Author: Hayley Ryan

Read Hayley's bio.
Posted on by Gerald L. Maatman, Jr.

Fifth Circuit Reverses Dismissal Of Adtech Class Action On Narrow Grounds, Finding Sufficient Factual Allegations Of Disclosure Of PHI

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick

Duane Morris Takeaways:  On October 23, 2026, in Rand, et al. v. Eyemart Express, LLC, 2026 WL 3180055 (5th Cir. Oct. 23, 2026), the U.S. Court of Appeals for the Fifth Circuit reversed an order by the U.S. District Court for the Northern District of Texas in which the district court had dismissed a class action brought by website users alleging that a prescription eyewear seller’s use of website advertising technology (“adtech”) violated the Electronic Communications Privacy Act (“ECPA”) and other laws. 

This ruling is significant in that it shows that in the hundreds of adtech class actions across the nation seeking millions (or billions) in dollars in statutory damages under the ECPA and other laws, courts ruling on Rule 12(b)(6) motions and drawing all reasonable inferences in the light most favorable to plaintiffs may find plausible allegations that a website operator in fact transmitted private information to an adtech company, such that website owners seeking to challenge adtech class actions under Rule 12(b)(6) may find more success in foregoing such factual challenges to well-pled allegations and instead pressing more legal arguments such as that alleged adtech transmissions do not plausibly allege an “interception” or a “criminal or tortious purpose” under the ECPA. 

Background

This case is one of a legion of class actions that plaintiffs have filed nationwide alleging that Meta Pixel, Google Analytics, and other similar software embedded in defendants’ websites secretly captured plaintiffs’ web-browsing data and sent it to Meta, Google, and other online advertising agencies and/or data analytics companies.  In these adtech class actions, the key issue is often a claim brought under the ECPA on the theory that hundreds of thousands of website visitors times $10,000 per claimant in statutory damages equals a huge amount of damages.  Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including education, retailers, and consumer products.  Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided.

To state a claim for violation of the ECPA, also known as the federal wiretap act, a plaintiff must show an intentional interception of the contents of an electronic communication.  The ECPA is a one-party consent statute, meaning that there is no liability under the statute for any party to the communication “unless such communication is intercepted for the purposes of committing a criminal or tortious act in violation of the Constitution or laws of the United States or any State.”  18 U.S.C. § 2511(2)(d)); 18 U.S.C. § 2511(2)(d).

In Rand, plaintiffs, Meta users who had already shared their names, photos, and other personal information through their Facebook accounts, brought suit against a seller of prescription eyewear.  According to the plaintiffs, the eyewear seller installed the Meta Pixel on its website, thereby transmitting to Meta, allegedly without the plaintiffs’ consent, the following data about their visits to the website: (1) search terms and web browsing activities, as to those plaintiffs who used the site to search and browse for prescription glasses (the “Search Plaintiffs”); (2) prescription information, as to plaintiffs who made purchases on the site (the “Prescription Plaintiffs”); and (3) as to both sets of plaintiffs, an anonymized identifier sufficient for Meta to link these search terms, web-browsing activities, and prescription information to the plaintiffs’ Facebook profiles and send them targeted advertisements.  Id. at *2.

The plaintiffs also alleged that these allegedly transmitted data types met the definition of individually identifiable health information (“IIHI”) protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Further, the plaintiffs alleged that these alleged data transmissions of IIHI without consent violated the ECPA, the Missouri Wiretap Act, and Illinois Eavesdropping act, and constituted an intrusion upon seclusion and breach of contract.

The district court dismissed the complaint under Rule 12(b)(6), finding that the Search Plaintiffs failed to state a claim for relief because they did not allege that they shared any IIHI with the eyewear seller.  As to the Prescription Plaintiffs, the district court acknowledged that they allegedly shared IIHI with the eyewear seller by entering their prescription information but found that they had failed to plausibly allege that any IIHI was disclosed to Meta.  Without sufficient allegations that any plaintiff’s IIHI was shared with Meta, the district court concluded that each of the plaintiffs’ claims necessarily failed.  Id. at *1-2.

On appeal, the plaintiffs argued that the district court’s dismissal order should be reversed and their class action complaint reinstated because they adequately alleged both that they shared their IIHI with the defendant and that the Pixel on defendant’s website conveyed that IIHI to Meta without their knowledge or consent.

The Fifth Circuit’s Decision

The Fifth Circuit agreed with the plaintiffs and reversed, finding, first, that the district court erred in finding lack of any plausible allegations that the Search Plaintiffs did not share any IIHI with the defendant.  As the Fifth Circuit explained, the defendant conceded that the information received through the Pixel was individually identifiable because through Facebook, the information was linked to specific users.  Id. at *5.   Moreover, the Fifth Circuit found that the Search Plaintiffs adequately alleged that they shared information relating to their health conditions or the provision of healthcare by using website.  Specifically, the Fifth Circuit found that while the Search Plaintiffs did not allege the transmission of diagnoses or symptoms, “IIHI is not so narrow” and also includes information collected from an individual that “relates to” an individual’s health or condition, to the provision of healthcare to an individual, or the individual’s payment for healthcare.  Thus, taking the plaintiffs’ allegations as true, the Fifth Circuit held that the district court erred in finding that the Search Plaintiffs had not shared any IIHI with the defendant.  Id. at *5-7.

Second, the Fifth Circuit found that the district court also erred in finding that the plaintiffs failed to plead that their IIHI was shared with Meta.  The district court had considered a figure from the complaint representing an example of transmitted data (created by the plaintiffs’ attorney, not representing plaintiffs’ activity), reasoning that it did not sufficiently specify transmission of the either plaintiffs’ data or any prescription information.  Accordingly, the district court found that the complaint did not sufficiently allege that any IIHI was shared with Meta.  Id. at *7.  The Fifth Circuit disagreed. It opined that IIHI is not so narrow that it applies only to specific prescription information and includes, also, interactions on the website relating to plaintiffs’ health.  Moreover, the Fifth Circuit found that the figure in the complaint was provided only by way of example and did not contradict other factual allegations that the Fifth Circuit found alleged the transmission of data to Meta relating to the “Prescription Plaintiffs’ actual purchases.”  Id.

For these reasons, the Fifth Circuit reversed the dismissal order and remanded for further proceedings.

Implications For Companies

Rand is a cautionary tale for defendant website operators seeking to dismiss adtech class actions under Rule 12(b)(6) on the basis that plaintiffs failed to plausibly allege that the defendant transmitted the plaintiffs’ private data to an adtech company. 

While whether any given plaintiff’s private data was in fact transmitted to an adtech company by a website operator remains an individualized issue dependent on browser type, social media account login status, and cookie blocking features, which courts have found sufficiently individualized to prevent named plaintiffs from establishing the defendant’s liability to alleged class members under Rule 23 (as we blogged about here and here), courts must, however, take any allegations of adtech transmissions as true for purposes of Rule 12(b)(6).

For these reasons, adtech class action defendants bringing Rule 12(b)(6) motions often argue for and sometimes achieve dismissal of ECPA claims, instead, on the basis of no plausibly alleged interception, when an internet-based communication is allegedly forwarded to an adtech company as opposed to being intercepted mid-flight, and no plausibly alleged criminal or tortious purpose where the plaintiffs fail to allege that the defendant had the purpose to violate any statute but allege a purpose rather to engage in advertising or data analytics.  (See, e.g., our prior blog entry discussing one of these successful dismissals, here.)  Notably, the Fifth Circuit’s decision in Rand did not address these arguments.  Website owners facing adtech ECPA class actions would do well to press such arguments where appropriate.

Corporate counsel seeking to deter ECPA litigation should also keep in mind the following best practices (discussed in more detail in our prior blog post, here): (1) add or update arbitration clauses to deter class actions and mitigate the risks of mass arbitration; (2) update website terms of use, data privacy policies, and vendor agreements; and (3) audit and adjust uses of website advertising technologies.

Posted on by Gerald L. Maatman, Jr.

Illinois Federal Court Denies Class Certification In Employer Wiretapping And Eavesdropping Case Due To Lack Of Common Evidence Of Call Recording

By Gerald L. Maatman, Jr., Justin R. Donoho, and Hayley Ryan

Duane Morris Takeaways:  On October 15, 2026, in Alholm, et al. v. The Vrdolyak Law Group, LLC, No. 22-CV-1820, 2026 WL 3082834 (N.D. Ill. Oct. 15, 2026), Judge Georgia N. Alexakis of the U.S. District Court for the Northern District of Illinois denied class certification in a case brought by former employees against a law firm alleging that the company secretly recorded their telephone conversations in violation of the federal wiretap act, Tennessee’s wiretap act, and Illinois’ eavesdropping act.  The ruling is significant as it shows that while plaintiffs’ circumstantial evidence of one plaintiff’s call recordings and of the employer’s history of surveillance may suffice to withstand summary judgment on plaintiffs’ individual claims for illegal wiretapping and eavesdropping, Rule 23 requires more evidence than that in order for plaintiffs to show that the central issue of whether alleged class members’ calls were recorded is a common question that can be resolved in one stroke with common evidence.  Further, the ruling shows that absent such common evidence on the central issue of whether a company recorded any or all of the calls made over its system, proposed classes of people who had conversations over the system cannot satisfy Rule 23(b)(3)’s predominance requirement.

