[Enforcement library](/enforcement)

# Camplisson v. Adidas: a privacy policy link in the footer is not consent to a TikTok pixel

If the only notice of your ad pixels is a privacy policy linked in the footer, you have no consent record to show. This court held that footer links are neither conspicuous notice nor assent, and let a pen-register claim over the TikTok Pixel and Microsoft's Bing tag go forward.

US District Court, Southern District of California · CIPA §638.51 · Motion to dismiss denied, 18 November 2025; stayed 26 August 2026

## The problem

Three visitors to adidas.com/us, one a minor, alleged that the site loaded the TikTok Pixel and Microsoft's Bing tracker into their browsers. The trackers allegedly collected IP addresses, unique identifiers and browsing information without any request for consent ([order](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3_25-cv-00603/pdf/USCOURTS-casd-3_25-cv-00603-0.pdf), pp. 2–3). The only disclosure was a terms page and privacy policy linked at the "very bottom" of the page in "small font" (Compl. ¶ 51). These are allegations; nothing has been proved.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, Southern District of California (Judge Gonzalo P. Curiel) |
| Case number | 3:25-cv-00603-GPC |
| Parties | Maeve Camplisson, David Sanchez and S.D. (a minor) v. Adidas America, Inc. |
| Counsel | Plaintiffs: Bernstein Litowitz Berger & Grossmann LLP. Defendant: Morrison & Foerster LLP (\[parties\](https://www.courtlistener.com/docket/69738592/parties/camplisson-v-adidas-america-inc/)) |
| Laws | CIPA §638.51 (pen register), the only claim |
| Stage | Motion to dismiss denied; case stayed until February 2027 at the latest |
| Amount | None |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| CIPA §638.51 | No pen register or trap and trace device without a court order, unless "the consent of the user of that service has been obtained" (§638.51(b)(5)) | TikTok Pixel and Bing tracker collected IP addresses and identifiers on every visit; no prompt, only footer links (\[Compl. ¶¶ 3, 24, 49–55\](https://storage.courtlistener.com/recap/gov.uscourts.casd.807817/gov.uscourts.casd.807817.3.0.pdf)) | Motion to dismiss denied on standing, pen-register scope and consent |

## Technical issue

- **Tools or vendors:** the TikTok Pixel, including fingerprinting, the `_ttp` cookie and "AutoAdvanced Matching", which sends form data such as name, date of birth and address to TikTok (Compl. ¶¶ 31–34). Microsoft's Bing tracker, which sets a Microsoft ID (MUID); the complaint says Microsoft tells advertisers the data does not expire for 13 months (Compl. ¶ 44).
- **Where:** adidas.com/us product and browsing pages.
- **What data:** IP address, timestamps, unique identifiers, device and browser details, page URLs and clicks (order, pp. 2–3).
- **When:** on page load. The site "did not ask visitors, including Plaintiffs, whether they consented" (Compl. ¶ 54). There was no cookie banner; the case concerns tags with no consent step at all.
- **Server-side:** not alleged.
- **How it came to light:** the complaint reproduces captures of the TikTok and Microsoft requests (Compl. ¶¶ 33, 47). It does not say who captured them.

**Inth's technical interpretation:** without a banner, the only lawful-basis argument a site has is that browsing implies agreement to its terms. Courts test that as a browsewrap contract: was notice conspicuous, and did the visitor click anything? A footer link fails both. The engineering consequence is simple. If a tag needs consent where you operate, there must be a choice the visitor makes and a record of it, made before the tag loads.

Illustrative pattern, not the defendant's code.

```html
<!-- Bad: pixels in the head, notice only in the footer -->
<head>
  <script>!function (w, d, t) { /* TikTok base code */ }(window, document, 'ttq');
    ttq.load('TIKTOK_PIXEL_ID'); ttq.page();</script>
  <script>(function (w, d, t, r, u) { /* UET base code */ })(window, document, 'script',
    '//bat.bing.com/bat.js', 'uetq');</script>
</head>
<footer><a href="/terms">Terms</a> · <a href="/privacy">Privacy</a></footer>
```

Illustrative pattern, not the defendant's code. Generic consent API, not a c15t call.

```html
<head>
  <script>
    window.uetq = window.uetq || [];
    uetq.push('consent', 'default', { ad_storage: 'denied' }); // UET consent mode
    consent.whenGranted('marketing', () => {
      loadScript('//bat.bing.com/bat.js');
      uetq.push('consent', 'update', { ad_storage: 'granted' });
      loadTikTokPixel('TIKTOK_PIXEL_ID');
    });
  </script>
</head>
```

## Timeline

| Date | Event |
| --- | --- |
| 14 March 2025 | Complaint filed; corrected complaint 19 March 2025 (\[ECF No. 3\](https://storage.courtlistener.com/recap/gov.uscourts.casd.807817/gov.uscourts.casd.807817.3.0.pdf)) |
| 14 November 2025 | Hearing on Adidas's motion to dismiss |
| 18 November 2025 | Motion to dismiss denied (\[ECF No. 32\](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3\_25-cv-00603/pdf/USCOURTS-casd-3\_25-cv-00603-0.pdf)) |
| 4 June 2026 | Scheduling order; class certification motion due 6 November 2026 |
| 26 June 2026 | Adidas moves to stay pending \*Variety Media v. Superior Court\* (No. B350578) |
| 26 August 2026 | Stay granted for six months or until \*Variety Media\* is published (\[ECF No. 65\](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3\_25-cv-00603/pdf/USCOURTS-casd-3\_25-cv-00603-1.pdf)) |

## Outcome

Judge Curiel held three things in November 2025. First, the plaintiffs had standing: CIPA protects a substantive privacy right, and *Popa* did not add "heightened requirements", because there the data concerned only how the plaintiff used one site (pp. 12–13). Second, website trackers can plausibly be pen registers, "even if only IP addresses are collected" (p. 15). Third, consent failed. The "user" who must consent is the visitor whose browser runs the tracker, not Adidas (pp. 15–16). And the footer terms gave neither conspicuous notice nor a way to assent: the site "only hyperlinked the Terms and Conditions at the footer of the website and did not have a pop-up window or other mechanism that would obtain Plaintiffs' and Class members' affirmative consent" (p. 18).

