Duane Morris Takeaway: The Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, et seq., has long been a focus of class action litigation. Since the TCPA was enacted 30 years ago, the methods and technology that businesses use to engage and interact with customers has evolved and changed. The trend of states enacting or amending their own mini-TCPAs shows no signs of slowing down, making this subject area a likely continued focus for the plaintiffs’ class action bar in years to come.
To that end, the class action team at Duane Morris is pleased to present the 2026 edition of the TCPA Class Action Review. We hope it will demystify some of the complexities of TCPA class action litigation and keep corporate counsel updated on the ever-evolving nuances of these issues. We hope this book – manifesting the collective experience and expertise of our class action defense group – will assist our clients by identifying developing trends in the case law and offering practical approaches in dealing with TCPA class action litigation.
Click here to bookmark or download a copy of the TCPA Class Action Review – 2026 e-book.
Stay tuned for more TCPA class action analysis coming soon on our weekly podcast, the Class Action Weekly Wire.
By Gerald L. Maatman, Jr., Jennifer A. Riley, Daniel D. Spencer, Katherine L. Alphonso, and Kenny T. Tran
Duane Morris Takeaways: On January 21, 2026, in Yeh v. Barrington Pacific, LLC, Case No. B337904, 2026 Cal. App. LEXIS 30 (Cal. App. Jan. 21, 2026), the California Court of Appeal for the Second Appellate District held that plaintiffs have standing to sue under the Investigative Consumer Reporting Agencies Act (ICRAA) without showing any actual injury because the statute authorizes a $10,000 minimum recovery untethered to any actual harm. At the same time, the Court of Appeal affirmed dismissal of the Unfair Competition Law (UCL) claims, reinforcing that UCL standing remains firmly rooted in concrete economic loss that cannot be manufactured from purely technical statutory violations.
Case Background
Barrington Pacific, LLC (Barrington) and its related entities own and operate multiple apartment complexes across Los Angeles, all managed under a centralized process. Id. at *3. Prospective tenants were required to complete a standardized rental application, authorize background screening, and pay a nonrefundable $41.50 application fee. Id. at *4. That fee was expressly allocated to obtaining credit reports, eviction histories, and resident screening reports, as well as processing internal costs. Id. Each applicant signed a written authorization permitting Barrington to obtain background information “including, but not limited to, resident screening and credit checking.” Id.
Between November 2020 and July 2022, more than 100 applicants, who were ultimately approved as tenants, filed individual lawsuits alleging Barrington violated the ICRAA’s disclosure requirements. Id. The alleged violations were procedural in nature, including failure to provide plaintiffs with a means of requesting a copy of such reports, failure to identify the consumer reporting agency, failure to disclose the scope of the investigative consumer reports procured, and failure to offer or provide copies of the reports. Id. at *4-5. Notably, no plaintiff alleged inaccurate information, denial of housing, identity theft, or any adverse consequence whatsoever. Id. at *7. Three plaintiffs also asserted UCL claims premised on the same alleged ICRAA violations. Id. at *5.
After the cases were related and consolidated, with Yeh designated as the lead action, Barrington moved for summary judgment. Id. at *5. Barrington argued that plaintiffs lacked standing because they could not show concrete injury, relying heavily on Limon v. Circle K Stores Inc., 84 Cal.App.5th 671 (2002), which held that uninjured plaintiffs lack standing under the federal Fair Credit Reporting Act (FCRA) when claims are based solely on statutory violations. The trial court agreed, concluding that the ICRAA’s $10,000 provision did not create standing through statutory penalty and that plaintiffs suffered no harm because they became tenants and alleged no inaccuracies in any of the information Barrington had. Id. at *6-7. Summary judgment was entered for Barrington on both the ICRAA and UCL claims. Id. at *6.
The California Court of Appeal’s Decision
The Court of Appeal reversed as to the ICRAA, holding plaintiffs need not prove actual harm to bring an ICRAA claim. Id. at *25. Central to the Court of Appeal’s analysis was Civil Code section 1786.50(a)(1), which permits recovery of “[a]ny actual damages sustained by the consumer as a result of the failure or, except in the case of class actions, ten thousand dollars ($10,000), whichever sum is greater.” Id. at *19. Emphasizing the disjunctive “or,” the Court of Appeal concluded that actual damages and the $10,000 amount are alternative remedies, not cumulative or interdependent. Id. at *20. The Court of Appeal relied on a line of recent California decisions recognizing that statutory schemes may confer standing through statutory damages or penalties untethered from actual harm. It cited Chai v. Velocity Investments, LLC, 108 Cal.App.5th 1030 (2025), Guracar v. California Capital Insurance Co., 111 Cal.App.5th 337 (2024), and Kashanian v. National Enterprise Systems, Inc., 114 Cal.App.5th 1037 (2025), each of which held that statutory damages provisions create standing even where plaintiffs admit no concrete injury. Id. at *11-16. Like those statutes, the ICRAA creates informational rights and attaches a fixed monetary consequence to their violation in order to punish and deter noncompliance. Id. at *18.
The Court of Appeal expressly declined to follow Limon, explaining that its reasoning was tied to the FCRA’s distinct statutory language and federal Article III standing concerns. See Limon, supra, 84 Cal.App.5th at 700-03. The Court of Appeal reasoned that the legislative materials make clear that the “ICRAA was designed to overcome the FCRA’s practical limitations by ensuring that consumers could obtain a nontrivial recovery and thus would be motivated to enforce ICRAA, even when actual damages were nonexistent.” Id. at *24-25. Legislative history also showed the California Legislature intentionally set a minimum recovery, which was $300 in 1975 and has since been increased to $10,000, to incentivize enforcement and compliance. Id. at *25. Of note, opponents of the ICRAA’s enactment criticized the statute precisely because it would impose liability “without regard to whether the individual has ever suffered damages,” further confirming that this result was not accidental but deliberate. Id. at *24.
The Court’s Reasoning on the UCL Claims
Where the opinion strongly favors the defense bar is its treatment of the UCL claims, the Court of Appeal affirmed summary adjudication, holding that Business and Professions Code section 17204 requires injury in fact and loss of money or property, regardless of whether the predicate statute allows recovery without harm. Id. at *31-32. Relying on cases such as Peterson v. Cellco Partnership, 164 Cal.App.4th 1583 (2008), the Court of Appeal reiterated that private UCL standing demands real economic injury. Id. at *31. Per Peterson, a private plaintiff must make a twofold showing: “he or she must demonstrate injury in fact and a loss of money or property caused by unfair competition.” Peterson, 164 Cal.App.4th at 1590.
Here, the Plaintiffs’ theory that the $41.50 application fee constituted lost money failed outright. Id. at *32. They argued that they were harmed because they were required to pay for a report that they were not given a copy of. Id. The Court of Appeal disagreed – the rental application described how the $41.50 non-refundable processing fee would be used to screen applicants with respect to their credit history and other background information. Id. Moreover, the application broke down the elements of the $41.50 fee: $22.99 for credit and screening reports, and $18.51 in costs, including overhead and soft costs, related to the processing of the application. Id. Since the application did not suggest that the $41.50 fee was for a consumer report to be provided to the applicant, the Court of Appeal determined that Plaintiffs received precisely what they paid for: the processing and consideration of their rental applications, which resulted in their approval as tenants. Id. at *32-33. Finally, any failure to provide plaintiffs with copies of their consumer reports within three days also does not constitute an injury because plaintiffs failed to allege any concrete or particularized harm as a result of the delay. Id. at *33.
The Court of Appeal emphasized that applicants paid for screening and processing, received exactly that, and were approved as tenants. Id. The alleged failure to timely provide copies of reports did not deprive plaintiffs of property, cause lost opportunities, or result in financial harm. Id. Technical noncompliance alone was not enough.
Implications for Companies
The takeaway here is twofold.
First, Investigative Consumer Reporting Agencies (ICRAs) under the ICRAA, loosely defined as any person who, for compensation, gathers or communicates information regarding a consumer’s character, reputation, or personal characteristics, usually obtained through extensive, often more personal investigative methods — such as interviews or public record checks — should carefully audit ICRAA disclosures as plaintiffs can proceed without needing to prove actual harm. This decision underscores the ICRAA as a strict liability statute with teeth, and technical compliance matters even when no one is harmed.
Second, this case confirms that California courts remain unwilling to dilute UCL standing requirements. Even in an era of expansive statutory enforcement, courts continue to draw a hard line against no injury, no loss UCL claims. This ruling provides powerful authority to limit exposure by cutting off UCL claims early where plaintiffs cannot show injury in fact and a loss of money or property.
Duane Morris Takeaways: Data breaches are becoming increasingly common and detrimental to companies. The scale of data breach class actions continued its record growth in 2025, as companies faced copycat and follow-on lawsuits across multiple jurisdictions. The last year also saw a virtual explosion in privacy class action litigation. As a result, compliance with privacy and data privacy laws in the myriad of ways that companies interact with employees, customers, and third parties is a corporate imperative.
To that end, the class action team at Duane Morris is pleased to present the third editions of the Data Breach Class Action Review – 2026 and the Privacy Class Action Review – 2026. These publications analyze the key data breach and privacy-related rulings and developments in 2025 and the significant legal decisions and trends impacting data breach and privacy class action litigation for 2026. We hope that companies and employers will benefit from this resource and assist them with their compliance with these evolving laws and standards.
Click here to download a copy of the Duane Morris Data BreachClass Action Review – 2026 eBook.
Click here to download a copy of the Duane Morris Privacy Class Action Review – 2026 eBook.
Stay tuned for more data breach and privacy class action analysis coming soon on our weekly podcast, the Class Action Weekly Wire.
Duane Morris Takeaways: Given the importance of compliance with workplace anti-discrimination laws for our clients, we are pleased to present the fourth annual edition of the Duane Morris EEOC And Government Enforcement Litigation Review – 2026. The EEOC And Government Enforcement Litigation Review – 2026 analyzes the EEOC’s and U.S. Department of Labor enforcement lawsuit filings in 2025 and the significant legal decisions and trends impacting this litigation for 2026.
Click here to bookmark or download a copy of the EEOC And Government Enforcement Litigation Review – 2026 e-book.
