Shah v. Politico: a cookie toggle has to switch off every vendor behind it

If your banner lets visitors switch off "Performance" and "Advertising" cookies, test what happens after "Confirm my choices". Here readers alleged the toggles changed nothing, and the court held that was enough to plead standing. The case also shows a defence: CIPA’s one-year clock.

US District Court, Northern District of California · Privacy, intrusion, fraud, CIPA · Motions to dismiss granted in part, 6 February and 25 September 2026

The problem

Vishal Shah alleged that in the first half of 2023 politico.com "immediately" showed him a cookie banner saying he could "choose not to allow certain types of cookies". He toggled off "Performance Cookies" and "Online Behavioural Advertising" cookies and clicked "Confirm my Choices". He alleged third-party cookies and user data kept flowing anyway (order of 6 February 2026, p. 2). Two more readers joined in 2026 with the same account. These are allegations, not findings.

Case record

Court: US District Court, Northern District of California (Judge Noël Wise)
Case number: 5:25-cv-05213-NW
Parties: Vishal Shah, Heidi Willis and Stacy Penning v. Politico LLC
Counsel: Plaintiffs: Gutride Safier LLP. Defendant: Fisher & Phillips LLP ([parties](https://www.courtlistener.com/docket/70596318/parties/shah-v-politico-llc/))
Laws: CIPA §631 and §638.51; California constitutional privacy; intrusion; fraud; unjust enrichment; contract and trespass (dropped)
Stage: Second amended complaint filed 16 October 2026
Amount: None
Source review: 17 October 2026

The problem
Case record
What was alleged
Technical issue
Timeline
Outcome
What it cost
Why it matters
How Inth catches this
Checks for your own systems
Sources and limits

What was alleged

What was alleged
Claim	What the law requires	Facts alleged	Result
Invasion of privacy and intrusion	Reasonable expectation of privacy; highly offensive intrusion	Toggles promised opt-out; Google, Adobe and other cookies kept collecting browsing data (Compl. ¶¶ 19, 38–68)	Survived for all three plaintiffs
CIPA §631 and §638.51	Interception or pen-register use, sued within one year	Same conduct in 2023	Shah: time-barred, dismissed with prejudice. Willis and Penning: dismissed with limited leave
Fraud	Misrepresentation, reliance, damage	Shah kept browsing "in reliance on" the toggles (Compl. ¶¶ 79, 82)	Survived
Unjust enrichment	Benefit retained without legal basis	Data passed to 14 named ad-tech companies (FAC ¶ 3)	Dismissed in February; survived in September after the contract theory was dropped
Breach of contract, implied covenant, trespass to chattels	Actual damages; impaired device	Privacy policy promises; cookies use storage	Dismissed with leave in February; not re-pleaded

Technical issue

Tools or vendors: the first complaint names cookies "furnished by Google and Adobe, among others" (ECF No. 74, p. 5). The amended complaint lists Google, Adobe, LiveRamp, Microsoft, The Trade Desk, Comscore, PubMatic, Amazon, X, Yahoo, Criteo, Sonobi, GumGum and OpenX (order of 25 September 2026, p. 12).
Where: politico.com, a political news site.
What the banner said: users could "choose not to allow certain types of cookies", with toggles for "Performance Cookies" and "Online Behavioural Advertising", then a "Confirm my Choices" button.
What kept firing: after the choice, cookies allegedly were "sent to Plaintiffs['] and other visitors' browsers, stored on their devices, and transmitted to the Third Parties along with user data" (FAC ¶¶ 1–6, quoted at p. 1): browsing history, interactions, identifiers and geolocation.
Server-side: neither order mentions a server-side relay.
When: 2023. Politico filed a declaration that it removed the banner on 13 September 2023; the court treated the plaintiffs' contrary declarations as enough for now (ECF No. 131, pp. 7–8).
How it came to light: Shah took a screenshot of the site on 12 August 2023 and sent a demand letter five days later (ECF No. 131, p. 3).

Inth’s technical interpretation: a category toggle is a mapping from labels to vendors. It fails when vendors sit in a category the visitor cannot switch off, when header-bidding or ad-server code sets cookies outside the consent tool, or when the tool blocks new cookies but leaves identifiers already set. When most named recipients are programmatic advertising companies, as here, the ad-serving stack is the first place to look. The record does not say which failure, if any, occurred.

Illustrative pattern, not the defendant’s code.

// Bad: the banner offers two toggles, but the vendor map leaks
const categories = {
  necessary:   ['session', 'csrf', 'adobe-analytics', 'liveramp-ats'], // cannot be switched off
  performance: ['google-analytics'],
  advertising: ['criteo'],
};
// Header bidding loads directly in the page template, outside any category
loadScript('https://securepubads.g.doubleclick.net/tag/js/gpt.js');

Illustrative pattern, not the defendant’s code. Generic consent API, not a c15t call.

