Costello v. Posh Peanut: Five Trackers, Five Claims, One Ordinary Store
An online children's-clothing store gets sued over the five advertising trackers running on its checkout — Meta, Google, TikTok, Klaviyo, and AppLovin — under five different privacy laws at once. There is nothing exotic about this storefront, and that's exactly why every direct-to-consumer brand should read the complaint.
Case snapshot
- Case
- Costello v. Posh Peanut, Inc.
- Court
- U.S. District Court, Southern District of California
- Case number
- 3:26-cv-04883
- Filed
- August 26, 2026
- Plaintiff / Defendant
- Jenny Costello (Carlsbad, CA) v. Posh Peanut, Inc. (Glendale, CA children's clothing retailer)
- Legal theories
- Federal Wiretap Act (ECPA); CIPA §631 (wiretapping); CIPA §632 (recording confidential communications); California Comprehensive Computer Data Access and Fraud Act (CDAFA); California constitutional invasion of privacy
- Tracking at issue
- Meta (Facebook Pixel), Google (Analytics & DoubleClick), TikTok Pixel, Klaviyo "Active on Site," AppLovin "Axon" pixel
- Data alleged captured
- Names, emails, phone numbers, product details, URLs, timestamps, advertising identifiers
- Class
- Anyone who made a purchase on poshpeanut.com
- Status
- Filed · allegation stage No settlement, no claims process, no money available. Allegations are unproven.
On this page
The Posh Peanut lawsuit is the case that should make every online store owner uncomfortable, precisely because there's nothing special about it. Posh Peanut is a direct-to-consumer children's-clothing brand. Its website runs the same advertising and marketing trackers that sit on a huge share of e-commerce sites: the Meta Pixel, Google Analytics, a TikTok pixel, a Klaviyo email tag, and an ad-tech pixel. The complaint in Costello v. Posh Peanut alleges those trackers captured customers' personal and purchase information and shared it with third parties without consent — and it pleads five separate legal theories to say so. If a boutique baby-clothes store can draw a five-count privacy complaint over a textbook marketing stack, the exposure isn't about Posh Peanut. It's about the stack, which almost every store is running.
What the case is about
Filed August 26, 2026 in the Southern District of California, Costello v. Posh Peanut, Inc. alleges that the retailer embedded tracking code from five advertising and marketing firms on poshpeanut.com, and that this code captured customer data and transmitted it to those third parties without consent. The named plaintiff, a California resident who made a purchase on the site, seeks to represent a class of everyone who bought from the store.
The five trackers named are mainstream to the point of being default: Meta's Facebook Pixel, Google Analytics and DoubleClick, a TikTok Pixel, Klaviyo's "Active on Site" tracking (a common email-marketing tool), and AppLovin's "Axon" pixel. The complaint says the data captured included names, email addresses, phone numbers, product details, URLs, timestamps, and advertising identifiers — in other words, the full picture of who a shopper is and what they bought.
The detail that makes it matter
The striking feature here is how normal the setup is. A marketing team didn't do anything unusual to end up as a defendant. Meta Pixel for ad conversion tracking, Google Analytics for traffic, TikTok for social ads, Klaviyo for email flows, an ad-tech pixel for retargeting — this is the recommended, best-practice toolkit that every "how to grow your Shopify store" guide tells founders to install. The complaint's theory is that running them the standard way, firing on customer data before consent, is what creates the violation.
There's a second detail worth naming carefully. Posh Peanut sells children's products. The class is defined as purchasers (adults buying for kids), not children — but the sensitivity of the category, and the possibility that data could relate to products for minors, is the kind of fact that tends to sharpen a privacy complaint and attract attention. For any store in a sensitive vertical — kids, health, finance — the lesson is that the category raises the stakes of the exact same tracking setup.
How many trackers fire on your checkout?
This case is about five tags firing on customer data before consent. ConsentPixel's free scanner loads your store and lists every tracker — Meta, Google, TikTok, Klaviyo and the rest — that fires before a shopper agrees, so you can see your own count in minutes.
Scan my store free →Five theories, explained
What makes this complaint notable isn't one novel argument — it's the stack of five, each giving the plaintiff a different path to the same destination. Pleading several theories is a deliberate tactic: a defendant has to defeat all of them, and the plaintiff only needs one to stick.
The stacking matters for a second reason: damages. CIPA attaches statutory damages of $5,000 per violation under Cal. Penal Code §637.2, independent of whether any shopper suffered measurable harm. When a class is defined as "everyone who purchased on the site," and each purchase potentially involves multiple trackers, the arithmetic a plaintiff can put in front of a defendant becomes enormous very quickly — which is exactly what gives these complaints their settlement pressure. The dollar figure isn't a prediction of what a court would award; it's the leverage that makes settling feel safer than litigating. Understanding that math is the first step to not being stampeded by it.
The "ordinary stack" problem
Here's the trap a lot of founders are in without realizing it. Every growth playbook says: install the Meta Pixel to optimize ads, add Google Analytics to understand traffic, drop in a TikTok pixel for social, wire up Klaviyo for email, layer on retargeting. Each tool, individually, is standard and sensible. But each one is also a third party that receives customer data — and when they all fire on page load, before a shopper has consented, the store has assembled exactly the fact pattern these complaints describe.
