In re Meta Pixel Tax Filing Cases

What the case is about

This case is unusual on the CIPA docket for one reason: the defendant isn't a website. It's Meta Platforms — the company that makes the tracker. Consolidated in the Northern District of California from December 2022, the plaintiffs alleged that the Meta Pixel, installed by tax-filing services TaxAct, H&R Block, and TaxSlayer, transmitted their data to Meta without consent.

The data at issue went beyond generic browsing. Plaintiffs alleged the Pixel sent URLs of pages visited, device IP addresses, and browser information — and, critically, potentially sensitive tax details such as filing status, income, and refund amounts. Because the Pixel works alongside Facebook cookies, plaintiffs alleged Meta could link that activity directly to a specific Facebook account, feeding the detailed advertising profiles Meta maintains on users and non-users alike.

The claims were the modern CIPA stack plus a state consumer-protection theory: CIPA §631 (the wiretap provision), CIPA §638.51 (the pen-register provision, added in a May 2025 amended complaint), and California's Unfair Competition Law. What followed was a four-year fight that produced two rulings every website operator should understand — one that went badly for Meta, and one that saved it.

The legal theory — and Meta's failed "we just receive data" defense

CIPA §638.51 prohibits installing or using a pen register — a device or process that records dialing, routing, addressing, or signalling information — without a court order. Plaintiffs argued the Pixel qualifies because it records and decodes exactly that kind of information from tax-filing websites.

Meta's defense was clever and, for the adtech industry, important. It argued a textual distinction: CIPA's wiretap provision imposes liability on anyone who "uses, or attempts to use" information obtained from a wiretap — but the pen-register provision contains no such language. On Meta's reading, the tax websites installed and used the Pixel; Meta merely used the data it received from the Pixel, which the statute doesn't reach.

One detail from the ruling deserves a moment. The court noted the complaint alleged that Meta receives some information from the Pixel before the tax services themselves receive the data. Read that again if you run a website with the Pixel installed: the allegation is that data reaches Meta's servers before it reaches yours. Meta's motion to dismiss the pen-register claim was denied. The theory survived.

So by mid-2025, Meta was facing live CIPA wiretap and pen-register claims over sensitive tax data. On the merits, it was losing ground. What happened next is why this case is on every defense lawyer's reading list.

Where it stands (as of July 2026)

On March 30, 2026, Judge Pitts denied the plaintiffs' motion for class certification — and did so without reaching the merits of whether the Pixel violates CIPA. The case turned on Rule 23 procedure:

• The class definition shifted. The original complaint defined the class around people whose tax filing information was collected. At certification, plaintiffs sought to certify a far broader class: anyone who visited the tax sites and whose data appeared in Meta's internal tables, regardless of whether it included financial information.
• That broadening was fatal. Only individuals within the original definition were likely entitled to tolling of CIPA's one-year statute of limitations. The expansion swept in people whose claims were time-barred.
• Predominance collapsed. Sorting who fell inside the original definition versus the expanded one would require individualised inquiry — potentially a line-by-line review of terabytes of data — overwhelming the common questions Rule 23(b)(3) requires.
• No injunctive relief. The court found no named plaintiff showed a likelihood of future injury; there was no evidence Meta had collected data from any named plaintiff since 2023. Past exposure alone doesn't support forward-looking relief.
• A standing problem underneath it all. Discovery revealed Meta had received no tax-filing information about the named plaintiffs. The court emphasised that at certification, standing must be established by a preponderance of the evidence — not merely alleged as at the pleading stage.

Meta was represented by Gibson Dunn, with partner Lauren Goldman arguing. Status is stated as of publication; the denial of certification is not a merits judgment, and the docket (5:22-cv-07557-PCP) should be consulted for the latest.

How this fits the 2026 landscape

2026's CIPA docket splits into cases decided on theory and cases decided on procedure. On theory, courts are all over the map — Rounds v. DDI rejected the pen-register theory outright, while Podraza v. Nourish let wiretap and CIPA claims survive on inadequate consent. In re Meta Pixel Tax Filing Cases is the flagship of the procedural stream: a defendant winning on Rule 23 mechanics while the underlying theory stays intact.

The wider context matters too. Over 1,000 CIPA lawsuits were filed in 2025 alone, and the same fact pattern — a site running Meta, Google, LinkedIn, or TikTok trackers that transmit visitor data without adequate notice and consent — is being replicated across sectors. Courts continue to reach, in Holland & Knight's phrase, wildly different outcomes on key issues, and that uncertainty is precisely what keeps demand letters flowing.

Why this case matters for website operators

There's a comfortable misreading of this case: "Meta won, so the pixel cases are weakening." That reading is wrong in three specific ways, and each one costs money.

First, Meta didn't win on the merits. It won because the plaintiffs' lawyers defined their class one way in the complaint and a broader way at certification, colliding with a one-year limitations period. A different plaintiff, with a tighter class definition and a timely filing, faces none of those problems. The pen-register and wiretap theories against the Pixel were never rejected — they're still on the table.

Second, the merits ruling that did land went against the tracker. The court held Meta plausibly "uses" the Pixel because it transmits data in real time with no intervening actor. That's a finding about how the tool works on your site. And the allegation the court took seriously — that Meta receives some data before the website itself does — means the transmission you're responsible for happens before your own systems ever see it.

Third, and most importantly: you are not Meta. Meta had Gibson Dunn, years of discovery, and the resources to fight to certification and win on a procedural nuance. A mid-sized business facing a demand letter does not have that. Most defendants settle long before a Rule 23 argument, because the cost of reaching one exceeds the cost of the settlement.

What this means for your site

If you run the Meta Pixel — and most consumer-facing businesses do — the practical lessons here are technical, not procedural:

• Block the Pixel until consent. The entire chain the court described — real-time transmission to Meta with no intervening actor — only begins if the Pixel loads. Non-essential trackers should not fire until the visitor affirmatively agrees. That's the one control that removes the conduct being litigated.
• Never let sensitive data near a marketing tracker. The tax-filing fact pattern is the extreme version of a common problem: financial, health, or otherwise sensitive fields flowing into an ad platform. Meta's own terms preclude sending sensitive information through the Pixel — which means if it happens on your site, that's your exposure, not Meta's.
• Audit what actually transmits, not what you intended. The gap between "we installed a pixel for conversions" and "the pixel is sending URLs, IPs, and form context" is where these cases live. Verify it in the browser rather than assuming.
• Keep an auditable consent log. Timestamped proof of affirmative consent is the record that makes the all-party consent question straightforward instead of a four-year fight.

ConsentPixel — Privacy · Verified blocks the Meta Pixel and other third-party trackers at the browser level until the visitor consents, and logs every decision. It doesn't depend on how a future plaintiff drafts a class definition — it removes the pre-consent transmission that the theory is built on.