Run a free scan

Rios v. HRB Digital: a mass-arbitration clause can fail and leave pixel claims in open court

Many companies expect their arbitration clause to keep tracking claims out of court. In Rios, H&R Block’s clickwrap was clear and the arbitration clause "well flagged", but its mass-arbitration protocol was held unconscionable, so a class action over tax-return data shared with Meta and Google stays in federal court unless the Ninth Circuit reverses.

US District Court, Northern District of California · ECPA and CIPA claims; Federal Arbitration Act · Arbitration refused 27 October 2025; appeal pending

The problem

The plaintiffs alleged that pixels in H&R Block’s online tax software sent Meta and Google details from people’s returns: names and identifiers, health savings account contributions, scholarships, tuition, dependants, income categories and tax credits (Dkt. 47, pp. 1–2). H&R Block did not answer that on the merits. It asked the court to send each claim to individual arbitration under its Online Services Agreement.

Case record

Court
N.D. Cal. (Judge Edward M. Chen); Ninth Circuit on appeal
Case number
3:25-cv-03530-EMC; 9th Cir. No. 25-7199
Parties
Pedro Rios, Jr. and Christian Marquez v. HRB Digital LLC and HRB Tax Group, Inc.
Counsel
Not stated in the cited record
Laws
ECPA, CIPA, UCL, CLRA; Federal Arbitration Act
Stage
Motion to compel arbitration denied; interlocutory appeal pending
Amount
None
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
ECPA and CIPANo interception or disclosure of communication contents without consentMeta Pixel and Google code, on default settings, sent page titles reflecting what taxpayers filed ([Dkt. 47, p. 2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf))Not yet decided
UCL and CLRAUnfair or unlawful practice; consumer lossTax data monetised for advertisingNot yet decided
Arbitration (HRB's motion)An arbitration agreement is enforceable unless, for example, unconscionable under state law21-page agreement with a staged bellwether protocol for 25 or more similar claimsDenied: procedurally and substantively unconscionable; not severable

Technical issue

  • Tools or vendors: the Meta Pixel and Google analytics code (Dkt. 47, p. 2).
  • Where: the logged-in tax preparation flow.
  • What data: page titles and other fields that described entries on the return, according to the complaint.
  • When: while users prepared returns; the plaintiffs accepted the agreement in January 2024.
  • How it came to light: not stated in the order. Public reporting in 2022 on tax-filing sites and Meta is cited in plaintiff-side materials but not in this record.

The clickwrap and the clause

Returning users saw "We’ve updated our terms & policies" and could not click Next without ticking "I agree to the terms and conditions of the . . . Online Services Agreement, which includes the requirement that any dispute be resolved through binding arbitration" (Dkt. 47, p. 2). The plaintiffs did not dispute that they agreed. The fight was over Section 11.6: once 25 or more claimants with the same or coordinated counsel raised similar claims, 20 test cases (10 per side) went first, nothing else could be filed with the AAA, the next round waited for every case in the last one, and later rounds were capped at 50 (pp. 3–4). Plaintiffs' counsel had served notices for 2,481 claimants (p. 5).

Inth’s technical interpretation: the pixel half of this case is a familiar pattern. GA4 sends the page title in the dt parameter of every collect request, and the Meta Pixel sends the page URL, so a page titled after a tax form or credit discloses that the user has it. The legal half is new: the contract a team relies on to contain tracking claims can itself be the weak point.

Illustrative pattern, not the defendant’s code.

