A recent order in Shah v. MyFitnessPal, Inc. suggests that some courts may be looking at CCPA to understand California consumers’ privacy expectations. The case arises from the increasingly common allegations focused on companies’ use of tracking tools.
In the case, plaintiffs argued that MyFitnessPal used both advertising and analytics cookies after they opted out through the site's cookie consent banner. Those cookies, they alleged, shared their personal information with popular third-party platforms. The plaintiffs brought claims including invasion of privacy, intrusion upon seclusion, and violations of California's wiretap law. MyFitnessPal sought to dismiss, but the court denied its motion as to the privacy claims (other claims were dismissed with leave to amend).
In its ruling, the court noted that CCPA's provisions can be relevant to understanding California consumers’ expectations about how a company might process cookie opt-out requests. As a reminder, the CCPA does not have a private right of action. On the wiretap and pen register claims, the court dismissed those with leave to amend, finding that the plaintiffs had not specifically alleged that their own communications were intercepted. Plaintiffs filed an amended complaint on February 24, 2026, reasserting all claims.
Putting It Into Practice: This case will be one to watch. Will other courts agree with this approach for CCPA as establishing consumer expectations? Or will they instead recognize that those obligations were intended to be part of a law that does not have a private right of action?
