Run a free scan

Lakes v. Ubisoft: layered, provable consent ended a Meta Pixel case at the pleading stage

Most pixel cases here show what went wrong. This one shows a defence that worked: Ubisoft put three consent touchpoints in front of every buyer and could prove, with dated screenshots, what each said. If you run ad pixels on account or purchase flows, this is the record to be able to produce.

US District Court, Northern District of California · VPPA, Wiretap Act, CIPA §631 · Dismissed with prejudice, 2 April 2025

The problem

Two Ubisoft customers alleged that as they searched for, added to cart and bought games on ubisoft.com, the Meta Pixel sent Meta the game titles with their Facebook identifiers. Ubisoft answered that they had agreed at least three times before buying anything. The court agreed.

Case record

Court
US District Court, Northern District of California
Case number
3:24-cv-06943-TLT (Judge Trina L. Thompson)
Parties
Trevor Lakes and Alex Rajjoub v. Ubisoft, Inc.
Counsel
Plaintiffs: Peiffer Wolf Carr Kane Conway & Wise. Ubisoft: Paul Hastings
Laws
VPPA, Federal Wiretap Act, CIPA §631, California Constitution, intrusion upon seclusion
Stage
Dismissed with prejudice; appeal pending (9th Cir. No. 25-2857)
Amount
None
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
VPPANo knowing disclosure of identified viewing without "informed, written consent"Game titles (games contain cut scenes) sent with the Facebook ID ([Compl. ¶¶ 88–93](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.1.0.pdf))Dismissed: consent met all three statutory conditions
Wiretap ActNo interception of contents; one party's consent suffices unless the crime-tort exception appliesUbisoft "purposefully included the Pixel" to redirect communications to MetaDismissed: consent proved; crime-tort exception rejected
CIPA §631, constitution, intrusionNo reading in transit, or serious invasion, without consentSame pixel trafficDismissed: consent is a defence to each

Technical issue

  • Tools or vendors: the Meta Pixel (order, p. 2).
  • Where: search results, game pages, cart and checkout on ubisoft.com.
  • What data: the complaint alleged a PageView carrying search terms, a PageView carrying the game title, AddToCart, and PageView and ViewContent on checkout, each with the unencrypted Facebook ID and the fr cookie (Compl. ¶¶ 89–93; order, p. 2).
  • When: the banner appeared "the first time a user arrives", and an account was required before any purchase (order, pp. 2–3).
  • How it came to light: the plaintiffs' own captures of pixel requests, reproduced as figures in the complaint.

The three touchpoints that won

1. The banner. From March 2021 to 25 September 2024 the banner read: "By continuing to navigate on this site, you accept the use of cookies by Ubisoft and its partners to offer advertising adapted to your interests, collect visit statistics and allow you to use the social network share buttons", with "To learn more", "set your cookies" and "ok" (Arion Decl. ¶ 5; Ex. A). "Set your cookies" opened per-category toggles for analytics, personalisation, targeted advertising and multimedia player cookies (Ex. D). By December 2024 it offered Accept, Decline and Set Cookie Preferences, and Accept covered "game browsing and purchase activity" shared with partners (Ex. C). The court found the banner met the VPPA’s "written" and "informed" requirements (order, p. 14).

2. The account-creation clickwrap. No account, and so no purchase, without ticking "I accept Ubisoft’s Terms of Use, Terms of Sale and Privacy Policy", each one a link (Ex. H; Arion Decl. ¶ 8). The same screen carried a separate box, "Share my personal and game data with select partners for marketing purposes", which appears ticked in the exhibit screenshot. Users who signed up before 2020 had to re-accept the updated Privacy Policy at next sign-in (Arion Decl. ¶ 10).

3. The purchase-flow disclosure. The payment page said "Ubisoft processes your personal data for the purpose of purchasing your Ubisoft product", linked "Ubisoft’s Privacy Policy", and required "Validate and pay" under a Terms of Sale statement (Ex. I). Because this appeared at every purchase, the court accepted that consent fell inside the VPPA’s two-year window for every class member (order, p. 14).

All three linked a Privacy Policy saying Ubisoft lets "some of our partners" set cookies, with ways to withdraw consent (order, pp. 9, 13).

Inth’s technical interpretation: the win came from evidence, not from the pixel being harmless. Ubisoft filed each screen with its dates of operation, sworn to by the executive responsible for the web properties, and nothing in its notices promised the opposite, which is what kept consent alive in Calhoun v. Google. Two details would not travel: a "continuing to navigate" banner and a ticked-by-default marketing box are not consent under EU rules (CJEU, Planet49, C-673/17). Copy the structure, not those two choices.

