On July 20, 2026, another California federal court denied class certification in a putative privacy class action involving a company’s cookie-based advertising platform. Lewis v. Magnite, Inc., 2:25-cv-03448-MWC-SSC (C.D. Cal. July 20, 2026). The plaintiffs alleged that Magnite secretly installed tracking cookies—called “khaos IDs”—on users’ browsers to collect data for targeted advertising. The claims included violations of the federal Wiretap Act (ECPA) and California Invasion of Privacy Act (CIPA), among other privacy-based claims.
Why the Court Said “No” to Class Certification
The court found multiple fatal flaws in the plaintiffs’ certification bid:
- Individualized consent issues. Because putative class members visited different websites with different privacy policies and cookie disclosures, each person’s consent (or lack thereof) required individual analysis. The court noted that determining what each user saw, agreed to, and understood would overwhelm any common questions.
- Inability to know who’s in the class. The defendant operated pseudonymously—it didn’t know who was behind any given tracking ID. Users could have multiple IDs (different browsers, different devices), or multiple people could share the same ID. Without a workable method to identify class members, the class fell apart.
- Standing problems. The court emphasized that a bare statutory violation isn’t enough to confer standing under Article III. Plaintiffs couldn’t show how privacy harms could be evaluated class-wide, especially when the defendant’s records showed it collected pseudonymous data as opposed to names, addresses, or emails.
- No damages roadmap. Plaintiffs failed to show how damages could be calculated on a class-wide basis, which the court held was a prerequisite under Comcast Corp. v. Behrend.
What This Means for Your Business
This decision underscores that class certification in tracking and cookie cases is far from automatic. Courts are scrutinizing whether plaintiffs can demonstrate classwide harm, identify class members, and overcome individualized consent defenses. For companies that rely on advertising technology, the case offers both reassurance and a roadmap:
- Robust privacy disclosures matter. Varied, site-specific privacy policies and cookie banners can create individualized consent questions that defeat predominance.
- Pseudonymous data is a defense. If your tracking technology collects pseudonymous identifiers rather than personally identifiable information, plaintiffs may struggle to show concrete harm or even identify who belongs in a class.
- Leverage these arguments early. As we previously highlighted, when facing a demand letter or class action complaint, decisions like Lewis v. Magnite should shape your defense strategy from day one—potentially avoiding costly discovery or settlement pressure.