[Enforcement library](/enforcement)

# Lakes v. Ubisoft: layered, provable consent ended a Meta Pixel case at the pleading stage

Most pixel cases here show what went wrong. This one shows a defence that worked: Ubisoft put three consent touchpoints in front of every buyer and could prove, with dated screenshots, what each said. If you run ad pixels on account or purchase flows, this is the record to be able to produce.

US District Court, Northern District of California · VPPA, Wiretap Act, CIPA §631 · Dismissed with prejudice, 2 April 2025

## The problem

Two Ubisoft customers alleged that as they searched for, added to cart and bought games on ubisoft.com, the Meta Pixel sent Meta the game titles with their Facebook identifiers. Ubisoft answered that they had agreed at least three times before buying anything. The court agreed.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, Northern District of California |
| Case number | 3:24-cv-06943-TLT (Judge Trina L. Thompson) |
| Parties | Trevor Lakes and Alex Rajjoub v. Ubisoft, Inc. |
| Counsel | Plaintiffs: Peiffer Wolf Carr Kane Conway & Wise. Ubisoft: Paul Hastings |
| Laws | VPPA, Federal Wiretap Act, CIPA §631, California Constitution, intrusion upon seclusion |
| Stage | Dismissed with prejudice; appeal pending (9th Cir. No. 25-2857) |
| Amount | None |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| VPPA | No knowing disclosure of identified viewing without "informed, written consent" | Game titles (games contain cut scenes) sent with the Facebook ID (\[Compl. ¶¶ 88–93\](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.1.0.pdf)) | Dismissed: consent met all three statutory conditions |
| Wiretap Act | No interception of contents; one party's consent suffices unless the crime-tort exception applies | Ubisoft "purposefully included the Pixel" to redirect communications to Meta | Dismissed: consent proved; crime-tort exception rejected |
| CIPA §631, constitution, intrusion | No reading in transit, or serious invasion, without consent | Same pixel traffic | Dismissed: consent is a defence to each |

## Technical issue

- **Tools or vendors:** the Meta Pixel ([order, p. 2](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)).
- **Where:** search results, game pages, cart and checkout on ubisoft.com.
- **What data:** the complaint alleged a PageView carrying search terms, a PageView carrying the game title, AddToCart, and PageView and ViewContent on checkout, each with the unencrypted Facebook ID and the `fr` cookie ([Compl. ¶¶ 89–93](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.1.0.pdf); [order, p. 2](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)).
- **When:** the banner appeared "the first time a user arrives", and an account was required before any purchase ([order, pp. 2–3](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)).
- **How it came to light:** the plaintiffs' own captures of pixel requests, reproduced as figures in the complaint.

### The three touchpoints that won

**1\. The banner.** From March 2021 to 25 September 2024 the banner read: "By continuing to navigate on this site, you accept the use of cookies by Ubisoft and its partners to offer advertising adapted to your interests, collect visit statistics and allow you to use the social network share buttons", with "To learn more", "set your cookies" and "ok" ([Arion Decl. ¶ 5](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.1.pdf); [Ex. A](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.2.pdf)). "Set your cookies" opened per-category toggles for analytics, personalisation, targeted advertising and multimedia player cookies ([Ex. D](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.5.pdf)). By December 2024 it offered Accept, Decline and Set Cookie Preferences, and Accept covered "game browsing and purchase activity" shared with partners ([Ex. C](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.4.pdf)). The court found the banner met the VPPA's "written" and "informed" requirements ([order, p. 14](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)).

**2\. The account-creation clickwrap.** No account, and so no purchase, without ticking "I accept Ubisoft's Terms of Use, Terms of Sale and Privacy Policy", each one a link ([Ex. H](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.9.pdf); [Arion Decl. ¶ 8](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.1.pdf)). The same screen carried a separate box, "Share my personal and game data with select partners for marketing purposes", which appears ticked in the exhibit screenshot. Users who signed up before 2020 had to re-accept the updated Privacy Policy at next sign-in ([Arion Decl. ¶ 10](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.1.pdf)).