Background

In Alholm, former employees of a law firm brought suit against their former employer alleging that the firm secretly recorded their telephone conversations while each was employed there.  They brought class claims for illegal wiretapping under 18 U.S.C. § 2511 and section 39-13-601 of the Tennessee Code, and for illegal eavesdropping under section 5/14-1 of chapter 720 of the Illinois Compiled Statutes.

The company answered the complaint, the parties engaged in discovery, and the court denied summary judgment to the company and ordered the setting of a trial date.  In so holding, the court found a genuine factual dispute as to whether the employer actually intercepted and eavesdropped upon the plaintiffs’ calls and did so intentionally, based on conflicting circumstantial evidence submitted by both parties as to whether the company recorded the plaintiffs’ calls.  Alholm, et al. v. Vrdolyak L. Grp., LLC, 2026 WL 1194954 (N.D. Ill. May 1, 2026).

On the one hand, Plaintiffs submitted evidence consisting of call recordings of one of the former employees purportedly discovered on the system by one of the former employees, evidence that the phone system has a call recording feature that only would have been activated at the request of the employer, and evidence from which the court found that “a reasonable jury could conclude that [the company] had a history of intentionally monitoring its employees and that its call recording was the result of defendant’s conscious objective rather than the product of a mistake or an accident.”  Id. at *13.

But the court found other evidence pointing the other way, including testimony from the phone system provider that the system could record a call on an individual phone line if the user of the line dialed a specific key code during the call.  In addition, the phone system provider testified that the call recording could have been turned on only for the one named plaintiff who had found the recordings of the allegedly intercepted calls.  Further, the phone system provider testified that the employer never asked it to activate the system’s call-recording function, that the function had never been activated, and that the system lacked the storage capacity and processing power to record employer’s high volume of calls.  Members of the employer’s senior leadership also testified that they never authorized the recording of calls.  Id.

Before trial, the plaintiffs moved for class certification, seeking to certify classes consisting of all employees, clients, and potential clients of the employer who had a telephone conversation between November 1, 2019, and January 28, 2020, with a person using the employer’s telephone system.

The Court’s Decision

The Court found that the central question of the case of whether calls made over the company’s phone system were recorded was an individualized issue that predominated over any common issues and, accordingly, denied class certification for lack of predominance, without deciding any other Rule 23 requirement.

As the Court explained, for all three wiretapping and eavesdropping claims, the question “that towers over all others” is whether calls made over the company’s phone system were recorded.  Alholm, 2026 WL 3082834, at *3. 

So, first, the Court considered whether that question can be answered, yes or no, using common evidence. 

The Court found that the plaintiffs lacked common evidence of call recordings.  First, it found that evidence of the company’s pervasive surveillance through the use of video cameras and encouragement of employees to monitor subordinates might be admissible for showing intent but not for establishing actual recording of calls made over the phone system.

Second, the court ruled that the recordings of only one plaintiff’s calls did not constitute common evidence of class-wide recordings because plaintiffs lacked any “glue” holding these calls “together with the calls of the other class members—some fact showing that if [one plaintiff]’s calls were recorded then those of other class members were as well.”  Id. at *5.  For example, the court noted conflicting testimony from the phone system’s administrators as to whether the system could only record calls on a system-wide basis.  Moreover, additional testimony showed that recordings could be made on the phone system not just by the company and its system administrators but also individually by end users.  Id. at *6-9.

For these reasons, the Court determined that the plaintiffs lacked common evidence of call recording by the company. 

Further, the Court opined that because this question of whether the company recorded any or all of the calls made over its system is the central issue in the case and, owing to a lack of common evidence, is not a common once, “the proposed class cannot satisfy Rule 23(b)(3)’s predominance requirement, and the class cannot be certified.”  Id. at *9. 

Finally, the Court held that because the plaintiffs’ failure to satisfy predominance was enough to preclude class certification, the Court declined to assess whether the proposed class satisfied the other requirements of Rule 23(a) and Rule 23(b)(3).  Id. at * 10.

Implications For Companies

Alholm provides powerful precedent for any company opposing certification of wiretapping and eavesdropping class actions involving alleged call recordings where plaintiffs lack common evidence to show a class-wide practice of making call recordings. 

This precedent is also key for limiting any large statutory penalties under wiretapping and eavesdropping statutes ($10,000 under the federal wiretap act, for example) to only such penalties sought individually by any named plaintiffs who have filed a complaint and amassed enough evidence to go to trial on whether the company recorded their own individual phone calls. 

In sum, as Aholm demonstrates, a former employee’s circumstantial evidence that the employer recorded his or her calls, even if sufficient to go to trial on the former employee’s individual claims, alone, may not suffice for that former employee to represent and go to trial on behalf of other former employees, who may need to prove their own call recordings individually.

Posted on by Gerald L. Maatman, Jr.

California Legislature Halts Class Actions Alleging That Common Website Advertising Technologies Are Pen Registers And Trap And Trace Devices

By Gerald L. Maatman, Jr., Justin R. Donoho, and Hayley Ryan

Duane Morris Takeaways:  On September 30, 2026, California Governor Newsome signed Senate Bill 690, which amends the California Invasion of Privacy Act (“CIPA”) to eliminate the private right of action under California Penal Code § 638.51 for pen register and trap-and-trace device claims arising from website, online application, and mobile application activity. Under the amended statute, only the California Attorney General may bring such claims against private actors. The law takes effect on January 1, 2027, and it applies retroactively to any pending claim in an action commenced within two years before that date. For the thousands of companies now facing CIPA § 638.51 class actions and demand letters over the use of pixels, cookies, and similar website advertising technologies (“adtech”), Senate Bill 690 offers significant and fast relief. It is not, however, the end of CIPA litigation. The wiretapping provision (§ 631) and the eavesdropping provision (§ 632), which plaintiffs have also used in adtech cases, are untouched.

The bill’s final form is much narrower than the version first introduced. As introduced, Senate Bill 690 would have exempted all processing of personal information for a “commercial business purpose” as defined by the California Consumer Privacy Act (“CCPA”) from civil and criminal liability under all three sections of the CIPA. See Assembly Committee On Privacy And Consumer Protection Committee Report (July 1 , 2026) (“Committee Report”) at 6-7. The analysis in our blog post covers the legal landscape that led to the bill, the scope and mechanics of the enacted statute, how the bill narrowed during the legislative process, and what corporate counsel and class action practitioners should do now.

Background

The CIPA was adopted in 1967 to criminalize wiretapping, eavesdropping, interception, and recording of telephone communications without court authorization. Section 637.2 confers a private right of action to any person injured by a violation of the CIPA. Available relief includes statutory damages of $5,000 per violation, three times the actual damages suffered by the plaintiff, if any, and injunctive relief. Section 637.2(c) specifically provides that plaintiffs do not need to show actual damages. The Assembly Committee on Privacy and Consumer Protection observed that, in the adtech context, these violations “can stack up rapidly, causing defendants to face potentially devastating liability.” See Committee Report at 7.

Recent adtech litigation has relied on three CIPA provisions: § 631 (wiretapping), § 632 (recording confidential communications), and § 638.51 (pen registers and trap-and-trace devices). Section 638.51 was added only in 2015, and according to the Assembly Committee on Privacy and Consumer Protection, the Legislature gave “little, if any, thought” to how it would apply online or interact with the CIPA’s private right of action. See Committee Report at 1. The Committee called the pen register and trap and trace device statute “a poster child for abusive lawsuits,” explaining that “[b]ecause the potential liability can be staggering, businesses generally settle this litigation hastily, encouraging vexatious litigants to continue blasting out demand letters.” See id. at 1.

The case law gave businesses little certainty.  For example, federal district courts in California are split as to whether third-party collection of website-user information may constitute a trap and trace device or pen register under § 638.51.  California state trial courts, by contrast, have mostly dismissed these claims, as in Licea v. Hickory Farms LLC, No. 23STCV26148, 2024 WL 1698147 (Cal. Super. Ct. Mar. 13, 2024), Casillas v. Transitions Optical, Inc., No. 23STCV30742, 2024 WL 4873370 (Cal. Super. Ct. Sep. 9, 2024), and Sanchez v. Cars.com Inc., No. 24STCV13201, 2025 WL 487194 (Cal. Super. Ct. Jan. 27, 2025). The Committee noted that there is no published California appellate authority applying § 638.51 to software. See Committee Report at 16. According to the bill’s sponsors, § 638.51 lawsuits rose from about 600 to nearly 4,000 after SB 690 was introduced, and tens of thousands of businesses received demand letters. See id. at 7.

What Does SB 690 Change?