The uncomfortable implication is that doing marketing "right" by conventional standards is what builds the exposure. The number of trackers isn't a sign of a badly run store; it's a sign of a well-marketed one. That's why the fix isn't "use fewer tools" so much as "make sure the tools you use wait for consent before they fire" — a control most default installations simply don't have out of the box.
There's a wrinkle that makes this harder than it first appears, and it's worth being honest about. A lot of stores have moved part of their tracking server-side — using tools like Meta's Conversions API or Google's server-side tagging — partly for performance and partly in the belief that it's "more private." It usually isn't more private in the way that matters here: server-side tracking can still transmit the same customer data to the same platforms, it just does so from your server instead of the shopper's browser. That means a consent control bolted onto the front end can miss it entirely, and it means a browser-only audit understates the real data flow. The practical takeaway: when you check what your store shares, account for both the client-side tags a scan can see and the server-side connections your marketing tools may be making behind them. The complaint's theory doesn't care which pipe the data leaves through — only that it left before consent.
How it fits the 2026 landscape
Place Posh Peanut on the tracker next to the healthcare and publisher cases and the spectrum completes itself. The theory has now reached ordinary retail.
| Case type | Site | Data | What it adds |
|---|---|---|---|
| Healthcare | Patient portals | Health info | Sensitive data draws claims |
| Publisher (Forbes) | News site | IPs, ad IDs | Non-sensitive data still draws claims |
| E-commerce (Posh Peanut) | Online store | Purchase + contact data | The everyday marketing stack is enough |
Retail is the broadest category of all — there are millions of online stores, and the overwhelming majority run some combination of the five tags named here. Posh Peanut is the case that says the theory isn't reserved for hospitals or big media; it's pointed at the long tail of ordinary commerce.
What this means for your store
If you run an online store, you can treat this complaint as a checklist written specifically for you:
Key takeaways
- An ordinary store, an ordinary stack. Posh Peanut was sued over the Meta, Google, TikTok, Klaviyo, and AppLovin tags most e-commerce sites run.
- Five theories in one complaint. ECPA, CIPA §631, CIPA §632, CDAFA, and constitutional privacy — the defense has to beat all five.
- SB 690 doesn't help. The claims rest on §631/§632, which the reform leaves intact.
- Good marketing builds the exposure. The number of trackers reflects a well-marketed store, not a careless one — the fix is consent gating, not fewer tools.
- Your vertical matters. Selling to sensitive categories raises the stakes of the same setup.
Frequently asked questions
What is the Posh Peanut lawsuit about?
Costello v. Posh Peanut, Inc. is a proposed class action alleging that the online children's-clothing retailer ran five advertising and marketing trackers — the Meta Pixel, Google Analytics/DoubleClick, a TikTok pixel, Klaviyo's Active on Site tracking, and AppLovin's Axon pixel — that captured customer data (names, emails, phone numbers, purchase details, and more) and shared it with third parties without consent. It was filed August 26, 2026 in the Southern District of California. The allegations are unproven and there is no settlement.
What laws does the complaint use?
Five: the federal Wiretap Act (ECPA), CIPA §631 (wiretapping), CIPA §632 (recording confidential communications), California's Comprehensive Computer Data Access and Fraud Act (CDAFA), and California's constitutional right to privacy. Pleading multiple theories is a common tactic — the plaintiff only needs one to succeed, while the defendant must defeat all of them.
These are standard marketing tools — how can running them be a problem?
That's the central point of the case. The Meta Pixel, Google Analytics, TikTok pixel, and Klaviyo are mainstream, recommended tools. The complaint's theory isn't that they're unusual — it's that running them in the default way, so they fire on customer data before consent, matches the conduct these privacy statutes prohibit. Being a standard tool is not a defense; what matters is whether it transmits before the shopper agrees.
Is there a settlement or money to claim?
No. As of October 2026 the case is at the allegation stage — recently filed, with no settlement, no claims process, and no money available. It's included on the tracker because it illustrates how the theory is reaching ordinary e-commerce, not because there's a payout to pursue.
Does SB 690 protect my store from a case like this?
No. SB 690 narrows the §638.51 pen-register theory, which this complaint doesn't even use. The claims here rest on §631 and §632 — the wiretapping and recording theories SB 690 leaves fully intact and privately enforceable — plus federal and constitutional claims the reform doesn't touch.
What should my online store do?
Find out how many third-party trackers you run and whether they fire before consent. Most stores underestimate both. Then make sure trackers are actually blocked until a shopper consents — not merely that a cookie banner appears while the pixels have already loaded. A privacy scan shows the firing order and the full tracker list in minutes, which is the fastest way to see whether you're running the setup described in the complaint.
The bottom line
Posh Peanut is the case that closes the "it won't happen to a store like mine" loophole. No sensitive health data, no household-name publisher — just a direct-to-consumer brand running the exact marketing stack that every growth guide recommends, now facing a five-count privacy complaint over it.
The number of trackers on your store is a measure of how well you market, not how carelessly. The fix isn't to stop marketing — it's to make every one of those tags wait for consent before it fires. Seeing which ones currently don't is a five-minute scan.
Count the trackers on your store — free
See every tag — Meta, Google, TikTok, Klaviyo and more — that fires before a shopper consents. It's the exact setup at the center of the Posh Peanut complaint.
Scan my store free →