Consumer Privacy Class Action

State of play.

• State AGs are deploying consumer-protection statutes as the primary enforcement vehicle against AI platforms. The Florida AG has filed what it describes as the nation's first state-led suit against OpenAI and CEO Sam Altman under Florida's Deceptive and Unfair Trade Practices Act, alleging concealed safety risks and harms to minors—coordinated with a parallel criminal investigation . Kentucky's AG has separately sued Character.AI under consumer and data-protection statutes, and the FTC issued Section 6(b) orders to chatbot companies in 2025 .
• The FTC has obtained a court order freezing a $700M subscription-fraud network, targeting Genesis Tech and 14 related entities for ROSCA and FTC Act violations—burying subscription terms, adding unauthorized charges, and obstructing cancellation through an offshore shell structure .
• Subscription misrepresentation has reached the AI sector directly, with a federal class action against Anthropic alleging that its Claude Max 5x and Max 20x plans delivered materially less usage than marketed—a theory that, if certified, would extend consumer-protection class action exposure to AI platform pricing across the industry .
• Arbitration clauses are being used to foreclose children's privacy class actions, with a Central District of California ruling compelling minor plaintiffs to arbitrate Roku data-collection claims based solely on parental acceptance of terms of service—a ruling that, if it spreads, systematically channels children's privacy disputes out of class litigation .
• For counsel advising consumer-facing digital platforms, AI companies, or subscription businesses, the practical baseline is simultaneous exposure across state AG enforcement, FTC ROSCA actions, AI-specific class actions, and a rapidly shifting arbitration landscape for minors—all moving without new federal legislation.

Where things stand.

• VPPA pixel litigation has a firm circuit split. The Second Circuit applies an "ordinary person" test that has dismissed multiple pixel-based VPPA claims including the NBCUniversal action; other circuits remain more plaintiff-permissive, making venue selection material for both sides .
• CCPA's private right of action is expanding beyond breach. District court rulings in Shah v. Capital One and a Therapymatch case have allowed CCPA claims to proceed based on unauthorized disclosure through tracking tools to third parties—no traditional breach required—a departure that has not yet been tested at the Ninth Circuit .
• Article III standing doctrine is actively sorting tracking claims by data sensitivity. Courts allow pixel-tracking claims to survive when sensitive health data is exposed; claims based on routine behavioral data without sensitive information attached are routinely dismissed; the DPPA standing dismissal in Cicale reinforces that tangible injury beyond data misuse is required across privacy statutes .
• ROSCA enforcement against subscription dark patterns is active and expanding. The FTC's Uber case survived dismissal on the theory that pre-stored payment credentials cannot substitute for fresh affirmative consent before subscription enrollment; 21 state AGs are co-plaintiffs; the Genesis Tech action extends the same theory to offshore shell structures .
• State auto-renewal law is tightening at the state level. Virginia's amendments to its automatic-renewal statute, effective July 1, 2026, require cancellation to be at least as easy as enrollment through the same channels, eliminate prior good-faith safe harbors, and treat violations as prohibited practices under the Virginia Consumer Protection Act—federal rules do not preempt .
• Cookie banner compliance is an independent litigation vector. CIPA claims targeting non-functional "Reject All" buttons and dark-pattern consent interfaces are proliferating; Honda and HelloFresh have already resolved enforcement actions, and a thickening pattern of CIPA suits was filed in 2025 .
• California CPPA is enforcing opt-out fragmentation. The agency's 2026 enforcement actions target businesses that honor opt-outs in some contexts but not others—fragmented compliance is itself the violation .
• Biometric and wearable health data exposure is accelerating across consumer product sectors. Virtual try-on tools, wearable health monitors, and cookie-based tracking practices are drawing simultaneous CIPA class action filings and state AG scrutiny under a reshaped 2026 multi-state privacy regime; consumer health data from wearables falls outside HIPAA but within state health data statutes in Connecticut and Washington .
• State privacy law proliferation continues without federal resolution. Alabama enacted the 21st comprehensive state privacy statute; the SECURE Data Act has been introduced with full state-law preemption but lacks bipartisan support; Indiana, Kentucky, and Rhode Island privacy laws took effect January 1, 2026 .
• Junk fee class actions and mass arbitrations are accelerating. The FTC's Rule on Unfair or Deceptive Fees is in force for live-event tickets and short-term lodging; California's SB 478 adds per-violation penalties; plaintiffs' firms are bypassing class-action waivers through coordinated mass arbitrations .

Latest developments.

