Limas v. Wayfair: six social pixels that fire before any banner or notice

Load your site in a clean browser and note the first third-party request and the moment your banner paints. If social pixels go out first, there is no consent defence to argue. In this case that gap, plus pixels that match visitors to their social accounts, kept the wiretap claim alive.

US District Court, Central District of California · CIPA §631 and §638.51 · Motion to dismiss granted in part, 13 August 2026

The problem

Joseph Limas alleged that when he shopped on wayfair.com, pixels from TikTok, Meta, Pinterest, Snapchat, X and Reddit identified him and recorded what he viewed. The complaint says this happened "instantaneously upon connecting to Defendant’s website, before any privacy policy or cookie banner is presented to the user" (FAC ¶ 70). These are allegations. Wayfair has answered and the case continues.

Case record

Court: US District Court, Central District of California (Chief Judge Dolly M. Gee)
Case number: 2:25-cv-11185-DMG (Ex); removed from Los Angeles Superior Court No. 25STCV30609
Parties: Joseph Limas v. Wayfair LLC
Counsel: Plaintiff: Law Offices of Todd M. Friedman, P.C. Defendant: Duane Morris LLP ([removal notice](https://storage.courtlistener.com/recap/gov.uscourts.cacd.996573/gov.uscourts.cacd.996573.1.0.pdf); [FAC](https://storage.courtlistener.com/recap/gov.uscourts.cacd.996573/gov.uscourts.cacd.996573.22.0.pdf))
Laws: CIPA §631(a); CIPA §638.51 (pen register and trap and trace)
Stage: Motion to dismiss granted in part, denied in part; answer filed 27 August 2026
Amount: None
Source review: 17 October 2026

The problem
Case record
What was alleged
Technical issue
Timeline
Outcome
What it cost
Why it matters
How Inth catches this
Checks for your own systems
Sources and limits

What was alleged

What was alleged
Claim	What the law requires	Facts alleged	Result
CIPA §631(a), clause two via clause four	Third party reads contents in transit without all parties' consent; site knowingly aids it	Pixels matched visitors to social accounts and recorded pages, products and ad clicks, before any banner (FAC ¶¶ 35–171)	Survived ([order](https://storage.courtlistener.com/recap/gov.uscourts.cacd.996573/gov.uscourts.cacd.996573.31.0.pdf), pp. 3–8)
CIPA §638.51, pen register	Records outgoing dialling, routing or addressing data	The pixels are pen registers	Dismissed without leave; plaintiff did not defend it (p. 9)
CIPA §638.51, trap and trace	Captures incoming impulses "reasonably likely to identify the source"	Pixels identify the visitor sending requests to the site	Survived (pp. 9–12)

Technical issue

Tools or vendors: TikTok Pixel and Reddit Pixel with "Advanced Matching" and "Auto Advanced Matching" enabled (FAC ¶¶ 43, 159); Meta Pixel; Pinterest Tag (enhanced match); Snap Pixel; X Pixel (order, pp. 1–2).
Where: wayfair.com pages for furniture, decor, lighting and appliances.
What data: IP address, device model, operating system, unique browser ID, pages visited, products viewed or bought and ads clicked. Most tools also linked the visit to the visitor’s social media account (pp. 2, 11 n.9).
When: on page load, before any notice. The order states the FAC is "devoid of any allegations of a banner" (p. 7). Wayfair’s argument that its privacy policy was conspicuous was not considered, because the policy was not in the complaint or authenticated (p. 7 n.6).
Server-side: the order does not mention server-side events or the Meta Conversions API.
How it came to light: the complaint reproduces the site’s pixel code and network captures, including the TikTok Pixel ID (FAC ¶¶ 38, 48). It does not say who made them.

Inth’s technical interpretation: pixels pasted into the page head run before any consent tool has rendered, so even a fast banner arrives after the first requests. Advanced Matching makes it worse: the vendor script reads email or phone fields and hashes them into the request, which is part of why the court found the data "reasonably likely to identify" the visitor. The fix is ordering. Nothing marketing-related loads, and no matching fields are read, until the visitor’s choice is known.

Illustrative pattern, not the defendant’s code.

<head>
  <script>
    !function (w, d, t) { /* TikTok Pixel base code */ }(window, document, 'ttq');
    ttq.load('TIKTOK_PIXEL_ID');   // automatic advanced matching on in Events Manager
    ttq.page();
    rdt('init', 'REDDIT_PIXEL_ID'); rdt('track', 'PageVisit');
  </script>
  <!-- cookie banner script loads later, at the end of <body> -->
</head>

Illustrative pattern, not the defendant’s code. Generic consent API, not a c15t call.