**3\. The purchase-flow disclosure.** The payment page said "Ubisoft processes your personal data for the purpose of purchasing your Ubisoft product", linked "Ubisoft's Privacy Policy", and required "Validate and pay" under a Terms of Sale statement ([Ex. I](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.10.pdf)). Because this appeared at every purchase, the court accepted that consent fell inside the VPPA's two-year window for every class member ([order, p. 14](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)).

All three linked a Privacy Policy saying Ubisoft lets "some of our partners" set cookies, with ways to withdraw consent ([order, pp. 9, 13](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)).

**Inth's technical interpretation:** the win came from evidence, not from the pixel being harmless. Ubisoft filed each screen with its dates of operation, sworn to by the executive responsible for the web properties, and nothing in its notices promised the opposite, which is what kept consent alive in [Calhoun v. Google](/enforcement/calhoun-v-google). Two details would not travel: a "continuing to navigate" banner and a ticked-by-default marketing box are not consent under EU rules ([CJEU, Planet49, C-673/17](https://curia.europa.eu/juris/liste.jsf?num=C-673/17)). Copy the structure, not those two choices.

### What to build from each touchpoint

| Touchpoint | What the court relied on | What to build | Evidence to keep |
| --- | --- | --- | --- |
| Banner | Notice naming partners and the advertising purpose; per-category settings; a "Set cookies" link on every page | Accept and Reject with equal weight, category settings, a reopen link, and the pixel gated on the marketing category | c15t consent record (choice, country, policy applied) plus your own dated history of banner copy |
| Account clickwrap | A required box accepting linked terms and privacy policy; a separate data-sharing box | A required, unticked acceptance box and a separate, unticked marketing-sharing box | Account ID, timestamp and terms version in your user database |
| Checkout notice | Privacy notice and link at every purchase, inside the VPPA two-year window | The notice beside the pay button on every order, re-shown when the policy changes | Order ID with the notice version shown |

Illustrative pattern, not the defendant's code.

```js
// Bad: pixel fires on every product page; consent lives only in the policy text
fbq('init', PIXEL_ID);
fbq('track', 'ViewContent', { content_name: game.title });
```

Illustrative pattern, not the defendant's code.

```tsx
// Fixed: the event waits for the marketing category (c15t React hook)
const { has } = useConsentManager();
useEffect(() => {
  if (!has('marketing')) return;
  fbq('track', 'ViewContent', { content_ids: [game.sku] }); // ID, not title
}, [has, game.sku]);
```

## Timeline

| Date | Event |
| --- | --- |
| 3 October 2024 | Complaint filed (\[Dkt. 1\](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.1.0.pdf)) |
| 16 December 2024 | Motion to dismiss with 12 screenshot exhibits (\[Dkt. 22\](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.0.pdf)) |
| 1 April 2025 | Hearing (\[order, p. 1\](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)) |
| 2 April 2025 | Order and judgment entered (\[Dkt. 44\](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.44.0.pdf)) |
| 2 May 2025 | Appeal docketed, 9th Cir. No. 25-2857 (\[docket\](https://www.courtlistener.com/docket/70242137/lakes-et-al-v-ubisoft-inc/)) |
| 25 November 2025 | Video game industry body ESA files amicus brief for Ubisoft; EPIC has filed for the appellants; argument "not yet scheduled" (\[ESA brief, p. 1 and n.13\](https://www.theesa.com/wp-content/uploads/2025/12/ECF-0034.1-ESA-Lakes-Amicus-Brief21228217.1.pdf)) |

## Outcome

The court took judicial notice of the banner, cookie settings, account and checkout screenshots and the Privacy Policy, then held that consent defeated every claim. It refused to require a disclosure naming Meta or describing "video game titles combined with unique Facebook identifiers": "None of Plaintiffs' cited cases support Plaintiffs' request for a highly granular disclosure" ([order, p. 10](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)). It rejected the crime-tort exception because the complaint alleged a purpose "to make money" ([p. 12](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf)). Leave to amend was denied as futile. This is a district court order; it binds no other court.

