[Enforcement library](/enforcement)

# McKie v. Huel: opt-out banner creates privacy expectation, but grocery tracking is not highly offensive

A California visitor to huel.com alleged she rejected tracking on the cookie banner, then Meta, TikTok and Snap pixels still tracked pages viewed, meal purchases and checkout contact data. Judge Breyer found a plausible expectation of privacy from the opt-out banner but held the intrusion was not highly offensive: grocery-style data is not sensitive and tracking was limited to one visit on one site. All claims dismissed for lack of Article III standing, with leave to amend within 30 days. CDAFA also failed statutory economic-loss standing.

## Key facts

- **Regulator or court:** US District Court, Northern District of California
- **Jurisdiction:** California, US
- **Framework:** ECPA; CIPA §§ 631 and 632; CDAFA; California Constitution
- **Record date:** 2026-10-26
- **Procedural status:** Motion to dismiss granted 26 October 2026 for lack of Article III standing; leave to amend within 30 days

Rejecting cookies on a meal-kit site was enough for an expectation of privacy. It was not enough for Article III standing when the data was grocery-style purchases from a single visit.

[Start a free scan](/run-free-codebase-scan)

- **Court**: US District Court, N.D. California (Judge Charles R. Breyer)
- **Case number**: 26-cv-00653-CRB (Justia: 3:2026cv00653)
- **Parties**: Eden McKie v. Huel Ltd.
- **Laws**: ECPA; CIPA §§ 631 and 632; CDAFA; California Constitution
- **Stage**: Motion to dismiss granted 26 October 2026 (Filing 28) for lack of Article III standing; leave to amend within 30 days (\~25 November 2026). Court did not reach failure to state a claim
- **Amount**: None
- **Source review**: 29 October 2026

## The problem

Eden McKie, a resident of Fremont, California, alleged that on or around 11 June 2025 she visited huel.com, Huel Ltd.'s online food and grocery retail site. A cookie banner offered Accept, Required cookies only, and Cookie Settings. She expressly rejected tracking. She then browsed and bought four hot and savory meal packs and seven hot and savory meal cups, and at checkout entered her email, phone, name and address. She alleged that Meta, TikTok and Snap pixels still tracked pages viewed, products purchased and checkout contact data, irrespective of whether a visitor accepted or rejected cookies, and sued on behalf of a putative class under the ECPA, CIPA §§ 631 and 632, CDAFA and the California Constitution ([Order, Filing 28](https://docs.justia.com/cases/federal/district-courts/california/candce/3:2026cv00653/462988/28)).

## What the court found

| Issue | Holding |
| --- | --- |
| Expectation of privacy | Plausible. Post-CCPA, the opt-out banner was an affirmative representation; following Ortiz I and Wiley, California users can expect customized privacy when a site offers cookie settings |
| Highly offensive — misrepresentation | Not enough on its own after Popa. Deceit is a plus factor, not a per se rule that turns routine collection into a concrete privacy harm |
| Highly offensive — sensitivity | Grocery-style meal purchases and contact data are not sensitive. Analogy to Popa (pet-store browsing) and Rusow (groceries, not health) |
| Highly offensive — breadth | Tracking limited to one visit on one site. Not cradle-to-grave profiling across the web as in In re Facebook |
| CDAFA standing | Fails separately: statutory standing needs economic loss, which online tracking of this kind does not show |
| All five claims (ECPA; CIPA §§ 631 and 632; CDAFA; Cal. Const.) | Dismissed for lack of Article III standing; leave to amend within 30 days. Failure to state a claim not reached |

The court stressed that McKie's first amended complaint often described generic third-party tools and a hypothetical consumer rather than particularized facts about her single visit ([Order, Filing 28](https://docs.justia.com/cases/federal/district-courts/california/candce/3:2026cv00653/462988/28)).

## Technical issue

- **Data (alleged):** pages viewed, products purchased (meal packs and meal cups), and checkout contact data (email, phone, name, address); IP and device identifiers also discussed.
- **Recipients (alleged):** Meta, TikTok and Snap via embedded pixels, for targeted advertising.
- **Consent state:** collection allegedly continued after an express rejection on a banner with Accept, Required cookies only and Cookie Settings.

**Inth's technical interpretation:** a reject that leaves marketing pixels firing is a failed opt-out. Wire the decline path to a denied consent state that tag loaders read before every send, and keep checkout and purchase events out of ad pixels when marketing is denied. Standing turned on sensitivity and breadth here; the same broken decline can still support claims when the page context is health, finance or continuous cross-site tracking.