What to build from each touchpoint

Technical issue
TouchpointWhat the court relied onWhat to buildEvidence to keep
BannerNotice naming partners and the advertising purpose; per-category settings; a "Set cookies" link on every pageAccept and Reject with equal weight, category settings, a reopen link, and the pixel gated on the marketing categoryc15t consent record (choice, country, policy applied) plus your own dated history of banner copy
Account clickwrapA required box accepting linked terms and privacy policy; a separate data-sharing boxA required, unticked acceptance box and a separate, unticked marketing-sharing boxAccount ID, timestamp and terms version in your user database
Checkout noticePrivacy notice and link at every purchase, inside the VPPA two-year windowThe notice beside the pay button on every order, re-shown when the policy changesOrder ID with the notice version shown

Illustrative pattern, not the defendant’s code.

// Bad: pixel fires on every product page; consent lives only in the policy text
fbq('init', PIXEL_ID);
fbq('track', 'ViewContent', { content_name: game.title });

Illustrative pattern, not the defendant’s code.

// Fixed: the event waits for the marketing category (c15t React hook)
const { has } = useConsentManager();
useEffect(() => {
  if (!has('marketing')) return;
  fbq('track', 'ViewContent', { content_ids: [game.sku] }); // ID, not title
}, [has, game.sku]);

Timeline

Timeline
DateEvent
3 October 2024Complaint filed ([Dkt. 1](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.1.0.pdf))
16 December 2024Motion to dismiss with 12 screenshot exhibits ([Dkt. 22](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.0.pdf))
1 April 2025Hearing ([order, p. 1](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf))
2 April 2025Order and judgment entered ([Dkt. 44](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.44.0.pdf))
2 May 2025Appeal docketed, 9th Cir. No. 25-2857 ([docket](https://www.courtlistener.com/docket/70242137/lakes-et-al-v-ubisoft-inc/))
25 November 2025Video game industry body ESA files amicus brief for Ubisoft; EPIC has filed for the appellants; argument "not yet scheduled" ([ESA brief, p. 1 and n.13](https://www.theesa.com/wp-content/uploads/2025/12/ECF-0034.1-ESA-Lakes-Amicus-Brief21228217.1.pdf))

Outcome

The court took judicial notice of the banner, cookie settings, account and checkout screenshots and the Privacy Policy, then held that consent defeated every claim. It refused to require a disclosure naming Meta or describing "video game titles combined with unique Facebook identifiers": "None of Plaintiffs' cited cases support Plaintiffs' request for a highly granular disclosure" (order, p. 10). It rejected the crime-tort exception because the complaint alleged a purpose "to make money" (p. 12). Leave to amend was denied as futile. This is a district court order; it binds no other court.

What it cost

What it cost
ItemRecord
Damages, fund or penaltyNone
Fees awardedNot stated in the cited record
Defence costsNot stated in the cited record

Why it matters

  • Consent scope. "Partners" and "cookie identifiers" were enough here. Contrast Calhoun v. Google, where a specific contrary promise kept consent open, and Smith v. Rack Room Shoes, where the policy said cookie data was not personally identifiable.
  • VPPA consent can live in a store flow. Per-purchase re-disclosure satisfied the two-year rule (VPPA).
  • Crime-tort exception. Lakes sits on the narrow side of the split (Federal Wiretap Act).
  • Status. The plaintiffs appealed (9th Cir. No. 25-2857), with amicus briefs from EPIC for them and the Entertainment Software Association for Ubisoft. We found no Ninth Circuit ruling as of 17 October 2026. Until there is one, treat this as one district judge’s view.

How Inth catches this

  • Code audit: flags a pull request that adds a Meta Pixel ViewContent or AddToCart event outside the consent check, and traces a product title from the page template into the event payload.
  • Website audit: records each request to facebook.com/tr with the page, time, visitor region and consent state, so you can show what ran before and after a choice.
  • Consent banner: under an opt-in policy the Meta Pixel waits for marketing consent. Inth’s default California policy is opt-out, so tags run until the visitor opts out; if you want the pixel to wait for an affirmative choice in California, configure a California opt-in policy.
  • Evidence: each consent record shows the visitor’s choice, their country and the policy that applied, which is the banner half of the record Ubisoft filed.

Limit: Inth does not hold your account-creation or checkout terms; keep versioned copies of those screens yourself.

Checks for your own systems

In the repository

  • List every pixel event on search, product, cart and checkout templates and the fields each sends.
  • Confirm each event sits behind a consent check, including on client-side route changes.
  • Check that no data-sharing box on sign-up defaults to ticked.

In the browser and network

  • In a clean profile, filter for facebook.com/tr and note whether dl or cd[content_name] carry a title before you choose.
  • Click Decline, then search and add to cart; confirm no marketing requests follow.
  • Repeat while logged in to Facebook in the same browser, as the plaintiffs did.

With the people responsible

  • Ask who can produce, with dates, each banner, sign-up and checkout screen from the last two years.
  • Compare the privacy policy, help pages and product notices for statements that contradict each other.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Ubisoft’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.