Clark Santoro’s Privacy Lawsuits, Case by Case

Clark Santoro’s name appears in website-privacy litigation involving Bloomberg, Hyundai Motor America, AARP, Waystar and Lulu & Georgia. Read together, the records offer a useful view of how claims about advertising technology reach the courts, how differently those cases can end, and why a company’s account of its tracking practices needs technical evidence behind it. if you received a demand letter or privacy lawsuit from Clark Santoro, Swigart, Pacific Trial Attorneys, Gutride Safier, Robert Bell, or any of the other privacy plaintiffs please reach out as our software protects your website from these types of wiretapping claims and we can provide a complimentary privacy audit.

There is also a development that changes how businesses should read this history. On September 30, 2026, California enacted SB 690, restricting private enforcement of the pen-register and trap-and-trace provision used in this litigation. Its January 1, 2027 effective date and retroactivity provisions deserve attention alongside the older complaints and rulings.

Research reviewed October 25, 2026. This article distinguishes allegations from findings and reports the latest events located in the sources reviewed, rather than assuming that every public docket reproduction is current. The appendix identifies additional case captions and explains which claims and outcomes could not be verified. This is a public-source investigation, not a certified search of every court docket or private arbitration.

Five cases with a clearer public record

The strongest records located for this review concern the following five matters. State and federal numbers appearing in the same row refer to the same action moving between courts, not two separate lawsuits.

These outcomes answer different questions. A pleading ruling tests whether a claim is legally sufficient at that stage. A remand concerns the court that can hear the dispute. A voluntary dismissal records how an action ended, while a settlement notice establishes that the parties reported a resolution. None should be substituted for a finding that the challenged technology was unlawful.

The records also show overlapping plaintiff counsel. Robert Tauler filed the voluntary dismissal notices in the AARP and Waystar matters. The Bloomberg docket identifies Tauler, Wendy Robinson Miele and Narain Kumar as Santoro’s attorneys. That establishes a visible connection between the litigation records. It does not establish who initiated each website visit, how the investigations were financed or what any party’s private settlement strategy was.

Lulu & Georgia: the ruling that exposes the legal dispute

The most useful substantive order located is in Santoro v. Lulu & Georgia. Santoro filed the complaint on April 22, 2025, asserting a claim under California Penal Code section 638.51. He alleged that TikTok software collected identifying information when he visited the retailer’s website on September 19, 2024, without his consent.

On November 21, 2025, Judge Steven A. Ellis overruled the demurrer. The order rejected arguments that the allegations failed to connect collection to Santoro, that the law covered only telephone communications, that the software collected only communication contents, and that the service-operation exception defeated the claim as pleaded. The court accepted the adequately pleaded allegations for purposes of that motion. It did not establish that TikTok received every alleged field, resolve disputed technical evidence, or enter a liability judgment.

The practical issue is how to describe a tracker accurately. “Analytics,” “advertising” and “functional” are business classifications. They do not themselves answer whether a process meets a statutory definition. Counsel needs to know what information a component handles, which communication it belongs to, who receives it and what purpose the transfer serves.

A defense based on operating a website also requires a more specific account than saying the tool improves the business. Delivering a requested page, protecting a service against abuse and matching a visitor to an advertising profile are different purposes. A technical inventory should preserve those distinctions so that the legal analysis can address the relevant exception.

Hyundai: a reported settlement with no verified public price tag

The Hyundai docket traces the action to a June 3, 2024 state-court complaint and an October 18, 2024 removal. Contemporary Class Action Reporter coverage described allegations that Santoro visited Hyundai’s website and encountered software he claimed was an unlawful trap-and-trace device. That account concerns alleged website tracking; it should not be recast as a finding about connected-car surveillance.

The November 13, 2024 dismissal order expressly records a notice of settlement. It initially dismissed the action without prejudice, retained a 30-day reopening window, and provided for automatic conversion to dismissal with prejudice on the thirty-first day absent a timely motion to reopen.

The reviewed materials do not establish a settlement amount, payment to Santoro, classwide relief or an admission of wrongdoing. They also do not establish whether a later motion affected the conditional dismissal. Reporting a settlement is supported; assigning it a dollar value or describing it as a judicial determination of unlawful tracking is not.

AARP: a tracking complaint followed by a dismissal without prejudice

Santoro v. AARP was filed in federal court on November 7, 2024. Publicly indexed portions of the complaint identify section 638.51 and allegations about TikTok software on AARP’s website. The complete pleading was not available for unrestricted inspection in this review, so those excerpts should not be expanded into an account of every alleged data field or vendor setting.

The docket records Santoro’s December 4, 2024 notice of voluntary dismissal without prejudice. It does not establish a settlement or a decision rejecting the allegations. Without prejudice generally leaves room for a claim to be brought again, subject to applicable procedural and substantive limits; it does not establish that another action was actually filed.

