Ortiz v. Foris Dax, Inc. (Crypto.com)

What the case is about

In October 2025, plaintiffs led by a consumer named Ortiz filed a putative class action against Foris Dax, Inc., the company that operates the cryptocurrency exchange Crypto.com, over the tracking technology on its website. The core allegation is one that's now familiar in 2026: that Crypto.com embedded third-party cookies and advertising/analytics pixels that captured visitors' data — IP addresses, device information, and browsing activity — and shared it with outside parties without valid consent.^[3]

But this case has a detail that sets it apart from the typical cookie complaint, and it's the reason the case matters. The plaintiffs allege they didn't just passively browse — they clicked "Disable All" on the site's cookie controls, affirmatively opting out of tracking. And the tracking, they say, continued anyway.^[2] That single fact reframes the whole dispute. This isn't "you tracked me without asking." It's "I told you to stop, and you didn't." A consent tool that doesn't actually stop tracking is, for litigation purposes, worse than no tool at all — because it proves the visitor's expectation of privacy while failing to honour it.

The two legal theories — and why they split

The plaintiffs pursued two distinct CIPA theories, and understanding the difference is the key to the whole ruling. They are not interchangeable, and this case turned on treating them separately.

Why the wiretapping claim (§631) was dismissed

The court dismissed the §631 claim — with leave to amend — for a reason that has become a consistent theme in 2026 rulings: the plaintiffs alleged only the categories of information the cookies were capable of collecting, not what communications of theirs were actually intercepted.^[1] To state a wiretapping claim, a plaintiff has to plead that the contents of a real communication were captured — the search terms they entered, the forms they submitted, the specific clicks they made. Alleging that you "browsed" a site whose cookies could collect data gives a court nothing to work with on the contents element.^[1]

The court made the same point about the "highly offensive" element of the privacy claim: the plaintiffs didn't specify what they actually did on the Crypto.com site beyond browsing, so the complaint couldn't establish that the intrusion crossed the "highly offensive" threshold.^[2] This is a recurring, learnable lesson — vague "the site tracked me" pleading loses on §631; specific "here is the content that was intercepted" pleading is what survives.

Why the pen-register claim (§638.51) survived

The pen-register claim is where Ortiz becomes genuinely significant. The court refused to dismiss it — and in doing so delivered one of the most thorough federal analyses yet of whether CIPA's pen-register provision applies to internet tracking at all. Its answer was yes.^[1]

The reasoning is worth understanding because it's the engine driving a large share of 2026 litigation. The court grounded its conclusion in both statutory text and legislative history: California borrowed its pen-register definition from a federal statute that Congress had already broadened in 2001 to cover internet-based tracking, and nothing in the California statute limits the provision to telephone lines or telephonic devices.^[4] On that reading, a cookie or pixel that captures IP addresses and device identifiers — the internet's equivalent of routing information — can plausibly be a "pen register" installed "without first obtaining a court order."

The bigger picture: a deepening federal–state split

What makes Ortiz impossible to read in isolation is that it lands on one side of a genuine, unresolved split — and the split, not any single ruling, is what determines outcomes right now.

On the federal side, courts have increasingly accepted that CIPA's pen-register provision reaches website tracking. Ortiz joins the AEG (Garcia v. Anschutz Entertainment Group) ruling, which delivered a similarly thorough federal endorsement grounded in the 2001 congressional expansion of the pen-register definition.^[1] On the state side, several California courts have gone exactly the opposite way: in Rodriguez v. Ink America, a Los Angeles court held in December 2025 that §638.51 "did not, and does not, criminalize the process by which websites communicate with users who choose to access them," reasoning that reading CIPA that broadly would render the CCPA meaningless.^[5]

Notably, the court declined to treat pending reform legislation (Senate Bill 690, which would exempt "commercial purpose" tracking from CIPA) as a guide to what the law means today. Until either the California legislature acts or an appellate court resolves the split, cases like Ortiz keep the pen-register theory firmly alive in federal court.^[1]

Where it stands (as of July 2026)

As of July 2026, the case is alive and proceeding on the pen-register theory. The May 21, 2026 order was a ruling on Crypto.com's motion to dismiss: the §631 wiretapping claim was dismissed with leave to amend (meaning the plaintiffs may try to re-plead it with the specificity the court found lacking), while the §638.51 pen-register claim survived and moves forward.^[2] The case is captioned Ortiz et al v. Foris Dax, Inc., No. 3:25-cv-08950-EMC, in the U.S. District Court for the Northern District of California, before Judge Edward M. Chen.^[6]

How Ortiz fits the 2026 landscape

Ortiz is best understood as the federal counterpart to the pen-register story — the "yes, this theory reaches websites" pole of the split, paired with a vivid opt-out fact. Read alongside its siblings, the pattern is clear:

The through-line across the surviving cases — Ortiz, AEG — is that the pen-register theory is strongest when paired with a fact that undercuts consent: cookies firing before a banner loads (AEG), or tracking continuing after a user clicks "Disable All" (Ortiz). Where a plaintiff alleges only generic metadata capture with no consent wrinkle, standing defenses like Khamooshi and the Popa v. Microsoft framework still knock claims out. The lesson isn't "pen-register claims always win" — it's "they win when your consent mechanism visibly failed."

Why this case matters for website operators

For website owners, Ortiz delivers two lessons that pull in the same direction. The first is about the pen-register theory's durability: in federal court, the argument that ordinary cookies and pixels are "pen registers" is not a fringe theory a judge will wave away — it now has some of the most thorough judicial reasoning behind it. If your site runs third-party trackers that capture IP addresses and device data, that theory can reach you.^[1]

The second lesson is sharper and more actionable: a consent banner that doesn't actually stop tracking is a liability, not a shield. The plaintiffs' "Disable All" allegation is what gave their case its teeth. If your cookie banner presents a "reject" or "disable" option but your trackers keep firing anyway — because the banner is cosmetic, or the tags aren't actually gated behind the consent choice — you've manufactured the exact fact pattern that helped Crypto.com's plaintiffs survive. You've created written proof that the visitor expected privacy, and then allegedly denied it.

What this means for your site

The durable lesson from Ortiz is that consent has to be real, not cosmetic. It isn't enough to show a banner; the "reject" or "disable" choice has to actually block the third-party trackers it promises to block, before they fire. The gap between a banner that looks like consent management and a system that actually enforces it is precisely the gap the Crypto.com plaintiffs are litigating.

That enforcement is exactly what ConsentPixel is built to do: it blocks third-party trackers until a visitor opts in, and when a visitor declines, those trackers genuinely don't fire — so a "Disable All" click means tracking actually stops. Just as importantly, ConsentPixel keeps an immutable log of each consent decision, so if a plaintiff ever claims their opt-out was ignored, you have a timestamped record showing what was blocked and when.

And because this case — like most in the 2026 wave — began with third-party tags a site owner may not have realised were still firing after opt-out, the first, cheapest step is simply to see what actually runs on your pages before and after a visitor rejects consent. If anything fires when it shouldn't, that's your Ortiz exposure, in plain sight.

Disclaimer: This page is for general informational purposes only and is not legal advice. Case details are drawn from public court records and the legal reporting listed above; the case is Ortiz et al v. Foris Dax, Inc., No. 3:25-cv-08950-EMC (N.D. Cal.), before Judge Edward M. Chen, and the ruling described is a May 21, 2026 order on a motion to dismiss, not a final judgment. Status is stated as of July 6, 2026 and litigation can change. ConsentPixel — Privacy · Verified is not a law firm and does not provide legal counsel. For advice on your specific situation, consult a qualified privacy attorney.