Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
The California Comprehensive Computer Data Access and Fraud Act (CDAFA)—a 1980s computer crime statute—has become a fixture of the web tracking class action complaint, pleaded alongside California Invasion of Privacy Act (CIPA) wiretapping and pen register counts against pixels, advertising SDKs, chatbots, and session replay tools. Utilizing a successful consent defense, Meta Platforms, Inc. recently procured the dispositive dismissal of a CDAFA class action alleging that it improperly collected and monetized Facebook and Messenger users’ voice data. Robinson v. Meta Platforms, Inc., No. 3:26-cv-01616-CRB, 2026 WL 2722540 (N.D. Cal. Sept. 15, 2026).
The dismissal turned entirely on consent. Because the plaintiff accepted Meta’s Terms of Service—which incorporated a privacy policy and jurisdiction-specific supplemental notices disclosing that “voice recordings . . . may be used to identify” users and personalize advertising—Meta could not have used the plaintiff’s data “knowingly” and “without permission,” defeating the CDAFA count outright. Robinson arrives at a consequential moment: Governor Newsom signed Senate Bill 690 (SB 690) on September 30, 2026, eliminating the private right of action for website-based CIPA pen register and trap and trace claims effective January 1, 2027, with reach-back to actions filed on or after January 1, 2025. As the plaintiffs’ bar shifts to CIPA § 631 and CDAFA, the quality of a defendant’s consent record will decide more motions than ever.
Why It Matters
Robinson is the clearest recent articulation of a consent-based defense to CDAFA claims built on ordinary, multi-document online terms: permission obtained “in the first instance” through accepted terms negates the knowledge element; disclosures may be spread across several properly incorporated and linked documents; a broad disclosure is not an ambiguous one; and a plaintiff claiming “limited purpose” consent must allege that the company was actually put on notice of the limitation.
The bottom line: An accurately worded, well-incorporated disclosure chain can end a CDAFA tracking count before discovery—but the defense is only as good as the match between disclosure and technology, and it is weakest where the plaintiff is an anonymous visitor who never clicked “I agree.”
The Robinson Decision
The Robinson plaintiff alleged Meta used audio captured through its apps to identify users and target ads, and pleaded a single claim under CDAFA § 502(c)(2), which prohibits “knowingly” and “without permission” taking, copying, or using data from a computer. Meta moved to dismiss on four grounds; the court reached only one—failure to plead that Meta knew it lacked permission.
Because “the term ‘knowingly’ modifies each element of the alleged violation,” a CDAFA defendant must have known it lacked authorization, and a defendant that obtains permission “in the first instance” does not violate the statute. The plaintiff conceded he accepted Meta’s Terms of Service, which incorporated privacy notices disclosing that “voice recordings . . . may be used to identify” users and to personalize ads. The court rejected each of his three attempts to escape that assent:
- Disclosures “scattered” across documents. “[I]t is of no consequence that Meta disclosed its policy across several documents.” Online terms may incorporate documents by reference, and assent is valid even if it requires “several steps” and “web-browsing intuition.”
- The disclosure did not use the plaintiff’s terminology. A “contractual term is not ambiguous just because it is broad.” Disclosing the function of the data use was enough.
- Consent was limited to one purpose. The plaintiff never alleged he told Meta he was limiting or revoking consent, and “implied authorization” suffices under Ninth Circuit precedent.
The court also distinguished Brown v. Google LLC, 525 F. Supp. 3d 1049 (N.D. Cal. 2021)—the “incognito mode” litigation where Google allegedly promised privacy and used scripts that circumvented opt-outs. Meta, by contrast, disclosed the use, and the plaintiff did not allege that it acted “surreptitiously.” Nor did a later in-app permission pop-up that failed to mention the data use undermine consent: that notification “necessarily comes after a user’s initial consent to the Terms of Service,” and permission in the first instance is all that CDAFA requires. Because plaintiff’s counsel conceded at the hearing that no amendment could cure a finding of consent, dismissal was without leave to amend.
Analysis & Takeaways
CDAFA’s Growing Role in Web Tracking Litigation
The California web tracking complaint has followed a familiar template: CIPA § 631 (wiretapping) and § 638.51 (pen register/trap and trace) counts, a CDAFA count, intrusion upon seclusion, a constitutional privacy claim, and a UCL tag-along. CDAFA earned its place because it requires no “communication” in transit, is not subject to CIPA’s party exception, and carries its own damages and attorney’s fee provisions. That role is about to grow.
SB 690 amends CIPA § 637.2 so that only the California Attorney General may bring § 638.51 claims based on websites, online applications, or mobile applications, operative January 1, 2027. CIPA § 631, the federal Wiretap Act, and CDAFA are untouched, and plaintiffs’ shops are already re-pleading pixel allegations under § 631 alongside CDAFA.