The Review explains the impact of the EEOC’s six enforcement priorities as outlined in its Strategic Enforcement Plan on employers’ business planning and how the direction of the Commission’s Plan should influence key employer decisions. The Review also contains a compilation of significant rulings decided in 2025 that impacted government-initiated litigation and a list of the most significant settlements in 2025.
We hope readers will enjoy this new publication. We will continue to update blog readers on any important EEOC developments and look forward to sharing further thoughts and analysis in 2026!
Duane Morris Takeaway: In 2025, Artificial Intelligence – AI – continued to influence class action litigation on multiple fronts. First, we saw a growth of class action lawsuits targeting AI, including in the copyright area and employment space, as well as the securities fraud area with claims of “AI washing.” Second, we saw an increasing number of courts and lawyers err in their use of AI to generate documents filed on dockets across the country and encountered numerous examples of the ways in which AI is continuing to impact the efficiencies that underlie the litigation process.
DMCAR Editor Jerry Maatman discusses this trend in detail in the video below:
AI Provided Raw Material For Class Action Lawsuits
AI has been an accelerating force in class action litigation as a source of claims stemming from the development, use, and promotion of AI technologies. In 2025, some of those filed claims or ongoing claims included claims stemming from alleged copyright infringement, algorithmic bias or discrimination, and securities fraud.
On the copyright front, courts issued key decisions, including divergent decisions on whether using copyrighted works to train generative AI models constitutes “fair use” under the Copyright Act. In copyright cases, the plaintiffs typically allege that a developer of a generative AI tool violated copyright laws by using publicly available copyrighted works to train and inform the output of the AI tools. In Tremblay v. OpenAI, Inc., No. 23-CV-3223 (N.D. Cal. June 13, 2024), for instance, the plaintiffs alleged that OpenAI trained its algorithm by “copying massive amounts of text” to enable it to “emit convincingly naturalistic text outputs in response to user prompts.” The plaintiffs alleged these outputs included summaries that were so accurate that the algorithm must have collected and retained knowledge of the ingested copyrighted works in order to output similar textual content. The plaintiffs typically invoke the Copyright Act to allege that the defendant willfully made unauthorized copies of thousands of copyrighted works, generating damages up to $150,000 per copyrighted work for willful infringement, and, therefore, to seek billions in damages.
The $1.5 billion settlement reached in Bartz, et al. v. Anthropic is a landmark settlement and a prime example. In that suit, three authors filed a class action lawsuit against Anthropic claiming that Anthropic had downloaded millions of copyrighted books from “shadow libraries” like Library Genesis and Pirate Library Mirror to train its AI systems. In June 2025, Judge William H. Alsup of the Northern District of California denied Anthropic’s motion for summary judgment on the issue of fair use in a split-the-baby decision. The record showed that Anthropic downloaded more than seven million books from pirate sites but also bought and scanned millions more. The court held that Anthropic’s use of legally acquired books for AI training was protected fair use but that downloading and keeping pirated copies was not, noting that a developer that has obtained copies of books “from a pirate site has infringed already, full stop.” In August 2025, Judge Alsup granted the plaintiffs’ motion for class certification, sua sponte defining the class to include “all beneficial or legal copyright owners of the exclusive right to reproduce copies of any book” in the datasets that met his criteria. With tens of billions of dollars on the line, the parties promptly reached a settlement for $1.5 billion, the largest settlement of any class action in 2025.
Notably, shortly after Judge Alsup’s decision on summary judgment, Judge Vince Chhabria of the U.S. District Court for the Northern District of California reached a different conclusion in Kadrey, et al. v. Meta Platforms, Inc., No. 2023-CV-03417 (N.D. Cal. June 25, 2025). In that case, 13 authors, mostly famous fiction writers, sued Meta for downloading their books from online “shadow libraries” and using the books to train Meta’s generative AI models (specifically, its large language models, called Llama). The parties filed cross-motions for partial summary judgment regarding fair use. The court rejected the plaintiffs’ argument that “the fact that the AI developer downloaded the books from shadow libraries and did not start with an ‘authorized copy’ of each book gives them an automatic win.” The court held that, because Meta’s use of the works was highly transformative, to overcome a fair use defense, the plaintiffs needed to show that the AI model harmed the market for the plaintiffs’ works. Because the plaintiffs presented no meaningful evidence of market dilution, the court entered summary judgment for Meta on the fair use defense.
On the employment front, Mobley, et al. v. Workday, Inc., No. 23-CV-770 (N.D. Cal. May 16, 2025), continues to reign as one of the most watched and influential cases. In Mobley, the plaintiff, an African American male over the age of 40, who alleged that he suffers from anxiety and depression, brought suit against Workday claiming that its applicant screening tools discriminated against applicants on the basis of race, age, and disability. The plaintiff claimed that he applied for 80 to 100 jobs, and despite holding a bachelor’s degree in finance, among other qualifications, did not get a single job offer. The district court granted the defendant’s motion to dismiss on the ground that plaintiff failed to plead sufficient facts regarding the supposed liability of Workday as a software vendor for the hiring decisions of potential employers. In other words, the plaintiff failed to allege that Workday was “procuring” employees for its customers and merely claimed that he applied for jobs with a number of companies that all happened to use Workday.
On February 20, 2024, the plaintiff filed an amended complaint alleging that Workday was an agent of the employers that delegated authority to Workday to make hiring process decisions or, alternatively, that Workday was an employment agency or an indirect employer. Plaintiff claimed, among other things, that, in one instance, he applied for a position at 12:55 a.m. and his application was rejected less than an hour later. Judge Rita F. Lin granted in part and denied in part Workday’s motion to dismiss the amended complaint. The court reasoned, among other things that the relevant statutes prohibit discrimination “not just by employers but also by agents of those employers,” so an employer cannot “escape liability for discrimination by delegating [] traditional functions, like hiring, to a third party,” and an employer’s agent can be independently liable when the employer has delegated to the agent “functions [that] are traditionally exercised by the employer.” The court noted that, if it reasoned otherwise, and accepted Workday’s arguments, then companies could “escape liability for hiring decisions by saying that function has been handed to over to someone else (or here, artificial intelligence).”
The court opined that, given Workday’s allegedly “crucial role in deciding which applicants can get their ‘foot in the door’ for an interview, Workday’s tools are engaged in conduct that is at the heart of equal access to employment opportunities.” The court also denied Workday’s motion to dismiss the plaintiff’s disparate impact discrimination claims reasoning that “[t]he zero percent success rate at passing Workday’s initial screening” combined with the plaintiff’s allegations of bias in Workday’s training data and tools plausibly supported an inference that Workday’s algorithmic tools disproportionately rejected applicants based on factors other than qualifications, such as a candidate’s race, age, or disability. Thereafter, the court conditionally certified a collective action of all individuals aged 40 and over who applied for jobs using Workday’s platform and were rejected. In doing so, it authorized plaintiff to send notice of the lawsuit to applications nationwide. This litigation has been closely watched for its novel case theory based on artificial intelligence use in making personnel decisions and, given its success to date, is likely to prompt tag along and copycat litigation.
On the securities front, over the past three years, plaintiffs have filed dozens of lawsuits alleging that various defendants made false or misleading statements related to AI technology or related to AI as a driver of market revenue or demand, including claims that companies overstated their AI capabilities, effectiveness, or revenue generation in a practice known as “AI washing.” For instance, on April 17, 2025, the plaintiff Wayne County Employees’ Retirement System filed suit against AppLovin Corporation, No. 25-CV-03438 (N.D. Cal.), alleging that, among other things, the company falsely attributed its financial success to its enhanced AXON 2.0 digital ad platform and the use of “cutting edge” AI technologies to match advertisements to mobile games. In the complaint, the plaintiffs claim that the company’s revenue instead stemmed from manipulative ad practices, such as forced, silent app installations and that, upon release of short-seller reports disclosing the alleged practices, the company’s share price declined more than 12%.
Because investors have shown a willingness to pay a premium for shares of companies that appear positioned to capitalize on the effective use of AI, such statements have had the tendency to boost share prices. When projections fail to materialize, however, and share prices decline, plaintiffs are poised to take advantage.
In another example, plaintiffs filed a securities class action against Apple in the Northern District of California alleging that Apple made misleading and false statements regarding Siri’s generative AI features. The plaintiffs allege that Apple, at its annual Worldwide Developers Conference and on earnings calls, made claims that its AI solution called Apple Intelligence would create a more advanced and capable Siri. The plaintiffs allege that Apple continued to maintain that these features would arrive in early 2025 until March 2025 when it admitted that “[i]t’s going to take us longer than we thought.” The plaintiffs allege that, in the wake of these announcements, Apple’s share price dropped almost $47.
In sum, with AI continuing to flourish, the implications of its development, use, and advertisement are providing the raw material for creative plaintiffs’ class action lawyers. We should expect to see an upward trend of key decisions and new cases in 2026 and beyond as this burgeoning area of the law continues to expand.
AI Continued To Impact The Litigation Process
As legal professionals on both sides leverage AI to attempt to increase efficiency and gain a strategic advantage, examples of improper use abound. Rarely a day passes without a headline reporting attorney misconduct. To date, much of the AI misuse has centered on attorneys submitting or courts generating filings and legal briefs with fake citations. So-called “AI hallucinations” can take the form of citations to cases that do not exist or, even worse, the attribution of incorrect “hallucinated” holdings or quotations to existing opinions.
Bar associations have compiled dozens if not hundreds of instances of attorneys misusing generative AI in complaints, legal memoranda, expert reports, and appellate briefs. Perhaps more disturbing, these examples are joined by at least two instances of courts withdrawing decisions due to the incorporation of AI-generated contend.
Such conduct has led to severe sanctions, including fines and suspensions for violation of ethical duties, as well as (presumably) terminations. To date, claims of overbilling for such AI-generated worked product have not been made public, and lawyers continue to reiterate and train that AI is a tool and not a substitute for the application of legal analysis and judgment.
