[Enforcement library](/enforcement)

# Shah v. Politico: a cookie toggle has to switch off every vendor behind it

If your banner lets visitors switch off "Performance" and "Advertising" cookies, test what happens after "Confirm my choices". Here readers alleged the toggles changed nothing, and the court held that was enough to plead standing. The case also shows a defence: CIPA's one-year clock.

US District Court, Northern District of California · Privacy, intrusion, fraud, CIPA · Motions to dismiss granted in part, 6 February and 25 September 2026

## The problem

Vishal Shah alleged that in the first half of 2023 politico.com "immediately" showed him a cookie banner saying he could "choose not to allow certain types of cookies". He toggled off "Performance Cookies" and "Online Behavioural Advertising" cookies and clicked "Confirm my Choices". He alleged third-party cookies and user data kept flowing anyway ([order of 6 February 2026](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5_25-cv-05213/pdf/USCOURTS-cand-5_25-cv-05213-1.pdf), p. 2). Two more readers joined in 2026 with the same account. These are allegations, not findings.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, Northern District of California (Judge Noël Wise) |
| Case number | 5:25-cv-05213-NW |
| Parties | Vishal Shah, Heidi Willis and Stacy Penning v. Politico LLC |
| Counsel | Plaintiffs: Gutride Safier LLP. Defendant: Fisher & Phillips LLP (\[parties\](https://www.courtlistener.com/docket/70596318/parties/shah-v-politico-llc/)) |
| Laws | CIPA §631 and §638.51; California constitutional privacy; intrusion; fraud; unjust enrichment; contract and trespass (dropped) |
| Stage | Second amended complaint filed 16 October 2026 |
| Amount | None |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| Invasion of privacy and intrusion | Reasonable expectation of privacy; highly offensive intrusion | Toggles promised opt-out; Google, Adobe and other cookies kept collecting browsing data (Compl. ¶¶ 19, 38–68) | Survived for all three plaintiffs |
| CIPA §631 and §638.51 | Interception or pen-register use, sued within one year | Same conduct in 2023 | Shah: time-barred, dismissed with prejudice. Willis and Penning: dismissed with limited leave |
| Fraud | Misrepresentation, reliance, damage | Shah kept browsing "in reliance on" the toggles (Compl. ¶¶ 79, 82) | Survived |
| Unjust enrichment | Benefit retained without legal basis | Data passed to 14 named ad-tech companies (FAC ¶ 3) | Dismissed in February; survived in September after the contract theory was dropped |
| Breach of contract, implied covenant, trespass to chattels | Actual damages; impaired device | Privacy policy promises; cookies use storage | Dismissed with leave in February; not re-pleaded |

## Technical issue

- **Tools or vendors:** the first complaint names cookies "furnished by Google and Adobe, among others" (ECF No. 74, p. 5). The amended complaint lists Google, Adobe, LiveRamp, Microsoft, The Trade Desk, Comscore, PubMatic, Amazon, X, Yahoo, Criteo, Sonobi, GumGum and OpenX ([order of 25 September 2026](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5_25-cv-05213/pdf/USCOURTS-cand-5_25-cv-05213-2.pdf), p. 12).
- **Where:** politico.com, a political news site.
- **What the banner said:** users could "choose not to allow certain types of cookies", with toggles for "Performance Cookies" and "Online Behavioural Advertising", then a "Confirm my Choices" button.
- **What kept firing:** after the choice, cookies allegedly were "sent to Plaintiffs\['\] and other visitors' browsers, stored on their devices, and transmitted to the Third Parties along with user data" (FAC ¶¶ 1–6, quoted at p. 1): browsing history, interactions, identifiers and geolocation.
- **Server-side:** neither order mentions a server-side relay.
- **When:** 2023\. Politico filed a declaration that it removed the banner on 13 September 2023; the court treated the plaintiffs' contrary declarations as enough for now (ECF No. 131, pp. 7–8).
- **How it came to light:** Shah took a screenshot of the site on 12 August 2023 and sent a demand letter five days later (ECF No. 131, p. 3).

