Hi, CIPAWorld! Kelly Sandberg here, with a case defying a plaintiff’s request to deny cookies but still finding a lack of Article III standing.
In Shirley Vanasch et al. v. GoFundMe Inc., Plaintiffs Sal Munoz and Shirley Vanasch brought an action against Defendant GoFundMe for violations of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 631 and 638.51, and common law fraud, deceit and/or misrepresentation for the use of third-party tracking technologies on Defendant’s website despite Plaintiffs’ choices to opt out of such tracking. Shirley Vanasch, et al., v. GoFundMe Inc., No. 26-CV-01217-TLT, 2026 WL 3182540 (N.D. Cal. Oct. 14, 2026).
GoFundMe operates a website that provides public online fundraising to allow individuals to raise money or donate to a variety of causes. Website users can also share fundraising campaigns with potential donors and browse for various campaigns on the website themselves.
Plaintiffs alleged that when they visited the website, GoFundMe provided a cookie-consent banner that offered users the option to either accept or reject all cookies. When Plaintiffs clicked the option to reject all cookies, GoFundMe caused Plaintiffs’ browsers to send information to third-party companies. These third-party companies included Google, Meta, Microsoft, PayPal, TikTok, and others who received Plaintiffs’ information through the use of cookies, pixels, scripts, and similar technologies.
The information disclosed included Plaintiffs IP addresses, browser and device information, identifiers, webpage URLs, site-navigation and interaction information, as well as the particular webpages they viewed on the website.
Plaintiffs alleged that the information tracked could reveal further information concerning medical conditions, financial difficulties, personal relationships, religious affiliations, or other sensitive matters.
GoFundMe moved to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(1) for a lack of Article III standing, and the United States District Court for the Northern District of California agreed with their reasoning.
For a plaintiff to survive a Rule 12(b)(1) motion for standing, they must provide a showing of three elements: (1)an injury in fact—meaning concrete and particularized or an actual or imminent invasion of a legally protected interest, (2) a causal connection between the injury and the conduct, and (3) that the issue will likely be redressed by a favorable decision.
To determine whether Plaintiffs have alleged a concrete privacy injury, “courts should assess whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.” Popa v. Microsoft Corp., 153 F.4th 784, 789 (9th Cir. 2025).
“Plaintiffs must establish (i) the data is ‘sensitive,’ (ii) the use or disclosure is ‘highly offensive,’ (iii) the data is ‘individually identifiable’ to them and (iv) they maintained a ‘reasonable expectation of privacy’ in the data.” Shirley Vanasch, 2026 WL 3182540 at *3 (citations omitted).
Plaintiffs contested that because GoFundMe had sought their consent by providing the cookie consent banner, they had created an expectation of privacy which they later defied despite Plaintiffs’ rejection of the tracking software.
The Court determined that Plaintiffs’ interactions on the website did not reveal the same type of sensitive data courts have generally found to confer Article III standing. Specifically, the Court relied on the case of Lutge v. Timex.com, which maintained a nearly identical claim that was dismissed for lack of Article III standing because the intrusion did not meet the ‘high bar’ to be ‘highly offensive’ even where the collection of information was contrary to an explicit promise. Lutge v. Timex.com, No. 26-cv-00960, 2026 WL 2691100, at *2 (N.D. Cal. Sept. 14, 2026).
So, even though consent for the use of cookie tracking was denied by Plaintiffs, the Court still found that, despite GoFundMe’s explicit promise to uphold this request, the information tracked was not considered sensitive enough to confer a concrete injury viable to establish Article III standing.