At the same time, AI is becoming an asset in the hands of more cautious connoisseurs who are taking advantage of its efficiencies for projects involving data analytics, document reviews, and form generation. Its use has become transformative in the settlement administration process where it has exposed vulnerabilities in the claims administration process by, for example, generating thousands of entries that dilute legitimate claims, thereby reducing legitimate recoveries.
Similar to classrooms where teachers use AI to detect AI, recipients are responding with their own AI-based tools to detect irregularities.
As the technology continues to evolve, it continues to impact that class action space in particular, which is particularly susceptible to mass-generated claims, demand letters, and form complaints. As a result, we are likely seeing the tip of the iceberg in terms of AI’s influence on the class action space.
Duane Morris Takeaway:In 2025, case law continued to develop in fragmented ways among the federal circuits on issues material to plaintiffs’ ability to maintain and certify class actions, enhancing the likelihood of and incentive for forum shopping. In terms of standards governing conditional certification of FLSA, EPA, and ADEA matters, 2025 saw the crystallization of four distinct standards, ranging in the burdens applicable to plaintiffs, as well as in the review and consideration of the evidence presented. A second chasm relates to courts’ approaches uninjured class members, or the notion that each member of a putative class as defined might not have experienced a concrete injury sufficient to provide such individual standing to pursue a claim. A third chasm reflects courts’ divergent views relative to personal jurisdiction and whether a court that cannot exercise general personal jurisdiction must have a basis for specific personal jurisdiction as to each putative class member.
DMCAR co-editor Jennifer Riley explains this trend in detail in the video below:
These fractures have made forum selection more consequential than ever. Plaintiffs are increasingly skewing their filings toward federal circuits where they anticipate a greater likelihood of a favorable outcome, including toward jurisdictions where judges are taking a more lenient approach to certification or a more permissive view on issues like standing and jurisdiction. To date, efforts to persuade the U.S. Supreme Court to take up cases that would resolve these splits have failed, so we expect they will continue to drive uncertainty in class-related litigation through 2026.
Courts Disagree Over The Standards For Conditional Certification Of Collective Actions
The standards for conditional certification under the FLSA, EPA, and ADEA, continue to diverge such that district and appellate courts are applying any of at least four distinct approaches. These statutes provide little guidance as to the process they intended to incorporate for so-called conditional certification. In 29 U.S.C. § 216(b), the FLSA provides that “[a]n action . . . may be maintained against any employer (including a public agency) . . . by any one or more employees for and in behalf of himself or themselves and other employees similarly-situated. No employee shall be a party plaintiff to any such action unless he gives his consent in writing to become a party and such consent is filed in the court in which such action is brought.” 29 U.S.C. § 216(b). Courts have interpreted such language to authorize a process by which courts grant “conditional certification” of a collective action, authorize notice to persons who fall within the defined group, and permit those persons to “opt-in” by returned their consent forms. Courts, however, have disagreed over the standards plaintiffs must satisfy to initiate this process. In other words, how and when should a court determine if such persons are “similarly-situated”?
To date, federal courts that have addressed these issues have developed or adopted one of four primary schemes.
First, for many years, court accepted the familiar and lenient two-step standard set forth in Lusardi v. Xerox Corp., 118 F.R.D. 351 (D.N.J. 1987), and the U.S. Court of Appeals for the Second Circuit expressly adopted this standard in Scott v. Chipotle Mexican Grill, Inc., 954 F.3d 502, 515 (2d Cir. 2020), while the First, Third, Tenth, and Eleventh Circuits had done the same by “acquiescence” without express adoption. See Kwoka v. Enterprise Rent-A-Car Company of Boston, LLC, 141 F.4th 10, 22 (1st. Cir. 2025); Zavala v. Wal Mart Stores Inc., 691 F.3d 527, 534 (3d Cir. 2012); Thiessen v. General Electric Capital Corp., 267 F.3d 1095, 1105 (10th Cir. 2001); Hipp v. Liberty National Life Insurance Co., 252 F.3d 1208, 1219 (11th Cir. 2001)
Under Lusardi, a court considers at “step one” whether a plaintiff has made a “modest factual showing” based on his or her evidence, which often comprises one or more declarations, and may or may not even look at competing evidence submitted by the employer. If the court determines that a plaintiff has satisfied his or her “lenient” burden, the court authorizes notice. At the close of discovery, the employer then can move to decertify the conditionally certified collective action, and the court will consider based on the evidence whether the plaintiff has demonstrated that the persons who joined the action are similarly situated.
The Ninth Circuit clarified in Campbell v. City of Los Angeles, 903 F.3d 1090, 1114 (9th Cir. 2018), that the plaintiff must show he or she is similarly situated with respect to “some material aspect” of his or her claim and not merely in some way that is irrelevant to the claims asserted.
Second, in the first example of a court revisiting and examining the text of the FLSA, the Fifth Circuit prompted the ensuing split with its decision in Swales v. KLLM Transportation Services, LLC, 985 F.3d 430, 443 (5th Cir. 2021). In that decision, the Fifth Circuit rejected Lusardi’s two-step approach outright and directed district courts to “rigorously enforce” the FLSA’s similarity requirement at the outset of the litigation in a one-step approach. “[T]he district court needs to consider all of the available evidence” at the time the motion is filed and decide whether the plaintiff in fact has “met [his or her] burden of establishing similarity.” Id. at 442-43.
Third, in the wake of Swales the Sixth Circuit likewise revisited the standard in Clark v. A&L Homecare & Training Center, LLC, 68 F.4th 1003 (6th Cir. 2023). The Sixth Circuit rejected Lusardi, but also declined to adopt Swales. Instead, the court likened the standard to one comparable to the standard for obtaining a preliminary injunction. An employee must show a “strong likelihood” that others are similarly situated to the employee before the district court may authorize the plaintiff to send notice of the action. The Sixth Circuit left open the standard by which the court should consider a potential motion for decertification down the line. Id. at 1011.
Fourth, most recently, the Seventh Circuit addressed the same issue in Richards, et al. v. Eli Lilly & Co., 149 F.4th 901 (7th Cir. 2025). The Seventh Circuit rejected the Lusardi framework but declined to go as far as Swales or Clark. Instead, the Seventh Circuit ruled that “a plaintiff must first make a threshold showing that there is a material factual dispute as to whether the proposed collective is similarly situated” to secure a ruling authorizing notice, and an employer “must be permitted to submit rebuttal evidence” for the court to consider. Id. at 913. The court declined to set any bright line rule as to whether a court should decide the similarly situated question in a one or two step approach, noting that the analysis is not an “all-or-nothing determination.” Id. at 913-914.
The U.S. Courts of Appeal for the District of Columbia, Fourth, and Eighth Circuits have not yet opined on the proper method, leaving district courts to exercise their discretion. These divergent standards have influenced forum selection, as plaintiffs significantly have decreased the number of collective actions they pursue in the Fifth and Sixth Circuits in particular, in favor of filing in forums that apply more lenient standards.
Courts Continue To Disagree Over Standing And Personal Jurisdiction
Courts continue to disagree regarding the impact and treatment of uninjured class members, a key issue that remains unresolved. It is axiomatic that individuals who did not suffer injury as the result of the defendant’s conduct cannot maintain claims, and courts do not have the power to award them relief. As the U.S. Supreme Court reiterated in its seminal 2020 decision in TransUnion, “Article III does not give federal courts the power to order relief to any uninjured plaintiff, class action or not.” TransUnion LLC v. Ramirez, 141 S.Ct. 2190, 2208 (quoting Tyson Foods v. Bouaphakeo, 577 U.S. 442, 466 (2016) (Roberts, C.J., concurring)). In this respect, the “plaintiffs must maintain their personal interest in the dispute at all stages of the litigation . . . And standing is not dispensed in gross; rather, plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek.” Id.
Despite this admonition, courts continue to grapple with the application of these concepts in the class certification context and, in particular, they disagree over whether to certify a class, a plaintiff must demonstrate that every putative class member has standing, or, stated differently, must demonstrate that the class excludes those individuals who did not suffer harm. In TransUnion, the Supreme Court expressly left open the question of “whether every class member must demonstrate standing before a court certifies a class.” Id. at n.4. Such a requirement has significant consequences for the class action landscape.
As a result, in January 2025, the U.S. Supreme Court granted a petition for certiorari in Laboratory Corporation Of American Holdings v. Davis, 145 S.Ct. 1608 (2025). In Davis, plaintiffs filed suit on behalf of a putative class of legally blind patients alleging that Lab Corp. violated the ADA by failing to make its self-service check-in kiosks accessible. In May 2022, the district court certified a broad class of that included all legally blind individuals were denied full and equal enjoyment of its goods and services due to “LabCorp’s failure to make its e-check-in kiosks accessible,” emphasizing that individualized damages questions do not defeat the predominance requirement. Lab Corp. sought interlocutory appeal, arguing that plaintiffs’ class definition swept in uninjured individuals who would not have used kiosks anyway. The Ninth Circuit granted the petition and affirmed. Applying Ninth Circuit precedent, the appellate court reasoned that Rule 23 permits certification of a class even when the class “‘potentially includes more than a de minimis number of uninjured class members.’” The U.S. Supreme Court granted certiorari in January 2025. Following briefing and oral argument, the U.S. Supreme Court declined to resolve the issue and dismissed the writ as improvidently granted. Justice Kavanaugh authored a dissent from such decision noting that, if given the opportunity, he would hold that “[f]ederal courts may not certify a damages class under Rule 23 when, as here, the proposed class includes both injured and uninjured class members.”
Without guidance from the U.S. Supreme Court, lower federal courts have continued to reach varying decisions on the issue. For instance, on July 17, 2025, the Fifth Circuit issued its decision in Wilson v. Centene Management Co., 144 F.4th 780 (5thCir. 2025). The plaintiffs in this case asserted breach of contract claims against the defendant insurance companies, alleging that it issued inaccurate provider lists and thereby caused the plaintiffs to pay artificially inflated premiums for access to providers who were not available. The district court denied class certification finding that the plaintiffs lacked standing. On appeal, the Fifth Circuit held that, at the class certification state, a plaintiff need only demonstrate his or her own standing, and the district court erred in its determination of the plaintiff’s standing, which it reached through a merits-based evaluation of the plaintiff’s expert.
