Shah v. MyFitnessPal: after an opt-out, a fitness site’s search terms and sign-up answers must stay with the site

On a health or fitness site, check what a search box and a sign-up form send to third parties after the visitor opts out. In this case a search for "obesity" allegedly reached Comscore, and a "lose weight" goal entered during sign-up kept one plaintiff’s wiretap claim alive.

US District Court, Northern District of California · Privacy, intrusion, fraud, CIPA §631 and §638.51 · Orders of 27 January and 28 September 2026

The problem

MyFitnessPal told visitors it used Required, Functional and Advertising cookies, and that they could opt out of the last two through a pop-up banner. Two Californians alleged they opted out and that the site still "caused the Third-Party tracking cookies, including Functional and Advertising cookies, to be placed on Website users' browsers" and data sent to Facebook, Google, TikTok, Amazon and The Trade Desk (order of 27 January 2026, p. 2). These are allegations. MyFitnessPal has not been found liable.

Case record

Court: US District Court, Northern District of California (Judge P. Casey Pitts)
Case number: 5:25-cv-04430-PCP
Parties: Vishal Shah and Christine Wiley v. MyFitnessPal, Inc.
Counsel: Plaintiffs: Gutride Safier LLP. Defendant: Baker & Hostetler LLP ([docket](https://www.courtlistener.com/docket/70354957/shah-v-myfitnesspal-inc/))
Laws: CIPA §631 and §638.51; constitutional privacy; intrusion; fraud; unjust enrichment
Stage: Two motions to dismiss decided; case proceeds
Amount: None
Source review: 17 October 2026

The problem
Case record
What was alleged
Technical issue
Timeline
Outcome
What it cost
Why it matters
How Inth catches this
Checks for your own systems
Sources and limits

What was alleged

What was alleged
Claim	What the law requires	Facts alleged	Result
Invasion of privacy and intrusion	Reasonable expectation of privacy; highly offensive intrusion	Opt-out offered, then ignored, on a nutrition and fitness site	Survived (January 2026)
CIPA §631	A third party reads the contents of a communication in transit; site aids it	Wiley entered her name, gender and the goal "lose weight" during sign-up; activity shared with third parties (Am. Compl. ¶ 126)	Dismissed with leave in January; survived for Wiley, dismissed for Shah in September
CIPA §638.51	Device or process recording routing or signalling data	Third parties collected "TCP and/or UDP port numbers" and HTTP header metadata (Am. Compl. ¶¶ 98–101)	Same split as §631
Fraud	Misrepresentation pleaded with "who, what, when"	Visits in January and February 2023 relying on the opt-out	Dismissed in January for vagueness; survived in September
Unjust enrichment	Benefit retained without legal basis	Data value captured despite opt-out	Survived
Trespass to chattels	Measurable harm to the device	Cookies took storage	Dismissed; not re-pleaded

Technical issue

Tools or vendors: Facebook, Google, TikTok, Amazon and The Trade Desk (ECF No. 44, p. 2); Comscore received a search query (ECF No. 61, p. 2).
Where: the MyFitnessPal website, its site search, its blog and the start of its app sign-up flow.
What the banner said: the order paraphrases it. MyFitnessPal’s privacy policy said users "can block and control cookies", and the banner let them opt out of Functional and Advertising cookies (ECF No. 44, p. 2).
What kept firing: after opt-out, third-party cookies "including Functional and Advertising cookies" were allegedly still placed, and data sent. A search query containing "obesity" was allegedly sent to Comscore (Am. Compl. ¶ 51, quoted in order of 28 September 2026, p. 2).
Server-side: neither order mentions a server-side relay or the Meta Conversions API.
How it came to light: the complaint included undated screenshots; the court refused to strike them, noting they "could later be verified" against the plaintiffs' visits (ECF No. 44, p. 17).

Inth’s technical interpretation: site search usually puts the query in the URL (/search?q=obesity). Every analytics or ad tag that reports the page URL then carries the search term. Sign-up flows often fire "lead" or "registration" events with form values attached. On a fitness site those values describe a person’s health goals. After an opt-out, both the browser tags and any server-side forwarding of the same events have to stop.

Illustrative pattern, not the defendant’s code.

// Bad: the server forwards sign-up events whatever the visitor chose
app.post('/signup/step', async (req, res) => {
  await saveStep(req.body);
  await metaCapi.send({ event_name: 'Lead',
    event_source_url: req.headers.referer,          // carries ?q=obesity
    custom_data: { goal: req.body.goal },           // "lose weight"
    user_data: { client_ip_address: req.ip, fbp: req.cookies._fbp } });
  res.sendStatus(204);
});

Illustrative pattern, not the defendant’s code. Generic consent lookup, not a c15t API.

