Rejecting cookies on a meal-kit site was enough for an expectation of privacy. It was not enough for Article III standing when the data was grocery-style purchases from a single visit.
Eden McKie, a resident of Fremont, California, alleged that on or around 11 June 2025 she visited huel.com, Huel Ltd.'s online food and grocery retail site. A cookie banner offered Accept, Required cookies only, and Cookie Settings. She expressly rejected tracking. She then browsed and bought four hot and savory meal packs and seven hot and savory meal cups, and at checkout entered her email, phone, name and address. She alleged that Meta, TikTok and Snap pixels still tracked pages viewed, products purchased and checkout contact data, irrespective of whether a visitor accepted or rejected cookies, and sued on behalf of a putative class under the ECPA, CIPA §§ 631 and 632, CDAFA and the California Constitution (Order, Filing 28).
| Issue | Holding |
|---|---|
| Expectation of privacy | Plausible. Post-CCPA, the opt-out banner was an affirmative representation; following Ortiz I and Wiley, California users can expect customized privacy when a site offers cookie settings |
| Highly offensive — misrepresentation | Not enough on its own after Popa. Deceit is a plus factor, not a per se rule that turns routine collection into a concrete privacy harm |
| Highly offensive — sensitivity | Grocery-style meal purchases and contact data are not sensitive. Analogy to Popa (pet-store browsing) and Rusow (groceries, not health) |
| Highly offensive — breadth | Tracking limited to one visit on one site. Not cradle-to-grave profiling across the web as in In re Facebook |
| CDAFA standing | Fails separately: statutory standing needs economic loss, which online tracking of this kind does not show |
| All five claims (ECPA; CIPA §§ 631 and 632; CDAFA; Cal. Const.) | Dismissed for lack of Article III standing; leave to amend within 30 days. Failure to state a claim not reached |
The court stressed that McKie's first amended complaint often described generic third-party tools and a hypothetical consumer rather than particularized facts about her single visit (Order, Filing 28).
Inth's technical interpretation: a reject that leaves marketing pixels firing is a failed opt-out. Wire the decline path to a denied consent state that tag loaders read before every send, and keep checkout and purchase events out of ad pixels when marketing is denied. Standing turned on sensitivity and breadth here; the same broken decline can still support claims when the page context is health, finance or continuous cross-site tracking.
// Reject closes the banner but pixels keep firing purchase and checkout events
declineButton.onclick = () => banner.hide();
fbq('track', 'Purchase', { contents: cartItems, email, phone });
// Decline denies marketing; checkout and product events stay gated
declineButton.onclick = () => {
consent.deny(['analytics', 'marketing']);
banner.hide();
};
if (consent.has('marketing')) {
fbq('track', 'Purchase', { value: total, currency: 'USD' });
}
| Date | Event |
|---|---|
| On or around 11 June 2025 | McKie visits huel.com, rejects tracking, purchases meal products and enters checkout contact data (alleged) |
| Not stated in the order | Complaint and first amended complaint (FAC, Dkt. 17) filed |
| Not stated in the order | Huel moves to dismiss (Dkt. 22); opposition (Dkt. 23); reply (Dkt. 24) |
| 26 October 2026 | Order granting motion to dismiss all claims for lack of Article III standing, with leave to amend within 30 days (Filing 28) |
| About 25 November 2026 | Deadline to amend (30 days after the order) |
Huel's motion was granted. All five claims were dismissed for lack of Article III standing, with leave to amend within 30 days of the 26 October 2026 order if McKie can do so in good faith (Order, Filing 28). The court did not decide whether the complaint stated a claim. No liability has been found and no money has changed hands.
| Item | Amount | Source |
|---|---|---|
| Damages or settlement | None | Order, Filing 28 |
| Defense costs | Not stated in the cited record |
Related pages: Article III standing, CIPA § 631, Failed opt-out controls, Undisclosed data exchanges.
Records Accept, Required only and category declines as consent states that tags read before loading or sending, and stops tags already on the page after a reject.
Declines on each site in a clean profile and flags any Meta, TikTok, Snap or other third-party tracking request or cookie set afterwards, including on product and checkout pages.
Consent records with choice, country and policy version, and post-decline network observations per page.
Start a free scanYour ticks stay on this page. Inth does not save or send them.
The order was opened. The complaint, the first amended complaint, the motion to dismiss and the opposition and reply briefs were not opened; case facts come from the order's account of the FAC. Whether an amended complaint has been filed was not checked.
Source review: 29 October 2026. This page describes the cited record and procedural stage. It does not audit Huel's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.