The Seventh Circuit addressed the question in Arandell Corp. v. Xcel Energy Inc., 149 F.4th 883 (7th Cir. 2025). In that case, the plaintiffs brought a putative state-wide class action alleging that defendants engaged in a price-fixing conspiracy to manipulate natural gas prices. The Seventh Circuit noted that, to the extent defendants suggested that, before class certification, the plaintiffs must show all class members suffered some injury, “that is not correct.” It reiterated its prior holding that that “a class should not be certified if it is apparent that a great many persons who have suffered no injury at the hands of the defendant,” it clarified that “[t]here is no precise measure for ‘a great many.’ Such determinations are a matter of degree and will turn on the facts as they appear from case to case.”
In contrast, the Fourth Circuit took a different approach in Freeman v. Progressive Direct Insurance Co., 149 F.4th 461 (4th Cir. 2025). After an automobile collision, the plaintiff’s insurer provided her a payment based on the “actual cash value” of her car that it determined using a “projected sold adjustment.” Although the plaintiff accepted the payment, and did not contest the valuation, she filed suit for breach of contract. Although the district court certified a class, the Fourth Circuit reversed. The Fourth Circuit explained that, to succeed on her claim, the plaintiff needed to show that her insurer paid her less than the actual cash value of her vehicle and, likewise, that her insurer paid members of the class less than the actual cash value of their vehicles, regardless of whether the “projected sold adjustment” was used in determining that value. Yet, the class was defined to include anyone who was paid “compensation for the total loss of a covered vehicle, where . . . the actual cash value was decreased based upon Projected Sold Adjustments.” Thus, the class was defined to include insureds who accepted the insurer’s offer of payment, insureds who negotiated a higher payment, and insureds who invoked the appraisal process in the policy, simply because in each circumstance the insurer made its calculation using the Projected Sold Adjustment. “Yet, none of those could claim injury because each agreed to resolution of the loss. . . This characteristic of the certified class alone justifies reversal of the class certification order.”
Similarly, courts have continued to disagree regarding the scope of a court’s personal jurisdiction over the defendant in the class action context. In short, the U.S. Supreme Court decided Bristol Myers Squibb v. Superior Court, 137 S. Ct. 1773 (2017), in 2017 and ruled that a court must have a basis for exercising personal jurisdiction over a defendant for each claim it adjudicates. In that case, which involved a mass tort action, the U.S. Supreme Court concluded that the existence of similar claims asserted by plaintiffs who purchased a drug in California did not provide a court with personal jurisdiction over the defendant for purposes of adjudicating claims asserted by plaintiffs who purchased the same drug outside of California.
Again, despite this clear ruling, courts have continued to grapple with the application of these concepts in the class certification context and, in particular, they disagree over whether, to certify a class that includes nationwide class members, a plaintiff must demonstrate that the court can exercise personal jurisdiction over the defendant for purposes of resolving each of their claims or, stated differently, must demonstrate that each claim arises from or relates to a foreign defendant’s contacts with the forum state.
On July 1, 2025, the Ninth Circuit became the latest to address this issue. In Harrington, et al. v. Cracker Barrel Old Country Store, 142 F.4th 678 (9th Cir. 2025), the Ninth Circuit ruled that the U.S. Supreme Court’s decision in Bristol-Meyers applies to collective actions brought under the FLSA. The Ninth Circuit held that, when a plaintiff relies on specific personal jurisdiction as the basis for personal jurisdiction over the defendant in an FLSA collective action, district courts must assess whether they can exercise specific personal jurisdiction over the defendant on a claim-by-claim basis. This means that the claim of every opt-in plaintiff must arise out of or relate to the defendant’s activities in the forum state, and opt-in plaintiffs with no connection to the forum cannot rely on the connections of the named plaintiffs to establish personal jurisdiction.
In sum, courts continue to disagree as to their power in the class action context and the extent to which a procedural rule like Rule 23 can alter otherwise fundamental concepts of subject matter and personal jurisdiction for putative class members. Given the implications of such rules, we can anticipate that such questions will continue to influence forum selection for plaintiffs and continue to fuel uncertainty for defendants through 2026.
Duane Morris Takeaway:Government enforcement litigation is similar in many respects to class action litigation. In lawsuits brought by the U.S. Equal Employment Opportunity Commission (EEOC), as well as the U.S. Department of Labor (DOL), the government asserts various claims on behalf of or as a representative of numerous allegedly impacted individuals. These cases typically present numerous claimants, as well as significant monetary exposure.
The video below featuring DMCAR editor Jerry Maatman explains this trend in detail:
While plaintiffs in private party class actions must meet the requirement of Rule 23 to secure class certification, the law does not require the government to clear such hurdle. For example, systemic “pattern or practice” lawsuits brought by the EEOC follow a framework established by the U.S. Supreme Court in International Brotherhood Of Teamsters v. United States, 431 U.S. 324 (1977), rather than Rule 23. Nonetheless, EEOC systemic lawsuits present similar issues and similar risk for corporate defendants.
While the EEOC and DOL historically have been among the most aggressive litigants in terms of their pursuit of claims, the Trump Administration has had a profound impact on these agencies and their enforcement agendas. President Trump ran for election on a platform that runs counter to many of the “emerging issues” on the EEOC’s priority list, foreshadowing a realignment of litigation priorities.
The Trump Administration has kept its promise of less government oversight and regulation and has shifted the priorities of these agencies to more closely match the administration’s objectives.
Litigation And Settlement Trends
In fiscal year (FY) 2025, which ran from October 1, 2024, to September 30, 2025, the EEOC’s litigation enforcement activity stalled significantly as compared to previous years.
By the numbers, the EEOC filed a total of 94 lawsuits, far fewer than it filed at the height of filings in FY 2018, when it filed 217 lawsuits.
The decline in enforcement activity shows that, for President Trump’s second term in office, companies should expect the EEOC to be less aggressive as compared to past regimes in terms of the volume of enforcement lawsuits filed.
Each year, the EEOC’s fiscal year ends on September 30, and the agency engages in a sprint to the finish as it files a substantial number of lawsuits during the month of September. In FY 2025, the EEOC filed 94 lawsuits. Of these, it filed 35 – or 37% of the annual total – during September, the last month of its fiscal year. The overall number represents a decrease from prior years, but the filings followed a somewhat similar pattern. In FY 2024, the EEOC filed 110 lawsuits. It filed 67 of these actions, or more than 60%, during the month of September. By comparison, in FY 2023, the EEOC filed 144 lawsuits, with a similarly heavy September tranche of 35.We track the EEOC’s filing efforts across the entire fiscal year from its beginning in October through the anticipated filing spree in September.
Unlike other fiscal years, during 2025, the EEOC’s filing patterns were consistent in the first half of FY 2025, peaking with 14 lawsuits in January. Filings again slowed until the summer, when the EEOC filed another 14 lawsuits in June 2025. Thereafter, lawsuit filings dipped until the “eleventh hour” in September. The following shows filing activity by month:
Lawsuit Filings By EEOC District Office
In addition to tracking the total number of filings, the litigation filing patterns of the EEOC’s 15 district offices are telling. Some districts tend to be more aggressive than others, and some focus on different case filing priorities. The following chart shows the number of lawsuit filings by each of the EEOC district offices in FY 2025.
In FY 2025, Philadelphia and Chicago led the pack in filing the most lawsuits, with 11 each, followed by Indianapolis with eight filings, then Atlanta, Birmingham, Houston, and Phoenix with seven filings, and Charlotte, New York, and Miami each with six filings.
St. Louis had five filings, Los Angeles and San Francisco had four filings, and Dallas had three filings. Memphis had the lowest amount with only two filings.
As in FY 2024, Philadelphia proved itself as a leader in EEOC enforcement filings. Chicago remained steady with 11 filings, the same as FY 2024. St. Louis (two filings in FY 2024) and Phoenix (four filings in FY 2024) showed increases in filing numbers as compared to FY 2024.
Other offices comparatively lagged in enforcement activity. Atlanta (11 filings in FY 2024), Indianapolis (nine filings in FY 2024), and Houston (eight filings in FY 2024) showed slight decreases in enforcement activities. Across the board, filings generally became more even for district offices compared to FY 2024, but filing activity decreased.
Lawsuit Filings Based On Type Of Claim
The types of claims the EEOC filed in FY 2025 provides a window into its shifting strategic priorities.
When considered on a percentage basis, the distribution of cases filed by statute skewed significantly in favor of Title VII cases when comparing FY 2025 to prior years.
The EEOC again based most of its claims on alleged violations of Title VII, but these claims comprised 50% of its filings in FY 2025, compared to 58% of its filings in FY 2024. Those numbers represent a significant decrease from FY 2023 and FY 2022, when Title VII claims represented 68% of the EEOC’s filings in FY 2023 and 69% of its filings in FY 2022.
Overall claims for alleged violation of the ADA made up the next most significant percentage of the EEOC’s FY 2025 filings – totaling 31.5%. This share again shows a decrease from prior years when ADA claims comprised 42% of filings in FY 2025, 34% of filings in FY 2023, and 37% of filings in FY 2021. The percentage is marginally higher than FY 2022, when ADA filings on a percentage basis comprised 29.7% of all filings.
The EEOC filed more claims for alleged violation of the ADEA in FY 2025. It filed nine ADEA cases in FY 2025, as compared to six ADEA age discrimination cases in FY 2024, but it filed 12 ADEA age discrimination cases in FY 2023 and seven in FY 2022.
As in FY 2024, this past year the EEOC pursued claims under the Pregnant Worker’s Fairness Act. It filed six cases, compared to three in FY 2024. In addition, the EEOC filed slightly more claims for alleged violation of the Pregnancy Discrimination Act in FY 2025. It filed five such cases, as compared to four in FY 2024.
Notably, the EEOC refrained from filing any claims for alleged violation of the Equal Pay Act in FY 2025 and any cases for alleged violation of the Genetic Information Nondiscrimination Act.
The following graph shows the number of lawsuits filed according to the statute under which they were filed.
