Scott Kamber and the Evolution of Privacy Litigation: From GeoCities and Facebook Beacon to AI and the Modern Tracking Wars

Long before plaintiffs’ firms were sending demand letters over Meta Pixel, session replay, chat software and website tracking, Scott Kamber was litigating many of the same underlying questions.

Who receives information about what people do online?

Did the user know the transmission was happening?

Did the company obtain meaningful consent?

Can an identifier combined with behavioral information become personally revealing?

And when technology operates invisibly in the background, how closely should courts examine what the code actually does?

Those questions now sit at the center of a rapidly expanding privacy litigation industry.

For Kamber, they are not new.

The founding member of KamberLaw says his Internet privacy practice began in the late 1990s. Since then, he has served as lead counsel in dozens of class actions involving consumer protection, Internet privacy, biometrics, data breaches and technology, with his firm describing the resulting relief as reaching hundreds of millions of dollars. Today, his practice has expanded into artificial intelligence, including questions involving neural networks, machine unlearning, differential privacy and mechanistic interpretability. He was even a keynote speaker at the IAPP conference one year.

That career creates an unusual through-line from the earliest Internet privacy cases to the privacy disputes companies are facing in 2026.

The technology has changed enormously.

The legal argument often has not.

Privacy litigation before privacy litigation was fashionable

Kamber’s involvement with Internet privacy dates to an era when most companies did not have dedicated privacy officers, cookie banners did not exist and the phrase “privacy engineering” was barely part of the corporate vocabulary.

One of the early matters associated with Kamber was Wormley v. GeoCities.

KamberLaw has described the case as what it believes was the first Internet privacy class action to produce a benefit for affected class members. Court filings from his later cases likewise identify GeoCities as an early privacy matter in his career.

That timing matters.

The modern privacy class-action bar did not suddenly emerge when plaintiffs discovered CIPA.

There has been a much longer effort to apply consumer-protection, communications and privacy law to the technologies companies use to collect information online.

Kamber was operating in that field before behavioral advertising became the enormous industry it is today.

Facebook Beacon foreshadowed today’s tracking litigation

One of the most important cases in Kamber’s privacy career involved Facebook’s Beacon program.

Facebook introduced Beacon in 2007 as a way to connect activity occurring on other companies’ websites with Facebook.

If a Facebook user performed an action on a participating website—for example, renting a movie—the participating company could transmit information about that activity to Facebook, which could then incorporate it into the user’s Facebook experience. The Ninth Circuit later described precisely that data flow while reviewing the settlement.

The plaintiffs alleged that Facebook and participating websites collected and disclosed information without adequate notice or informed consent.

And the statutes asserted should look familiar to anyone following privacy litigation today.

They included:

• the Electronic Communications Privacy Act;
• the Video Privacy Protection Act;
• the Computer Fraud and Abuse Act;
• California consumer-protection statutes.

Court filings described the central theory as the transmission of information from Beacon-participating websites to Facebook without proper notice and consent.

That was nearly two decades ago.

Replace “Beacon” with “Meta Pixel” and parts of the factual theory sound strikingly contemporary.

The Facebook case also showed Kamber’s preference for structural relief

The Beacon litigation eventually produced a $9.5 million settlement.

The settlement did not simply involve individual checks to millions of users. It included the creation of a privacy-focused foundation funded through the settlement, and the Ninth Circuit ultimately upheld the agreement. Kamber served as class counsel.

That settlement was controversial in some privacy circles because of the cy pres structure and Facebook’s role in the resulting foundation.

But it illustrates an important characteristic of Kamber’s career: his cases have often targeted the behavior of the technology itself, not merely monetary compensation.

That approach becomes even more apparent in his litigation over persistent online tracking.

Flash cookies were an early version of today’s invisible-tracking fight

In 2010, KamberLaw brought litigation involving Quantcast and Clearspring over so-called Flash cookies.

At the time, consumers were accustomed to deleting ordinary HTTP cookies from their browsers.

The lawsuits alleged that companies could use Adobe Flash local shared objects to restore or “respawn” tracking identifiers after users had deleted conventional browser cookies.

That allegation created a particularly compelling privacy narrative:

User deletes tracking cookie
↓
User believes tracking has stopped
↓
Different storage technology restores identifier
↓
Tracking continues

The litigation involved major publishers and online companies using the underlying technologies.

Kamber and his firm served as class counsel in the consolidated litigation. The settlement created a multimillion-dollar fund, and court records show KamberLaw formally appointed to represent the class.

The technical mechanism is mostly historical now.

The legal principle is not.

A privacy control is only meaningful if the technology honors it.

That same issue appears today when:

User clicks Reject All
↓
Meta Pixel continues firing

or:

User enables GPC
↓
Advertising technology ignores the signal

or:

CMP blocks cookies
↓
Server-side tracking continues

The technology changes.

The dispute remains whether the user’s expressed privacy choice actually changes the underlying data flow.