Sample:

```ts
// Reject closes the banner but pixels keep firing purchase and checkout events
declineButton.onclick = () => banner.hide();
fbq('track', 'Purchase', { contents: cartItems, email, phone });

// Decline denies marketing; checkout and product events stay gated
declineButton.onclick = () => {
  consent.deny(['analytics', 'marketing']);
  banner.hide();
};
if (consent.has('marketing')) {
  fbq('track', 'Purchase', { value: total, currency: 'USD' });
}
```

## Timeline

| Date | Event |
| --- | --- |
| On or around 11 June 2025 | McKie visits huel.com, rejects tracking, purchases meal products and enters checkout contact data (alleged) |
| Not stated in the order | Complaint and first amended complaint (FAC, Dkt. 17) filed |
| Not stated in the order | Huel moves to dismiss (Dkt. 22); opposition (Dkt. 23); reply (Dkt. 24) |
| 26 October 2026 | Order granting motion to dismiss all claims for lack of Article III standing, with leave to amend within 30 days (Filing 28) |
| About 25 November 2026 | Deadline to amend (30 days after the order) |

## Outcome

Huel's motion was granted. All five claims were dismissed for lack of Article III standing, with leave to amend within 30 days of the 26 October 2026 order if McKie can do so in good faith ([Order, Filing 28](https://docs.justia.com/cases/federal/district-courts/california/candce/3:2026cv00653/462988/28)). The court did not decide whether the complaint stated a claim. No liability has been found and no money has changed hands.

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Damages or settlement | None | [Order, Filing 28](https://docs.justia.com/cases/federal/district-courts/california/candce/3:2026cv00653/462988/28) |
| Defense costs | Not stated in the cited record |  |

## Why it matters

- **Opt-out banners still matter for expectation of privacy.** Following the CCPA line in Wiley and Ortiz I, offering Accept / Required only / Cookie Settings can create a privacy expectation even on an ordinary retail site.
- **Popa cabins standing after a broken decline.** Misrepresentation alone is a plus factor; grocery-style purchases and a single-site, single-visit pixel path were not "highly offensive".
- **Context still decides the risk.** Health, finance or cradle-to-grave tracking remain the harder facts. Compare [Popa v. Microsoft](/enforcement/popa-v-microsoft) and [Wiley v. Universal Music](/enforcement/wiley-v-universal-music).

Related pages: [Article III standing](/enforcement/laws/article-iii-standing), [CIPA § 631](/enforcement/laws/cipa-631-wiretapping), [Failed opt-out controls](/enforcement/issues/failed-opt-out-controls), [Undisclosed data exchanges](/enforcement/issues/undisclosed-data-exchanges).

## How Inth catches this

- **Consent banner**: Records Accept, Required only and category declines as consent states that tags read before loading or sending, and stops tags already on the page after a reject.
- **Website audit**: Declines on each site in a clean profile and flags any Meta, TikTok, Snap or other third-party tracking request or cookie set afterwards, including on product and checkout pages.

### Out of reach

- Inth sees what leaves the browser. It cannot decide whether the data was sensitive enough for Article III standing, which is what this order turned on.

Consent records with choice, country and policy version, and post-decline network observations per page.

[Start a free scan](/run-free-codebase-scan)

## Checks for your own systems

Your ticks stay on this page. Inth does not save or send them.

### In the repository

- [ ] Read the Required cookies only and Cookie Settings handlers: do they write a denied marketing state, or only hide the banner?
- [ ] List every purchase, AddToCart and checkout event parameter sent to Meta, TikTok, Snap or similar pixels.

### In the browser and network

- [ ] Reject tracking, browse product pages and complete a test checkout; record every third-party request.
- [ ] Confirm contact fields and product identifiers are not sent after a reject.

### With the people responsible

- [ ] Compare banner and privacy-policy copy about what a reject does with what the network shows.
- [ ] Decide which retail pages, if any, still need advertising pixels after marketing is denied.

## Sources and limits

- [Order granting motion to dismiss, Filing 28](https://docs.justia.com/cases/federal/district-courts/california/candce/3:2026cv00653/462988/28), filed 26 October 2026
- [Leagle copy of the order](https://www.leagle.com/decision/infdco20261027h18)
- [National Law Review, "No Harm, No Foul"](https://natlawreview.com/article/no-harm-no-foul-another-cipa-tracking-suit-dismissed), 28 October 2026

The order was opened. The complaint, the first amended complaint, the motion to dismiss and the opposition and reply briefs were not opened; case facts come from the order's account of the FAC. Whether an amended complaint has been filed was not checked.

Source review: 29 October 2026. This page describes the cited record and procedural stage. It does not audit Huel's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

## Related cases

[Every case in the Enforcement library](/enforcement)