**Inth's technical interpretation:** a category toggle is a mapping from labels to vendors. It fails when vendors sit in a category the visitor cannot switch off, when header-bidding or ad-server code sets cookies outside the consent tool, or when the tool blocks new cookies but leaves identifiers already set. When most named recipients are programmatic advertising companies, as here, the ad-serving stack is the first place to look. The record does not say which failure, if any, occurred.

Illustrative pattern, not the defendant's code.

```js
// Bad: the banner offers two toggles, but the vendor map leaks
const categories = {
  necessary:   ['session', 'csrf', 'adobe-analytics', 'liveramp-ats'], // cannot be switched off
  performance: ['google-analytics'],
  advertising: ['criteo'],
};
// Header bidding loads directly in the page template, outside any category
loadScript('https://securepubads.g.doubleclick.net/tag/js/gpt.js');
```

Illustrative pattern, not the defendant's code. Generic consent API, not a c15t call.

```js
// Fixed: every third party sits in a switchable category, and ad code waits
const categories = {
  necessary:   ['session', 'csrf'],
  performance: ['google-analytics', 'adobe-analytics'],
  advertising: ['liveramp-ats', 'criteo', 'gpt', 'prebid'],
};
consent.onChange((state) => {
  if (state.has('advertising')) loadScript('https://securepubads.g.doubleclick.net/tag/js/gpt.js');
  else window.googletag?.pubads?.().setPrivacySettings({ restrictDataProcessing: true });
});
```

## Timeline

| Date | Event |
| --- | --- |
| 12 and 17 August 2023 | Screenshot of the site; demand letter to Politico |
| 21 December 2023 | Arbitration demand filed |
| 29 July 2024 | Arbitrator rules the claims non-arbitrable |
| 7 February 2025 | Petition to "confirm" that ruling filed (\[4:25-cv-01338\](https://www.courtlistener.com/docket/69623453/shah-v-politico-llc/)); later dismissed for lack of jurisdiction |
| 20 June 2025 | This complaint filed |
| 6 February 2026 | Motion to dismiss granted in part (\[ECF No. 74\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5\_25-cv-05213/pdf/USCOURTS-cand-5\_25-cv-05213-1.pdf)) |
| 4 June 2026 | First amended complaint adds Willis and Penning |
| 25 September 2026 | Second motion granted in part (\[ECF No. 131\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5\_25-cv-05213/pdf/USCOURTS-cand-5\_25-cv-05213-2.pdf)) |
| 16 October 2026 | Amended complaint filed (\[docket\](https://www.courtlistener.com/docket/70596318/shah-v-politico-llc/)) |

## Outcome

On standing, the court held that the opt-out offer set the expectation: Politico "set an expectation that . . . user data would not be collected, but then collected it anyway" (ECF No. 74, p. 6, quoting *In re Facebook Internet Tracking*). In September it added that, read against *Popa*, a political news site "leans toward standing" compared with the watch retailer in *Lutge v. Timex.com* (ECF No. 131, p. 6 n.4).

On timing, CIPA's one-year limit decided the statutory claims. Even tolling the 221 days in arbitration, "at least 452 un-tolled days passed" before Shah sued (ECF No. 74, p. 9). Shah's CIPA claims were dismissed with prejudice in September; the new plaintiffs may amend only to show what they did to discover the tracking.

Politico argued Shah and Penning were "testers". The court called it a question of fact; for Penning it noted "sixteen cases over two years, while troubling," did not make his allegations implausible (ECF No. 131, p. 7). These are unpublished district court orders.

## What it cost

| Item | Record |
| --- | --- |
| Damages or settlement | None; case pending |
| Fees or costs | Not stated in the cited record |

