: scheduled for July 15, 2026 before Judge Melissa Polo in Tampa, Florida. Payments issue after final approval and the resolution of any appeals.

Because European Wax Center settled, there is no court ruling on the merits of the CIPA theory here — the value of this case is as a data point on settlement economics, not case law. Status is stated as of publication; consult the official settlement site for the latest.

How this fits the 2026 landscape

The CIPA docket in 2026 has two distinct streams. One is the rulings stream — courts split on whether the pen-register or wiretap theories survive (see Rounds v. DDI for a defense win, or Podraza v. Nourish for a plaintiff-side survival). The other is the settlements stream, and that's where Cumor belongs — alongside deals like the LA Times' $3.85M and Fandom's $1.2M resolutions.

What makes the settlement stream so important is that it doesn't depend on the legal uncertainty being resolved. While courts argue about whether a 1967 statute reaches modern web trackers, defendants keep writing seven-figure checks to make the risk go away. For a business, that means you can't wait for the law to settle — the financial exposure is live now, regardless of which way the rulings eventually break. And the trigger, every time, is the same: trackers firing before consent.

Why this case matters for website operators

The single most important thing about Cumor v. European Wax Center is the banality of the tracking stack. Meta Pixel, Attentive, LinkedIn, Snap — there is nothing unusual about this combination. It's the default toolkit for any business that runs Facebook and Instagram ads, sends SMS marketing, and does B2B outreach. If that describes your site, you are running some or all of the exact configuration that cost European Wax Center $5 million.

The second lesson is that a consent banner alone would not have saved them. As the legal analysis of the case stressed: a banner on the page is not enough if the scripts fire before the user interacts with it. The liability isn't the absence of a banner — it's the timing. Pixels that load on page arrival, before any consent, are the violation. Tag managers, SDKs, and server-side tracking all need to be verified against that standard, not assumed compliant because a banner exists.

What this means for your site

The fix for the exact failure in Cumor is technical and entirely achievable. The trackers weren't the problem in themselves — the timing was. Here's the defensible posture:

• Block marketing pixels until consent is captured. Meta, Attentive, LinkedIn, Snap, and any analytics must not fire until the visitor affirmatively agrees. This is the single control that would have prevented the case.
• Verify, don't assume. A consent banner doesn't guarantee blocking. Check what actually fires: open your site in incognito, open the DevTools Network tab, and watch which trackers transmit before you interact with the banner.
• Cover tag managers and server-side tracking too. Pixels loaded via Google Tag Manager or server-side setups fire just as early — they need the same consent gate.
• Keep a consent log. Timestamped records of each visitor's choice are your evidence that tracking only began after consent — the proof European Wax Center couldn't offer.

ConsentPixel — Privacy · Verified is built to block exactly this stack: it prevents Meta, Attentive, LinkedIn, Snap, and other third-party trackers from firing until the visitor consents, and logs every decision. The gap that cost European Wax Center $5 million is the gap it's designed to close — before a demand letter arrives, not after.