For nonprofits and membership organizations, the case is a reason to examine website technology on its own terms. A familiar commercial or nonprofit identity tells a reviewer little about what an embedded advertising component does. Whether a particular statute applies remains a separate legal question.

Bloomberg: allegations about search activity, followed by remand

According to contemporary reporting on the complaint, Santoro alleged that Bloomberg’s website used third-party tracking technology to intercept and share communications, including search queries that could reveal financial interests or planning. Those are allegations about browsing and search activity, not proof that bank-account records were exposed.

The action originated in Los Angeles Superior Court as 25STCV01820. Bloomberg removed it to federal court on March 7, 2025. The federal docket records an amended complaint, dismissal briefing, and a June 23, 2025 order denying the dismissal motion and remanding for lack of subject-matter jurisdiction. Receipt of remand was subsequently recorded. The materials reviewed do not establish the later state-court outcome.

A federal docket marked terminated after remand can create a misleading impression that the underlying dispute disappeared. Here, the record establishes a return to state court. It does not establish a merits victory for either side. Likewise, the docket’s motion seeking more time to pursue class certification does not establish that a class was certified.

The compliance question raised by search-related allegations is specific: does an event report merely say that someone used search, or does it include the actual search text? A payload containing a query can reveal substantially more than an aggregate count. That distinction should be checked in the transmitted request, rather than inferred from the name assigned to the analytics event.

Waystar: an allegation that the opt-out did not control the transmission

The Waystar action began in state court on April 15, 2025, and was removed on May 9. Publicly indexed text of the removal notice references Penal Code sections 631 and 638.51 and California’s unfair-competition statute.

Class Action Reporter’s account describes a proposed class involving California visitors who allegedly opted out of nonessential tracking through the site’s consent mechanism but nevertheless had search queries or other communications intercepted and transmitted to third parties. The federal docket then records a May 20, 2025 voluntary dismissal with prejudice. No payment or settlement terms were verified in the reviewed materials.

The alleged opt-out failure is worth examining independently of that outcome. A banner can store a preference successfully while a separate tag ignores it. An advertising integration can also receive events from a backend system even after browser-side controls stop a pixel. These are possible implementation failures to test, not findings about Waystar’s systems.

Testing should therefore follow the user’s choice through the actual collection and forwarding paths. A screenshot showing a reject button answers whether the button existed. It does not answer what a third party received after someone used it.

The law behind the allegations has changed

The relevant provisions should be separated. Section 638.50 defines pen registers and trap-and-trace devices by reference to dialing, routing, addressing or signaling information, excluding communication contents. The former concerns information transmitted from an instrument or facility; the latter concerns incoming impulses reasonably likely to identify a communication’s source. The direction and role of the information matter.

Section 638.51 restricts installation or use without a court order, subject to specified exceptions for providers of electronic or wire communication services. Those include certain operational, protective and user-consented uses. A blanket claim that every website needs a court order overlooks that statutory structure. Equally, calling all marketing technology necessary does not establish an exception.

Section 631(a) addresses distinct conduct, including unauthorized wire connections and learning communication contents while in transit without the consent of all parties. A complaint invoking that provision requires analysis of the particular statutory clause and alleged conduct. A metadata-based theory cannot simply be renamed an interception claim without establishing the additional elements.

Historically, section 637.2 supplied the civil remedy invoked in these cases: the greater of $5,000 per violation or three times actual damages. That is not an automatic $5,000 award for each cookie, request or visitor. Liability, the relevant unit of violation, available defenses and any class requirements still matter.

The chaptered text of SB 690 adds an important limit: an action under section 637.2 against a private actor for an alleged section 638.51 violation arising from a website, online application or mobile application may be brought only by the Attorney General. The amendment also reaches pending claims in actions commenced within two years before its operative date. The governor’s September 30 legislative update confirms the signing.

As explained in Stinson’s analysis of the enacted law, the change takes effect January 1, 2027, with the relevant lookback beginning January 1, 2025. It is not yet operative on this article’s research date.

Applied to this case history, the April 2025 Lulu & Georgia filing falls within that calendar window if a covered claim remains pending when the amendment operates. That is an inference from the filing date and enacted text, not a report of a new order in Santoro’s case. Counsel must check the live docket, operative pleading and any intervening proceedings before identifying the proper motion or predicting the outcome.

SB 690 does not itself reopen a completed settlement, establish that earlier conduct was lawful, or eliminate section 631. Its narrow enforcement change is a reason to reassess a pleaded claim, while continuing to evaluate other applicable privacy obligations separately.

The technical facts a business needs to establish

These disputes make more sense when collection, identification and communication contents are examined separately. A vendor request might contain an event name, a page address, a persistent identifier and a form value. Each field can serve a different function. Labeling the entire request “anonymous analytics” skips the work necessary to support that description.