SB 690 amends only § 637.2, the CIPA’s civil remedies provision. Its main features are as follows:

  • AG-Only Enforcement For Online Pen Register And Trap-And-Trace Claims. An action against a private actor for a violation of § 638.51 “alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”
  • The Private Right Of Action Otherwise Remains. Subdivisions (a) and (b) of section 637.2 still authorize private suits for statutory damages, treble damages, and injunctive relief for all other CIPA violations, now subject only to the new subdivision (d) exception. The no-actual-damages provision in subdivision (c) also remains.
  • Retroactivity. The amendments “apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation.” The Committee explained that this provision is meant to relieve defendants in pen register lawsuits filed within the two-year period before January 1, 2027. It also stated that the amendments would not affect any case in which final judgment has been entered.
  • Severability. The Committee explained that a severability clause was added “in view of possible constitutional challenges to the retroactivity provisions.” See Committee Reportat 25.

Who And What Is Covered?

The carve-out is narrow and depends on four elements. First, it applies only to claims under § 638.51. Second, it applies only to actions against a “private actor.” Third, the claim must be “alleged to arise from conduct occurring on” a website, online application, or mobile application. Fourth, it removes only private standing. The underlying prohibition in § 638.51 remains, and the Attorney General may pursue violations using the remedies the CIPA already provides.

SB 690 does not define “private actor,” and it does not explain when conduct “arise[s] from conduct occurring on” a website or app. Defendants should expect plaintiffs to test those terms. Possible targets include back-end service providers to websites and apps, such as companies that provide payroll, shipping logistics, cybersecurity and antifraud technology, cloud storage, HR, and analytics and advertising tools, which the bill’s sponsors noted had also been sued.

How Did The Bill Change During The Legislative Process?

The introduced and enacted versions of SB 690 differ significantly. As introduced, the bill would have exempted any “commercial business purpose,” as defined by the CCPA, from both civil and criminal liability under the CIPA. The enacted version does much less: it removes private standing only for certain § 638.51 claims. The introduced bill would have changed CIPA §§ 631, 632, 632.7, and 638.51. The Committee’s amendments struck all changes to §§ 631, 632, 632.7, and 638.50, so the enacted law amends only § 637.2, the CIPA’s civil remedies provision. See Committee Report at 25-26.

The two versions also differ in reach. The original bill applied to all civil and criminal violations, was not limited to website activity, and could have covered any recording or interception of a confidential communication made for a commercial business purpose. Id. at 15. The enacted bill leaves criminal liability unchanged, focuses only on the civil private right of action against private actors, and is limited to conduct occurring on an internet website, online application, or mobile application. Further, the original bill did not provide for public enforcement, while the enacted version gives the California Attorney General standing to pursue these pen register and trap-and-trace violations using the remedies the CIPA already provides. The enacted version also adds two provisions the original bill did not have: retroactive application to pending claims in actions commenced within two years before the operative date, and a severability clause added in view of possible constitutional challenges to that retroactivity.

The Committee called the original bill “too blunt” and warned that the bill could “unintentionally shield wiretapping violations that involve highly offensive intrusions.” See Committee Report at 2, 25. The Committee also treated the trap and trace device and pen register statute differently from the other provisions, noting that trap and trace device and pen register cases usually involve “seemingly innocuous technical violations arising from ordinary operation of websites.” Id. at 2. By contrast, it found that §§ 631 and 632 cases often involve “highly offensive intrusions on users’ reasonable expectations of privacy, although they are not immune from abuse.” Id.  The narrowed bill passed the Legislature unanimously in late August 2026.

What SB 690 Does Not Do

Claims under Sections 631 (wiretapping) and 632 (eavesdropping), which carry the same $5,000 per-violation exposure, remain available to private plaintiffs in class action litigation. The Committee acknowledged that § 631 “continues to be challenging for courts to apply” to conduct occurring on websites. See Committee Report at 2. It concluded that targeted reform of § 631 “appears warranted, albeit not as urgent as reforms to the pen register statute.” Id. at 24. The Committee also noted that plaintiffs have moved toward other theories, including claims under California’s Comprehensive Computer Data Access and Fraud Act and the federal Electronic Communications Privacy Act. Id. at 25. In his signing message, Governor Newsom noted that “additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants,” and “urge[d] the Legislature to take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation.”

Implications For Companies

SB 690 should sharply reduce the volume of § 638.51 class actions and demand letters. In the short term, however, the plaintiffs’ bar may shift its claims rather than abandon them. Companies with any online presence, including websites, mobile applications, and online forms and applications, should consider the following steps.

  • Assess Pending § 638.51 Matters Now. For cases filed within the two-year retroactivity window, defendants should consider motions for judgment on the pleadings or dismissal once the law becomes operative on January 1, 2027, and should consider seeking stays in the meantime. Defendants should also reconsider their settlement posture on pen register-only demands.
  • Expect The Retroactivity Provision To Be Challenged. The Legislature added the severability clause because it anticipated constitutional challenges. Defendants should be prepared to defend retroactive application.
  • Expect Claims To Be Repleaded Under §§ 631 and 632. Plaintiffs asserting trap and trace device and pen register claims under § 638.51 are likely to recast adtech, claims as wiretapping or eavesdropping claims, particularly where descriptive URLs, search terms, or health information are involved, as adtech plaintiffs typically argue that such items constitute “contents” of a communication under § 631 and that transmission of such items to adtech companies constitutes “eavesdropping” or aiding and abetting eavesdropping under § 632. These claims still carry $5,000 per-violation statutory damages and remain suitable for class treatment.  Of course, adtech plaintiffs will continue to face numerous significant legal challenges regarding the merits and certifiability of their §§ 631 and 632 claims, as we blogged about here, here, and here.
  • Continue Auditing Website Advertising Technologies. The relief provided by SB 690 fails to limit exposure not only under the CIPA §§ 631 and 632 but also under the Electronic Communications Privacy Act (ECPA), the Video Privacy Protection Act (VPPA), the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA), the Florida Security of Communications Act (FSCA), and other state and federal privacy statutes. Companies should continue to review and evaluate their adtech, data practices, consent mechanisms, and privacy notices, in light of rapidly evolving legal precedent regarding whether these old statutes apply to adtech, to ensure compliance with these other privacy laws.
  • Watch The 2027 Legislative Session. Given the Governor’s call for further reform, additional CIPA amendments are a realistic possibility.

Companies should consider Senate Bill 690 as a narrow solution providing limited relief to adtech defendants rather than a comprehensive reform. Companies that treat it that way will be better positioned for the next phase of CIPA class action litigation.

Posted on by Gerald L. Maatman, Jr.

California Federal Court Denies TikTok’s Motion To Dismiss Children’s Privacy Claims Based on Prior Class Action Settlements

By Gerald L. Maatman, Jr., Justin R. Donoho, and Hayley Ryan

Duane Morris Takeaways:  On September 23, 2026, in the case of In Re TikTok, Inc., Minor Privacy Litigation, No. MDL 25-3144, ECF No. 414 (C.D. Cal. Sept. 23, 2026), Judge George H. Wu of the U.S. District Court for the Central District of California issued a tentative ruling (adopted as final on September 24, 2026) denying TikTok’s motion to dismiss the Second Amended Consolidated Class Action Complaint in a multidistrict litigation brought by minors alleging that TikTok collected, shared, and exploited their personal information without parental consent in violation of the Children’s Online Privacy Protection Act (“COPPA”) and related state laws.

The ruling is significant because it rejected TikTok’s argument that two prior nationwide class action settlements – totaling over $93 million combined – barred the plaintiffs’ claims, holding that the record at the pleadings stage did not establish the named plaintiffs’ membership in those prior settlement classes.  For companies that have previously settled class actions, the decision underscores the risk that broad settlement releases may not foreclose subsequent litigation where class membership is not clearly established on the face of the pleadings.

Background

This case is one of a series of privacy class actions targeting TikTok and its parent companies, ByteDance Inc. and ByteDance Ltd.  The plaintiffs are minors who allege that while under the age of 13, their personal information was collected, shared, and exploited by TikTok without the parental notice and consent COPPA requires for children under 13. The plaintiffs seek to impose liability stretching back to March 28, 2019.

Two prior nationwide settlements form the backdrop of the dispute.  The first, T.K. v. Bytedance Technology Co., No. 1:19-CV-07915 (N.D. Ill.), followed the FTC’s 2019 enforcement action concerning COPPA violations by Musical.ly, TikTok’s predecessor, and settled for $1.1 million on behalf of approximately 6 million individuals who used Musical.ly or TikTok before August 22, 2022, while under the age of 13. The settlement included a broad release but no injunctive relief.  The second, In Re TikTok, Inc., Consumer Privacy Litigation, No. 1:20-CV-04699 (N.D. Ill.) (the “Privacy MDL”), consolidated lawsuits focused on TikTok’s use of algorithms, facial recognition, and other technologies to collect and transfer personally identifiable user data to servers in China, and settled for $92 million with broad injunctive relief.