<!-- Bad: default GA4 config on authenticated return pages sends the title -->
<title>Education credits: Form 1098-T | Your 2023 return</title>
<script>gtag('config', 'G-XXXX');</script>
<!-- Fixed: no third-party tags on return pages; neutral titles everywhere -->
<title>Your return</title>
<script>
  if (!location.pathname.startsWith('/return/')) gtag('config', 'G-XXXX', { page_title: 'App' });
</script>

Timeline

Timeline
DateEvent
January 2024Plaintiffs accept the Online Services Agreement ([Dkt. 47, p. 2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf))
5 December 2024HRB agrees to accept service of 2,481 notices, reserving all rights ([p. 6](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf))
22 April 2025Complaint filed ([p. 6](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf))
27 October 2025Motion to compel arbitration denied ([Dkt. 47](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf))
13 November 2025HRB appeals (reported by [Thomson Reuters](https://tax.thomsonreuters.com/news/hr-block-appeals-ruling-in-tax-data-privacy-class-action/))
20 July 2026HRB's opening brief (reported by [Thomson Reuters](https://tax.thomsonreuters.com/news/hr-block-appeals-ruling-in-tax-data-privacy-class-action/))
27 July 2026Business groups file amicus brief for HRB ([DktEntry 18](https://www.uschamber.com/assets/documents/U.S.-Chamber-Coalition-Amicus-Brief-Rios-v.-HRB-Digital-LLC-9th-Cir.pdf))

Outcome

Judge Chen found procedural unconscionability despite a 30-day opt-out: consumers "would not reasonably anticipate HRB’s complex bellwether and batching scheme", and the agreement’s 120-day aim "instills a false sense of efficiency" (Dkt. 47, pp. 10–11). Substantively, the staged rounds meant "the slowest case in a given round sets the pace for all others"; even at 120 days per round, 2,000 notices could take 13 years (p. 16). Tolling terms added forfeiture risk. Because the defects were structural, the court refused to sever them and held the whole arbitration agreement unenforceable (p. 22).

Appeal status as of 17 October 2026. H&R Block argues the conspicuous opt-out defeats procedural unconscionability under Mohamed v. Uber, that bellwethers mirror multidistrict litigation, and that the Federal Arbitration Act pre-empts the ruling; it says nearly 40% of the notices came from people who did not use its online service (reported by Thomson Reuters). We found no argument date or decision. The merits of the tracking claims have not been ruled on.

What it cost

What it cost
ItemRecord
Damages, fund or penaltyNone to date
Arbitration feesNot stated in the cited record
Defence costsNot stated in the cited record

Why it matters

  • Mass-arbitration design is now litigated in privacy cases. Judge Chen relied on Pandolfi, a bellwether ruling the Ninth Circuit affirmed in an unpublished memorandum in August 2025 (Dkt. 47, p. 17). Other courts have treated H&R Block’s agreement differently: Hunt v. Meta compelled arbitration under it, and Pabon v. HRB Digital found the opt-out undercut procedural unconscionability (as cited by H&R Block, reported by Thomson Reuters). The Ninth Circuit’s ruling will settle the split for this circuit.
  • Tax data is treated as sensitive. Compare the settled TaxAct case. See Sensitive context in event data.
  • Contrast with clickwrap wins. Assent was not the problem here, unlike consent fights in Lakes v. Ubisoft.

How Inth catches this

  • Code audit: flags a pull request that loads the Meta Pixel or GA4 on authenticated return routes, and traces a tax-form name from the page template into the title sent to the vendor.
  • Website audit: records each request to facebook.com/tr and google-analytics.com with the page, time, region and consent state.
  • Consent banner: holds the pixel and analytics until the visitor opts in where the policy is opt-in. Inth’s default California policy is opt-out, so tags run until the visitor opts out; configure a California opt-in policy if needed. Keeping tags off return pages is a separate code decision.
  • Evidence: finding history and runtime observations show when a tag reached a sensitive page and who approved it.

Inth has no capability relevant to arbitration clause design; that is for counsel.

Checks for your own systems

In the repository

  • List routes under the authenticated product that load any third-party tag.
  • Check page titles and URL paths for form names, diagnoses, amounts or account types.

In the browser and network

  • Log in with a test account, open a sensitive form and filter for collect? and facebook.com/tr; read dt and dl.

With the people responsible

  • Ask counsel whether the arbitration terms include a batching or bellwether protocol, and how a ruling like this would affect them.
  • Confirm which vendor contracts allow the vendor to use data for its own advertising.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit H&R Block’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.