[Enforcement library](/enforcement)

# Ingraham v. Capital One: a tracking class failed because each visitor's data, notices and harm differed

Pixel cases usually turn on the motion to dismiss. This one shows the next gate. Claims against Capital One's card-application pages survived dismissal, but the court would not certify a class because what each visitor sent, what notice each saw, and whether each was harmed all varied. Records of who saw what are now central evidence for both sides.

US District Court, Northern District of California · CIPA and ECPA · Class certification denied 16 June 2026

## The problem

People applied for Capital One credit cards or checked pre-approval online. They alleged that tracking code on those pages, and server-to-server integrations behind them, passed their personal and financial details to third parties without consent (reported by [Fisher Phillips](https://www.fisherphillips.com/en/insights/insights/california-federal-courts-denial-of-class-certification-may-reshape-website-tracking-litigation)). The tools named in the court's 2025 order include the Meta Pixel and Google's ([order](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html)).

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, Northern District of California (Judge Trina L. Thompson) |
| Case number | 3:24-cv-05985-TLT, captioned Shah v. Capital One Financial Corporation; commentators cite the 2026 order as Ingraham v. Capital One |
| Parties | Vishal Shah, Gary Ingraham, Deia Williams and Devin Rose v. Capital One Financial Corporation (\[March 2025 order\](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html)) |
| Counsel | Not stated in the cited record |
| Laws | CIPA, ECPA, CCPA, negligence, unjust enrichment |
| Stage | Class certification denied; individual claims continue |
| Amount | None |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| CIPA and ECPA | No interception of communication contents without consent | Pixels and server-to-server tools sent application data to vendors | Survived dismissal, March 2025 |
| CCPA, negligence, unjust enrichment, declaratory relief | Reasonable security; no unjust benefit | Financial data disclosed for advertising | Survived dismissal, March 2025 |
| CDAFA and UCL | Loss of money or property | Value of personal data | Dismissed with leave: "Plaintiffs' personal information does not constitute property" (\[March 2025 order\](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html)) |
| California constitutional privacy | An egregious breach of social norms | Employment and bank account information disclosed | Dismissed with leave |
| Class certification | Common questions must predominate | Two nationwide classes with California subclasses: server-to-server and browser tracking | Denied, 16 June 2026 |

## Technical issue

- **Tools or vendors:** the March 2025 order lists Google, Microsoft, DoubleClick, New Relic, Adobe, Everest, Skai/Kenshoo, Snowplow, BioCatch, Tealium and the Meta Pixel ([order](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html)).
- **Where:** the credit card application and pre-approval site.
- **What data:** personal and financial information, which the order describes as including "employment information, bank account information".
- **When:** during applications, with consent disputed.
- **How it came to light:** not stated in the sources read.

**Inth's technical interpretation:** the court's first reason is an engineering fact. Whether a given pixel sends a given field depends on the browser, blocking settings, logged-in state, the page path and the tag configuration at that date, and server-side relays add another variable. The second reason is about records: which notice each applicant saw, including the additional California notices. A team that cannot reconstruct those facts per visitor cannot answer either side's questions.

Illustrative pattern, not the defendant's code.

```js
// Bad: one tag-manager trigger sends application fields to several vendors
dataLayer.push({ event: 'application_submit', income: form.income,
                 employment: form.employer, housing: form.housingStatus });
```

Illustrative pattern, not the defendant's code.

```js
// Fixed: application data never enters the data layer; vendors get a neutral event
dataLayer.push({ event: 'application_submit' });
// Server-side forwarders send nothing from the application payload
```

## Timeline

| Date | Event |
| --- | --- |
| 2024 | Putative class action filed (reported by \[Fenwick\](https://www.fenwick.com/insights/publications/california-federal-court-denies-class-certification-cipa-pixel-tracking-case)) |
| 3 March 2025 | Motion to dismiss granted in part (\[order\](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html)) |
| 16 June 2026 | Class certification denied (reported by \[Fisher Phillips\](https://www.fisherphillips.com/en/insights/insights/california-federal-courts-denial-of-class-certification-may-reshape-website-tracking-litigation) and \[TCPAWorld\](https://tcpaworld.com/2026/06/24/another-pixel-class-action-fails-court-holds-consent-standing-and-data-collection-questions-defeat-class-certification/)) |
| 22 September 2026 | Calhoun v. Google is stayed pending "Williams v. Capital One Financial Corporation, No. 26-5547 (9th Cir.)" (\[Calhoun Dkt. 1149\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-4\_20-cv-05146/pdf/USCOURTS-cand-4\_20-cv-05146-78.pdf)) |

