Privacy Policy Consent: What a California Federal Court Said in a CIPA Case

The case: what was alleged and what the court decided

The order comes from the Northern District of California. According to the order’s summary of the complaint, the plaintiff alleges that a retailer embedded code in its website that causes tracking technology to be installed on visitors’ browsers, and that the trackers let the retailer and third parties follow users as they browse and across the internet. The complaint alleges this supports targeted advertising and detailed user profiles.

The company, Ulta, asked the court to end the case early. The court granted that motion in part. One claim, under California’s Unfair Competition Law, was dismissed with leave to amend. Per the order, “the remaining claims survive dismissal,” including both CIPA claims.

At this stage, the court was asking whether the allegations were plausible enough to let the case continue. It wasn’t deciding whether they’re true. You can read the full order on Justia.

Privacy policy consent: what the judge wrote

Both CIPA provisions at issue turn partly on consent. The order notes that Section 631(a) covers interception “without the consent of all parties to the communication,” and that the pen register provision allows use “if the consent of the user . . . has been obtained.”

The company argued that its website privacy policy established consent, because the policy disclosed the use of trackers. The court wrote:

“[T]he mere existence of the policy does not equate to consent without any indication that the user saw the policy or agreed to it, and Ulta offers no argument otherwise.”

Order, Doc. 19, Section A.3, Asercion v. Ulta Salon, Cosmetics & Fragrance, Inc. (N.D. Cal. Aug. 21, 2026)

The court also pointed to timing. The plaintiff alleges the trackers were installed when he visited the site. From that, the judge said, it is “reasonable to infer that this installation, which led to the subsequent tracking, occurred before Plaintiff could have possibly been aware of the privacy policy and the disclosures it contained.”

Finally, the company suggested it was implausible that the site had no “mechanism” for consent, given its policy. The court said that “presents a factual inquiry improper for resolution at this stage.” In other words, it left that question for later in the case.

Why the order matters beyond one case

The order cites a string of other federal decisions on website tracking claims, so these arguments have come up before. It also cites Hubbard v. Google for comparison, where another court said it would not presume awareness of terms “merely because these terms existed.”

The takeaway that applies broadly is about evidence. Whether the claim is under CIPA or the TCPA, consent tends to come down to two practical questions.

The same logic shows up in telemarketing consent. The FCC’s definition of prior express written consent, for example, asks for a signed agreement with a clear disclosure, and the FCC is changing how people can revoke that consent starting November 25. We covered that in our post on the FCC’s revocation rules.

Where ExpressConsent fits, and where it doesn’t

TCPA Today is powered by ExpressConsent, so read this section with that in mind. Everything below comes from ExpressConsent’s own documentation.

According to ExpressConsent’s docs, when a person submits a consent form, a script takes a screenshot of the whole page and stores it as a Certified Digital Record. The record shows the consent wording, whether a consent checkbox was checked, and the control the person pressed, along with a timestamp and details like IP address and browser. Our full explainer walks through what’s in a record.

If the consent wording links to a privacy policy, ExpressConsent can also archive what was behind the link. Its docs say the visual record shows the link was there when the person submitted. The archived copy is a text version of the document with the time it was retrieved and a SHA-256 fingerprint.

Mapped to the court’s language, a record like this speaks to the “did the person see it” question. It’s a dated picture of what was on the screen when they agreed. A policy URL on its own can’t do that.

Questions many companies bring to counsel

Nothing here is advice. These are the kinds of questions the order and the broader consent debate raise, and many companies choose to work through them with an attorney.

1. What loads when someone first lands on our pages? That includes ad, analytics and other third-party scripts, and whether anything runs before the visitor has seen any disclosure.
2. Where do visitors see our disclosures? A link buried in a footer and a link next to the place where someone agrees are different facts.
3. When someone does agree, what do we keep? A database flag, a screenshot, a copy of the wording, or nothing beyond the policy’s URL.
4. Which version of the policy was live that day? Policies get updated, so the version matters.
5. Who reviews all of this? Consent wording, tracker setup and record-keeping tend to cross legal, marketing and engineering teams.

Frequently asked questions

Does this ruling mean a privacy policy is never enough?

No. It’s one trial-court order, at the pleading stage, in one case. The court said the policy’s existence wasn’t enough without some indication the user saw it or agreed to it, and noted the company offered no argument beyond that. What would be enough is a question for counsel.

Is this a TCPA case?

No. The claims are under California’s CIPA and other laws, including the federal Wiretap Act. We cover it because the consent question, what a person saw and when, shows up across privacy and telemarketing law.

Did the court find the company violated the law?

No. The order lets the claims proceed. It doesn’t decide whether the allegations are true.

Does ExpressConsent stop CIPA claims?

No one can promise that. ExpressConsent’s records are evidence of what appeared on a page when a form was submitted. They aren’t a tracker control, and they don’t speak to what ran earlier in a visit.

What happened in the case after the order?

A docket listing last retrieved October 2, 2026 shows an amended complaint filed September 11, 2026. We haven’t confirmed anything after that. Check the docket for the current status.

More on TCPA Today

Last updated: November 5, 2026. Docket status after September 11, 2026 has not been confirmed.