Run a free scan

Ingraham v. Capital One: a tracking class failed because each visitor’s data, notices and harm differed

Pixel cases usually turn on the motion to dismiss. This one shows the next gate. Claims against Capital One’s card-application pages survived dismissal, but the court would not certify a class because what each visitor sent, what notice each saw, and whether each was harmed all varied. Records of who saw what are now central evidence for both sides.

US District Court, Northern District of California · CIPA and ECPA · Class certification denied 16 June 2026

The problem

People applied for Capital One credit cards or checked pre-approval online. They alleged that tracking code on those pages, and server-to-server integrations behind them, passed their personal and financial details to third parties without consent (reported by Fisher Phillips). The tools named in the court’s 2025 order include the Meta Pixel and Google’s (order).

Case record

Court
US District Court, Northern District of California (Judge Trina L. Thompson)
Case number
3:24-cv-05985-TLT, captioned Shah v. Capital One Financial Corporation; commentators cite the 2026 order as Ingraham v. Capital One
Parties
Vishal Shah, Gary Ingraham, Deia Williams and Devin Rose v. Capital One Financial Corporation ([March 2025 order](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html))
Counsel
Not stated in the cited record
Laws
CIPA, ECPA, CCPA, negligence, unjust enrichment
Stage
Class certification denied; individual claims continue
Amount
None
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
CIPA and ECPANo interception of communication contents without consentPixels and server-to-server tools sent application data to vendorsSurvived dismissal, March 2025
CCPA, negligence, unjust enrichment, declaratory reliefReasonable security; no unjust benefitFinancial data disclosed for advertisingSurvived dismissal, March 2025
CDAFA and UCLLoss of money or propertyValue of personal dataDismissed with leave: "Plaintiffs' personal information does not constitute property" ([March 2025 order](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html))
California constitutional privacyAn egregious breach of social normsEmployment and bank account information disclosedDismissed with leave
Class certificationCommon questions must predominateTwo nationwide classes with California subclasses: server-to-server and browser trackingDenied, 16 June 2026

Technical issue

  • Tools or vendors: the March 2025 order lists Google, Microsoft, DoubleClick, New Relic, Adobe, Everest, Skai/Kenshoo, Snowplow, BioCatch, Tealium and the Meta Pixel (order).
  • Where: the credit card application and pre-approval site.
  • What data: personal and financial information, which the order describes as including "employment information, bank account information".
  • When: during applications, with consent disputed.
  • How it came to light: not stated in the sources read.

Inth’s technical interpretation: the court’s first reason is an engineering fact. Whether a given pixel sends a given field depends on the browser, blocking settings, logged-in state, the page path and the tag configuration at that date, and server-side relays add another variable. The second reason is about records: which notice each applicant saw, including the additional California notices. A team that cannot reconstruct those facts per visitor cannot answer either side’s questions.

Illustrative pattern, not the defendant’s code.

// Bad: one tag-manager trigger sends application fields to several vendors
dataLayer.push({ event: 'application_submit', income: form.income,
                 employment: form.employer, housing: form.housingStatus });

Illustrative pattern, not the defendant’s code.

// Fixed: application data never enters the data layer; vendors get a neutral event
dataLayer.push({ event: 'application_submit' });
// Server-side forwarders send nothing from the application payload

Timeline

Timeline
DateEvent
2024Putative class action filed (reported by [Fenwick](https://www.fenwick.com/insights/publications/california-federal-court-denies-class-certification-cipa-pixel-tracking-case))
3 March 2025Motion to dismiss granted in part ([order](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html))
16 June 2026Class certification denied (reported by [Fisher Phillips](https://www.fisherphillips.com/en/insights/insights/california-federal-courts-denial-of-class-certification-may-reshape-website-tracking-litigation) and [TCPAWorld](https://tcpaworld.com/2026/06/24/another-pixel-class-action-fails-court-holds-consent-standing-and-data-collection-questions-defeat-class-certification/))
22 September 2026Calhoun v. Google is stayed pending "Williams v. Capital One Financial Corporation, No. 26-5547 (9th Cir.)" ([Calhoun Dkt. 1149](https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_20-cv-05146/pdf/USCOURTS-cand-4_20-cv-05146-78.pdf))

Outcome

As reported, the court found three separate predominance failures, each enough on its own (Fisher Phillips; Fenwick):

  1. Transmission. Different technologies collected different data; browser settings and behaviour changed what was sent; even the named plaintiffs' transmissions were disputed.
  2. Consent. Applicants saw different disclosures, and California residents received additional notices. In Fenwick’s summary, consent "would turn on each user’s subjective understanding of the relevant agreements".
  3. Standing. In an earlier ruling one named plaintiff showed private information was disclosed and another did not. The plaintiffs offered no class-wide way to prove injury.

Both proposed nationwide classes and their California subclasses were denied. We could not open the order itself; the description above relies on law-firm summaries and is labelled as such.

Appeal. On 22 September 2026 another court stayed Calhoun v. Google to await "Williams v. Capital One Financial Corporation, No. 26-5547 (9th Cir.)" (Calhoun Dkt. 1149). Deia Williams is a named plaintiff here, but we have not confirmed that No. 26-5547 is an appeal from this class ruling.

What it cost

What it cost
ItemRecord
Damages, fund or penaltyNone to date
Fees and defence costsNot stated in the cited record

Why it matters

  • Certification is the new battleground. The same reasoning defeated class treatment in Calhoun v. Google (June 2025) and Smith v. Rack Room Shoes (September 2026, on standing).
  • Financial context helped at the pleading stage, not at certification. Compare TaxAct, which settled before certification was tested.
  • Server-to-server claims. A separate server-to-server class shows plaintiffs now plead relays as well as pixels; see Rack Room on the "in transit" problem for server-side tools.
  • See Notice, consent scope and assent.

How Inth catches this

  • Code audit: flags a pull request that pushes application fields into the data layer or a server-side forwarder, and traces income or employment fields from the form to the vendor call.
  • Website audit: records each third-party request on application pages with page, time, visitor region and consent state, the per-visitor facts the court found missing.
  • Consent banner: under an opt-in policy, marketing and analytics tags wait for a choice. Inth’s default California policy is opt-out, so tags run until the visitor opts out; configure a California opt-in policy if you want them held back.
  • Evidence: each consent record shows the visitor’s choice, their country and the policy that applied, which goes to the per-visitor consent question; it does not store the full notice text each person saw.

Limit: browser observations cannot show server-to-server sharing, which was one of the two proposed classes.

Checks for your own systems

In the repository

  • Search application and onboarding flows for data-layer pushes or vendor calls carrying form values.
  • List every server-side integration that receives application events.

In the browser and network

  • Complete a test application in two browsers (one blocking third-party cookies) and compare what each vendor receives.

With the people responsible

  • Confirm you can show, per region and date, which privacy notice and consent text applicants saw.
  • Ask vendors with server-to-server feeds what fields they receive and keep.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Capital One’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.