// Fixed: check the stored choice, and never send health goals or search terms
app.post('/signup/step', async (req, res) => {
  await saveStep(req.body);
  const choice = await consentRecords.latest(req.cookies.visitor_id);
  if (choice?.granted('marketing')) {
    await metaCapi.send({ event_name: 'Lead',
      event_source_url: stripQuery(req.headers.referer),
      user_data: { client_ip_address: req.ip } }); // no goal, no search term
  }
  res.sendStatus(204);
});

Timeline

Timeline
Date	Event
January and February 2023	Wiley and Shah visit the site and opt out (Am. Compl. ¶¶ 108, 120)
23 May 2025	Complaint filed ([docket](https://www.courtlistener.com/docket/70354957/shah-v-myfitnesspal-inc/))
27 January 2026	Motion to dismiss granted in part; motion to strike denied (ECF No. 44)
28 September 2026	Motion to dismiss amended complaint granted only for Shah's CIPA claims (ECF No. 61)

Outcome

Standing. Judge Pitts compared the injury to the common-law tort of public disclosure of private facts, which covers misrepresenting how private information will be used. He held that "because a misrepresentation about how information would be used and the non-consensual sharing of personal information could give rise to injuries that were actionable invasions of privacy at common law, plaintiffs have sufficiently pleaded an injury-in-fact" (ECF No. 44, pp. 4–5). He distinguished Popa: pet-store preferences are not sensitive, but nutrition and fitness interactions plausibly are.

Expectations. The court used the CCPA to read what visitors expect: "Today, when California users visit a website, they can expect to see a popup screen giving them the option to opt out of various types of tracking" (p. 8). Deceit was a "plus" factor for offensiveness: MyFitnessPal "not only misled users into thinking that their opt outs would be effective but led them to engage in tracked conduct they otherwise would not have undertaken" (p. 9).

Contents. In September the court split the plaintiffs. Shah’s visit to the "Recipes" page was browsing a public site, so only record information. Wiley "communicated with MFP’s website by directly informing the website of her preferences and personal information", so her CIPA claims proceed (ECF No. 61, p. 7). Fraudulent-concealment tolling kept 2023 visits in time at this stage (pp. 4–5).

These are district court rulings at the pleading stage; the January order is reported at 824 F. Supp. 3d 906. They bind no other court and find no facts.

What it cost

What it cost
Item	Record
Damages or settlement	None; case pending
Fees or costs	Not stated in the cited record

Why it matters

Other courts already rely on it. Spears v. Campbell’s and Shah v. Politico both rely on it for standing after Popa. Cook v. GameStop left the same opening: GameStop "made no promise to refrain from collecting information" (opinion).
Sensitive context matters twice. It helped standing and it turned sign-up answers into "contents" under §631. See sensitive context in event data.
Opposite result elsewhere. Lutge v. Timex.com (N.D. Cal. 14 September 2026) found no standing for a watch retailer despite ignored opt-outs, as described in the Politico order of 25 September 2026.
SB 690. Stats. 2026, ch. 976, signed 30 September 2026 and operative 1 January 2027 (the default effective date for a 2026 statute), makes private §638.51 claims over website and app conduct Attorney General only, retroactive to pending claims in actions filed on or after 1 January 2025. It leaves §631, §632 and §632.7 untouched, so Wiley’s §631 claim is not affected (bill text). This case was filed in May 2025, so on Inth’s reading SB 690 would end Wiley’s private §638.51 claim from 1 January 2027; the court has not addressed it.

How Inth catches this

Code audit: traces the search term and sign-up goal from the form into analytics, pixel and server-side event payloads, and flags event code that sends without checking consent.
Website audit: records requests to Comscore, Facebook or TikTok carrying search terms after the visitor opted out, with page, time, region and consent state.
Consent banner: after an opt-out, the Consent banner sends the revocation to each integration and stops loading tags that have not loaded yet. Some helpers stay loaded and receive the revocation instead: the Meta Pixel helper gets fbq('consent', 'revoke'), and Google tags keep running under Consent Mode v2 with consent denied. Under an opt-in policy, tags wait until the visitor chooses. Inth’s default California policy is opt-out, so tags run before a choice unless you configure a California opt-in policy.
Evidence: the consent record (choice, country, policy) that a server-side sender can check, plus the Code audit finding history.

A browser observation cannot show server-side relays; only the event code and server logs can show whether a Conversions API call respected the opt-out.

Checks for your own systems

In the repository

Find where search queries enter URLs, titles or event parameters; strip them before any third-party call.
List every event fired from the sign-up flow and the fields each one carries.
Check server-side senders (Conversions API, TikTok Events API, Segment) read the visitor’s consent before sending.

In the browser and network

Opt out, run a site search for a health term, and filter requests for that term.
Start the sign-up flow after opting out and inspect every third-party request for form values.

With the people responsible

Ask whether the site is treated as handling health-related data, and whether marketing tags belong on sign-up pages at all.
Confirm who maintains the server-side event integrations and their consent logic.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit MyFitnessPal, Inc.'s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.