Involved parties include plaintiffs alleging nonconsensual data collection/sharing, defendants Capital One Financial Corp. and Therapymatch (seeking class actions), and referenced prior cases like M.G. and John Doe (expanding to opt-out violations); the CCPA (enacted 2018, effective 2020) and its CPRA amendment (2023, adding email/password breaches) provide the statutory basis.[1][2][11]
Initially, CCPA's private right of action (tied to §1798.81.5 security duties) was limited to data breaches involving nonencrypted/nonredacted personal info, with courts like Judge Carter (2022) and others dismissing non-breach claims (e.g., notice violations).[3][6][10] Recent rulings diverge, citing CCPA's broad "personal information" definition (§1798.140(v)) and consumer autonomy purpose, allowing claims for tracking-based "unauthorized access/exfiltration/disclosure."[1][11][12] Timeline: CCPA lawsuits surged post-2020; splits emerged 2021-2022; these 2026 decisions (published April 10) signal expansion.[1][10]
Newsworthy now as these rulings could unleash widespread litigation against tracking practices, diverging from breach-only precedent and raising business risks amid 2026 enforcement uptick (e.g., Ford fine), per Ballard Spahr analysis.[1][6][11]