In April 2025, the U.S. Judicial Panel on Multidistrict Litigation ordered the transfer of the present actions to the Central District of California.  After an initial partial dismissal of claims brought under laws of states without a domiciled plaintiff, the plaintiffs amended, and the defendants moved to dismiss the Second Amended Consolidated Class Action Complaint (“Complaint”), arguing that the T.K. and Privacy MDL settlements barred claims for conduct occurring before August 22, 2022, the cutoff date defining the later T.K. settlement class.  The dispositive question was therefore whether the pleadings themselves established that the named plaintiffs fell within those prior settlement classes.

The Court’s Decision

The Court denied TikTok’s motion to dismiss, finding that the defendants failed to establish, on the record available at the pleadings stage, that the named plaintiffs were members of the T.K. class. ECF No. 414 at 8-9.

At the heart of the ruling was a straightforward factual gap.  The T.K. settlement class included individuals who used TikTok or Musical.ly before August 22, 2022, while under the age of 13.  Id.  However, the Complaint did not allege the birth dates or first-use dates of any of the named plaintiffs – it alleged only that the plaintiffs were under 13 and used TikTok during the Class Period, defined as March 28, 2019, to the present.  Id. at 9.  The Court held that these allegations did not establish when within that period the plaintiffs used TikTok, and the judicially noticed materials likewise did not supply that information.  Id.

Even assuming none of the plaintiffs opted out of the prior settlements, the Court found that the defendants still had not shown the plaintiffs belonged to the prior classes in the first place.  Id.  As the Court stated, “[a] person need not opt out of a class to which that person never belonged.”  Id.

The Court also rejected TikTok’s argument that plaintiffs should not be allowed to avoid res judicata simply by “artfully pleading around” the relevant facts.  Id.  Because a plaintiff’s failure to anticipate and plead around an affirmative defense is not a pleading deficiency, as the Supreme Court explained in Jones v. Bock, 549 U.S. 199 (2007), the Court concluded that even plaintiffs who knew these defenses were coming, and knew their own ages and use histories, were not required to plead around TikTok’s affirmative defenses of release and preclusion, provided they otherwise sufficiently pleaded their causes of action. Id. at 10.

The Court further rejected TikTok’s alternative argument that, regardless of membership in the prior classes, plaintiffs either were precluded from, or lacked Article III standing to pursue, claims for the pre-August 2022 period.  Id.  TikTok reasoned that uncertainty about whether the named plaintiffs were under 13 and used TikTok before August 22, 2022, does not prevent dismissal because plaintiffs who meet those criteria are bound by the prior settlements, while plaintiffs who did not use TikTok during the relevant period cannot recover for that period and lack standing to represent those who did.  Id.  The Court disagreed.  The Court held that once a named plaintiff establishes individual standing, differences in injuries between the named plaintiffs and absent class members go to class certification rather than standing, the distinction drawn by the Ninth Circuit in Melendres v. Arpaio, 784 F.3d 1254 (9th Cir. 2015).  Id. at 11.  As the Court explained, “[w]hether Plaintiffs can represent class members who experienced that conduct earlier in the proposed Class Period concerns their representative capacity under Rule 23, and the possibility that Plaintiffs used TikTok only after August 22, 2022, does not defeat their standing to pursue the alleged claims.”  Id.  The Court likewise declined to redefine the class period at the pleading stage, holding that the issue is more appropriately addressed at class certification.  Id.

After oral argument on September 24, 2026, the Court adopted its tentative ruling as the final ruling.  See ECF No. 416.

Implications For Companies

This decision provides important guidance for any company facing follow-on privacy and/or adtech class action litigation after a prior settlement, by showing that broad settlement releases cannot be enforced at the motion-to-dismiss stage unless the defendant can demonstrate from the pleadings alone that the current plaintiffs were members of the prior class.  That is a high bar where the operative complaint does not specify individual plaintiffs’ ages or first-use dates, or other identifying information necessary to determine membership.

Of course, preclusion based on prior settlements is just one tool in a defendant’s kit for defeating class certification in privacy and adtech cases.  For example, in the related case of In Re TikTok, Inc., Consumer Privacy Litigation, 713 F. Supp. 3d 470 (N.D. Ill. 2024), the court declined to dismiss in-app browser claims on the basis of the prior $92 million settlement but left the door open to a different result upon further discovery.  Id. at 501-02.  There, the court observed that “the unusual and as-yet-undisclosed manner and method of the Original Plaintiffs’ post-settlement investigation leaves open the possibility that further information might alter this conclusion — for example, evidence that they recognized both the in-app browser’s risks and the potential to use them as the basis for a wiretapping theory of liability, but deliberately chose not to pursue this opportunity,” adding that “[s]uch evidence would be worth further attention, if not a different result.”  Id. at 501.  The court reinforced this point by noting that the original plaintiffs’ source code expert had been given “free rein to probe TikTok’s relevant technology” during confirmatory discovery.  Id. at 499.  Defendants facing successive adtech class actions should accordingly pursue targeted discovery into prior expert analyses and internal communications reflecting awareness of the privacy risks at issue — evidence that, under the court’s reasoning in In Re TikTok, Inc., Consumer Privacy Litigation, could compel preclusion of theories that were available but not pursued in the earlier proceeding.

Posted on by Gerald L. Maatman, Jr.

California Federal Court Denies Class Certification In Adtech Case Due To Lack Of Article III Standing

By Gerald L. Maatman, Jr., Justin R. Donoho, and Hayley Ryan

Duane Morris Takeaways:  On September 21, 2026, in Smith, et al. v. Rack Room Shoes, Inc., No. 24-CV-6709 (N.D. Cal. Sept. 21, 2026), Judge Rita F. Lin of the U.S. District Court for the Northern District of California denied class certification in a case brought by consumers against an online shoe store company alleging that the company’s use of website advertising technology (“adtech”) violated the California Invasion of Privacy Act (“CIPA”) and Electronic Communications Privacy Act (“ECPA”).  The ruling is significant as it shows that before any class can be certified in the hundreds of adtech class actions filed in federal courts across the nation alleging that adtech violates privacy laws, plaintiffs not only bear the burden to establish, by the preponderance of the evidence, that they have suffered an Article III injury, but also cannot meet this burden by showing merely that they visited the defendant’s website at a time when adtech was installed on the website.

Background

This case is one of a legion of class actions that plaintiffs have filed nationwide alleging that third-party technology captured plaintiffs’ information and used it to facilitate targeted advertising. 

This software, often called advertising technologies or “adtech,” is a common feature of millions of consumer products and websites in operation today.  In adtech class actions, the key issue is often a claim brought under a the CIPA, the ECPA, or a variety of other statutes providing for statutory damages regardless of whether any actual injury occurred, because plaintiffs often seek millions (and sometimes even billions) of dollars, even from midsize companies, on the theory that hundreds of thousands of consumers or website visitors, times $5,000 per claimant in statutory damages under the CIPA and $10,000 per claimant in statutory damages under the ECPA, for example, equals a huge amount of damages.  Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including retailers, consumer products, universities, and the adtech companies themselves.  Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided. 

In Smith, the plaintiffs brought suit against Rack Room Shoes, Inc., an online shoe store company, alleging that in 2024, during their online web visits to purchase shoes from the company, the company had embedded on its website adtech supplied by Meta and other adtech companies that covertly intercepted the plaintiffs’ identities and interactions with the website, including the items the plaintiffs viewed, added to the their cart, and purchased, in alleged violation of the CIPA and the ECPA. 

The company answered the complaint, and the parties engaged in discovery, including the depositions of the plaintiffs and plaintiffs’ subpoenas to the adtech companies. 

Based on this discovery, the record reflected that in 2021 to 2023, the Meta pixel installed on the company’s website captured activities from devices and browsers that were signed into the plaintiffs’ accounts.  However, the plaintiffs provided no evidence that these 2021-2023 incidents involved their own web activities as opposed to activities of their family members using the same devices and browsers, that Meta captured any activity from the plaintiffs’ devices and browsers during their own sole 2024 visits, or that the other adtech installed on the company’s website captured any activities at all.

The plaintiffs moved for class certification, arguing that they had standing to bring their claims and that they satisfied Rule 23.

The Court’s Decision

The Court disagreed that the plaintiffs established standing and denied class certification on that basis without addressing or needing to address any of the parties’ arguments under Rule 23.

In their motion for class certification, the plaintiffs proffered two theories of injury in support of their argument that they had standing to bring their claims: one based on the actual interception of their information, and one based on the attempt to intercept their information.  (Slip Op. at 5.)

On the plaintiffs’ interception injury theory, the Court found no evidence that the Meta pixel embedded on the company’s website collected any data from the plaintiffs’ 2024 website visits, and no evidence that the activity that was recorded by Meta 2021-2023 was the plaintiffs’ own browsing activity.  Further, the Court rejected the plaintiffs’ argument that the company’s general use of the Meta pixel during 2024 was circumstantial evidence of actual tracking.  As the Court explained, citing the company’s expert testimony, the ability of adtech to collect and transmit data in a manner that can be linked to the website user “is impacted by many factors, including the browser being used, whether the browser and device are signed in to a social media account, and what cookie blocking features are enabled.”  (Id. at 7.)  In sum, the Court found that plaintiffs failed to present evidence from which a reasonable jury could find that any adtech installed on the company’s website collected any data attributable to the plaintiffs.

