California’s Consumer Privacy Act (CCPA) Assists a Private Right of Action–Shah v. MyFitnessPal

February 15, 2026 · by Eric Goldman · in Privacy/Security, Publicity/Privacy Rights

It’s been years since I blogged about the California Consumer Privacy Act (CCPA). Have you missed the dumpster fire meme?

* * *

This is one of an ever-growing number of cases alleging that a website purported to let users decline cookies but then disregarded those instructions and placed the cookies anyway.

Among other claims, the plaintiffs alleged that the unconsented cookie placements and resulting consumer tracking violated the common law invasion of privacy and intrusion upon seclusion doctrine. The court says that the CCPA’s statutory provisions bolster these common law claims:

The California Consumer Privacy Act (CCPA) further supports the conclusion that plaintiffs Shah and Wiley had a reasonable expectation of privacy in the information that was collected by cookies they had attempted to reject. As the California Attorney general’s website explains, the CCPA requires that companies give users the choice to opt out of any collection of personal information for “cross-context behavioral advertising, which is the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s online activity across numerous websites.”

Two obvious points. First, CA AG’s website explanations aren’t binding interpretations of the CCPA. As the Dude might say, that’s just like, uh, their opinion, man. (Though this AG quote is just trying to summarize the overwhelmingly complex CPRA).

Second, the CPRA’s cross-context behavioral advertising restriction doesn’t implicate all cookie placements. In other words, there are many reasons why a website might place a cookie that have nothing to do with that awkward statutory construct. In this case, some of the defendants’ activity at issue would not be related to the AG’s guidance.

The court continues:

When evaluating Californians’ reasonable expectations of privacy, the CCPA’s provisions are highly relevant “customs, practices, and circumstances,” because they provide Californians with the reasonable expectation that they will have some control over their data and necessarily shape users’ expectations about their ability to opt out of websites’ collection of data for profit.

Say what? The CCPA expressly precludes private rights of action for violations of its privacy provisions (there’s an unrelated limited private right of action for some data breaches). However, if courts will treat the CCPA’s statutory text as norm-shaping in a way that strengthens common law privacy claims, the CCPA’s text nevertheless facilitates a private right of action workaround despite its clear and contrary statutory intent. Nice.

Some courts have already been mangling the CCPA’s data breach private right of action to apply to any data disclosures, not just those we’d consider to be a result of a “breach.” Now, if the CCPA further turbocharges common law-based private rights of action, plaintiffs are getting an expanding toolkit of options to bypass the CCPA’s clear, express, and very-much-intended prohibition on private rights of action.

To be fair, I don’t think the court needs the CCPA’s norm-setting to establish the problems with asking users for their cookie preferences and then (allegedly) disregarding those instructions. If the website says X and then does not-X, consumers have a pretty reasonable expectation of X–no need for any statutory backup to legitimize that expectation. At the same time, I think of cases, like the old In re JetBlue case, where there’s a “no harm/no foul” realpolitik outcome when a privacy violation is inconsequential. If the plaintiffs don’t like a website’s data collection, but suffer no adverse consequence from it, what are we even doing?

Case Citation: Shah v. MyFitnessPal, Inc., 2026 WL 216334 (N.D. Cal. Jan. 27, 2026)

Because this case involves both the CCPA and CPRA, I might as well include the CPRA meme too:

Prior CCPA/CPRA Posts

California’s Consumer Privacy Act (CCPA) Assists a Private Right of Action–Shah v. MyFitnessPal

Comments and Pings