<head>
  <script src="/consent.js"></script> <!-- banner and policy load first -->
  <script>
    consent.whenGranted('marketing', () => {
      loadTikTokPixel('TIKTOK_PIXEL_ID'); // matching fields read only after the grant
      ttq.page();
    });
  </script>
</head>

Timeline

Timeline
Date	Event
20 October 2025	Complaint filed in Los Angeles Superior Court ([removal notice](https://storage.courtlistener.com/recap/gov.uscourts.cacd.996573/gov.uscourts.cacd.996573.1.0.pdf))
21 November 2025	Removed to federal court under CAFA
9 February 2026	First amended complaint
23 February 2026	Motion to dismiss, including a First Amendment challenge
13 August 2026	Motion granted in part, denied in part ([order](https://storage.courtlistener.com/recap/gov.uscourts.cacd.996573/gov.uscourts.cacd.996573.31.0.pdf))
27 August 2026	Wayfair answers ([docket](https://www.courtlistener.com/docket/71946350/joseph-limas-v-wayfair-llc/))

Outcome

Chief Judge Gee held that pixels linking a visit to a social media account capture "contents" rather than mere record information. She compared the result to the "compiled highly personalized profiles" in In re Facebook Internet Tracking (p. 4). On consent, "the FAC is devoid of any allegations of a banner or similar website contract that could suggest the Tracking Entities gained Plaintiff’s consent" (p. 7).

She rejected four other defences. Encryption does not stop a duplicate being "in transit". Wayfair is not an exempt communications provider. The rule of lenity and the canon against absurd results did not apply. And Wayfair lacked standing for its First Amendment argument: "Installing software cannot reasonably constitute protected expression under the First Amendment" (p. 14).

The order does not discuss Article III standing; it decides only the motion to dismiss. It binds no other court.

What it cost

What it cost
Item	Record
Damages or settlement	None; case pending
Fees or costs	Not stated in the cited record

Why it matters

Prior consent. The Ninth Circuit’s unpublished Javier v. Assurance IQ memorandum requires consent before the interception (memorandum). A site with no notice at load cannot point to any. Spears v. Campbell’s relied on this order for "in transit" and aiding (Spears order, pp. 21–22).
Standing. Popa and Cook turn on whether the data is sensitive or a promise was broken. Pre-banner cases have neither a banner promise nor, often, sensitive data, so standing remains a live defence even though Wayfair did not press it here. The FAC pleads that Limas is "genuinely interested" in Wayfair’s goods (FAC ¶ 4), language aimed at the tester defence in Rodriguez v. Autotrader.
SB 690. SB 690 (Stats. 2026, ch. 976), signed 30 September 2026 and operative 1 January 2027 (the default effective date for a 2026 statute), makes private §638.51 claims over website and app conduct Attorney General only, retroactively for pending claims in actions filed on or after 1 January 2025 (bill text). This action was filed on 20 October 2025, so on Inth’s reading that reaches the surviving trap-and-trace claim. SB 690 leaves §631, §632 and §632.7 untouched, so the §631 claim is unaffected.
See consent before collection.

How Inth catches this

Code audit: flags a pull request that adds a TikTok, Reddit or Meta pixel to a layout or head template outside the consent check, and traces email or phone fields that flow into a pixel call.
Website audit: records requests to analytics.tiktok.com, facebook.com/tr or alb.reddit.com before the visitor chose, with page, time, region and consent state.
Consent banner: holds ad pixels until the visitor grants marketing where the policy is opt-in. Inth’s default California policy is opt-out, which lets tags run before a choice. If CIPA pre-consent claims are a concern for you, configure a California opt-in policy so the pixels wait.
Evidence: a dated observation of what loaded before any choice, and a consent record for each visitor who later chose.

A browser observation shows what the pixel sent; it cannot show how TikTok or Meta matched it to an account afterwards.

Checks for your own systems

In the repository

Search templates for ttq.load, fbq('init', pintrk('load', snaptr('init', twq('config' and rdt('init'; each should sit behind the consent check.
Check vendor dashboards for automatic advanced matching and enhanced match settings.

In the browser and network

Clear storage, load a product page in a California geo, and compare the time of the first third-party request with the time the banner appears.
Type an email into a form field and check whether any pixel request carries a hashed email.

With the people responsible

Ask who can add pixels outside code review (tag manager, ad platform plug-ins).
Confirm which privacy notice a visitor sees before the first page finishes loading.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Wayfair LLC’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.