Consumer Privacy Class Action

State of play.

• The FTC and state AGs have opened a new enforcement front in digital health privacy, with the FTC, California, and Utah suing Hims & Hers for sharing sensitive health data with Meta and Snap through embedded tracking technologies while publicly promising privacy—a complaint that doubles as a ROSCA subscription-billing action and follows a nearly three-year investigation .
• Courts are scrutinizing embedded tracking technology operationally, not just by policy language, with federal courts allowing privacy class actions against Shopify and the NBA to proceed on the theory that consent banners and privacy policies do not establish meaningful consent if trackers fire before or after user interaction .
• Meta's social-media addiction litigation has crossed from theoretical harm into concrete financial exposure, with a $375 million New Mexico jury verdict and more than 5,700 pending California cases—scale that is pushing toward settlement or industry-wide consent decree territory rather than individual trial resolution .
• The 23andMe $46.75 million multistate bankruptcy settlement closes the enforcement cycle on the 2023 genetic data breach, with 42 AGs as co-parties and Kroll distributing funds—establishing a concrete recovery benchmark for sensitive biometric data breaches resolved through bankruptcy proceedings .
• For counsel advising telehealth companies, DTC subscription businesses, or consumer platforms using ad-tech tracking, the practical baseline is that health-data sharing with advertising platforms is now a primary FTC enforcement target, and embedded-tech consent architecture is independently litigable regardless of what the privacy policy says.

Where things stand.

• VPPA pixel litigation has a firm circuit split. The Second Circuit applies an "ordinary person" test that has dismissed multiple pixel-based VPPA claims including the NBCUniversal action; other circuits remain more plaintiff-permissive, making venue selection material for both sides .
• CCPA's private right of action is expanding beyond breach. District court rulings in Shah v. Capital One and a Therapymatch case have allowed CCPA claims to proceed based on unauthorized disclosure through tracking tools to third parties—no traditional breach required—a departure not yet tested at the Ninth Circuit .
• Article III standing doctrine is actively sorting tracking claims by data sensitivity. Courts allow pixel-tracking claims to survive when sensitive health data is exposed; claims based on routine behavioral data without sensitive information attached are routinely dismissed .
• ROSCA enforcement against subscription dark patterns is active and expanding. The FTC's Uber case survived dismissal on the theory that pre-stored payment credentials cannot substitute for fresh affirmative consent; 21 state AGs are co-plaintiffs in that action; the Genesis Tech asset freeze extends the same theory to offshore shell structures .
• The Hims & Hers complaint adds health-data sharing to the ROSCA enforcement template. The FTC's theory—that embedding ad-tech pixels on a health platform constitutes deceptive data sharing actionable under the FTC Act alongside ROSCA subscription violations—is the most expansive articulation of the agency's digital health enforcement posture to date .
• Cookie banner compliance is an independent litigation vector. CIPA claims targeting non-functional "Reject All" buttons and dark-pattern consent interfaces are proliferating; the Shopify and NBA cases extend this to checkout tools and third-party vendor scripts that may continue operating after opt-out .
• California CPPA is enforcing opt-out fragmentation. The agency's enforcement actions target businesses that honor opt-outs in some contexts but not others—fragmented compliance is itself the violation .
• Biometric and wearable health data exposure is accelerating across consumer product sectors. Virtual try-on tools, wearable health monitors, and cookie-based tracking practices are drawing simultaneous CIPA class action filings and state AG scrutiny; consumer health data from wearables falls outside HIPAA but within state health data statutes in Connecticut and Washington .
• State privacy law proliferation continues without federal resolution. Alabama enacted the 21st comprehensive state privacy statute; the SECURE Data Act has been introduced with full state-law preemption but lacks bipartisan support; Indiana, Kentucky, and Rhode Island privacy laws took effect January 1, 2026 .
• Arbitration clauses are being used to foreclose children's privacy class actions. A Central District of California ruling compelled minor plaintiffs to arbitrate Roku data-collection claims based solely on parental acceptance of terms of service—a ruling that, if it spreads, systematically channels children's privacy disputes out of class litigation .
• Law firm data breach class actions are an emerging category. The Blank Rome breach—57,554 clients' data exposed through a social-engineering attack, with a one-month notification delay—has produced two federal class actions alleging HIPAA, FTC Act, and California consumer protection violations, signaling that law firms are now class-action targets on the same terms as corporate defendants .

Latest developments.