On the plaintiffs’ attempt injury theory, the Court found that the mere presence of active adtech on a company’s website does not bear the requisite close relationship to the type of harm traditionally at issue in intrusion upon seclusion and which type of harm the plaintiffs argued was the historical analog to the type of injury they suffered and thus sufficient to confer Article III standing.  On this point, the Court’s opinion turned on its finding that the plaintiffs presented no evidence that the adtech on the company’s website attempted to collect any “embarrassing, invasive, or otherwise private information.”  (Id. at 8.)  Further the Court found that the plaintiffs had no reasonable expectation of privacy in their web-browsing data due to the company’s privacy policy because the plaintiffs did not read it and the policy also did not create an expectation of privacy from adtech transmissions, and that even if plaintiffs had had a reasonable expectation of privacy, the plaintiffs failed to show that the mere presence of adtech was highly offensive.  (Id. at 9.)  In short, the Court held that “[t]he mere presence of active tracking software … on a website involving objectively non-sensitive information” does not bear a close relationship to the type of harm traditionally at issue in intrusion upon seclusion and, therefore, was insufficient to confer Article III standing.

Implications For Companies

Smith provides powerful precedent for any company opposing adtech class action claims where plaintiffs lack evidence from which a reasonable jury could find that any adtech installed on the company’s website actually collected any data attributable to the plaintiffs, by showing that any number of issues could have prevented such collection, such as the browser being used, whether the browser and device are signed in to a social media account, and what cookie blocking features are enabled.

Of course, Smith is just one tool in a defendant’s kit for defeating class certification in adtech cases.  Another is that even when named plaintiffs can establish that adtech collected data attributable to themselves (unlike in Smith), the same factors identified in Smith — browser type, social media account login status, cookie blocking features — are individualized issues that prevent named plaintiffs from establishing the defendant’s liability to alleged class members under Rule 23, as we blogged about here.

Posted on by Gerald L. Maatman, Jr.

Colorado’s Proposed Rules Require Meaningful Human Review And Reconsideration Of Employment Decisions Materially Influenced by AI

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan

Duane Morris Takeaways:  On August 11, 2026, the Colorado Department of Law released a set of proposed rules intended to govern the implementation of Colorado’s Automated Decision-Making Technology Act (“ADMT Act”) and Conversational Artificial Intelligence Service Operator Requirements (the “Chatbot Safety Act”). Both laws, and the proposed rules (to the extent they become final, following a notice and comment period), take effect January 1, 2027.

The proposed rules under the ADMT Act would add additional layers of regulatory burdens on companies using AI-based tools to make consequential automated decisions affecting a consumer’s access to, eligibility for, or terms of employment, education, housing, lending, financial services, insurance, health care, essential government services, and public benefits. 

Take AI employment tools, for example — if Colorado’s ADMT rules were to become final, they would require companies using AI employment tools to make available and readily accessible to job candidates and employees:

  1. the make, model, and version number of any AI tool whose outputs were used or will be used to materially influence a consequential employment decision such as in candidate screening, interviewing, hiring, firing, and other consequential employment decisions;
  2. the types and categories of personal data input to the model;
  3. the sources of these input data, including the identities of intermediary and original sources; and
  4. to the recipients of any adverse outcomes materially influenced by the AI tool:
    1. within 30 days, notifications of the adverse outcome setting forth the decision, purpose of the AI tool, the reasoning and primary factors relied upon by the AI tool to produce the output, and the relative roles of the AI tool and human reviewers in the decision — such as whether the employer followed the human best practices to mitigate the risk of AI hiring tool noncompliance with antidiscrimination statutes that we identified in our blog (here); and
    2. within 45 days after receipt of a request for review, complete a meaningful human review and reconsideration of any adverse outcome, to the extent commercially reasonable.

The proposed rules under the Chatbot Safety Act would add age-assurance, disclosure, privacy, minor-protection, crisis-response, and reporting requirements on companies using AI-based chatbots.

The analysis in our blog post focuses on the “meaningful human review and reconsideration” component of the ADMT Act and its corresponding proposed rules, in the context of adverse employment decisions (number 4(b), above), to assist companies in preparing for compliance by January 1, 2027, and in commenting on the proposed rules before the comment period closes on October 26, 2027, as may be appropriate for their businesses. 

Organizations evaluating and seeking to comply with the proposed rules should continue monitoring the rulemaking process, as key provisions, including those discussed below, may change before the rules become effective.

Background

Colorado’s ADMT Act (Colo. Rev. Stat. § 6-1-1701, et seq.) was enacted May 14, 2026, and will become effective January 1, 2027.  It provides, among other things, that when an employee or job applicant experiences an adverse outcome resulting from a consequential decision that was materially influenced by AMDT such as an AI employment tool, then the employee or job applicant may request, and the employer must provide (i) instructions for requesting personal data and correcting factually  incorrect or materially inaccurate personal data used in the decision; and (ii) “an opportunity for meaningful review and reconsideration of the consequential decision, to the extent commercially reasonable.”  Id. § 6-1-1705. 

“Meaningful Human Review,” as defined under the ADMT Act, requires the employer to designate an individual who has authority to approve, modify, or override a consequential decision to perform the review.  Id. § 6-1-1701(15).  Further, in conducting the review, the designated individual must consider relevant, available primary evidence, must be trained to conduct the review, must not default to the system output, and must have access to sufficient information to understand (i) the output’s intended use, material limitations, and categories of inputs; and (i) the principal factors used to generate the output, without requiring disclosure of proprietary source code, model weights, or other trade secrets.  Id.

The ADMT Act also provides that, on or before January 1, 2027, Colorado’s Attorney General shall adopt rules to clarify and implement these requirements.  Id.

On August 11, 2026, the Colorado Department of Law released a set of proposed rules under the ADMT Act and Chatbot Safety Act that, among other things, would clarify and implement rules regarding reviewer standards, commercial reasonableness, response requirements, and documentation requirements, as discussed below.

Who Can Perform A Meaningful Human Review?

The proposed rules provide that an individual who conducts a meaningful human review must meet the following criteria:

  • Independence – The reviewer must be an independent reviewer who did not make the original decision and who is not a subordinate of the original decision-maker, whenever feasible.
  • Subject matter understanding – The reviewer must have a level of subject matter understanding that is commensurate with the nature of, and negative consequences resulting from, the adverse outcome of the consequential decision being reviewed.
  • Sufficient training – The reviewer must be trained regarding (a) accuracy and objectivity in decision-making; (b) information considered by the AI employment tool; (c) the output’s intended use, material limitations, and categories of inputs; and (d) the subject matter at issue at a level that would enable the reviewer to identify whether review of additional available primary evidence would be valuable, and to review and understand that evidence.
  • Sufficient authority – The reviewer must not be subject to steering by the upper management that would influence the reviewer’s decision, and they must be shielded from potential retaliation.
  • Unassisted by AI – The reviewer may not use any ADMT in conducting his or her review.

When Is Meaningful Human Review Commercially Reasonable?

Under the ADMT Act, employers receiving requests to review adverse outcomes materially influenced by an AI employment tool must conduct a meaningful human review and reconsideration of such outcome “to the extent commercially reasonable.” 

The proposed rules provide that an employer bears the burden of demonstrating that meaningful human review is not commercially reasonable.

To meet this burden, employers must use specific evidence, and consider the following factors, weighed together, with no single factor being dispositive:

  • type of review required — i.e., either (a) if the circumstances and request indicate that the AI tool may have malfunctioned, then correcting and re-performing the decision-making process; or (b) if additional evidence is submitted by the employee or job applicant, then considering whether that evidence changes the adverse outcome;
  • magnitude of harm resulting from the adverse outcome;
  • reversibility of the adverse outcome;
  • value provided by the review of available primary evidence;
  • employer size and capacity;
  • marginal cost and technical feasibility of the review; and
  • availability of qualified reviewers.

When the harm to an employee or job applicant resulting from an adverse outcome is a severe and irreversible denial of a basic human need, meaningful human review is presumed to be commercially reasonable.  This presumption of commercial reasonableness can be rebutted by evidence showing that the review is technically or financially impossible or could not change the adverse outcome of the consequential decision.

When And How Must An Employer Respond To A Request For Review?

Within 10 days after receiving a request for review of an adverse outcome of a consequential decision meaningfully influenced by an AI employment tool, the employer must confirm receipt of the request and provide information about how the employer will process the request.

Within 45 days of receiving the request, meaningful human review must be completed, and a response must be provided to the employee or job candidate.  The response must include the reviewer’s decision to confirm or override the consequential decision, the type of review conducted, the factors considered in making that decision, and the reasons the reviewer decided to confirm or override the consequential decision.  Reasons provided must be specific to the evidence provided, and not a recitation of the AI tool’s general logic. 