The grounds for such claims are reflect the stated priorities of the Trump Administration, including by reflecting a decreased emphasis on targeting alleged racial discrimination, and an increased emphasis on routing out disparate treatment based on gender and health-related and family-related conditions. Claims based on alleged disability discrimination, sex discrimination, and retaliation led the way. Collectively, these three theories provided the foundation for 59.4% of FY 2025 EEOC filings.
Notably, in FY 2025, the EEOC filed only three lawsuits asserting discrimination based on race or national origin, a total of 2.3% of the lawsuit filings. In FY 2024, 8.9% of all filings included claims based on race. The following graph shows a breakdown of the allegations underlying the FY 2025 filings.
Lawsuits Filings Based On Industry
In terms of filings by industry, FY 2025 aligned with prior years and reflected the EEOC’s focus on a few major industries. In FY 2025, two industries remained among the EEOC’s top targets – hospitality and healthcare.
On a percentage basis, hospitality industry employers (restaurants / hotels / entertainment) were recipients of 25% of EEOC filings, and healthcare industry employers received 21.3%. In FY 2025, manufacturing (15% of FY 2025 filings, 12.1% of FY 2024 filings) overtook retail (11.3% of FY 2025 filings; 23.1% of FY 2024 filings) as the next most targeted industry, with retain experiencing a double-digit decline. Only one other industry, transportation & logistics received a double-digit percentage share of EEOC-initiated lawsuits (with 10%). Filings against employers in staffing and construction remained flat in terms of relative percentage in FY 2025 as compared to FY 2024 (8.8% and 8.8% of filings, respectively). As in FY 2024, in FY 2025, the EEOC did not file any of its enforcement lawsuits against employers in the automotive, security, and/or technology industries.
Strategic Priorities
Moving into FY 2026, the EEOC’s budget justification includes a $19.618 million decrease from FY 2025. This move is reflective of the Trump Administration’s stated priority of returning to the “agency’s true mission.” The EEOC aims to return to its founding principles and restore evenhanded enforcement of employment civil rights laws on behalf of all Americans.
Every new presidential administration brings with it an array of objectives focused on different priorities. Since President Trump’s inauguration, the Trump Administration has taken unique steps to significantly reshape the EEOC. Among its moves to overhaul the agency, President Trump dismissed two Democratic-appointed EEOC commissioners and its General Counsel and replaced them with officials viewed as more aligned with his agenda. The Administration appointed new leadership, including Chair Andrea Lucas and Acting General Counsel Andrew Rogers. On October 7, 2025, Brittany Panuccio was confirmed by the Senate as a commissioner, thereby restoring a quorum.
President Trump has issued a series of executive orders reflecting its shift in enforcement priorities, particularly against DEI initiatives. On January 20, 2025, the White House issued an executive order, “Ending Radical and Wasteful Government DEI Programs and Preferencing,” and, on January 21, 2025, the White House issued, “Ending Illegal Discrimination and Restoring Merit-Based Opportunity.” The latter’s stated purpose is to end “dangerous, demeaning, and immoral race- and sex-based preferences under the guise of so-called ‘diversity, equity, and inclusion’ (DEI) or ‘diversity, equity, inclusion, and accessibility’ (DEIA) that can violate the civil-rights laws of this Nation.” President Trump ordered all executive departments and agencies to terminate all “discriminatory and illegal preferences” and to “combat illegal private-sector DEI preferences, mandates, policies, programs, and activities.”
Shortly thereafter, in February 2025, the EEOC took prompt action to implement the Administration’s shift in direction. Citing the Trump Administration’s Executive Order on “gender ideology extremism,” the EEOC announced that it would withdraw seven lawsuits it had filed across the country, including:
EEOC v. Sis-Bro Inc., No. 25-CV-968 (S.D. Ill.) EEOC v. Harmony Hospitality LLC, No. 24-CV-357 (M.D. Ala.) EEOC v. Brik Enterprises, Inc., et al., No. 24-CV-12817 (E.D. Mich.) EEOC v. Reggio’s Pizza Inc., No. 24-CV-8910 (N.D. Ill.) EEOC v. Lush Handmade Cosmetics LLC, No. 24-CV-6859 (N.D. Cal.) EEOC v. Boxwood Hotels, LLC, No. 24-CV-902 (W.D.N.Y.) EEOC v. Starboard Group Inc., No. 24-CV-2260 (S.D. Ill.)
On February 18, 2025, in EEOC v. LeoPalace, No. 25-CV-4 (D. Guam), the EEOC settled a lawsuit for more than $1.4 million and entered into a three-year consent decree with LeoPalace Resort, a large hotel in Guam. The EEOC alleged that LeoPalace provided employees of non-Japanese national origin with less favorable wages and benefits than their Japanese counterparts. This lawsuit is significant because it was the first seven figure settlement that the Commission procured after President Trump took office in January 2025 – and because it was accompanied by a statement from Chair Andrea Lucas announcing the Commission’s new enforcement agenda and its intent to protect all workers from national origin discrimination and “Anti-American Bias.”
In the accompanying press release, Chair Lucas announced that “Federal anti-discrimination laws ensure equal employment opportunity for jobs performed by all workers regardless of national origin. . . . This case is an important reminder that unlawful national origin discrimination includes discrimination against American workers in favor of foreign workers.” This was the Commission’s first publicized settlement since Lucas was appointed Acting Chair of the EEOC. One day after the settlement was announced, the EEOC published a second press release on its Newsroom “putting employers and other covered entities on notice” that the Commission was committed to protecting all workers from unlawful national origin discrimination, including American workers.
The Commission has stated that it is committed to carrying out President Trump’s policy agenda, consistent with his executive orders related to (1) “unlawful DEI-motivated race and sex discrimination,” (2) “defending the biological and binary reality of sex and related rights,” (3) “protecting workers from religious bias and harassment, including antisemitism,” and (4) “anti-American national origin discrimination.”
Further evidencing these stated objectives, among other things, Acting Chair Lucas has announced that one of her priorities for compliance, investigations, and litigation is to defend the biological and binary reality of sex and related rights, including women’s rights to single-sex spaces at work. She likewise removed the agency’s “pronoun app,” a feature in employees’ Microsoft 365 profiles, which allowed an employee to opt to identify pronouns, which then appeared alongside the employee’s display name across all Microsoft 365 platforms, including Outlook and Teams. This content was displayed both to internal and external parties with whom EEOC employees communicated. She also has ended the use of the “X” gender marker during the intake process for filing a charge of discrimination and directed the modification of the charge of discrimination and related forms to remove “Mx.” from the list of prefix options.
On December 19, 2025, Chair Lucas announced in an interview with Reuters that, “[i]f you have a DEI program or any employee program that involves taking an action in whole or in part motivated by race or sex or any other protected characteristic, that’s unlawful.” She confirmed that federal inquiries into corporate diversity programs are underway and warned that initiatives tied to hiring, promotion, or marketing may come under scrutiny. Lucas reiterated the White House’s position that white men have been subject to discrimination in the workplace through DEI programs and encouraged the submission of complaints.
In several respects, FY 2025 represented a hard pivot in enforcement targets. While total filings decreased, the new administration foreshadowed a new direction and targeted approach in upcoming EEOC enforcement.
Duane Morris Takeaway: Data privacy class action filings continued to expand in 2025, marking it as one of the fastest growing areas in the complex litigation space. Plaintiffs filed approximately 1,822 data privacy class actions in 2025. This represents an average of more than 150 fillings per month and more than seven filings per business day. These numbers reflect growth of more than 18% over the number of data breach class actions filed in 2024 and growth of more than 200% over the number of data breach class actions filed just three years ago in 2022.
Watch Review co-editor Jennifer Riley as she explains this trend in more detail below:
In 2025, courts also granted motions to dismiss these complaints at increasingly high rates, leading to many dismissals, many pre-ruling settlements, and few rulings on motions for class certification. Indeed, despite the significant increase in filings, courts issued few – only three – rulings on motions for class certification in 2025, suggesting that many motions are in the pipeline or that cases are increasingly resolved prior to class certification through dismissal or settlement.
Filing Numbers Continued Their Upward Trajectory
The volume of data breach class actions continued to expand in 2025 as data breach solidified its spot among the fastest growing areas of class action litigation. After every major (and even not-so-major) report of a data breach, companies should expect the negative publicity to prompt one or more class action lawsuits. These suits saddle companies with the significant costs of responding to the data breach as well as the costs of dealing with the resulting high-stakes class action lawsuits, often on multiple fronts.
Companies that were unfortunate enough to fall victim to data breaches in 2025 faced class actions at an increasing rate. In 2025, plaintiffs filed approximately 1,822 data privacy class actions, which represents a 18% increase over 2024. In 2024, plaintiffs filed 1,488 data privacy class actions, compared with 1,320 in 2023, and 604 in 2022.
As the graphic depicts, the growth of filings in the data breach area has been extraordinary, from 109 class action filings in 2018 to 1,822 class action filings in 2025, an increase of more than 1,613% in seven years.
Several factors are likely continuing to fuel this growth in data breach class actions. First, data breaches have continued to increase at a rate that roughly tracks the shape of the curve depicted above. Second, whereas defendants have achieved success in the courthouse, recent court decisions have provided a better roadmap for plaintiffs to attempt to escape dismissal with some portion of their complaint intact. Third, and most importantly, hefty settlements have continued to fuel filings. Observing the difficulty that plaintiffs have faced attempting to certify data breach class actions, plaintiffs are increasingly incentivized to file and then monetize their data breach claims early in the litigation, prior to reaching that crucial juncture, while their investment remains low.
So long as defendants continue to play ball on the settlement front, we are likely to continue to see even low settlement payouts continue to lure plaintiffs to this space and fuel those filing numbers.
Plaintiffs Continued To Face Hurdles In The Courthouse
Data breach plaintiffs continued to face hurdles in the courthouse in 2025. In 2025, federal courts issued substantive rulings on 222 motions to dismiss that they granted, granted in part, or denied. In those rulings, courts granted 150 motions to dismiss in whole or in part, and denied 72 of those motions, representing a success rate for defendants of 67.5%. Contrasting those results with 2024, in 2024, federal courts issued rulings on 265 motions to dismiss that they granted, granted in part, or denied. In those rulings, courts granted 171 motions to dismiss in whole or in part, and denied 94 of those motions, representing a success rate for defendants of 64.5%. Considering the increasing filing numbers, this suggests that defendants attacked the pleadings in a lower percentage of matters in 2025, or that a lower percentage of cases made it to the motion to dismiss stage.