Kamber has repeatedly focused on what the technology really does

His biography makes a point that is unusual for a lawyer profile: Kamber says he can program and works directly with advanced technologies.

KamberLaw says he rejects the idea that technological systems should be treated as black boxes and believes their internal workings often determine the outcome of litigation.

That philosophy is particularly well suited to privacy litigation.

Consider the difference between these two questions:

Does the website use analytics?

and:

When the user enters a search term, what exact network request leaves the browser, what fields are inside the payload, which endpoint receives it, and at what point in the consent sequence does the transmission occur?

The first question can be answered by a privacy policy.

The second requires technical evidence.

Modern CIPA, VPPA, session-replay and pixel litigation increasingly turns on the second kind of question.

Hulu brought the VPPA into the digital streaming era

Kamber was also involved in important early litigation applying the Video Privacy Protection Act to Internet streaming.

In litigation against Hulu, subscribers alleged that the company disclosed viewing activity and other information to companies including Facebook, Google Analytics and KISSmetrics.

Kamber authored briefing defending the plaintiffs’ argument that users could qualify as “consumers” under the VPPA even though Hulu’s service at the time did not necessarily require traditional subscription payments.

Again, the factual issue feels remarkably current.

Today, VPPA litigation routinely focuses on combinations such as:

video identifier
+
Facebook identifier

or:

content viewed
+
account ID

or:

CTV device identifier
+
viewing event

The legal arguments over what constitutes personally identifiable information, who qualifies as a consumer and when information has actually been disclosed remain intensely contested.

But the attempt to apply a 1988 video privacy statute to online streaming was occurring more than a decade before today’s VPPA wave.

The iPhone litigation put mobile privacy on the same trajectory

Kamber’s firm was also involved in early litigation concerning privacy and mobile applications.

In 2011, U.S. District Judge Lucy Koh appointed Kamber as interim class counsel in consolidated litigation involving Apple’s iPhone ecosystem, finding that KamberLaw had the experience and expertise to handle the consumer Internet privacy claims.

That period marked another major shift.

Privacy had moved from:

website

to:

website
+
mobile application
+
device identifier
+
SDK

The same expansion is happening again today as privacy scrutiny moves from websites to Connected TV, mobile SDKs, AI connectors and agentic systems.

He is not simply a CIPA demand-letter lawyer

That distinction is important in 2026.

The current privacy-plaintiffs market includes firms and individuals that built high-volume practices around relatively standardized claims involving website tracking.

Kamber belongs to a somewhat different lineage.

His Internet privacy work predates the current CIPA boom by decades.

His cases have involved:

• ECPA;
• VPPA;
• tracking cookies;
• persistent identifiers;
• mobile-device privacy;
• biometric data;
• data breaches;
• consumer protection;
• artificial intelligence.

His public profile emphasizes complex class actions rather than mass pre-suit demand campaigns. KamberLaw says it invests heavily in pre-complaint research and expert consultation when evaluating technologically complex consumer cases.

That does not mean Kamber’s legal theories should automatically be accepted as correct.

He represents plaintiffs.

His job is to advocate their interpretation of the law.

Defendants frequently contest those interpretations, and privacy statutes applied to modern technology continue to produce conflicting decisions.

But his longevity makes his practice useful for understanding where the plaintiffs’ privacy bar came from.

KamberLaw has also crossed into privacy compliance

Perhaps one of the more interesting developments is that KamberLaw now maintains a privacy regulation and compliance practice.

The firm advertises services involving website compliance, clickwrap agreements, data governance, risk management, incident response, AI, biometrics and state and federal privacy regulation.

Scott Kamber is listed as one of the primary contacts for that work.

That creates an unusual perspective.

A lawyer who has spent decades suing companies over privacy technology can also tell businesses which technical and procedural weaknesses plaintiffs are likely to exploit.

The firm’s website-compliance work expressly includes privacy disclosures, data-collection practices and reducing litigation and regulatory exposure.

It is effectively the offensive and defensive sides of the same technical problem.

AI is the logical next move

Kamber’s present focus on artificial intelligence initially looks like a departure from cookie and tracking litigation.

It really is not.

His biography says he has handled litigation involving AI models since at least 2019 and now studies areas including mechanistic interpretability, foundational machine unlearning and differential privacy inside neural networks.

Those are unusually technical topics for a trial lawyer.

But they fit the same philosophy he has brought to Internet privacy:

Do not accept the technology as a black box.

With AI, the black-box problem becomes even more significant.

Companies increasingly need to answer:

What training data entered the model?

Can personal information be extracted?

Can information actually be unlearned?

What does the model memorize?

How are outputs produced?

What happens when enterprise information is connected through RAG?

Can an AI agent access data outside its intended scope?

Those questions will increasingly become litigation questions.

AI litigation may recreate the early Internet privacy cycle

There is an interesting historical pattern here.

Companies adopt new technology quickly.

Law develops more slowly.

The technology creates data flows consumers do not fully understand.

Plaintiffs’ lawyers experiment with existing statutes.