## What it cost

| Item | Record |
| --- | --- |
| Damages, fund or penalty | None |
| Fees awarded | Not stated in the cited record |
| Defence costs | Not stated in the cited record |

## Why it matters

- **Consent scope.** "Partners" and "cookie identifiers" were enough here. Contrast [Calhoun v. Google](/enforcement/calhoun-v-google), where a specific contrary promise kept consent open, and [Smith v. Rack Room Shoes](/enforcement/smith-v-rack-room-shoes), where the policy said cookie data was not personally identifiable.
- **VPPA consent can live in a store flow.** Per-purchase re-disclosure satisfied the two-year rule ([VPPA](/enforcement/laws/vppa)).
- **Crime-tort exception.** Lakes sits on the narrow side of the split ([Federal Wiretap Act](/enforcement/laws/federal-wiretap-act)).
- **Status.** The plaintiffs appealed (9th Cir. No. 25-2857), with amicus briefs from EPIC for them and the Entertainment Software Association for Ubisoft. We found no Ninth Circuit ruling as of 17 October 2026. Until there is one, treat this as one district judge's view.

## How Inth catches this

- **Code audit:** flags a pull request that adds a Meta Pixel `ViewContent` or `AddToCart` event outside the consent check, and traces a product title from the page template into the event payload.
- **Website audit:** records each request to facebook.com/tr with the page, time, visitor region and consent state, so you can show what ran before and after a choice.
- **Consent banner:** under an opt-in policy the Meta Pixel waits for marketing consent. Inth's default California policy is opt-out, so tags run until the visitor opts out; if you want the pixel to wait for an affirmative choice in California, configure a California opt-in policy.
- **Evidence:** each consent record shows the visitor's choice, their country and the policy that applied, which is the banner half of the record Ubisoft filed.

Limit: Inth does not hold your account-creation or checkout terms; keep versioned copies of those screens yourself.

## Checks for your own systems

### In the repository

- List every pixel event on search, product, cart and checkout templates and the fields each sends.
- Confirm each event sits behind a consent check, including on client-side route changes.
- Check that no data-sharing box on sign-up defaults to ticked.

### In the browser and network

- In a clean profile, filter for `facebook.com/tr` and note whether `dl` or `cd[content_name]` carry a title before you choose.
- Click Decline, then search and add to cart; confirm no marketing requests follow.
- Repeat while logged in to Facebook in the same browser, as the plaintiffs did.

### With the people responsible

- Ask who can produce, with dates, each banner, sign-up and checkout screen from the last two years.
- Compare the privacy policy, help pages and product notices for statements that contradict each other.

## Sources and limits

- [Order granting motion to dismiss, Dkt. 43](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.43.0.pdf) (2 April 2025)
- [Judgment, Dkt. 44](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.44.0.pdf) (2 April 2025)
- [Complaint, Dkt. 1](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.1.0.pdf) (3 October 2024)
- [Arion declaration, Dkt. 22-1](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.1.pdf) and exhibits [A](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.2.pdf), [C](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.4.pdf), [D](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.5.pdf), [H](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.9.pdf), [I](https://storage.courtlistener.com/recap/gov.uscourts.cand.437523/gov.uscourts.cand.437523.22.10.pdf) (16 December 2024)
- [Ninth Circuit docket No. 25-2857](https://www.courtlistener.com/docket/70242137/lakes-et-al-v-ubisoft-inc/)
- [ESA amicus brief, DktEntry 34](https://www.theesa.com/wp-content/uploads/2025/12/ECF-0034.1-ESA-Lakes-Amicus-Brief21228217.1.pdf) (25 November 2025)
- [Covington Inside Privacy](https://www.insideprivacy.com/united-states/litigation/california-court-holds-plaintiffs-consent-defeats-claims-involving-use-of-website-pixel/) (14 April 2025)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Ubisoft's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Calhoun v. Google](/enforcement/calhoun-v-google) · [Smith v. Rack Room Shoes](/enforcement/smith-v-rack-room-shoes) · [Notice, consent scope and assent](/enforcement/issues/notice-consent-scope-and-assent) · [VPPA](/enforcement/laws/vppa)