In terms of the 150 favorable rulings for defendants in 2025, courts granted dismissal in 81 matters and granted dismissal in part in 69 matters. Thus, of the 150 rulings favoring defendants, 54% of those favorable rulings dismissed complaints in their entirety, often for lack of standing as discussed below. Defendants fared slightly better in 2025 than in 2024 in terms of gaining full dismissals. In 2024, courts issued 171 favorable rulings for defendants, granted dismissal in 103 matters and granted dismissal in part in 68 matters, meaning that, of the 171 rulings favoring defendants in 2024, 60% of those favorable rulings dismissed complaints in their entirety.
In terms of full dismissals, many of the decisions granting such motions addressed the issue of standing. The U.S. Supreme Court’s decision in TransUnion LLC v. Ramirez, 141 S.Ct. 2190 (2021), continues to fuel a fundamental threshold challenge in terms of whether a plaintiff can show that he or she suffered a concrete injury such that he or she has standing to sue. In TransUnion, the Supreme Court ruled that certain putative class members, who did not have their credit reports shared with third parties, did not suffer concrete harm and, therefore, lacked standing to sue. Since the TransUnion decision, standing has emerged as a key defense to data breach litigation because the plaintiffs often have difficulty demonstrating that they suffered concrete harm.
Courts have handed down a kaleidoscope of decisions on the issue of standing. For instance, some courts have found that mere public disclosure of private facts is sufficiently “concrete” enough for an injury to establish standing, whereas others have required allegations showing harm from misuse of the plaintiffs’ data. Decisions on motions to dismiss data breach class actions often turn on the sensitivity and level of exposure of the information involved, as well as plaintiffs’ ability to plausibly allege a credible risk of future harm, a duty to protect confidentiality of information, and many other specifics relevant to a large number various common law and statutory theories asserted by plaintiffs, who often file multiple claims, and sometimes file dozens of claims under dozens of theories in data breach class actions, in the hopes of finding one that will stick.
In Teague, et al. v. AGC America, Inc., 2025 U.S. Dist. LEXIS 102564 (N.D. Ga. Jan. 6, 2025), for instance, the plaintiff filed a class action alleging that the defendant failed to adequately safeguard personal information, resulting in a data breach. The plaintiff claimed that the breach exposed the PII of more than 20,000 individuals, which subsequently was accessed by cybercriminals. The defendant moved to dismiss, arguing that the plaintiff failed to show actual losses or a causal connection between the breach and his alleged injuries. The court, however, held that the plaintiff had standing to sue because he demonstrated a substantial risk of future harm resulting from the data breach. The court reasoned that the plaintiff’s allegations of misuse of his PII by criminals and the immutable nature of the information were sufficient for standing.
In Dougherty, et al. v. Bojangles’ Restaurants, Inc., 2025 U.S. Dist. LEXIS 194879 (W.D.N.C. Sept. 30, 2025), by contrast, the court dismissed a putative class action arising from a 2024 cyberattack against Bojangles. A group of former employees alleged negligence and violations of North Carolina tort and consumer protection laws, claiming emotional distress, privacy loss, and risk of identity theft. The court held that plaintiffs failed to allege a concrete injury sufficient for Article III standing. Eight of the nine plaintiffs based their claims solely on a speculative risk of future harm – such as potential sale of data on the dark web, increased spam calls, and time spent on mitigation – without a showing of any actual misuse. The lone plaintiff alleging fraudulent debit card charges failed to establish traceability, as he did not claim to have provided his card information to Bojangles.
Plaintiffs who clear the standing hurdle face another key inflection point at the class certification phase. Despite the robust filing activity, in 2025 courts issued few decisions on motions for class certification. In 2025, courts ruled on only three motions for class certification in the data breach area, and plaintiffs prevailed on one, for a success rate of 33%. Similarly, in 2024, courts ruled on only five motions for class certification in the data breach area, and plaintiffs prevailed on two, for a success rate of 40%. By comparison, in 2023, courts issued seven rulings on motions for class certification, and plaintiff prevailed on one, for a success rate of 14%. Given the volume of filings, these numbers suggest that hundreds of motions remain in the pipeline or that, observing the difficulty that plaintiffs have faced in certifying data breach such cases over the past three years, plaintiffs are electing to monetize their data breach claims prior to reaching that crucial juncture.
The court’s ruling in Theus, et al. v. Brinker International Inc., 2025 U.S. Dist. LEXIS 122165 (M.D. Fla. June 27, 2025), is illustrative. The plaintiff filed a class action against the defendant, Chili’s parent company Brinker International, Inc., alleging that hackers stole customers’ credit and debit card information and posted it for sale on a dark web marketplace called Joker’s Stash. The plaintiff filed a motion for class certification on behalf of all affected customers across the United States. The district court certified a class that included individuals who shopped at affected Chili’s locations during March and April 2018, had their data accessed by cybercriminals, and incurred expenses or time mitigating the consequences. However, Brinker appealed, and the Eleventh Circuit vacated the district court’s ruling. On appeal, the Eleventh Circuit reasoned that the phrase “data accessed by cybercriminals” was too broad and could include uninjured individuals. Id. at *4. The Eleventh Circuit ordered the district court to either revise the class definition to include only those who experienced fraudulent charges or had data posted on the dark web, or to reassess the original definition while recognizing it might contain uninjured members. On remand, the plaintiff initially proposed a narrower class definition but ultimately deferred to the Eleventh Circuit’s directive, which refined the class to include only those who: (i) experienced fraudulent charges or had their data posted on the dark web due to the breach; and (ii) spent time or money mitigating those consequences. Despite this refinement, the district court denied class certification. The district court found individualized questions, such as whether someone’s data was compromised, what expenses he or she incurred, or whether his or her card was ever posted or misused, would require case-by-case analysis. The district court ruled that proving the individualized issues would require “a great deal of individualized proof,” making the case unsuitable for class certification. Id. at *11.
In sum, while filing numbers continue to climb, the number of rulings on key phases of data breach class actions is continuing to decline. Observing the difficulty that plaintiffs have faced overcoming motions to dismiss and certifying such cases over the past three years, plaintiffs are increasingly incentivized to monetize their data breach claims early in the litigation, prior to reaching either juncture. As we continue to see filings grow in this area, we could continue to see a decline in the number of rulings. So long as defendants continue to play ball on the settlement front, and payouts remain higher than the associated transaction costs, we are likely to continue to see settlements lure plaintiffs to this space.
Duane Morris Takeaway: Arbitration agreements with class action waivers provide the foundation for one of the most potent defenses to class action litigation. While the U.S. Supreme Court has continued to promote arbitration agreements, plaintiffs have continued to attack their enforceability, and courts across the country have continued to apply exceptions in inconsistent and expansive ways.
Watch Review Editor Jerry Maatman explain this trend below:
One of the most impactful examples is the transportation worker exemption, which courts have applied expansively to local workers, such that the U.S. Supreme Court is poised to examine the exemption again, for a third time in the past five years. A defendant’s ability to enforce an arbitration agreement containing a class or collective action waiver continues to reign as one of the most impactful defenses in terms of shifting the pendulum of class action litigation. The U.S. Supreme Court cleared the last hurdle to widespread adoption of such agreements with its decision in Epic Systems Corp. v. Lewis, et al., 138 S. Ct. 1612 (2018).
In response, more companies of all types and sizes updated their onboarding systems, terms of use, and other types of agreements to require that employees and consumers resolve any disputes in arbitration on an individual basis.
Defendants Continued To Enforce Arbitration Agreements At High Rates
Their success rate in 2025 was not wholly out of line with their success rates over the past two years. In 2024, courts issued rulings on 167 motions to compel arbitration, and defendants prevailed in 91 of those rulings, a success rate of approximately 54%. In 2023, courts issued rulings on 187 motions to compel arbitration, and defendants prevailed on 123 motions, which translated into a success rate of 66%.
Given the potency of the arbitration defense, the plaintiffs’ class action bar has continued to press potential exceptions to its coverage. One of the most litigated is the transportation worker exemption to the FAA. Over the past year, plaintiffs made significant strides in terms of expanding that exemption as courts issued a mixed bag of rulings. Many lower federal courts continued to apply the transportation worker exemption in a broad manner to workers who handled goods that moved in interstate commerce, irrespective of whether the workers played a direct and necessary role in transporting the goods across borders, leading to divergent outcomes for last-mile delivery drivers, warehouse workers, and local distributors.
Section 1 of the FAA exempts from arbitration “contracts of employment of seamen, railroad employees, or any other class of workers engaged in foreign or interstate commerce.” The third category for workers “engaged in commerce” commonly is called the “transportation worker” exemption. Although the U.S. Supreme Court has instructed lower courts to interpret the exemption “narrowly,” its parameters have proved a slippery slope for lower courts.
In Southwest Airlines Co. v. Saxon, et al., 142 S.Ct. 1783 (2022), the U.S. Supreme Court considered application of the transportation worker exemption to an airport ramp supervisor. Considering the language of the exemption, the U.S. Supreme Court reasoned that the exemption turns on the actual work that the “class of workers” to which the plaintiff belongs “typically carr[ies] out.” Id. at 1792. The parties did not contest that the plaintiff, a ramp supervisor, frequently loaded and unloaded cargo. The U.S. Supreme Court held that, to be “engaged in foreign or interstate commerce,” the class of workers must “at least play a direct and necessary role in the free flow of goods across borders” or, put another way, must “be actively engaged in transportation of those goods across borders via the channels of foreign or interstate commerce.” It concluded that cargo loaders exhibited this central feature, reasoning that “there could be no doubt that [interstate] transportation [is] still in progress” when they do the work of loading or unloading cargo. Id. at 1793-94.