That makes CDAFA’s knowledge and permission elements a central battleground, and recent decisions show where the line falls. Tsering v. Meta Platforms, Inc., No. 3:25-cv-01611-RFL, 2026 WL 89320 (N.D. Cal. Jan. 12, 2026), dismissed CDAFA claims over SDK geolocation data collection where the plaintiffs failed to allege Meta knew that users had not consented. Months later, in In re Meta Android Priv. Litig., 833 F. Supp. 3d 1010 (N.D. Cal. 2026), the same judge denied a bid to dismiss a CDAFA claim at the pleading stage where Meta’s modified pixel allegedly circumvented Android’s sandboxing protections to match browsing data to logged-in accounts—conduct no reasonable user could read the privacy policy to authorize, and whose secretive implementation supported an inference of knowledge.
What the Consent Defense Requires—and Where It Fails
Read together, recent decisions define the CDAFA consent defense with unusual precision. It is likely to succeed where: (1) the user affirmatively assented to terms at sign-up, checkout, or account creation; (2) the privacy policy and any cookie notice are expressly incorporated into, and linked from, those terms; (3) the disclosure describes the practice in functional terms—what is collected, with whom it is shared, and why—even if it does not name the vendor or script; and (4) the defendant did nothing surreptitious to defeat the expectations the disclosure creates. It likely fails where the technology does something a reasonable reader could not anticipate, where the company circumvents browser or platform protections, or where it has been put on notice that a user limited or withdrew consent.
Structural Limits
Robinson also exposes structural vulnerabilities for typical web tracking defendants. The plaintiff in that case was a registered user who clicked “Sign Up” beneath a statement that he agreed to the Terms. Most tracking plaintiffs, however, are anonymous visitors who browsed a product page or started a chat without creating an account. For them, there is no sign-in wrap assent; the defense must rest on a cookie banner, a consent management platform that blocks non-essential scripts until acceptance, or a browsewrap argument courts view skeptically. A website that fires its pixels on page load and relies on a footer link has a far thinner “permission in the first instance” story than Meta did.
Practical Compliance Tips & Strategies
- Inventory tracking technologies. Catalog every pixel, tag, SDK, chatbot, and session replay script; document what each collects, when it fires, and where the data goes. Repeat quarterly—tag managers drift.
- Build an unbroken disclosure chain. Ensure terms of use expressly incorporate privacy policies and cookie notices; link each from account creation, checkout, chat, and form submission flows with clear “By continuing, you agree” language; capture and log affirmative assent; and honor opt-outs and Global Privacy Control (GPC) signals, since a company that ignores actual notice forfeits the defense.
- Disclose by function, accurately. State that the site uses cookies, pixels, and similar technologies to collect browsing and interaction data and shares it with advertising and analytics partners, where that is true—and never describe a practice more narrowly than the technology actually operates.
- Gate non-essential scripts behind consent. For anonymous visitors, a consent management platform that blocks advertising and replay scripts until the user accepts is the closest substitute for Robinson’s sign-up assent, and it simultaneously fortifies CIPA § 631 and federal Wiretap Act defenses.
- Reconcile disclosures with engineering. Vet new tags, custom pixel events, and data matching techniques—especially anything that routes around browser or platform controls—against existing disclosures before deployment.
- Preserve the record and allocate vendor responsibility. Archive each version of sign-up pages, terms, and notices for incorporation by reference or judicial notice on a motion to dismiss, and address data use limits and consent collection responsibility contractually with every tracking vendor.
- Reassess pending matters after SB 690. Evaluate dismissal of pending CIPA § 638.51 claims once the amendment kicks in at the start of 2027, and prepare for re-pleaded § 631 and CDAFA theories.
The Final Word
Robinson v. Meta Platforms is a meaningful defense win that can be relied on by companies in defending a wide variety of pixel, SDK, and session replay disputes. Its lesson is not that any privacy policy will do; it rewards companies that build a deliberate, well-incorporated disclosure architecture, obtain affirmative assent before data flows, and whose technology does what their disclosures say. With SB 690 pushing plaintiffs toward CIPA § 631 and CDAFA, the consent record will be the first thing courts examine.
The time to involve experienced privacy counsel is before the next tag is deployed, when terms, notices, consent flows, and tag configurations can still be aligned; a proactive, conservative approach to compliance is far less costly than defending a bet-the-company class action after a complaint hits the docket.
About the Author
David J. Oberly is a tech-savvy attorney and recognized thought leader in the privacy space. David provides strategic advice and counseling on all types of privacy and technology matters that arise when doing business in today’s digital world, and guides companies in navigating the full spectrum of regulatory, product, and risk management issues that impact the collection, use, and sharing of personal data. He also represents companies in the defense of privacy and technology class actions, with deep experience litigating class disputes asserting digital surveillance/wiretapping, video privacy, consumer privacy, consumer protection, and invasion of privacy claims. David can be reached at doberly@bakerdonelson.com.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
