[Enforcement library](/enforcement)

# Rios v. HRB Digital: a mass-arbitration clause can fail and leave pixel claims in open court

Many companies expect their arbitration clause to keep tracking claims out of court. In Rios, H&R Block's clickwrap was clear and the arbitration clause "well flagged", but its mass-arbitration protocol was held unconscionable, so a class action over tax-return data shared with Meta and Google stays in federal court unless the Ninth Circuit reverses.

US District Court, Northern District of California · ECPA and CIPA claims; Federal Arbitration Act · Arbitration refused 27 October 2025; appeal pending

## The problem

The plaintiffs alleged that pixels in H&R Block's online tax software sent Meta and Google details from people's returns: names and identifiers, health savings account contributions, scholarships, tuition, dependants, income categories and tax credits ([Dkt. 47, pp. 1–2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)). H&R Block did not answer that on the merits. It asked the court to send each claim to individual arbitration under its Online Services Agreement.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | N.D. Cal. (Judge Edward M. Chen); Ninth Circuit on appeal |
| Case number | 3:25-cv-03530-EMC; 9th Cir. No. 25-7199 |
| Parties | Pedro Rios, Jr. and Christian Marquez v. HRB Digital LLC and HRB Tax Group, Inc. |
| Counsel | Not stated in the cited record |
| Laws | ECPA, CIPA, UCL, CLRA; Federal Arbitration Act |
| Stage | Motion to compel arbitration denied; interlocutory appeal pending |
| Amount | None |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| ECPA and CIPA | No interception or disclosure of communication contents without consent | Meta Pixel and Google code, on default settings, sent page titles reflecting what taxpayers filed (\[Dkt. 47, p. 2\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_25-cv-03530/pdf/USCOURTS-cand-3\_25-cv-03530-0.pdf)) | Not yet decided |
| UCL and CLRA | Unfair or unlawful practice; consumer loss | Tax data monetised for advertising | Not yet decided |
| Arbitration (HRB's motion) | An arbitration agreement is enforceable unless, for example, unconscionable under state law | 21-page agreement with a staged bellwether protocol for 25 or more similar claims | Denied: procedurally and substantively unconscionable; not severable |

## Technical issue

- **Tools or vendors:** the Meta Pixel and Google analytics code ([Dkt. 47, p. 2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)).
- **Where:** the logged-in tax preparation flow.
- **What data:** page titles and other fields that described entries on the return, according to the complaint.
- **When:** while users prepared returns; the plaintiffs accepted the agreement in January 2024.
- **How it came to light:** not stated in the order. Public reporting in 2022 on tax-filing sites and Meta is cited in [plaintiff-side materials](https://lantern.labaton.com/Case/HR-Block) but not in this record.

### The clickwrap and the clause

Returning users saw "We've updated our terms & policies" and could not click Next without ticking "I agree to the terms and conditions of the . . . Online Services Agreement, which includes the requirement that any dispute be resolved through binding arbitration" ([Dkt. 47, p. 2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)). The plaintiffs did not dispute that they agreed. The fight was over Section 11.6: once 25 or more claimants with the same or coordinated counsel raised similar claims, 20 test cases (10 per side) went first, nothing else could be filed with the AAA, the next round waited for every case in the last one, and later rounds were capped at 50 ([pp. 3–4](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)). Plaintiffs' counsel had served notices for 2,481 claimants ([p. 5](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)).

**Inth's technical interpretation:** the pixel half of this case is a familiar pattern. GA4 sends the page title in the `dt` parameter of every collect request, and the Meta Pixel sends the page URL, so a page titled after a tax form or credit discloses that the user has it. The legal half is new: the contract a team relies on to contain tracking claims can itself be the weak point.

Illustrative pattern, not the defendant's code.

```html
<!-- Bad: default GA4 config on authenticated return pages sends the title -->
<title>Education credits: Form 1098-T | Your 2023 return</title>
<script>gtag('config', 'G-XXXX');</script>
```

```html
<!-- Fixed: no third-party tags on return pages; neutral titles everywhere -->
<title>Your return</title>
<script>
  if (!location.pathname.startsWith('/return/')) gtag('config', 'G-XXXX', { page_title: 'App' });
</script>
```

## Timeline

| Date | Event |
| --- | --- |
| January 2024 | Plaintiffs accept the Online Services Agreement (\[Dkt. 47, p. 2\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_25-cv-03530/pdf/USCOURTS-cand-3\_25-cv-03530-0.pdf)) |
| 5 December 2024 | HRB agrees to accept service of 2,481 notices, reserving all rights (\[p. 6\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_25-cv-03530/pdf/USCOURTS-cand-3\_25-cv-03530-0.pdf)) |
| 22 April 2025 | Complaint filed (\[p. 6\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_25-cv-03530/pdf/USCOURTS-cand-3\_25-cv-03530-0.pdf)) |
| 27 October 2025 | Motion to compel arbitration denied (\[Dkt. 47\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_25-cv-03530/pdf/USCOURTS-cand-3\_25-cv-03530-0.pdf)) |
| 13 November 2025 | HRB appeals (reported by \[Thomson Reuters\](https://tax.thomsonreuters.com/news/hr-block-appeals-ruling-in-tax-data-privacy-class-action/)) |
| 20 July 2026 | HRB's opening brief (reported by \[Thomson Reuters\](https://tax.thomsonreuters.com/news/hr-block-appeals-ruling-in-tax-data-privacy-class-action/)) |
| 27 July 2026 | Business groups file amicus brief for HRB (\[DktEntry 18\](https://www.uschamber.com/assets/documents/U.S.-Chamber-Coalition-Amicus-Brief-Rios-v.-HRB-Digital-LLC-9th-Cir.pdf)) |