## Why it matters

- **Popa and Cook.** [Popa](/enforcement/popa-v-microsoft) and [Cook](/enforcement/cook-v-gamestop) found no standing where the site made no promise; Cook stressed that "GameStop made no promise to refrain from collecting information" ([opinion](https://www2.ca3.uscourts.gov/opinarch/232574p.pdf)). Politico's toggles were that promise. Contrast *Khamooshi v. Politico* (N.D. Cal. 2025), where plaintiffs who alleged only collection of their IP addresses lacked standing against the same publisher (ECF No. 74, p. 6).
- **Clock.** The arbitration detour cost Shah his statutory claims. His privacy and fraud claims survived because they carry longer limitation periods (two and three years, as set out in the [MyFitnessPal](/enforcement/shah-v-myfitnesspal) order of 27 January 2026).
- **SB 690.** Stats. 2026, ch. 976, signed 30 September 2026 and operative 1 January 2027 (the default effective date for a 2026 statute), makes private §638.51 claims over website and app conduct Attorney General only, retroactive to pending claims in actions filed on or after 1 January 2025; §631, §632 and §632.7 are untouched ([bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)). This case was filed in June 2025.
- See [Spears v. Campbell's](/enforcement/spears-v-campbells), [failed opt-out controls](/enforcement/issues/failed-opt-out-controls).

## How Inth catches this

- **Code audit:** flags a pull request that adds an ad-tech or identity vendor, or loads header-bidding code in a template outside the consent check, and maps each vendor call to the consent category it depends on.
- **Website audit:** records requests to adsrvr.org, criteo.com or liveramp.com after a visitor turned off advertising, with the page, time, region and consent state.
- **Consent banner:** loads each integration only when its category is granted. When the visitor switches a category off, the Consent banner sends the revocation to each integration and stops loading tags that have not loaded yet; some helpers stay loaded and receive the revocation instead (the Meta Pixel helper gets `fbq('consent', 'revoke')`, and Google tags run under Consent Mode v2 with consent denied). Header-bidding and ad-server code loaded outside the banner is not covered. Inth's default California policy is opt-out, so tags run before a choice; a California opt-in policy is a configuration you choose.
- **Evidence:** a consent record of each category choice with the policy that applied, next to dated runtime observations.

A browser test shows which vendors received requests after the choice; it cannot show what those vendors stored or sold on.

## Checks for your own systems

### In the repository

- Export your consent tool's vendor-to-category map. Flag every third party in "necessary".
- Search page templates for ad-server, prebid and identity scripts loaded outside the consent check.
- Check whether turning a category off also clears or stops refreshing that category's cookies.

### In the browser and network

- Toggle off each category, confirm, reload, and list every third-party domain still contacted.
- Compare third-party cookies before and after the choice in a clean profile.
- Repeat on an article page with ads and on the home page.

### With the people responsible

- Ask ad operations which partners run through the ad server rather than the tag manager.
- Keep dated screenshots and configuration exports of the banner each time it changes.

## Sources and limits

- [Order on motion to dismiss, 6 February 2026 (ECF No. 74)](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5_25-cv-05213/pdf/USCOURTS-cand-5_25-cv-05213-1.pdf)
- [Order on motion to dismiss the first amended complaint, 25 September 2026 (ECF No. 131)](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5_25-cv-05213/pdf/USCOURTS-cand-5_25-cv-05213-2.pdf)
- [Order of 21 November 2025 on the discovery stay (ECF No. 54)](https://www.govinfo.gov/content/pkg/USCOURTS-cand-5_25-cv-05213/pdf/USCOURTS-cand-5_25-cv-05213-0.pdf)
- [Docket and parties, 5:25-cv-05213 (CourtListener)](https://www.courtlistener.com/docket/70596318/shah-v-politico-llc/)
- [Docket, 4:25-cv-01338 (CourtListener)](https://www.courtlistener.com/docket/69623453/shah-v-politico-llc/)
- [Cook v. GameStop, 3d Cir., 7 August 2025](https://www2.ca3.uscourts.gov/opinarch/232574p.pdf)
- [Popa v. Microsoft, 9th Cir., 26 August 2025](https://cdn.ca9.uscourts.gov/datastore/opinions/2025/08/26/24-14.pdf)
- [SB 690 bill text, published 1 October 2026](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Politico LLC's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Shah v. MyFitnessPal](/enforcement/shah-v-myfitnesspal) · [Spears v. Campbell's](/enforcement/spears-v-campbells) · [Popa v. Microsoft](/enforcement/popa-v-microsoft) · [CIPA §631](/enforcement/laws/cipa-631-wiretapping)