// Fixed: every third party sits in a switchable category, and ad code waits
const categories = {
  necessary:   ['session', 'csrf'],
  performance: ['google-analytics', 'adobe-analytics'],
  advertising: ['liveramp-ats', 'criteo', 'gpt', 'prebid'],
};
consent.onChange((state) => {
  if (state.has('advertising')) loadScript('https://securepubads.g.doubleclick.net/tag/js/gpt.js');
  else window.googletag?.pubads?.().setPrivacySettings({ restrictDataProcessing: true });
});

Timeline

Timeline
Date	Event
12 and 17 August 2023	Screenshot of the site; demand letter to Politico
21 December 2023	Arbitration demand filed
29 July 2024	Arbitrator rules the claims non-arbitrable
7 February 2025	Petition to "confirm" that ruling filed ([4:25-cv-01338](https://www.courtlistener.com/docket/69623453/shah-v-politico-llc/)); later dismissed for lack of jurisdiction
20 June 2025	This complaint filed
6 February 2026	Motion to dismiss granted in part ([ECF No. 74](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5_25-cv-05213/pdf/USCOURTS-cand-5_25-cv-05213-1.pdf))
4 June 2026	First amended complaint adds Willis and Penning
25 September 2026	Second motion granted in part ([ECF No. 131](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5_25-cv-05213/pdf/USCOURTS-cand-5_25-cv-05213-2.pdf))
16 October 2026	Amended complaint filed ([docket](https://www.courtlistener.com/docket/70596318/shah-v-politico-llc/))

Outcome

On standing, the court held that the opt-out offer set the expectation: Politico "set an expectation that . . . user data would not be collected, but then collected it anyway" (ECF No. 74, p. 6, quoting In re Facebook Internet Tracking). In September it added that, read against Popa, a political news site "leans toward standing" compared with the watch retailer in Lutge v. Timex.com (ECF No. 131, p. 6 n.4).

On timing, CIPA’s one-year limit decided the statutory claims. Even tolling the 221 days in arbitration, "at least 452 un-tolled days passed" before Shah sued (ECF No. 74, p. 9). Shah’s CIPA claims were dismissed with prejudice in September; the new plaintiffs may amend only to show what they did to discover the tracking.

Politico argued Shah and Penning were "testers". The court called it a question of fact; for Penning it noted "sixteen cases over two years, while troubling," did not make his allegations implausible (ECF No. 131, p. 7). These are unpublished district court orders.

What it cost

What it cost
Item	Record
Damages or settlement	None; case pending
Fees or costs	Not stated in the cited record

Why it matters

Popa and Cook. Popa and Cook found no standing where the site made no promise; Cook stressed that "GameStop made no promise to refrain from collecting information" (opinion). Politico’s toggles were that promise. Contrast Khamooshi v. Politico (N.D. Cal. 2025), where plaintiffs who alleged only collection of their IP addresses lacked standing against the same publisher (ECF No. 74, p. 6).
Clock. The arbitration detour cost Shah his statutory claims. His privacy and fraud claims survived because they carry longer limitation periods (two and three years, as set out in the MyFitnessPal order of 27 January 2026).
SB 690. Stats. 2026, ch. 976, signed 30 September 2026 and operative 1 January 2027 (the default effective date for a 2026 statute), makes private §638.51 claims over website and app conduct Attorney General only, retroactive to pending claims in actions filed on or after 1 January 2025; §631, §632 and §632.7 are untouched (bill text). This case was filed in June 2025.
See Spears v. Campbell’s, failed opt-out controls.

How Inth catches this

Code audit: flags a pull request that adds an ad-tech or identity vendor, or loads header-bidding code in a template outside the consent check, and maps each vendor call to the consent category it depends on.
Website audit: records requests to adsrvr.org, criteo.com or liveramp.com after a visitor turned off advertising, with the page, time, region and consent state.
Consent banner: loads each integration only when its category is granted. When the visitor switches a category off, the Consent banner sends the revocation to each integration and stops loading tags that have not loaded yet; some helpers stay loaded and receive the revocation instead (the Meta Pixel helper gets fbq('consent', 'revoke'), and Google tags run under Consent Mode v2 with consent denied). Header-bidding and ad-server code loaded outside the banner is not covered. Inth’s default California policy is opt-out, so tags run before a choice; a California opt-in policy is a configuration you choose.
Evidence: a consent record of each category choice with the policy that applied, next to dated runtime observations.

A browser test shows which vendors received requests after the choice; it cannot show what those vendors stored or sold on.

Checks for your own systems

In the repository

Export your consent tool’s vendor-to-category map. Flag every third party in "necessary".
Search page templates for ad-server, prebid and identity scripts loaded outside the consent check.
Check whether turning a category off also clears or stops refreshing that category’s cookies.

In the browser and network

Toggle off each category, confirm, reload, and list every third-party domain still contacted.
Compare third-party cookies before and after the choice in a clean profile.
Repeat on an article page with ads and on the home page.

With the people responsible

Ask ad operations which partners run through the ad server rather than the tag manager.
Keep dated screenshots and configuration exports of the banner each time it changes.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Politico LLC’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.