Where possible, an adverse outcome must be stayed pending meaningful human review.

What Documentation Of Meaningful Human Reviews Must Be Retained?

When a meaningful human review is conducted, the employer must retain a record showing:

  • the reviewer identity, authority, and relevant training;
  • review timestamps;
  • primary evidence available to the reviewer, including information provided by the employee or job candidate;
  • the reviewer’s access to the AI tool’s intended use, limitations, inputs and principal factors;
  • whether the reviewer approved, modified, or overrode the output; and
  • a written justification for the reviewer’s decision to approve, modify, or override the output.

Implications For Companies

Colorado’s ADMT Act and Chatbot Safety Act and their corresponding proposed rules add significant operational obligations and compliance burdens for companies using automated decision-making technology to meaningfully influence consequential decisions, and using chatbots, respectively. 

This blog post identified one component of these multifaceted burdens relating to one type of ADMT – meaningful human review and consideration of employment decisions materially influenced by AI employment tools.

Although the ADMT Act and Chatbot Safety Act do not provide a private right of action, violations may be prosecuted by the Colorado Attorney General and are treated as a deceptive trade practice under the Colorado Consumer Protection Act, carrying civil penalties of up to $20,000 per violation.

Companies using or considering using ADMT or chatbots should consider whether to comment on the proposed rules before the comment period closes on October 26, 2027, should continue to monitor the content of the rules as they may evolve during the notice and comment period, and should prepare for complying with the rules by the time they are scheduled to come into effect on January 1, 2027.

Posted on by Gerald L. Maatman, Jr.

Seventh Circuit Undoes Novel Privacy Class Settlement Due To Lack Of Separate Representatives For Nationwide Class And State Sub-Classes

By Gerald L. Maatman, Jr., Hayley Ryan, and Tyler Zmick

Duane Morris Takeaways:  On July 13, 2026, in the case captioned as In Re Clearview AI, Inc. Consumer Privacy Litigation, No. 25-1673, 2026 U.S. App. LEXIS 20406 (7th Cir. July 13, 2026), the U.S. Court of Appeals for the Seventh Circuit vacated a district court’s approval of a novel class action settlement between Clearview and individuals alleging that Clearview violated privacy laws by “scraping” their public photos from the internet to improve the company’s facial recognition technology. The Seventh Circuit held that the absence of separate class representatives for the nationwide class and the state-specific subclasses was a “key procedural problem” requiring vacatur of the settlement.

This decision is an important reminder that courts evaluating class settlements will closely scrutinize whether all classes and subclasses have adequate structural protections, including separate class representatives with separate counsel in cases where class members may have divergent interests.

Background

Clearview operates “a search engine for faces,” whereby the company scrapes photographs of individuals from public websites and analyzes them using artificial intelligence to generate “facial vectors” reflecting the geometry of a person’s facial features. Id. at *3. A search of Clearview’s database using a photograph of a person returns other photographs of that same person, together with links to the websites where the photographs were located.

The case arose from 11 putative class actions filed in federal district courts against Clearview and related defendants, which were ultimately transferred to the Northern District of Illinois for coordinated pretrial proceedings. 

After the appointment of interim lead class counsel, Plaintiffs filed a consolidated complaint asserting claims for declaratory judgment and unjust enrichment on behalf of a Nationwide Class comprised of all individuals in the United States whose biometric data was or is contained in Clearview’s database. Plaintiffs also asserted claims under the Illinois Biometric Information Privacy Act (“BIPA”) on behalf of an Illinois Subclass; claims under various California laws on behalf of a California Subclass; claims under New York’s civil rights code on behalf of a New York Subclass; and claims under the Virginia Computer Crimes Act and for statutory commercial misappropriation of identity on behalf of a Virginia Sub-class.

The parties first engaged in settlement discussions in 2022, which failed because Clearview lacked the financial ability to make the substantial immediate payments sought by Plaintiffs. But after mediating the case in 2023, the parties agreed to a settlement structure under which class members would acquire equity stake in Clearview. Specifically, the settlement provided that upon an initial public offering or a merger, consolidation, or sale of Clearview, the Class would receive a payment equivalent to a 23% equity stake in Clearview as of September 6, 2023. Alternatively, in lieu of that payment, the court-appointed settlement master could either (i) sell the settlement stake to a third party for a “commercially reasonable price” or (ii) make a cash demand equal to 17% of Clearview’s revenue from the date of final approval of the settlement until the date of such demand. Id. at *7.

The settlement stake itself would be divided unevenly among Class members based on the specific forms of relief available under the relevant state laws: ten shares to each member of the Illinois Subclass; five shares to each member of the California, New York, and Virginia Subclasses; and just one share to each member of the Nationwide Class. Notably, none of the eight original class representatives agreed to the settlement, so lead class counsel replaced them with four new representatives, each of whom belonged to one of the “favored” state-specific sub-classes.

After the District Court granted final approval, Objectors Robert Weissman and Rick Claypool, both members of the Nationwide Class, appealed. They argued that the settlement was not “fair, reasonable, and adequate” because (i) it did not provide injunctive relief, (ii) the future equity-stake and cash-demand fallback made the settlement’s value too uncertain, and (iii) the Nationwide Class lacked separate representation during the settlement negotiations.

The Seventh Circuit’s Decision

The Seventh Circuit vacated the District Court’s approval of the settlement and remanded the case for further proceedings. 

The Seventh Circuit rejected the Objectors’ two substantive challenges to the settlement, concluding that a fair settlement did not necessarily require injunctive relief and that the uncertainty associated with the equity-based structure was not disqualifying because “uncertainty is inherent” in such settlements. Id. at *11, 16.

The Seventh Circuit, however, agreed with the Objectors’ third argument regarding the settlement being deficient due to the absence of a separate Nationwide class representative with separate counsel. The Seventh Circuit explained that class action litigation relies on “structural assurance of fair and adequate representation for the diverse groups and individuals affected.” Id. at *23 (quoting Amchem Products, Inc. v. Windsor, 521 U.S. 591, 627 (1997)). One such “important structural feature” is the requirement that class representatives, who owe a fiduciary duty to absent class members, approve any proposed settlement. Id.

The Seventh Circuit emphasized that “[n]ot just any representative will do” and that the critical question is whether “the court can be confident that absent class members have been represented fairly.” Id. at *24-25. The Seventh Circuit concluded that the Nationwide Class lacked adequate representation because “none of the named class representatives was in a position to represent solely the interests of the Nationwide Class in allocating the settlement.” Id. at *29; see id. at *31 (“Appointment of separately counseled class representatives for identifiable, significantly different groups of claimants with fundamentally conflicting interests is Rule 23’s primary mechanism for such protection.”).

On this basis, the Seventh Circuit vacated the District Court’s approval of the settlement and remanded the case.

Implications For Companies

The Seventh Circuit’s decision in In Re Clearview AI, Inc. Consumer Privacy Litigation is a cautionary tale for companies structuring, or defending, class action settlements involving multiple classes or subclasses with potentially divergent interests. Where claimants fall into distinct groups with conflicting stakes in how settlement proceeds are allocated, courts will expect each group to have its own class representative with its own counsel at the negotiating table. A settlement that may be fair and reasonable on its face can be vacated if it lacks these structural safeguards, as without such protections a reviewing court cannot confirm that each class’s interests was independently considered during negotiations. Companies should keep this principle in mind at the outset of class settlement negotiations to avoid the possibility of a proposed class settlement failing on appeal due to the lack of necessary structural safeguards.

Posted on by Gerald L. Maatman, Jr.

Third Circuit Affirms Dismissal Of Session Replay Code Class Action Because The Collection Of Anonymized Information Does Not Constitute A Concrete Injury Necessary To Confer Article III Standing

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan

Duane Morris Takeaways:  On May 26, 2026, in Smidga, et al. v. Spirit Airlines, Inc., No. 24-1757, 2026 WL 1470137 (3d Cir. May 26, 2026), the U.S. Court of Appeals for the Third Circuit affirmed a federal district court’s dismissal of a class action alleging that the defendant’s use of session replay code, a form of website analytics technology, violated federal and state privacy laws.  Relying on its prior decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), the Third Circuit held that the three named plaintiffs lacked standing because there were no allegations of embarrassment or humiliation, plaintiffs voluntarily provided the information on the defendant’s website, the information allegedly collected was anonymized, and, in any event, most people “understand that what we do on the Internet is not completely private.” Id. at *2. Accordingly, the Third Circuit concluded that plaintiffs failed to allege a concrete injury to their privacy interests sufficient to confer Article III standing. Id. at *1.

This ruling reinforces the growing trend among federal courts requiring plaintiffs to plausibly allege that the collected data was personally identifiable and obtained without authorization in order to establish a concrete privacy injury.