## Outcome

As reported, the court found three separate predominance failures, each enough on its own ([Fisher Phillips](https://www.fisherphillips.com/en/insights/insights/california-federal-courts-denial-of-class-certification-may-reshape-website-tracking-litigation); [Fenwick](https://www.fenwick.com/insights/publications/california-federal-court-denies-class-certification-cipa-pixel-tracking-case)):

1. **Transmission.** Different technologies collected different data; browser settings and behaviour changed what was sent; even the named plaintiffs' transmissions were disputed.
2. **Consent.** Applicants saw different disclosures, and California residents received additional notices. In Fenwick's summary, consent "would turn on each user's subjective understanding of the relevant agreements".
3. **Standing.** In an earlier ruling one named plaintiff showed private information was disclosed and another did not. The plaintiffs offered no class-wide way to prove injury.

Both proposed nationwide classes and their California subclasses were denied. We could not open the order itself; the description above relies on law-firm summaries and is labelled as such.

**Appeal.** On 22 September 2026 another court stayed Calhoun v. Google to await "Williams v. Capital One Financial Corporation, No. 26-5547 (9th Cir.)" ([Calhoun Dkt. 1149](https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_20-cv-05146/pdf/USCOURTS-cand-4_20-cv-05146-78.pdf)). Deia Williams is a named plaintiff here, but we have not confirmed that No. 26-5547 is an appeal from this class ruling.

## What it cost

| Item | Record |
| --- | --- |
| Damages, fund or penalty | None to date |
| Fees and defence costs | Not stated in the cited record |

## Why it matters

- **Certification is the new battleground.** The same reasoning defeated class treatment in [Calhoun v. Google](/enforcement/calhoun-v-google) (June 2025) and [Smith v. Rack Room Shoes](/enforcement/smith-v-rack-room-shoes) (September 2026, on standing).
- **Financial context helped at the pleading stage, not at certification.** Compare [TaxAct](/enforcement/taxact), which settled before certification was tested.
- **Server-to-server claims.** A separate server-to-server class shows plaintiffs now plead relays as well as pixels; see [Rack Room](/enforcement/smith-v-rack-room-shoes) on the "in transit" problem for server-side tools.
- See [Notice, consent scope and assent](/enforcement/issues/notice-consent-scope-and-assent).

## How Inth catches this

- **Code audit:** flags a pull request that pushes application fields into the data layer or a server-side forwarder, and traces income or employment fields from the form to the vendor call.
- **Website audit:** records each third-party request on application pages with page, time, visitor region and consent state, the per-visitor facts the court found missing.
- **Consent banner:** under an opt-in policy, marketing and analytics tags wait for a choice. Inth's default California policy is opt-out, so tags run until the visitor opts out; configure a California opt-in policy if you want them held back.
- **Evidence:** each consent record shows the visitor's choice, their country and the policy that applied, which goes to the per-visitor consent question; it does not store the full notice text each person saw.

Limit: browser observations cannot show server-to-server sharing, which was one of the two proposed classes.

## Checks for your own systems

### In the repository

- Search application and onboarding flows for data-layer pushes or vendor calls carrying form values.
- List every server-side integration that receives application events.

### In the browser and network

- Complete a test application in two browsers (one blocking third-party cookies) and compare what each vendor receives.

### With the people responsible

- Confirm you can show, per region and date, which privacy notice and consent text applicants saw.
- Ask vendors with server-to-server feeds what fields they receive and keep.

## Sources and limits

- [Order granting in part motion to dismiss](https://caselaw.findlaw.com/court/us-dis-crt-n-d-cal/117026506.html) (3 March 2025, text via FindLaw)
- [Fisher Phillips](https://www.fisherphillips.com/en/insights/insights/california-federal-courts-denial-of-class-certification-may-reshape-website-tracking-litigation) (23 June 2026)
- [TCPAWorld](https://tcpaworld.com/2026/06/24/another-pixel-class-action-fails-court-holds-consent-standing-and-data-collection-questions-defeat-class-certification/) (24 June 2026)
- [Fenwick](https://www.fenwick.com/insights/publications/california-federal-court-denies-class-certification-cipa-pixel-tracking-case) (2 July 2026)
- [Calhoun v. Google, Dkt. 1149](https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_20-cv-05146/pdf/USCOURTS-cand-4_20-cv-05146-78.pdf) (22 September 2026)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Capital One's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Calhoun v. Google](/enforcement/calhoun-v-google) · [Smith v. Rack Room Shoes](/enforcement/smith-v-rack-room-shoes) · [Notice, consent scope and assent](/enforcement/issues/notice-consent-scope-and-assent)