Hi CIPAWorld! Today, I echo the Northern District of California’s reminder that rejecting cookies does not automatically establish a concrete privacy injury.
In another favorable decision for website operators facing privacy litigation, the Northern District of California dismissed all five privacy-related claims against Huel Ltd., finding that alleged third-party tracking following a consumer’s rejection of cookies was insufficient to establish Article III standing. McKie v. Huel Ltd., 2026 WL 3207486 (N.D. Cal. Oct. 26, 2026).
The Allegations
Plaintiff Eden McKie alleged that she expressly rejected tracking cookies while grocery shopping on Huel’s website, and that third-party tracking technologies operated by Meta, TikTok, and Snapchat continued collecting and transmitting information about her browsing activity, personal information, and purchases.
McKie brought five causes of action including the Electronic Communications Privacy Act (“ECPA”), California Invasion of Privacy Act (“CIPA”) Sections 631 and 632, the Comprehensive Computer Data Access and Fraud Act (“CDAFA”), and the California Constitution’s right to privacy.
Huel moved to dismiss all five claims, arguing that McKie failed to establish a concrete privacy harm sufficient for Article III standing.
The Court’s Ruling
Judge Charles R. Breyer agreed, dismissing all five claims for lack of Article III standing.
Relying on the Ninth Circuit’s decision in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025), the Court emphasized that allegations of unauthorized tracking must demonstrate a concrete privacy injury comparable to harms traditionally recognized at common law.
In evaluating McKie’s alleged injury, the Court looked to two traditional privacy torts: public disclosure of private facts and intrusion upon seclusion. The analysis centered on whether McKie had a reasonable expectation of privacy and whether the alleged tracking was highly offensive to a reasonable person. In making that determination, the Court considered Huel’s alleged misrepresentation about tracking, along with the sensitivity and extent of the information collected.
And while the Court acknowledged that Huel’s cookie consent banner created a reasonable expectation of privacy, it concluded that the alleged intrusion was not sufficiently offensive to establish standing, and that the alleged tracking was limited to a single website visit versus extensive monitoring across multiple websites or over time.
Importantly, the Court rejected the argument that a website’s failure to honor cookie preferences, standing alone, establishes a sufficiently offensive privacy intrusion. The Court explained, quoting Lutge v. Timex.com, Inc., “deceit alone does not convert every instance of routine information collection into a ‘highly offensive’ invasion.”
Thus, because McKie failed to establish a concrete injury, the Court dismissed all five claims with leave to amend within thirty days, without reaching the merits of the underlying statutory claims.
The Takeaway: Five claims. Zero standing.
McKie is another win for website operators in the evolving landscape of CIPA litigation. Building on Popa, the decision reinforces that a website’s alleged failure to honor cookie preferences does not automatically amount to a concrete privacy injury.
For CIPA defendants: even where tracking occurs without consent, the nature and extent of the information collected remain critical to establishing Article III standing.