In August 2026 the court stayed the case for up to six months while the California Court of Appeal decides whether §638.51 reaches website technology (ECF No. 65, p. 10). The orders are unpublished and bind no other court.

## What it cost

| Item | Record |
| --- | --- |
| Damages or settlement | None; case stayed |
| Statutory exposure | CIPA allows USD 5,000 per violation (§637.2); no total is stated |
| Fees or costs | Not stated in the cited record |

## Why it matters

- **Conflicting citation resolved.** The number 25-cv-00742-DMS, sometimes linked to this ruling, belongs to a different case: *Bradshaw v. Lowe's Companies*, in which another judge of the same court dismissed a near-identical TikTok and Bing claim for lack of standing six days earlier, applying *Popa* because the complaint rested on IP addresses ([ECF No. 39](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3_25-cv-00742/pdf/USCOURTS-casd-3_25-cv-00742-0.pdf), pp. 8–11). Same court, same trackers, opposite standing results.
- **Popa and Cook.** [Popa](/enforcement/popa-v-microsoft) asks whether the plaintiff lost something traditionally actionable. [Cook](/enforcement/cook-v-gamestop) found no standing partly because GameStop "disclosed what information it would collect, albeit in an allegedly inconspicuous location" ([opinion](https://www2.ca3.uscourts.gov/opinarch/232574p.pdf)). Here the same kind of footer disclosure failed as consent. A footer notice may help on standing and still fail as consent.
- **SB 690 and Variety Media.** This case has only a §638.51 claim and was filed in March 2025. SB 690 (Stats. 2026, ch. 976, signed 30 September 2026) makes website and app §638.51 claims Attorney General only from 1 January 2027 (the default effective date for a 2026 statute), retroactive to pending claims in actions filed on or after 1 January 2025. It leaves §631, §632 and §632.7 untouched ([bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)). On Inth's reading the whole private claim is in that window; the court has not ruled on it. See [Rose v. Variety Media](/enforcement/rose-v-variety-media).
- See [consent before collection](/enforcement/issues/consent-before-collection) and [notice, consent scope and assent](/enforcement/issues/notice-consent-scope-and-assent).

## How Inth catches this

- **Code audit:** flags a pull request that adds the TikTok Pixel or Bing UET tag outside the consent check, and traces form fields that flow into a pixel call.
- **Website audit:** records requests to analytics.tiktok.com and bat.bing.com on page load, with page, time, region and the absence of any consent state.
- **Consent banner:** gives the visitor a choice and holds ad pixels until marketing is granted where the policy is opt-in. Inth's default California policy is opt-out, which lets tags run before a choice. If CIPA pre-consent claims are a concern for you, configure a California opt-in policy so the pixels wait.
- **Evidence:** a consent record per visitor (choice, country, policy) to set against a claim that no one was asked.

Inth cannot decide whether a footer notice or a banner is legally sufficient where you operate; that is for your legal team.

## Checks for your own systems

### In the repository

- Search for `ttq.load` and `bat.bing.com/bat.js` and confirm each is behind a consent check.
- Check whether TikTok automatic advanced matching or UET enhanced conversions read form fields.

### In the browser and network

- In a clean California session, load a product page without touching anything and list every request to TikTok and Bing hosts.
- Confirm a consent prompt appears before those requests, and that a record exists after the choice.

### With the people responsible

- Ask whether the site is used by minors, and how age is handled for ad tags.
- Confirm what the terms say about cookies and whether any page requires the visitor to accept them.

## Sources and limits

- [Order denying motion to dismiss, 18 November 2025 (ECF No. 32)](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3_25-cv-00603/pdf/USCOURTS-casd-3_25-cv-00603-0.pdf)
- [Order granting stay, 26 August 2026 (ECF No. 65)](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3_25-cv-00603/pdf/USCOURTS-casd-3_25-cv-00603-1.pdf)
- [Corrected class action complaint, 19 March 2025 (ECF No. 3)](https://storage.courtlistener.com/recap/gov.uscourts.casd.807817/gov.uscourts.casd.807817.3.0.pdf)
- [Parties, 3:25-cv-00603 (CourtListener)](https://www.courtlistener.com/docket/69738592/parties/camplisson-v-adidas-america-inc/)
- [Bradshaw v. Lowe's Companies, order of 12 November 2025](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3_25-cv-00742/pdf/USCOURTS-casd-3_25-cv-00742-0.pdf)
- [Cook v. GameStop, 3d Cir., 7 August 2025](https://www2.ca3.uscourts.gov/opinarch/232574p.pdf)
- [SB 690 bill text, published 1 October 2026](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)
- [Fisher Phillips alert](https://www.fisherphillips.com/en/insights/insights/court-allows-cipa-claim-involving-third-party-pixels-to-proceed) (secondary)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Adidas America, Inc.'s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Limas v. Wayfair](/enforcement/limas-v-wayfair) · [Rodriguez v. Autotrader](/enforcement/rodriguez-v-autotrader) · [Shah v. Fandom](/enforcement/shah-v-fandom) · [CIPA §638.51](/enforcement/laws/cipa-638-51-pen-register)