Background

Many companies embed session replay code and other similar software, such as Google Analytics and the Meta Pixel, into their websites to conduct website analytics and/or targeted advertising.  All of these various technologies capture users’ browsing behaviors and cryptographically transmit this data to algorithms residing on the software providers’ servers.  Upon entry into the algorithm, this data is typically anonymized, aggregated, and not alleged to have been viewed or accessible by any human.  Plaintiffs across the country have filed multitudes of class actions challenging these various website analytics and advertising practices under federal and state privacy laws, targeting companies in virtually every industry, including healthcare, retail, education, and consumer products.  Some cases have resulted in multimillion-dollar settlements, others have been dismissed, and the vast majority remain undecided.  In these session replay and other data privacy class actions, the central question is often whether the specific data captured is sufficiently sensitive or personally identifying to establish a cognizable legal injury.

In Smidga, three named plaintiffs sued the defendant airline, alleging that session replay code embedded on its website recorded users’ interactions with the website in real time, including “text entries, mouse clicks, and geolocation.” Id. at *1.  Plaintiffs asserted claims under the Pennsylvania and Maryland Wiretap Acts, the California Invasion of Privacy Act, California’s Unfair Competition Law, and several other state and common law causes of action. Id. at *1 n.2.

All three plaintiffs visited defendant’s website to browse flights. Only one plaintiff ultimately purchased tickets and entered the names, addresses, and ages of herself and her children while doing so.  Id. at *1.

The defendant moved to dismiss for lack of Article III standing under Federal Rule of Civil Procedure 12(b)(1) or, alternatively, for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).  In support of its Rule 12(b)(1) arguments, the defendant submitted a declaration from its Senior Vice President and Chief Information Officer disputing plaintiffs’ allegations that the session replay code collected personal information and explaining that any data collected was “not traceable to any specific [w]ebsite user.”  Id. at *1.

The District Court granted the motion to dismiss for lack of standing, finding that the plaintiffs failed to establish an injury-in-fact sufficient to confer Article III standing, while also granting plaintiffs leave to seek jurisdictional discovery and amend the complaint again. Id. When plaintiffs took no further action, the District Court dismissed the complaint with prejudice, and plaintiffs appealed.

The Third Circuit’s Decision

The Third Circuit affirmed dismissal of the complaint but modified the District Court’s order so that the dismissal would be without prejudice. Id.

After observing that its recent decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), “plainly resolve[d]” plaintiffs’ standing challenge, the Third Circuit “briefly explain[ed]” why plaintiffs failed to establish a concrete injury sufficient to confer Article III standing. Id. at *2.

First, the Third Circuit held that the alleged harm did not share a “close relationship” to the comparator torts of disclosure of private information or intrusion upon seclusion. Id.  With respect to public disclosure of private information, the Third Circuit explained that the two non-purchasing plaintiffsdid not allege that the defendant collected any personal information. Although the purchasing plaintiff entered personal information while using the website, the Third Circuit noted that the tort of public disclosure of private facts requires allegations of resulting embarrassment or humiliation, which were absent from the complaint.  Id. 

The Third Circuit similarly concluded that plaintiffs failed to state an analogous intrusion upon seclusion injury. Such a claim requires allegations that the defendant intentionally intruded upon plaintiffs’ “private affairs or concerns.” Id. The Third Circuit determined that standard was not satisfied because plaintiffs voluntarily provided the information, the allegedly collected information was anonymized, and, in any event, most people “understand that what we do on the Internet is not completely private.” Id.

Second, the Third Circuit rejected plaintiffs’ argument that bare violations alone confer standing, concluding that the argument misconstrued Third Circuit precedent and the U.S. Supreme Court’s holding in TransUnion LLC v. Ramirez, 594 U.S. 413, 426–27 (2021). Id. at *2.

Third, the Third Circuit reasoned that it was “hard-pressed to find that a de facto invasion of privacy exists where a website makes no express promise to refrain from collecting site visitors’ information.” Id. at *3. As explained in Cook, “there is a material difference between an allegation that a website merely failed to ask for visitors’ consent to data collection and an allegation that a website expressly promised it would not collect information but secretly did so anyway.” Id. The complaint contained no allegations that the defendant made such a promise.

The Third Circuit also rejected plaintiffs’ challenge to the District Court’s consideration of the declaration submitted in support of the defendant’s Rule 12(b)(1) motion to dismiss. The Third Circuit emphasized that plaintiffs failed to request discovery to respond to the defendant’s factual challenge despite being given the opportunity to do so, and it agreed that plaintiffs’ “boilerplate averments” alone could not rebut the defendant’s external evidence. Id. at *3.

Accordingly, the Third Circuit affirmed the District Court’s dismissal order for lack of Article III standing but modified the dismissal to be without prejudice.

Implications For Companies

Smidga reinforces that plaintiffs challenging the use of common website analytics and advertising technology must, at a minimum, plausibly allege that the technology collected and disclosed personally identifying information, rather than anonymized, aggregated web-browsing data cryptographically transmitted to software providers’ servers and not viewable or accessible by any human.  Moreover, alleging the collection and disclosure of PII via functionally internal session replay technology may or may not confer standing, depending on the jurisdiction one is in, as we blogged about earlier this month (here).

For companies facing session replay and other data privacy class actions in federal court, Article III standing remains a significant threshold defense that should be evaluated throughout the litigation, while balancing the possibility that claims may continue in state court.

Posted on by Gerald L. Maatman, Jr.

Third Circuit Holds That Unauthorized Collection Of Credit Card Information Via Session Replay Code Confers Article III Standing, Creating Split Of Authority

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan

Duane Morris Takeaways: On May 11, 2026, in In Re BPS Direct, LLC; Cabela’s, LLC Wiretapping Litigation, No. 23-3235, 2026 WL 1280969 (3d Cir. May 11, 2026), the U.S. Court of Appeals for the Third Circuit reversed a federal district court’s dismissal of a class action alleging that defendants’ use of session replay code, a form of website analytics technology, violated federal and state privacy laws. The Third Circuit held that two plaintiffs who made purchases on the defendants’ websites had standing to sue because the session replay code collected their credit card information without consent, an alleged injury the Third Circuit deemed analogous to the common law tort intrusion upon seclusion. Id. at *6-7.

This ruling is significant in that it shows that in class actions seeking millions (or billions) in dollars in statutory damages under federal and state data privacy laws for alleged use of session replay code, the Third Circuit has distinguished itself from California District Courts, which have held that there is no reasonable expectation of privacy in credit card information collected by session replay code.  Companies operating in the Third Circuit should take note as the legal risk of session replay code has meaningfully shifted in that jurisdiction. 

Background

Many companies embed their websites with session replay code and other similar software such as Google Analytics and the Meta Pixel in order to perform website analytics and/or targeted advertising. All of these various technologies capture users’ browsing behaviors and cryptographically transmit this data to algorithms residing on the software providers’ servers.  Upon entry into the algorithm, this data is typically anonymized, aggregated, and not alleged to have been viewed or accessible by any human.  In addition, session replay code (unlike other website analytics and advertising technologies) is typically alleged to record and store “videos” of “all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, [and] text entries,” so that the session replay provider can provide that information back to the company “in a format that [the company] can use for its business purposes.” Id. at *1, 5. Plaintiffs across the country have filed multitudes of class actions challenging these various website analytics and advertising practices under federal and state privacy laws, targeting companies in virtually every industry, including healthcare, retail, education, and consumer products.  Some cases have resulted in multimillion-dollar settlements, others have been dismissed, and the vast majority remain undecided.  In these session replay and other data privacy class actions, the central question is often whether the specific data captured is sufficiently sensitive or personally identifying to establish a cognizable legal injury.

In In re BPS Direct, LLC, eight named plaintiffs sued the defendant retailers, alleging that session replay code embedded on their websites captured users’ interactions, including “mouse clicks and movements, keystrokes, search terms, substantive information inputted …, pages and content viewed …, scroll movement[s], and copy and paste actions.” Id. at *2.  Plaintiffs asserted claims under the federal Wiretap Act, 18 U.S.C. § 2510 et seq., and the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 et seq., along with several state and common law causes of action. Id.

The plaintiffs fell into two groups. Two plaintiffs made purchases on the defendants’ websites and entered his or her “name, address, and payment and billing information” into text fields. Id. The remaining six plaintiffs browsed the websites without making purchases and did not enter any personally identifying information while browsing the websites.  Id.

Defendants moved to dismiss for lack of Article III standing under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).  The District Court granted the motion, dismissing the non-purchasing plaintiffs’ claims with prejudice, finding that, after two attempts, they could not establish concrete harm “because they did not make purchases on the Websites or engage in any activity prompting their browsers to send highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards.” 705 F. Supp. 3d 333, 367 (E.D. Pa. 2023).  The claims of the two purchasing plaintiffs were dismissed without prejudice. Id. Rather than amend, those two plaintiffs filed a notice of intent to stand on their allegations, and all eight plaintiffs appealed.  2026 WL 1280969, at *2-3.