This ruling set off a barrage of disparate decisions as courts struggled to find a workable line. As a result, in April 2024, the U.S. Supreme Court took up Bissonnette, et al. v. LePage Bakeries Park Street, LLC, 601 U.S. 246 (2024). As in Saxon, the U.S. Supreme Court emphasized that the test for application of the transportation worker exemption focuses on the work performed and not the employer’s industry. Addressing the employer’s argument that its test would fold virtually all workers who load or unload goods, such as pet shop employees and grocery store clerks, into the exemption, the U.S. Supreme Court stated that the exemption has “never” been interpreted to apply in “such limitless terms.” Id. at 256. It held that, for the exemption to apply, the worker “must at least play a direct and necessary role in the free flow of goods across borders.” Id.
The Bissonnette decision, however, appears to have had a smaller impact on the lower courts, which continued to issue opinions before and after Bissonette that broadly construe the transportation worker exemption. In 2025, rulings by lower courts diverged substantially, particularly with respect to workers who move goods, which have crossed or ultimately will cross state borders, within a facility or local area.
The court in Wolford, et al. v. United Coal Co. LLC, 2025 U.S. Dist. LEXIS 15681 (W.D. Va. Jan. 28, 2025), for example, rejected plaintiffs’ attempts to apply the exception to mine workers like electricians and machine operators who did not directly transport coal across state lines. The plaintiffs argued that their work was closely related to the interstate transportation of coal via a beltline, which crossed state lines into Virginia, because they interacted with the beltline. The court found that the plaintiffs’ work did not qualify them as transportation workers under the FAA. Although coal crossed state lines, the court opined that the plaintiffs were primarily involved in tasks performed within the mine in Kentucky and their work was too far removed from the interstate transportation of coal to be considered transportation work.
Similarly, the court in Rubio-Leon, et al. v. Fresh Harvest, Inc., 2025 U.S. Dist. LEXIS 181816 (N.D. Cal. Sept. 16, 2025), ruled that the plaintiffs, a group of seasonal farm workers who hauled and trucked agricultural products, failed to show they qualified for the exemption. The plaintiffs demonstrated that they moved products from fields to a cooling facility at the farm’s processing plant but did not produce evidence as to what then happened with the products. The plaintiffs pointed to statements on the defendant farms’ websites indicating the farms’ products were distributed nationally, but the court found such statements insufficient to show how, when, and where the products moved through the supply chain or how the plaintiffs played a meaningful role in that movement. The court therefore concluded that the FAA applied and compelled individual arbitration.
By contrast, numerous courts reached opposite conclusions. For example, the court in Mitchell, et al. v. Lineage Logistics Services, LLC, 2025 US Dist. LEXIS 35792 (E.D. Cal. Feb. 27, 2025), applied the transportation worker exemption to plaintiff, a warehouse worker, who organized boxes of goods and therefore denied the employer’s motion to compel arbitration. Although the court found the plaintiff to be part of a class of workers that organizes boxes in preparation for storage or shipment, it concluded that such work was tied to the movement of goods in interstate commerce and thus applied the exemption. The court explained that “preparing boxes for egress from the facility or organizing them for storage before they are ready to be shipped is necessary to the subsequent transit of those goods out of the facility. In other words, those goods cannot be transported without the workers like Plaintiff.” Id. at *15.
In Joyner, et al. v. Frontier Airlines, Inc., 2025 U.S. Dist. LEXIS 101068 (D. Colo. May 19, 2025), the court applied the exemption to three customer service agents who worked for an airline. Two of the plaintiffs worked at ticket counters and the third plaintiff worked at the boarding gates. The defendant argued that the plaintiffs were not supposed to touch customer baggage but were instead required to supervise passengers as they tagged and loaded their own bags onto conveyer belts. The plaintiffs argued that they often weighed bags, tagged bags, and loaded them onto conveyer belts or, if the conveyer belts malfunctioned, loaded baggage on to carts. As such, the court found that the plaintiffs belonged to a class of workers who lift, weigh, inspect, and tag baggage and move it to conveyer belts or carts during a route to a destination on a plane. The court concluded that the plaintiffs played a direct and necessary role in ensuring that passengers’ baggage moves through the airport for loading on to planes and that this sufficed to establish the plaintiffs’ status as transportation workers.
Finally, in Silva, et al. v. Schmidt Baking Distribution, LLC, No. 24-2103-CV (2nd Cir. Dec. 22, 2025), the Second Circuit applied the exemption to commercial truck drivers who created their own corporations and executed arbitration agreements in their capacities as presidents of their own companies. The drivers filed a putative class action alleged violation of wage & hour laws and, after the district court granted the defendant’s motion to compel arbitration, the appellate court reversed. The appellate court noted that, before and after they formed their own corporations, their daily responsibilities involved driving commercial trucks to the defendant’s warehouse to pick up baked goods, delivering the product to retail outlets within their assigned territories, unloading the goods, and stocking the goods on retail shelves. The Second Circuit held that truck-driving work directly impacts the free flow of goods and, therefore, concluded that the drivers qualified as transportation workers without any examination of whether their routes or the goods crossed borders. It also credited the workers’ allegations that they were faced with a Hobson’s choice of adopting a corporate form or losing their jobs and, therefore, declined to allow such form to circumvent the transportation worker exemption.
These and other decisions reflect continued inconsistent application of the transportation worker exemption. In 2025, this led the U.S. Supreme Court to grant a writ of certiorari in Flower Foods, Inc. v. Brock, No. 24-945, 2025 U.S. LEXIS 3947 (U.S. Oct. 20, 2025). That case involves a plaintiff who worked as a local distributor of baked goods. He placed orders for products, most of which were produced by Flowers bakeries outside the state, picked up the products at a local warehouse, loaded them onto his own vehicle, and delivered them to his customers within the same state. The district court denied Flowers’ motion to compel arbitration based on the transportation worker exemption, and the Tenth Circuit affirmed that decision. The U.S. Supreme Court granted a writ of certiorari and is set to answer the question of whether workers who locally deliver goods, which traveled in interstate commerce, are transportation workers for purposes of the FAA exemption.
Thus, the Supreme Court is set to add some clarity to the scope of the transportation worker exemption in 2026, and its ruling could have a profound impact on class actions. Because nearly all products travel across state lines, the ruling effectively could exempt most workers from the FAA, weakening the force of arbitration agreements, or it could significantly curtail the broad reading the lower courts have given Saxon. Either way, given the enduring impact of the arbitration defense in class action litigation, the plaintiffs’ class action bar is apt to continue to attempt to develop creative work arounds to arbitration agreements and to continue to push the boundaries of the transportation worker exemption.
Duane Morris Takeaway: Continued settlements in the privacy space have inspired more members of the plaintiffs’ bar to make privacy litigation the centerpiece of their business models. Although the landscape has shifted over the past five years, the recipe has remained similar — combine archaic statutory schemes, which provide for lucrative statutory penalties, with a ubiquitous technology, to yield the threat of a potential business-crushing class action that can be made via widespread use of form letters and cookie-cutter complaints, to generate payouts on a massive scale.
Watch Class Action Review co-editor Jennifer Riley explain this trend in the following video:
Privacy continued to dominate as one of the hottest areas of growth in terms of class action filings by the plaintiffs’ bar in 2025.
As noted, the landscape has shifted over the past five years. In 2023, many plaintiffs’ attorneys targeted session replay technology, which captures and reconstructs a user’s interaction with a website, or website chatbots, which are programs that simulate conversation through voice or text, or biometric technologies, which capture traits like fingerprints or facial scans for purposes of identification.
Over the past two years, the focus for many plaintiffs’ class action lawyers has shifted to website pixels – pieces of code embedded on websites to track activity and, in some circumstances, to provide information about that activity to third-party social media and analytics providers. Plaintiffs have launched thousands of claims via form letters, cookie-cutter complaints, and mass arbitration campaigns.
In 2025, while plaintiffs pulled back on filings in areas like biometric privacy, we saw a surge in litigation over internet tracking technologies based on a patchwork quilt of state-level laws, including the California Invasion of Privacy Act (“CIPA”).
Illinois Biometric Information Privacy Act (“BIPA”) Claims
Following steep year-over-year growth between 2017 through 2024, companies that operate in Illinois finally saw a reprieve from the growth in BIPA litigation in 2025. The BIPA was once one of the most popular privacy laws in the United States. On August 2, 2024, however, the Illinois Governor signed a long-awaited amendment to the BIPA that eliminated “per-scan” statutory damages in favor of a “per-person” model. Over the past year, the impact of this amendment became apparent as the plaintiffs’ class action bar shifted its attention away from the BIPA and toward potentially more lucrative statutory schemes.
Enacted in 2008, the BIPA regulates the collection, use, and handling of biometric information and biometric identifiers by private entities. Subject to certain exceptions, the BIPA prohibits collection or use of an individual’s biometric information and biometric identifiers without notice, written consent, and a publicly available retention and destruction schedule.
For nearly a decade following enactment of the BIPA, activity under the statute remained largely dormant. The plaintiffs’ bar filed approximately two total lawsuits per year from 2008 through 2016 before filings increased in 2017 and then skyrocketed in 2019. In 2020, plaintiffs filed more than six times as many class action lawsuits for alleged violations of the BIPA than they filed in 2017 and more than the number of class action lawsuits they filed from 2008 through 2016 combined.
Filings continued to accelerate in 2023, prompted by two rulings from the Illinois Supreme Court that increased the opportunity for recovery of damages under the BIPA. On February 2, 2023, the Illinois Supreme Court held that a five-year statute of limitations applies to claims under the BIPA, and, on February 17, 2023, the Illinois Supreme Court held that a claim accrues under the BIPA each time a company collects or discloses biometric information. SeeTims v. Black Horse Carriers, 2023 IL 127801 (Feb. 2, 2023); Cothron v. White Castle System, Inc., 2023 IL 1280004 (Feb. 17, 2023). BIPA-related filings jumped markedly in the months following these rulings.
In 2024, the Illinois General Assembly abrogated Cothron. On August 2, 2024, the Illinois Governor signed SB 2979 into law, which amended the BIPA and clarified that plaintiffs are limited to one recovery per person under §§ 15(b) and 15(d). In other words, a private entity that, in more than one instance, collects, captures, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection “has committed a single violation” for which an aggrieved person is entitled, at most, to one recovery. See 740 ILCS 14/20 (b), (c).