TikTok’s own Pixel documentation describes uses of IP addresses, user-agent information and cookies. Its Automatic Advanced Matching documentation describes finding customer information on a website and matching it with people on TikTok. These current product descriptions explain why configuration matters. They do not establish what any defendant enabled at the time of Santoro’s alleged visit.

For an internal review, document whether matching is enabled, which inputs it uses, whether form fields or page text are included, and which events trigger transmission. Hashing an identifier for matching should not be described casually as eliminating the ability to link an event to a person. The intended matching function is itself relevant to that assessment.

The same attention belongs on URLs. A page address can be ordinary navigation information, but a query parameter may contain a search term, an email address or another user-supplied value. A useful engineering report identifies the actual fields and values involved. The legal characterization follows from the evidence and applicable rule.

What this means for businesses reviewing their websites

The reviewed cases span different kinds of organizations. The operational lesson is to prioritize the behavior of the technology and the sensitivity of the journey. A business that has never experienced a hacking incident can still face allegations about an intentional transfer to an advertising or analytics provider.

The following are review scenarios, not allegations against the companies named above:

Smaller organizations should also avoid importing the applicability thresholds of a different privacy statute. The “person” language in section 638.51 is not the same as the definition of a covered business under a comprehensive consumer-privacy law. Whether a particular claim reaches a particular organization needs its own analysis.

A defensible account starts with the first network request

A useful investigation reconstructs the visitor’s journey in order. Begin with a clean browser state and the relevant location settings. Capture what loads before any choice, the notice actually shown, the choice made, and the subsequent requests. Repeat the journey after acceptance, rejection and a later change of preference. Use separate clean sessions so that an earlier choice does not contaminate the next observation.

Record the page, deployment version, browser, timestamp and test steps. Preserve request destinations, event names, relevant payload fields, cookies and the source that initiated a request. Chrome’s Network panel supports inspection and export of request data. Its reference documentation distinguishes sanitized HAR exports from exports containing sensitive data. Use synthetic inputs for routine testing and control access to preserved evidence.

A browser capture has limits. It can show a request reaching the website’s own collection endpoint without revealing every onward transfer from that server. Review the corresponding server-side event configuration and vendor records before concluding that a transfer stopped. Conversely, a request to a vendor domain does not by itself establish every element of a privacy claim. Its contents, timing, purpose and legal context require examination.

Keep the historical record as well. A scan performed today cannot recreate a banner, tag configuration or vendor setting from a year earlier. Retain appropriate versions of notices, tag-manager releases, consent configurations and relevant contracts under a defined retention schedule. Once a dispute is reasonably anticipated, counsel should direct preservation rather than allowing ordinary deletion or configuration cleanup to erase relevant evidence.

This is where Captain Compliance’s software fits the actual problem. Its Cookie Scanner and Radar testing support investigation of cookies, pixels, pre-consent behavior and whether rejection choices are respected. Its Consent Manager provides purpose-based tag controls and consent records. Discovery, enforcement of a choice and documentation of that choice are related tasks, each requiring attention.

Those capabilities can help a team locate a mismatch, correct it and document the result. Legal review still determines whether the notice and choice were sufficient for the use, whether an exception applies and what a particular court must decide. A consent receipt is stronger evidence when it can be connected to the version of the site and the behavior observed during that visit.

What the case history leaves businesses with

The most useful response to a recurring plaintiff is a well-supported account of the disputed visit. Filing frequency does not establish that an allegation is true or false, and a list of dismissals does not reveal undisclosed settlement terms. The records reviewed here do not support a total recovery figure for Santoro or a claim that these cases produced a uniform judicial result.

For the next disputed visit, the decisive material may be an old tag-manager release, a preference record and a request payload containing a field nobody expected to send. A company that can put those records together gives its lawyers facts they can evaluate. A company that has only its current privacy-policy page has left the most important part of the story unrecorded.

Research appendix: additional captions and what could be verified

The following entries extend the case search beyond the five matters discussed above. They are deliberately separated by evidence quality. A caption match establishes that the name appears in an index; it does not establish every claim, the identity of the individual across all records, or a current outcome. No private demand letters or arbitration filings were available for this review.

How to use this inventory: The review located 15 distinct case captions in total, counting the five principal matters and these ten additional entries. That is not a verified total of 15 privacy lawsuits by the same individual. Seven matters have a privacy connection supported by the filings, reporting or classifications identified here; the remaining entries require further verification. A complete docket search and inspection of the underlying documents could add cases, resolve identity questions, establish additional privacy claims or change the reported procedural picture.

Source discipline: The Lulu & Georgia minute order and Hyundai dismissal order were inspected in full. Federal docket reproductions supply the procedural entries for the principal federal matters, but their last retrieval dates predate this review. Some complaint details are supported only by publicly indexed filing excerpts or expressly attributed contemporary reporting. Additional state captions rely on the precise index entries linked above. No settlement amount, certified class, final liability finding, improper motive or court designation of Santoro as a vexatious litigant is asserted on the basis of this review.