Hi CIPAWorld!
In Arny Asercion v. Ulta Salon, Cosmetics & Fragrance, Inc. the United States District Court for the Northern District of California denied a motion for judgment on the pleadings on California Invasion of Privacy Act claims. The Court rejected the defendant’s argument that its website privacy policy gave the plaintiff consent to install tracking technology. Arny Asercion v. Ulta Salon, Cosmetics & Fragrance, Inc., No. 26-CV-02442-RFL, 2026 WL 2453175 (N.D. Cal. Aug. 21, 2026). For businesses that treat posted privacy policies as a complete defense to CIPA suits, this ruling shows that a policy alone may not be enough.
Plaintiff Arny Asercion visited Ulta’s website in May 2025 to browse for Mother’s Day gifts. He alleged that Ulta embedded code into its site that caused third party tracking technology to install on his browser. These trackers allegedly collected his browsing activity in real time and transmitted the information to third parties for targeted advertising. He sued under CIPA Section 631(a) for interception of communications and Section 638.51(a) for use of a pen register without court approval. He also brought claims under the federal Wiretap Act, the Comprehensive Computer Data Access and Fraud Act, and the California Constitution. Ulta moved for judgment on the pleadings. It argued that the plaintiff consented to the tracking because its privacy policy disclosed the use of trackers.
The Court disagreed. It said that the mere existence of a privacy policy does not equal consent. A business must show that the user actually saw the policy or agreed to it. The court cited Hubbard v. Google LLC, which held that “mere disclosure of data collection practices in a privacy policy does not indicate whether those terms were conspicuously presented to the user.” A Court will not presume that a visitor saw a policy just because it exists on a website. The Court also pointed out that the plaintiff alleged the trackers installed automatically when he visited the site. This timing suggests the tracking began before he could have become aware of the privacy policy. Ulta suggested there must have been some mechanism to provide consent upon visiting the website. The court called that a factual question that cannot be resolved at the pleading stage.
The ruling impacted the other claims too. The Court allowed the CIPA interception claim to proceed because the plaintiff alleged the trackers collected product views and other substantive communication contents while in transit. The Court also allowed the pen register claim to move forward. Ulta had argued the pen register statute applies only to telephone technology. The Court rejected that view because other decisions in the Northern District already hold that the statute reaches internet technology. Only the UCL claim was dismissed, for conclusory economic injury, with amendment due September 11, 2026.
This decision is a clear signal that CIPA consent requires more than a posted privacy policy. Companies should review their websites to make sure they use active consent mechanisms that appear before tracking begins. Cookie banners, click to accept boxes, and other steps that require a user to take action matter. A link to a policy at the bottom of a page may not survive a motion to dismiss. For CIPA defendants, this case means the consent defense needs proof that the user saw the disclosure and agreed to it.
We will keep you posted, CIPAWorld!