Defendants argue that old laws do not fit new technology.

Courts produce inconsistent decisions.

Eventually legislation, settlements and technical standards begin creating boundaries.

That happened with Internet tracking.

It happened with mobile applications.

It happened with biometrics.

AI may simply be the next iteration.

A lawyer who spent decades applying existing privacy and consumer laws to emerging technologies is naturally positioned for that transition.

The rise of wiretap litigation is part of a much longer story

Today’s website-tracking litigation can sometimes look like an entirely new phenomenon.

It is not.

Consider the recurring pattern:

Facebook Beacon

Website activity was transmitted to Facebook.

Flash cookies

Tracking persisted after a consumer attempted to remove the identifier.

Hulu

Viewing behavior allegedly flowed to outside analytics and advertising companies.

Mobile applications

Applications allegedly transmitted identifiers and other information from personal devices.

Today’s tracking cases

Pixels, chat software, session replay and SDKs allegedly transmit user activity to third parties.

The mechanics differ.

The essential allegation repeatedly resembles:

The consumer interacted with Company A, and information about that interaction was transmitted to Company B without sufficient knowledge or consent.

That is the core architecture behind a large portion of modern privacy litigation.

Kamber was litigating versions of that architecture long before the current CIPA industry formed around it.

The plaintiffs’ privacy bar has now become much larger and more aggressive

The environment in 2026 is nonetheless very different.

Website scanning can now be automated.

Traffic can be captured inexpensively.

Plaintiffs can identify third-party technologies across thousands of websites.

Statutory damages can make relatively small technical transmissions economically attractive to pursue.

Demand letters can be generated at scale.

Cases involving CIPA, the federal Wiretap Act, VPPA, state wiretap statutes and biometric laws can be built around data flows most businesses do not realize are occurring.

The market has therefore attracted firms that operate at very different levels of technical sophistication and litigation strategy.

Some build complex class actions.

Some send high-volume demands.

Some test narrow statutory theories.

Some pursue individual arbitrations.

That makes it a mistake to treat “privacy plaintiffs’ lawyer” as a single category.

Kamber represents the technologically sophisticated end of that spectrum

What distinguishes Kamber’s public profile is not merely the number of privacy cases. It is the apparent belief that lawyers need to understand the underlying engineering.

That philosophy increasingly makes sense. A complaint involving tracking pixels might ultimately turn on:

request timing

payload structure

cookie synchronization

identifier persistence

SDK behavior

consent state

browser architecture

server-side forwarding

An AI case could depend on:

training architecture

model weights

retrieval systems

embeddings

fine-tuning

machine unlearning

differential privacy

A lawyer who cannot understand those systems is forced to rely almost entirely on experts. Kamber has built his public identity around doing substantially more of that technical work himself.

There is also a lesson here for companies

The obvious corporate reaction to plaintiffs’ privacy lawyers is hostility.

That may feel satisfying.

It is not particularly useful.

The better question is:

What are they going to find?

A plaintiffs’ lawyer does not control whether your website sends information to Meta.

Your technology stack does.

The plaintiffs’ lawyer does not determine whether Reject All actually blocks tracking.

Your CMP configuration does.

The plaintiffs’ lawyer does not decide whether your mobile SDK sends precise location.

Your application does.

The attorney merely examines what is already happening.

That is why technical privacy testing has become so important.

The strongest defense is knowing the system better than opposing counsel

Kamber’s career contains a useful lesson for defense teams and privacy programs.

He has repeatedly gone after areas where complicated technology created a gap between what consumers believed was happening and what the system actually did.

Flash cookies are perhaps the cleanest example.

A consumer deleted a browser cookie.

The user believed the identifier was gone.

Another technology allegedly restored it.

The discrepancy between the interface and the actual technical behavior became the case.

Modern companies should assume that similar discrepancies will eventually be examined.

If a banner says:

Reject All

the system needs to reject.

If a privacy notice says:

We do not sell sensitive data

the data flows should prove it.

If an AI system says:

This repository is restricted

the connector needs to enforce that restriction.

Scott Kamber’s career tracks the history of digital privacy litigation itself

From GeoCities in the late 1990s to Facebook Beacon, Flash cookies, mobile applications, streaming video, biometrics, data breaches and now artificial intelligence, Kamber’s practice follows the changing places where companies and consumers interact through technology.

His career also illustrates why privacy litigation keeps returning.

New technology repeatedly introduces new ways to collect, combine and disclose information faster than companies build governance around it.

Plaintiffs’ lawyers then test those practices against statutes that may have been written years or decades earlier.

Sometimes those theories fail.

Sometimes courts accept them.

Sometimes the litigation produces settlements that change industry behavior.

But the underlying question remains surprisingly consistent:

What information did the technology actually collect or disclose, and did the person understand and authorize it?

Scott Kamber has been asking some version of that question for nearly three decades.

The current explosion of tracking, wiretapping and AI litigation suggests the question is nowhere near being resolved.