Hi CIPAWorld!
In In re Adobe Data Tracking Litigation, No. 25-cv-03032-NW, 2026 WL 2606992 (N.D. Cal. Sept. 2, 2026), the United States District Court for the Northern District of California dismissed all nine claims in a putative privacy class action against Adobe. The Court held that a plaintiff cannot plead that he did not give consent by simply saying that he never gave it. Consent is an element of a CIPA claim and a complete defense to the common law privacy, California constitutional, and CDAFA claims, so lack of consent got these dismissed. The dismissal came with leave to amend, and the Court stayed discovery.
Adobe is best known for Acrobat and Photoshop, but this case is about a different product. Adobe’s Experience Cloud Identity Service assigns each user a persistent, unique identifier called an Adobe Experience Cloud ID, or ECID. Plaintiffs alleged that Adobe uses the ECID to follow users across its own products and across the websites of advertising partners, and to build detailed profiles for targeted advertising.
Five plaintiffs sued. Plaintiff Rapak alleged that he visited Marriott Bonvoy’s website, which runs Adobe’s tools, and that Adobe’s technology caused his browser to send information about the content of his communications with the site. He said he would not have used Marriott’s website, or would have demanded payment for his data, had he known that Adobe was gathering information about him.
So what did Plaintiffs actually say about consent? They pleaded lack of consent by saying that (1) Adobe collected the data without that plaintiff’s knowledge or consent and that (2) Plaintiffs did not consent to, authorize, or understand the interception (as a class). They added that Adobe hides in the background and publishes nothing about which sites carry its technology or what it does with the data.
The Court held that this was a legal conclusion dressed up as a fact and that “Plaintiffs must do more than merely assert that they did not consent to the tracking devices.” It started from the point that “the internet is generally not a place where users have a reasonable expectation of privacy.” Thomas v. Papa Johns Int’l, Inc., No. 22-cv-2012 DMS (MSB), 2024 WL 2060140, at 1 (S.D. Cal. May 8, 2024), aff’d, 2025 WL 1704437 (9th Cir. June 18, 2025). Under Iqbal, Plaintiffs had to allege facts, and a denial is not a fact. See Washington v. Flixbus, Inc., No. 25-CV-00212-H-MSB, 2025 WL 1592961, at 3 (S.D. Cal. June 5, 2025) (refusing to accept as true a plaintiff’s statement that he did not consent). And because consent is an element of at least one claim, the Court could decide the issue on the pleadings. Silver v. Stripe Inc., No. 4:20-CV-08196-YGR, 2021 WL 3191752, at *2 (N.D. Cal. July 28, 2021).
Notice what the Court never reached: no party analysis under Section 631, no confidential communication analysis under Section 632, no discussion of whether an ECID works like a pen register under Section 638.51. Consent ended the privacy claims before any of that mattered.
The rest fell quickly. The UCL claim failed because Plaintiffs sought equitable relief and never alleged that damages would be inadequate, which Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 2020), requires. One sentence would have saved it. Unjust enrichment is not a cause of action in California, and injunctive relief is not a standalone claim, so both failed, with narrow leave to replead unjust enrichment as a quasi-contract claim for restitution. Adobe also moved to stay discovery and got it, because the scope of the amended complaint is unknown. Plaintiffs have 21 days to amend.
The important lesson here is that consent is the first thing to look at in a tracking case. Defense counsel should read the consent allegations line by line and ask whether the complaint says anything about what the plaintiff saw on the site, what banners or disclosures appeared, and why they failed. If the answer is a simple denial of consent, there is a motion to file. Plaintiffs’ counsel should plead consent as a fact with detail about the user experience and leave the unjust enrichment and injunctive relief counts out of the next complaint.
We will keep you posted, CIPAWorld!