In a welcome relief for defendants, within a year after the BIPA’s new “per person” damages regime took effect, we saw a substantial drop in filings. Whereas their rate of growth slowed in 2024, BIPA-related filings remained robust in 2024 in comparison with prior years. In 2025, however, filings declined by a substantial margin. Plaintiffs filed only 150 lawsuits invoking the BIPA in 2025, compared with 427 lawsuits in 2024, 417 in 2023, and 362 in 2022.
The graphic shows the number of BIPA-related filings over the past eight years, including the year over year growth, followed by the substantial drop off in 2025. The rapid drop in BIPA-related filings suggests that damages available under other, perhaps more widely applicable and/or more generous per-violation statutes proved a more attractive lure to the plaintiffs’ class action bar in 2025.
Although website activity tracking tools are nothing new, and appear on most websites, this past year they continued to fuel a growing wave of lawsuits alleging that such tools caused companies in various industries to share users’ private information. In 2025, plaintiffs filed thousands of class action complaints – and served many more demand letters – alleging that companies had software code embedded in their websites that secretly captured plaintiffs’ data and shared it with Meta, Google, or other online advertising agencies.
Advertising technology, often called “adtech,” broadly describes the software and tools that advertisers use to reach audiences and to measure digital advertising campaigns. Adtech enables advertisers to track customers’ online behaviors so that they can shape advertising content. Advertisers rely on adtech to inform decisions on who to target, how to present information, and how to track success.
Plaintiffs have asserted claims attacking adtech based on one or more of a wide variety of statutes and legal theories, such as the Video Privacy Protection Act (“VPPA”), the Electronic Communications Privacy Act (“ECPA”), as well as state specific statutes such as the California Invasion of Privacy Act (“CIPA”). Many of the statutes that plaintiffs seek to invoke predate the technology by multiple decades, forcing courts to attempt to apply them to technologies that the drafters never contemplated, leading to a patchwork quilt of divergent outcomes.
Plaintiffs typically seek to invoke a statute that provides for statutory damages, asserting that hundreds of thousands of website visitors, times $10,000 per claimant in statutory damages under the Federal Wiretap Act, for example, or that hundreds of thousands of website visitors, times $5,000 per violation in statutory damages under the CIPA, equals billions of dollars in supposed damages.
Certain members of the plaintiffs’ class action bar have constructed business models designed to efficiently leverage such allegations. After identifying any of millions of websites with adtech, they generate form or templated demand letters asserting violations of the CIPA or other statutes based on the use of tracking technologies provided by companies such as TikTok, LinkedIn, X, or others. They slow-play any formal filing, with the goal of leveraging a quick settlement and avoiding investment of fees and costs.
This repeatable formula is fueled by settlement dollars and dependent on continued disagreement among courts on basic attributes of these claims. This past year plaintiffs asserted such claims under various statutes and common law theories. While claims under the VPPA encountered roadblocks, court rulings in other areas showed more promise, driving claims toward statutes like CIPA.
The VPPA
In cases where websites allegedly transmit video viewing information, plaintiffs often assert claims for alleged violations of the federal VPPA. The statute prohibits a “video tape service provider” from knowingly disclosing “personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1).
The statute defines a “video tape service provider” to include any person “engaged in business, or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio-visual materials.” 18 U.S.C. § 2710(a)(4). The VPPA provides for damages up to $2,500 per violation in addition to costs and attorneys’ fees for successful litigants, making it an attractive source of filings for the plaintiffs’ class action bar.
Reflecting its comparatively narrower scope, Plaintiffs filed fewer VPPA class actions in 2025, compared to 116 VPPA class actions in 2024, and 137 in 2023, fueled in large part by adtech claims.
In 2025, many defendants succeeded in dismissing VPPA claims at the outset, particularly in the Second Circuit, which surely depressed filings in this area. Solomon v. Flipps Media, Inc., 2025 U.S. App. LEXIS 10573 (2d Cir. May 1, 2025), is a prime example. In that case, the Second Circuit applied a narrow reading of the VPPA, holding that the statute protects against only those disclosures that an ordinary person could use to identify a consumer’s video-viewing history. The plaintiff, a subscriber to Flipps Media’s streaming platform, alleged that each time she watched a video on the platform, Flipps transmitted to Facebook, via the Facebook Pixel, an encoded URL identifying the video and her unique Facebook ID (FID) in violation of the VPPA. The district court dismissed the complaint reasoning that, although Flipps transmitted data to Facebook, the plaintiff had not shown that her Facebook ID, even when paired with a video URL, would enable an ordinary person to identify her or her video-viewing behavior. On appeal, the Second Circuit affirmed. The Second Circuit emphasized that Congress intended to prevent disclosures that an average person, “with little or no extra effort,” could use to link an individual to specific video content. Id. at *27. The data Flipps transmitted was embedded in a mass of technical code and unreadable to a layperson.
Whereas such rulings had a muting effect on filings, courts in other jurisdictions applied different standards, signaling some continued daylight for the VPPA to fuel claims. In Manza, et al. v. Pesi, Inc., 784 F. Supp. 3d 1110 (W.D. Wis. 2025), for instance, the plaintiff purchased videos from Pesi, Inc. and she brought a putative class action alleging that Pesi disclosed her purchasing history and unique identifiers (e.g., Facebook ID, Google/Pinterest client or user IDs, hashed emails, IP addresses) to third-party ad platforms and data brokers via tracking technologies (Meta Pixel, Google Analytics/Tag Manager, Pinterest Tag) without her consent in violation of the VPPA. Pesi moved to dismiss arguing that: (i) it is not a “videotape service provider” under the VPPA (citing its nonprofit status); (ii) the data disclosed is not “personally identifiable information” within the meaning of the statute; and (iii) Manza’s factual allegations were insufficient to satisfy federal pleading standards. Id. at *2-3. The court denied the motion. It held that, at the pleading stage, it was reasonable to infer that Pesi is a “videotape service provider” because it regularly sold videos on its website. Id. at *5. The court held that unique identifiers tied to a specific account (e.g., Facebook ID, client/user IDs) qualify as personally identifiable information under the VPPA when paired with video titles the customer obtained from the defendant. Finally, the court rejected the “ordinary person” test (and decisions adopting it), reasoning that the VPPA’s text and purpose support a broader reading that covers identifiers capable of being used to trace a customer’s video purchases.
The CIPA
Companies that operate websites frequented by California consumers have received a wave of demand letters threatening claims under the CIPA, many of which have matured into lawsuits and arbitration proceedings. The CIPA presents an attractive option for plaintiffs because it offers statutory damages of $5,000 per violation, making it one of the most, if not the most, generous damages schemes provided by any privacy law.
California passed the CIPA, a criminal statute, in 1967 to prevent unlawful wiretapping to eavesdrop on telephone calls. Among other things, the CIPA prohibits use of pen registers and “trap and trace” devices without either a court order or explicit consent. The CIPA defines a pen register as “a device or process that records or decodes dialing, routing, addressing, or signaling information” for outgoing communications, and it defines a trap-and-trace device as a surveillance tool that captures similar information for incoming communications.
Plaintiffs frequently allege that website tracking technologies, such as cookies and pixels, run afoul of the CIPA because they permit companies to acquire identifying information about website visitors, such as their phone numbers and email addresses and other personal information. In the past few years, plaintiffs have filed hundreds if not thousands of cases attacking various types of widely used website technologies. While plaintiffs have filed many lawsuits alleging violations of the CIPA, they have sent many more demand letters that resulted in arbitration or pre-lawsuit settlements.
Inconsistency in the case law continues to fuel these claims. Taking a recent example, in Camplisson, et al. v. Adidas, Case No. 25-CV-603 (S.D. Cal. Nov. 18, 2025), the plaintiff, a website visitor, claimed that the sportswear company used pixels on its website that collected private information from visiting consumers.
The court denied the motion to dismiss. The court held that the plaintiff sufficiently alleged that the trackers on Adidas’ website collected a “broad set” of personal identifying and addressing information and thus alleged a concrete harm in the loss of control of their own information. The court also held that the plaintiff sufficiently alleged that such web-based trackers plausibly qualify as pen registers and that users did not effectively consent because the website did not make its terms conspicuous and did not provide a mechanism for affirmative assent.
The ruling runs counter to other decisions and thus contributes to the patchwork quilt of rulings in this area. For instance, among other thing, the court distinguished the Ninth Circuit’s ruling in Popa, et al. v. Microsoft Corp., 153 F.4th 784, 786, 791 (9th Cir. 2025), from earlier this year.
It explained that Popa addressed a claim concerning the defendant’s use of session-replay technology, which collected information on what products the plaintiff browsed and where her mouse hovered while on the website, and thus concerned how the plaintiff interacted with the website rather than her personal, private information.
The ruling also failed to account for Price, et al. v. Converse, Case No. 24-CV-08091 (C.D. Cal. Sept. 30, 2025), where another district court considered similar allegations and reached a different conclusion. The plaintiff alleged that the TikTok pixel engages in “device fingerprinting” to collect data about visitors to the Converse website including browser information, geographic information, and referral tracking information. The court found the plaintiff’s allegations insufficient to establish a “concrete injury” as required for standing because the plaintiff failed to plead any kind of harm that is remotely like the ‘highly offensive’ interferences or disclosures that were actionable at common law.
On June 3, 2025, the California Senate unanimously passed Senate Bill 690 (SB 690), which would have amended the CIPA on a prospective basis by providing a “commercial business purpose” exception. The bill defined “commercial business purpose” as the processing of personal information either to further a business purpose, as defined in the CCPA, or when the collection of personal information is subject to a consumer’s opt-out rights under the CCPA.
The California Assembly, however, later placed SB 690 on hold, classifying it as a two-year bill, meaning that its earliest reconsideration would occur in 2026, if at all, and its future is uncertain.
Thus, without a legislative response, the continued variation among courts in their approaches to these claims is likely to continue to fuel uncertainty and, as a result, both claims and settlements in this area. An expansive discussion of the vast and growing patchwork quilt of differing approaches to adtech claims appears in Chapter 14 regarding Privacy Class Actions.