For the past several years, most of the action in website-tracking litigation under the California Invasion of Privacy Act (“CIPA”) has occurred on motions to dismiss. Plaintiffs have alleged that pixels, cookies, session-replay tools, and other common website technologies amount to unlawful wiretaps, eavesdropping devices, or pen registers. Courts have issued a growing—and sometimes conflicting—body of decisions addressing whether those theories state a claim.
But as some of these cases make their way through discovery, a different question is becoming increasingly important: Can these claims actually be litigated on behalf of a class?
A series of recent class certification decisions suggests that the answer depends heavily on the architecture of the particular claim. Three recent decisions—Smith v. Rack Room Shoes, Inc., Lewis v. Magnite, Inc., and Doe v. Adventist Health System/West—illustrate opposite sides of that divide.
Rack Room Shoes and Magnite: A Tracking Cookie Does Not Necessarily Make a Class or Confer Standing
In Lewis v. Magnite, Inc., 2026 WL 2254788 (C.D. Cal. July 20, 2026), plaintiffs challenged Magnite’s use of a tracking cookie that assigned browsers an alphanumeric “khaos ID.” Plaintiffs proposed a California class consisting of residents who had the cookie installed on their devices. While the court found one common question—whether the cookie qualified as a “pen register” under CIPA—that was nowhere near enough to establish predominance or superiority.
A threshold problem was figuring out who belonged in the class at all. Magnite operated pseudonymously and did not know the person behind a particular alphanumeric identifier. Plaintiffs did not offer a classwide method for bridging that gap. Instead, an individual first had to locate the cookie on a browser and provide the identifier to Magnite before Magnite could search its records.
Consent created another problem. The proposed class reached users of numerous third-party websites with different privacy policies and cookie banners. Determining consent would therefore require examining which site each person visited, what disclosures that person encountered, whether the user agreed to them, and potentially how those disclosures would have been understood.
Magnite also found individualized problems with Article III standing and damages. Plaintiffs had not demonstrated a common method for determining whether each proposed class member suffered the kind of concrete privacy injury required after Popa v. Microsoft Corp., nor had they supplied evidence supporting a workable classwide damages methodology.
The result: class certification denied.
Similarly, on September 21, 2026, a court in the Northern District of California denied class certification in a CIPA website tracking case and dismissed the claims for lack of Article III standing. See Smith v. Rack Room Shoes, Inc., 2026 WL 2825524 (N.D. Cal. Sept. 21, 2026). In Rack Room, the plaintiffs alleged a website operator violated CIPA and its federal counterpart, the Electronic Communications Privacy Act (“ECPA”), by allowing Meta to “intercept” their communications with Rack Room’s consumer-facing website. Just a year ago, the court allowed plaintiffs CIPA and ECPA claims to proceed past Rack Room’s motions to dismiss.
But come class certification, the result changed. The court denied class certification because the plaintiffs did not provide any “reliable evidence that there own communications were actually intercepted when they visited Rack Room’s website.” The court further held it was not enough that the website simply used Meta’s cookies during the relevant time. Too many factors go into whether a particular technology fires and what information it collects for the court to infer plaintiffs themselves suffered any “harm.” Accordingly, the court not only denied class certification – it dismissed plaintiffs’ claims for lack of Article III standing.
Adventist: Class Cert May be More Obtainable When You Know Your Users
The California Court of Appeal reached a different conclusion in Doe v. Adventist Health System/West, 2026 WL 2474859 (Cal. Ct. App. July 24, 2026), a case that has now been identified for publication in California Reporter.
In Adventist, patients alleged that Adventist used Google Analytics and the Meta Pixel on, among other places, a password-protected patient portal and a website used to submit health-risk assessments (“HRAs”). Plaintiffs sought certification of subclasses covering patients who logged into the portal and users who submitted HRA forms.
That factual distinction from Magnite was critical. Unlike an ordinary public website where a third-party identifier may correspond only to an unknown browser or device, Adventist had records capable of identifying patients who actually logged into the authenticated portal. The Court of Appeal concluded that those patients were therefore “readily identifiable.” Adventist also maintained records concerning the individuals who completed HRAs, including their contact information and the assessment they took.
The standardized nature of the relevant interactions also mattered. Plaintiffs offered evidence that the tracking technology uniformly transmitted baseline information when patients interacted with the portal. With respect to HRA submissions, plaintiffs offered evidence that the technology operated deterministically and that submission generated URLs linking to reports. While the appellate court did not decide whether those transmissions violated CIPA, it held that whether they did could be decided using common proof, reversing the trial court’s denial of class certification.
Earlier Decisions Show the Same Fault Line
In many respects, these three recent class certification decisions build on distinctions outlined in earlier website privacy class cert decisions:
- In In re Meta Pixel Tax Filing Cases, 826 F. Supp. 3d 1217 (N.D. Cal. 2026), plaintiffs defined their proposed classes by reference to users whose browsing data appeared in Meta’s own “Hive” database. So, unlike Magnite, the case was not simply about an inability to locate relevant records. Yet certification still failed. The court held it would not be manageable to determine user by user whether Meta had actually collected tax-filing information sufficient to bring each person within the original, tolled class definition.
- Similarly, in Griffith v. TikTok, Inc., 2024 WL 4308813 (C.D. Cal. Sept. 9, 2024), the plaintiffs sought to certify sweeping classes of non-TikTok users who visited thousands of third-party websites using the TikTok Pixel. The court denied certification because what TikTok allegedly received varied based on how each website implemented the technology, the nature of the website, and what each particular visitor did there.
- By contrast, the court certified a class in Frasco v. Flo Health, Inc., 349 F.R.D. 557 (N.D. Cal. 2025). Flo users alleged that the app transmitted reproductive-health information of registered users to Meta and Google through SDKs. The court emphasized evidence that those users experienced the same app and SDK practices, received materially similar privacy representations, and went through an onboarding process that generated standardized “Custom Events,” allowing plaintiffs to propose a common method of proving whether health information was transmitted—and that most of them could be identified using Flo’s records.
Finally, the class certification and summary judgment decisions in Torres v. Prudential Financial, Inc. show why class certification itself should not be confused with a determination on liability. In Torres, the court certified a Section 631 class involving a single Prudential life-insurance form, finding that defendants’ records were capable of identifying users whose communications had allegedly been intercepted. See 2024 WL 4894289 (N.D. Cal. Nov. 26, 2024). But several months later, the same court granted summary judgment because plaintiffs could not show that a third party actually “read” or attempted to understand the communications while they were in transit, as Section 631 requires. See 2025 WL 1135088 (N.D. Cal. Apr. 17, 2025).
What These Cases Mean for Website-Tracking Litigation
Taken together, these decisions suggest that “tracking technology” cases should not be treated as a single category for class-certification purposes. Even if a case makes it past a motion to dismiss, plaintiffs’ firms still face substantial obstacles to certifying a case as a class action—even if the same techonology connects every member within a would-be class.
The Ninth Circuit’s recent decision in Healy v. Milliman, Inc., 164 F.4th 701 (9th Cir. 2026), also remains largely untested in website technology cases. In Healy, the Ninth Circuit held that after class certification, there must be evidence that each class member suffered an injury-in-fact to confer standing. That could pose a significant challenge for pursuing class certification in general website browsing cases. And even when plaintiffs clear the class certification hurdle, Torres exemplifies that CIPA liability is not a foregone conclusion.
As more CIPA cases reach discovery, the factual details of how a technology operated, what it transmitted, what records exist, and what users were told matter much more than allegations that merely got the case past the pleading stage.