The Third Circuit’s Decision

The Third Circuit reversed the dismissal of the purchasing plaintiffs’ claims and modified the dismissal of the non-purchasing plaintiffs’ claims from with prejudice to without prejudice.  Id. at *1. 

The Third Circuit analyzed standing under two analogous common law torts: (1) public disclosure of private facts, and (2) intrusion upon seclusion. It held that none of the plaintiffs had standing under the first theory.  As to the non-purchasing plaintiffs, their browsing data was neither sensitive nor personally identifiable. As to the purchasing plaintiffs, their information was not publicly disclosed.  Id. at *4-5.

The Third Circuit held that only the two purchasing plaintiffs had standing under the intrusion upon seclusion theory. Id. at *3.  Under that common law tort, “[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” Id. at *5 (citing Restatement (Second) of Torts § 652B (1977)). The Third Circuit concluded that the two purchasing plaintiffs had entered “personal or sensitive” information – specifically their “complete credit card or debit card numbers” – when making purchases on the defendants’ websites. Id. at *7. The Third Circuit reasoned that “[j]ust as media consumption is sensitive and historically private, so is a person’s complete credit card or debit card number.” Id.

Accordingly, the Third Circuit held that these two plaintiffs had standing based on their allegations that defendants embedded session replay code in their websites, allowing third-party adtech providers to “surreptitiously record their billing and payment information absent consent.” Id.

Implications For Companies

This ruling puts the Third Circuit at odds with California District Courts, which have reached the opposite conclusion in two session replay cases. See Thomas v. Papa Johns Int’l, Inc., 2024 WL 2060140, at *5 (S.D. Cal. May 8, 2024) (plaintiff’s “name, address, credit card number(s), and billing information” collected via session replay is “not information over which society is prepared to recognize a reasonable expectation of privacy”); Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 525 (C.D. Cal. 2021) (collection via session replay of a website user’s “payment card information, including card number, expiration date, and CCV code” without consent was insufficient to constitute an invasion of privacy).

In the Third Circuit, session replay is no longer just an analytics tool – it carries significant legal risk for website operators.  Companies facing session replay class actions in the Third Circuit should shift their litigation strategy accordingly and consider moving beyond standing arguments, including demonstrating that plaintiffs cannot meet their burden of proof on the elements of the claims asserted.

Given the volume of session replay and similar litigation pending nationwide and the significant statutory damages at stake, this decision warrants close attention from any company whose website uses session replay code or similar technologies.

Posted on by Gerald L. Maatman, Jr.

Seventh Circuit Holds That Refusing To Register An Arbitration Agreement With The AAA Is Not A “Refusal To Arbitrate” Under The FAA

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Hayley Ryan

Duane Morris Takeaways: On May 1, 2026, in Bernal et al. v. Kohl’s Corporation et al., No. 24-2806, 2026 WL 1193991 (7th Cir. May 1, 2026), the U.S. Court of Appeals for the Seventh Circuit affirmed a federal district court’s denial of a petition to compel arbitration, holding that the defendant’s refusal to register its arbitration agreement with the American Arbitration Association (“AAA”), which caused the AAA to close the arbitration proceedings, did not constitute a “refusal to arbitrate” under the Federal Arbitration Act (“FAA”). The Seventh Circuit reasoned that because the parties had delegated that procedural question to the AAA, the district court had no authority to compel arbitration.

This decision is a significant win for businesses facing mass arbitration campaigns, particularly where arbitration agreements incorporate the AAA’s Consumer Arbitration Rules. The decision offers a concrete mechanism to avoid the steep filing fees such campaigns generate.

Background

Plaintiffs purchased products through Kohl’s website in 2020 and 2022 and agreed to arbitration provisions that required all disputes to be resolved through binding arbitration before the AAA under its rules, including the AAA’s Consumer Arbitration Rules. Id. at * 1.  The arbitration agreement also delegated to the arbitrator exclusive authority “to resolve any dispute related to the interpretation, applicability, enforceability or formation of” the arbitration agreement. Id.

In December 2022, Plaintiffs’ counsel initiated the pre-arbitration process by serving Kohnl’s with approximately 10,000 notices of dispute, followed by an additional 44,656 notices in April 2023. These claims alleged that Kohl’s marketing practices violated California’s consumer protection laws. Id. at *2. This is a classic mass arbitration strategy in which plaintiffs’ firms file thousands of individual demands to exploit mandatory per-claim filing fees paid by corporate defendants.

On May 22, 2023, while settlement discussions were ongoing, Kohl’s modified its terms and conditions to designate the National Arbitration and Mediation tribunal (rather than the AAA) as the arbitration forum for all claims. That same day, Plaintiffs filed formal individual demands with the AAA and paid all applicable filing fees. Id. Under AAA Consumer Arbitration Rule R-12, however, a business must register its arbitration clause and pay administrative fees for the AAA to administer consumer arbitrations. Kohl’s declined to do so. As a result,  the AAA exercised its discretion to decline administration, closed the cases, and refunded Plaintiffs’ filing fees. Id. at *3.

Plaintiffs then filed suit in the U.S. District Court for the Central District of California, which was later transferred to the U.S. District Court for the Eastern District of Wisconsin pursuant to the forum selection clause,  petitioning the court to compel Kohl’s to register its arbitration agreement with the AAA, pay all necessary filing fees, and proceed to arbitration. Id.

The District Court’s Ruling

The U.S. District Court for the Eastern District of Wisconsin denied the petition. Relying on Wallrich v. Samsung Elecs. Am., Inc., 106 F.4th 609 (7th Cir. 2024), the district court found that the parties had bargained for the AAA to apply and interpret its own Consumer Arbitration Rules. Id. at *3. When the AAA exercised that discretion by closing Plaintiffs’ cases upon Kohl’s non-registration, the court concluded it lacked authority to override that decision. Id.

Plaintiffs filed an interlocutory appeal, arguing that Kohl’s refusal to register its agreement constitutes a refusal to arbitration in violation of the Federal Arbitration Act (“FAA”). Id.

The Seventh Circuit’s Decision

The Seventh Circuit affirmed. Id. at *7. It held that the AAA’s exercise of discretion in closing Plaintiffs’ cases “flowed directly from the parties’ agreement granting AAA that power, leaving nothing for the district court to compel under the Federal Arbitration Act.” Id.

Under the FAA, a party seeking to compel arbitration must establish: (1) an enforceable written arbitration agreement; (2) a dispute falling within the scope of the agreement; and (3) a refusal to arbitrate. Id. at *4 (citing Wallrich, Inc., 106 F.4th at 617-18).  The Seventh Circuit’s analysis centered on the third element, i.e. whether Kohl’s non-registration constituted a refusal to arbitrate. Id. 

The Seventh Circuit characterized the AAA’s registration requirement as a “forum-specific procedural gateway” matter – the kind of matter parties implicitly delegate to the arbitration provider when they agree to arbitrate under its rules. Id. at *6 (citing Howsam v. Dean Witter Reynolds, Inc., 537 U.S. 79, 85–86 (2002)).  Citing Howsam, 537 U.S. at 85, the Seventh Circuit reasoned that, absent contrary language in the arbitration agreement, parties who agree to AAA arbitration intend to withhold registration disputes from judicial review. Id. Because the AAA exercised its own discretion (consistent with the parties’ agreement) in closing the cases, there was “nothing for the district court to compel” under the FAA.  Id. at *7.

The Seventh Circuit also relied on its prior decision in Wallrich, which held that a defendant’s failure to pay AAA fees, which resulted in termination of the arbitration, did not constitute a refusal to arbitrate where the outcome flowed from the parties’ agreed-upon procedures.

The Dissent

Judge Joshua P. Kolar dissented.  In his view, Kohl’s non-registration “was a conscious step to depart from its agreement to arbitrate,” not a procedural question delegated to the AAA. Id. at *8.  Judge Kolar warned that the majority’s reasoning stretches Wallrich’s holding too far and effectively converts “any bilateral agreement to arbitrate under AAA’s Consumer Rules into something of a unilateral option-to-arbitrate for business.” Id. at *9.  Judge Kolar would have compelled Kohl’s to register so that the AAA could initiate proceedings. Id.

Implications for Companies

Bernal has immediate practical significance for companies facing mass arbitration exposure under AAA arbitration agreements. By simply declining to register its arbitration agreement with the AAA, a company can cause the AAA to close the proceedings without judicial recourse, at least in the Seventh Circuit. Businesses with AAA arbitration clauses in their consumer-facing agreements should assess whether this strategy is available and appropriate given their specific contractual language and forum.

That said, the dissent’s warning deserves attention. If other circuits adopt Judge Kolar’s reasoning, or if the AAA amends its rules in response, the window this decision opens may narrow. Companies should monitor developments carefully and consult counsel before relying on non-registration as a mass arbitration defense.

© 2009- Duane Morris LLP. Duane Morris is a registered service mark of Duane Morris LLP.

The opinions expressed on this blog are those of the author and are not to be construed as legal advice.

Proudly powered by WordPress