## Outcome

Judge Chen found procedural unconscionability despite a 30-day opt-out: consumers "would not reasonably anticipate HRB's complex bellwether and batching scheme", and the agreement's 120-day aim "instills a false sense of efficiency" ([Dkt. 47, pp. 10–11](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)). Substantively, the staged rounds meant "the slowest case in a given round sets the pace for all others"; even at 120 days per round, 2,000 notices could take 13 years ([p. 16](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)). Tolling terms added forfeiture risk. Because the defects were structural, the court refused to sever them and held the whole arbitration agreement unenforceable ([p. 22](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)).

**Appeal status as of 17 October 2026.** H&R Block argues the conspicuous opt-out defeats procedural unconscionability under Mohamed v. Uber, that bellwethers mirror multidistrict litigation, and that the Federal Arbitration Act pre-empts the ruling; it says nearly 40% of the notices came from people who did not use its online service (reported by [Thomson Reuters](https://tax.thomsonreuters.com/news/hr-block-appeals-ruling-in-tax-data-privacy-class-action/)). We found no argument date or decision. The merits of the tracking claims have not been ruled on.

## What it cost

| Item | Record |
| --- | --- |
| Damages, fund or penalty | None to date |
| Arbitration fees | Not stated in the cited record |
| Defence costs | Not stated in the cited record |

## Why it matters

- **Mass-arbitration design is now litigated in privacy cases.** Judge Chen relied on Pandolfi, a bellwether ruling the Ninth Circuit affirmed in an unpublished memorandum in August 2025 ([Dkt. 47, p. 17](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf)). Other courts have treated H&R Block's agreement differently: Hunt v. Meta compelled arbitration under it, and Pabon v. HRB Digital found the opt-out undercut procedural unconscionability (as cited by H&R Block, reported by [Thomson Reuters](https://tax.thomsonreuters.com/news/hr-block-appeals-ruling-in-tax-data-privacy-class-action/)). The Ninth Circuit's ruling will settle the split for this circuit.
- **Tax data is treated as sensitive.** Compare the settled [TaxAct](/enforcement/taxact) case. See [Sensitive context in event data](/enforcement/issues/sensitive-context-in-event-data).
- **Contrast with clickwrap wins.** Assent was not the problem here, unlike consent fights in [Lakes v. Ubisoft](/enforcement/lakes-v-ubisoft).

## How Inth catches this

- **Code audit:** flags a pull request that loads the Meta Pixel or GA4 on authenticated return routes, and traces a tax-form name from the page template into the title sent to the vendor.
- **Website audit:** records each request to facebook.com/tr and google-analytics.com with the page, time, region and consent state.
- **Consent banner:** holds the pixel and analytics until the visitor opts in where the policy is opt-in. Inth's default California policy is opt-out, so tags run until the visitor opts out; configure a California opt-in policy if needed. Keeping tags off return pages is a separate code decision.
- **Evidence:** finding history and runtime observations show when a tag reached a sensitive page and who approved it.

Inth has no capability relevant to arbitration clause design; that is for counsel.

## Checks for your own systems

### In the repository

- List routes under the authenticated product that load any third-party tag.
- Check page titles and URL paths for form names, diagnoses, amounts or account types.

### In the browser and network

- Log in with a test account, open a sensitive form and filter for `collect?` and `facebook.com/tr`; read `dt` and `dl`.

### With the people responsible

- Ask counsel whether the arbitration terms include a batching or bellwether protocol, and how a ruling like this would affect them.
- Confirm which vendor contracts allow the vendor to use data for its own advertising.

## Sources and limits

- [Order denying motion to compel arbitration, Dkt. 47](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_25-cv-03530/pdf/USCOURTS-cand-3_25-cv-03530-0.pdf) (27 October 2025)
- [Amicus brief of the Chamber of Commerce, RLC and NRF, 9th Cir. No. 25-7199](https://www.uschamber.com/assets/documents/U.S.-Chamber-Coalition-Amicus-Brief-Rios-v.-HRB-Digital-LLC-9th-Cir.pdf) (27 July 2026)
- [Thomson Reuters Checkpoint](https://tax.thomsonreuters.com/news/hr-block-appeals-ruling-in-tax-data-privacy-class-action/) (24 July 2026)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit H&R Block's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [TaxAct](/enforcement/taxact) · [Sensitive context in event data](/enforcement/issues/sensitive-context-in-event-data) · [Federal Wiretap Act](/enforcement/laws/federal-wiretap-act)