• FTC, California, and Utah sue Hims & Hers in the Northern District of California, alleging health-data sharing with Meta and Snap through embedded tracking pixels, pre-consultation prescription charges, and ROSCA-violating subscription cancellation barriers—complaint follows a nearly three-year FTC investigation .
• Federal courts allow privacy class actions against Shopify and the NBA to proceed—Shopify's checkout tools alleged to collect California consumers' payment, location, and browsing data to build profiles under CIPA; NBA's cookie banner alleged to fail in practice because trackers load before or survive after user opt-out .
• Meta's social-media addiction litigation reaches $375 million jury verdict in New Mexico; Massachusetts court allows youth addiction case to proceed; more than 5,700 cases pending in California courts combined; Meta has halted plaintiff-recruitment advertising as docket expands .
• Bankruptcy court approves $46.75 million 23andMe settlement—42-state AG coalition co-party; covers 6.9 million breach victims; Kroll Restructuring distributing funds; settlement incorporates earlier $30 million class-action agreement and three years of security monitoring .
• Blank Rome faces two federal class actions over a May 2026 social-engineering breach exposing 57,554 clients' sensitive data including medical records and government identification numbers; one-month notification delay is a focal litigation issue .
• Nike and Lululemon face California class actions over alleged phantom discount pricing—Nike sued in S.D. Cal. over Air Max discounts allegedly held beyond the 90-day window under California's False Advertising Law; Lululemon sued in L.A. Superior Court over fictitious reference prices .
• TikTok Shop AI-avatar enforcement—TikTok now requires disclosure labels on shopping content featuring AI-generated presenters; undisclosed synthetic personas selling dropshipped goods create consumer protection and false advertising exposure for brands and marketplace participants .

Active questions and open splits.

• Health-data pixel sharing as FTC Act deception: how broadly does the Hims theory extend? The FTC's complaint treats embedding ad-tech tracking on a health platform as a deceptive act independent of any breach—the data sharing itself is the violation. Whether courts endorse this theory will determine exposure for every telehealth, DTC pharma, and digital health company that uses Meta Pixel, Google Analytics, or similar tools on pages where users submit health information .
• "Meaningful consent" and embedded tracking: what technical evidence is required? The Shopify and NBA cases require courts to evaluate what consent banners and privacy policies actually accomplish operationally—whether trackers fire before consent is obtained, and whether opt-out scripts actually stop data collection. The evidentiary standard for proving or disproving functional consent is unsettled and will drive discovery strategy in every pixel-tracking case .
• Social-media addiction: design-defect or Section 230 immunity? Meta's litigation has produced a $375 million verdict and thousands of pending cases, but the doctrinal question—whether algorithmic product features constitute actionable design defects, and whether Section 230 bars those claims—remains unresolved at the circuit level. The answer determines whether settlement is the only realistic outcome or whether defendants can litigate to dismissal .
• CCPA private right of action scope: breach-only or tracking-disclosure? The Shah and Therapymatch rulings extend CCPA liability to third-party tracking disclosures without a breach—a significant departure from prior precedent not yet tested at the Ninth Circuit. The Hims complaint, if it generates parallel class actions, will accelerate this question .
• Arbitration clauses binding non-consenting minors: will appellate courts hold the line? The Roku ruling channels children's privacy claims into individual arbitration based solely on parental assent. Enforceability against non-signatories who lack contractual capacity is unresolved at the circuit level .
• California phantom-discount temporal requirements: what is the 90-day rule's operational standard? The Nike and Lululemon suits test how courts interpret California's False Advertising Law requirement that reference prices reflect actual selling prices within 90 days—specifically, what documentation satisfies the disclosure obligation and whether digital pricing systems can satisfy it at scale .
• Law firm breach notification timing: does a one-month delay constitute a statutory violation? The Blank Rome litigation will test whether the gap between breach occurrence and client notification satisfies state and federal notice requirements—a question with direct implications for every firm's incident response protocol .

What to watch.

• Early motions practice in the Hims & Hers action—whether the FTC's pixel-as-deception theory survives dismissal, and whether parallel private class actions are filed on the same theory against other telehealth and DTC health platforms.
• Whether the Shopify and NBA cases produce rulings on what constitutes technically functional consent, and whether those rulings create a new evidentiary standard for cookie-banner compliance across the Ninth Circuit.
• Appellate review of the Roku minor-arbitration ruling—whether the Ninth Circuit addresses parental assent binding non-consenting minors, and whether the Florida AG's parallel state enforcement action produces a conflicting outcome .
• Whether the Meta addiction litigation produces a settlement framework or consent decree that imposes product-redesign obligations—any such agreement would become the de facto industry standard for engagement-feature governance affecting all major platforms.
• Whether the Blank Rome notification-delay theory produces early rulings that recalibrate incident-response timelines for professional-services firms holding client health and identification data.
• Whether other state AGs adopt the FTC's Hims health-data-sharing theory in independent enforcement actions against other digital health or DTC pharmaceutical companies.