Asercion v. Ulta: 201 trackers on arrival, and a privacy policy is not consent

Ulta argued its privacy policy disclosed the tracking. The court said a policy the visitor never agreed to is not consent when trackers load the moment the page opens.

US District Court, N.D. California · CIPA, Wiretap Act and CDAFA · Order 21 August 2026

Judgment on the pleadings largely denied; amended complaint filed 11 September 2026

Regulator or court: US District Court, Northern District of California
Jurisdiction: California, US
Framework: CIPA §§ 631(a) and 638.51; federal Wiretap Act; CDAFA; California Constitution; UCL
Order: 21 August 2026

Consent before collection · IP addresses and device identifiers · Notice, consent scope and assent

The problem

The plaintiff visited ulta.com in May 2025 and alleges 201 third-party trackers were installed on arrival and captured what the plaintiff viewed in real time, and that tracker components collected the plaintiff’s IP address. Ulta moved for judgment on the pleadings; the court denied it on every claim except the UCL (Order, Dkt. 19).

Case record

Court: US District Court, N.D. California (Judge Rita F. Lin)
Case number: 3:26-cv-02442-RFL; removed from San Mateo County Superior Court (26-CV-00756)
Parties: Asercion v. Ulta Salon, Cosmetics & Fragrance, Inc.
Laws: CIPA §§ 631(a) and 638.51; federal Wiretap Act; CDAFA; California Constitution; UCL
Stage: Judgment on the pleadings largely denied; amended complaint filed 11 September 2026
Amount: None
Source review: 20 October 2026

What the court found

Asercion v. Ulta rulings
Claim	Question	Result
CIPA § 631(a)	Real-time interception of contents; aiding and abetting	Survives. Product views and similar details can be contents, and trackers allegedly captured them in transit
CIPA § 638.51	Is a tracker a pen register?	Survives. Individual tracker components allegedly collected IP addresses
Consent defence	Did the privacy policy supply consent?	Rejected. A privacy policy is not consent, and the trackers loaded on arrival
Federal Wiretap Act	One-party consent	Survives through the crime-tort exception
CDAFA	Unauthorised access to a device	Survives
California constitutional privacy	Serious invasion	Survives, citing the 201 trackers alleged
UCL	Standing and remedy	Dismissed with leave to amend

Technical issue

What (alleged): 201 third-party trackers installed when the page loaded, capturing page and product views and IP addresses.
Where: ulta.com.
When: the plaintiff’s visit in May 2025.
Consent state: no choice had been made; Ulta relied on its privacy policy.

Inth’s technical interpretation: with every tag in the initial page load, the first request to each vendor goes out before any banner can be answered. The court’s "on arrival" point is about load order: vendor tags must wait for a recorded choice where your policy requires one.

<!-- Tags in the document head fire before any choice -->
<script src="https://vendor.example/tag.js" async></script>

// Load vendor tags only after the matching category is granted
consent.onChange(state => {
  if (state.granted.includes('marketing')) {
    const s = document.createElement('script');
    s.src = 'https://vendor.example/tag.js';
    document.head.appendChild(s);
  }
});

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

May 2025Plaintiff visits ulta.com
Not reviewedComplaint filed in San Mateo County Superior Court (26-CV-00756)
20 March 2026Ulta removes to N.D. Cal.
21 August 2026Order on motion for judgment on the pleadings (Dkt. 19)
11 September 2026Amended complaint filed (Dkt. 20)
2 October 2026Ulta’s response due; none appears on the public docket as of review

Outcome

All claims except the UCL proceed; the plaintiff has amended. No class has been certified and nothing has been decided on the merits.

What it cost

Asercion v. Ulta costs
Item	Amount	Source
Damages or settlement	None	[Order, Dkt. 19](https://law.justia.com/cases/federal/district-courts/california/candce/3:2026cv02442/466289/19/)
Defence costs	Not stated in the cited record

Why it matters

A privacy policy does not supply consent when trackers load before the visitor can act.
Pen-register claims survive here. This court accepted IP collection by tracker components; Wiley v. Universal Music dismissed similar claims a month later. The split within N.D. Cal. keeps § 638.51 claims alive.
Counting trackers. The number alleged (201) supported the constitutional claim’s seriousness.

Related law pages: CIPA § 631, CIPA § 638.51, Federal Wiretap Act.

How Inth catches this

Consent banner: keeps vendor tags out of the initial page load and loads them only after the visitor grants the matching category where the policy is opt-in.
Website audit: counts third-party domains and requests on first load before any choice, by region, and flags vendors that receive IP-bearing requests pre-consent.
Evidence: consent records with choice, country and policy, and first-load request inventories with timestamps.

Limit: whether California law requires a choice before a given tag loads is for your legal team.

Checks for your own systems

In the repository

List scripts in templates and the tag manager that load on page view without a consent condition.
Remove duplicate or unused vendors; each one is a separate request carrying the IP address.

In the browser and network

Open a product page in a clean California profile, make no choice, and count third-party domains contacted.
Check whether product names or SKUs appear in vendor request URLs.

With the people responsible

Ask who approves new vendors and whether each has a stated purpose and category.
Do not rely on the privacy policy as consent.

Sources and limits

Order on motion for judgment on the pleadings, Dkt. 19, 21 August 2026
Docket, reviewed 20 October 2026

The complaint and amended complaint were not opened; facts come from the order. The order does not name the vendors. The state-court filing date is not stated in the sources reviewed.

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Ulta’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.