Key point: (1) Two courts denied class certification because plaintiffs could not prove a tracker on the page actually captured their data; (2) three courts held that search terms can be CIPA “contents,” but only when the plaintiff alleges her own communication rather than mere browsing; and (3) a Washington court dismissed claims after applying the website’s choice-of-law provision foreclosed the plaintiffs’ claims.
Key point: Four takeaways from August decisions: (1) a federal magistrate judge concluded CIPA § 631 does not apply to internet communications but that § 632 does; (2) a cookie banner that merely pointed to a privacy policy did not establish consent to third-party data sharing; (3) a banner that offers, but fails to honor, users a choice can supply the “confidential communication” element of a § 632 claim; and (4) a consent defense depends on whether the privacy policy actually describes the third-party disclosures that tracking technologies make.
Welcome to our monthly update on how courts across the U.S. have handled privacy litigation involving website tools such as cookies, pixels, session replay, and similar technologies. In this post, we cover decisions from August 2026. We are focusing on statutes that would not be impacted by the pending Senate Bill 690 (SB 690), which has passed the California Assembly and Senate and was sent to Governor Gavin Newsom for signature. Although SB 690 provides sweeping reform for defendants facing pen register and trap and trace claims under California law, it leaves §§ 631 and 632 untouched, along with every non-CIPA theory, including claims brought under the ECPA, CDAFA, and the California constitutional right to privacy, among them. The plaintiffs’ bar is widely expected to refocus on those theories, and the four takeaways from August decisions discussed below preview how that shift may play out, including where the fights over §§ 631 and 632 will occur, and why cookie banners and privacy policies will carry even more weight than they do today.
Key point: SB 690 passes the California legislatures and eliminates the private right of action for website-based pen register and trap-and-trace claims and reaches back two years, but it leaves CIPA §§ 631 and 632 and the federal Wiretap Act entirely intact.
Key point: Plaintiffs in Virginia have focused on a rarely tested state privacy statute with statutory damages that imposes notice-and-consent obligations on retailers that share or sell in-store customer data.
Most retailers have spent the last several years building their privacy compliance programs around the major comprehensive state privacy laws, such as Virginia’s Consumer Data Protection Act (CDPA), California’s Consumer Privacy Act (CCPA), and their counterparts in a dozen other states. A recent lawsuit filed in the Eastern District of Virginia is a reminder that older, narrower statutes can carry just as much litigation risk, and that the plaintiffs’ bar is actively looking for the next viable theory.
The statute at issue is the Virginia Personal Information Privacy Act (VPIPA). It has been on the books for decades. Until recently, however, it had produced exactly one lawsuit. That may be changing.
Key point: Amendments to California Senate Bill (SB) 690 would foreclose private rights of action for pen register and trap and trace law and apply to cases brought within previous two years.
The Privacy and Consumer Protection Committee of the California State Assembly heard testimony on support and opposition to SB 690 late Wednesday, July 1.
Key point: Three takeaways from May decisions: (1) cookie banners cut both ways for plaintiffs and defendants; (2) generic wiretapping “contents” allegations lose while transaction-specific ones survive; and (3) courts are splitting on whether a profit motive satisfies the crime-tort exception.
Welcome to our monthly update on how courts across the U.S. have handled privacy litigation involving website tools such as cookies, pixels, session replay, and similar technologies. In this post, we cover decisions from May 2026.
Key point: Two courts in 2026 have allowed CCPA claims to proceed based on adtech use without addressing whether adtech discloses “personal information” under the CCPA
According to plaintiffs’ interpretation of a May 2026 decision from the Northern District of California, if your company uses Google Analytics, Meta Pixel, or other third-party tracking technology on its website, you may be exposed to not only wiretapping or trap-and-trace claims under the California Invasion of Privacy Act (CIPA) or federal law, but also claims under the California Consumer Privacy Act (CCPA) even if you never experience a data breach.
Key point: (1) Plaintiffs who expand their class definition beyond the complaint risk losing both certification and their class representative on limitations grounds; (2) Banners that require users to interact before accessing website may be sufficient to establish consent; (3) What makes tracking “highly offensive” is becoming clearer; (4) the “in transit” requirement continues to divide courts; (5) Courts demand more than labels to survive a standing challenge.
Welcome to Part Two of our series that examines the ECPA as a private right of action for privacy policy inaccuracies. In Part One of this series, we examined how a wave of state-law wiretapping litigation — predominantly under California’s Invasion of Privacy Act (CIPA) — set the stage for a new and more expansive federal class action litigation threat. After years of plaintiffs targeting websites that deploy tracking technologies such as pixels and cookies, a series of defense wins in 2025 (and pending legislative action) encouraged plaintiffs’ firms to seek alternative theories. They found one in the Electronic Communications Privacy Act (ECPA).
Key Points: An August 2025 federal court ruling has opened the door for plaintiffs to use alleged inaccuracies or misrepresentations in a company’s privacy policy and other privacy disclosures as the basis for a federal wiretapping claim under the Electronic Communications Privacy Act (“ECPA”).
Unlike state wiretapping claims like CIPA, class action plaintiffs can file ECPA claims nationwide and they can carry statutory damages of $100 per day of violation or $10,000, whichever is greater. Plaintiffs’ firms are increasingly leading with ECPA claims in demand letters and class action complaints.
Companies can take steps to help insulate themselves from litigation by assessing and modifying their privacy policy and other data processing disclosures.
Any company with a privacy policy that operates a website using so-called tracking technologies such as pixels, cookies, software development kits, or third-party analytics tools (which is practically every company) should be aware of the real class action risk associated with the federal wiretapping law known as the Electronic Communications Privacy Act (ECPA or Wiretap Act) and its “crime-tort” exception. We have data mined and analyzed thousands of privacy lawsuits using AI to track plaintiff lawyers’ allegations and patterns.