• FTC obtains temporary court order freezing Genesis Tech's subscription-fraud network—15 corporations and 8 individuals targeted; connected PayPal accounts processed nearly $700 million in 12 months; ROSCA and FTC Act violations alleged; offshore shell structure used to evade enforcement .
• FTC reports $3.5 billion in consumer losses to imposter scams in 2025, with total fraud losses across all categories reaching $15.9 billion—signaling sustained regulatory and enforcement focus on fraud prevention across financial services, government, and technology sectors .
• Federal class action filed against Anthropic alleging its Claude Max 5x and Max 20x subscription plans delivered materially less usage than marketed—first major subscription-misrepresentation class action targeting an AI platform .
• Florida AG sues OpenAI and CEO Sam Altman under Florida's Deceptive and Unfair Trade Practices Act, alleging concealed safety risks and harms to minors; coordinated with a parallel criminal investigation into ChatGPT's role in the April 2025 Florida State University shooting .
• Kentucky AG sues Character.AI; Texas parents file parallel litigation; FTC Section 6(b) orders issued to chatbot companies; trial consultants document heightened juror emotional intensity in AI-harm cases involving minors .
• Coordinated phishing campaign exploits stolen hotel reservation data from more than 350 hotels worldwide; Booking.com and BWH Hotels have disclosed breaches; campaign remains active and expanding as of June 2026, with direct exposure for hospitality, travel, and payment processing clients .
• Virginia enacts auto-renewal symmetry requirements effective July 1, 2026—cancellation must be as easy as enrollment through the same channels; prior good-faith safe harbors eliminated; violations treated as prohibited practices under the Virginia Consumer Protection Act .
• Central District of California compels minor children to arbitrate Roku privacy claims based on parental acceptance of terms of service—minors never personally consented; ruling could systematically channel children's privacy class actions into individual arbitration if it spreads to other circuits .
• Illinois Interchange Fee Prohibition Act faces renewed constitutional challenges; Nevada court rules crypto contract trading falls within gaming regulation; undisclosed-fee class actions continue to expose payment platform disclosure vulnerabilities .

Active questions and open splits.

• AI platform liability under existing consumer-protection statutes: how far does the duty-to-disclose run? The Florida AG's OpenAI complaint and the Kentucky AG's Character.AI suit both proceed under existing state UDAP and product-liability frameworks—no AI-specific statute required. Whether courts treat concealed safety warnings as actionable misrepresentation, and how they define duty of care for AI systems accessible to minors, will determine whether these cases establish a replicable enforcement template .
• AI subscription misrepresentation: what disclosure standard applies to usage limits? The Anthropic class action tests whether marketing AI plans by usage multiples—without disclosing the actual cap methodology—constitutes actionable deception. If certified, the theory extends to every AI platform with tiered pricing and variable usage constraints .
• Arbitration clauses binding non-consenting minors: will appellate courts hold the line? The Roku ruling channels children's privacy claims into individual arbitration based solely on parental assent. The enforceability of that approach against non-signatories who lack contractual capacity is unresolved at the circuit level—and the Florida AG's parallel state enforcement action against Roku suggests the ruling does not foreclose all avenues .
• CCPA private right of action scope: breach-only or tracking-disclosure? The Shah and Therapymatch rulings extend CCPA liability to third-party tracking disclosures without a breach—a significant departure from prior precedent that has not yet been tested at the Ninth Circuit. Whether the court endorses this expansion will determine class action exposure for the entire California-facing digital economy .
• ROSCA asset recovery against offshore shell structures: can the FTC reach international assets? The Genesis Tech action targets a network deliberately structured through offshore entities and continuously spawning new companies to evade enforcement. Whether the court's asset freeze and preliminary injunction survive challenge—and whether asset recovery reaches beyond U.S.-held funds—will define the practical limits of ROSCA enforcement against sophisticated evasion architectures .
• DPPA standing: does the data-commercialization model determine survival? Cicale dismissed a parking enforcement DPPA claim for lack of injury while the Carfax crash-report case in Maryland survived—suggesting courts are distinguishing incidental DMV data use from systematic commercial exploitation. The line between those models is not yet defined by any circuit court .
• Federal preemption: will the SECURE Data Act displace state privacy regimes? The bill's preemption language would eliminate CCPA, the Virginia CDPA, and 19 other state frameworks if enacted—but it lacks bipartisan support and faces a long history of failed federal privacy efforts. The preemption question is the central advisory issue for multistate compliance programs .

What to watch.

• Early motions practice in the Florida AG v. OpenAI action—whether the complaint survives dismissal on duty-of-care and FDUTPA grounds, and whether the sealed factual record becomes public; also whether other state AGs file parallel suits using the Florida complaint as a template .
• Whether the Anthropic class action survives a motion to dismiss and proceeds to class certification—the court's treatment of usage-multiple marketing as a measurable, class-wide representation will be the signal for the broader AI subscription market .
• Appellate review of the Roku minor-arbitration ruling—whether the Ninth Circuit or other circuits address whether parental assent to platform terms can bind non-consenting minors, and whether the Florida AG's state enforcement action produces a conflicting outcome .
• Virginia's July 1, 2026 auto-renewal effective date—whether enforcement actions follow promptly and whether other states adopt the symmetry-of-cancellation model .
• Whether the FTC's Genesis Tech asset freeze survives preliminary injunction challenge and whether the agency pursues individual liability against the named founder-CEOs—the outcome will calibrate how aggressively the FTC can reach offshore ROSCA violators .
• State AG enforcement actions in the fashion, beauty, and wearable tech sectors under the 2026 multi-state privacy regime—the first enforcement wave will set the compliance baseline for biometric and consumer health data handling outside HIPAA .