Run a free scan

Smith v. Target: Arizona’s records statute does not reach email open pixels

Open-tracking pixels in marketing emails record when you read a message, where and on what device. A wave of Arizona class actions said that made retailers liable under a telephone-records statute. In a published opinion, the Arizona Court of Appeals said no. The tracking still happens; this statute just does not cover it.

Arizona Court of Appeals, Division One · A.R.S. §44-1376.01 (TUCSRA) · Dismissal affirmed, 13 November 2025

The problem

Kiloh Smith alleged that Target put "spy pixels", a one-by-one image, into its marketing emails to extract data without his consent, including when he opened an email and whether he forwarded it (Op. ¶ 2 and n.1). He sued under Arizona’s Telephone, Utility and Communication Service Records Act, which bars procuring a "communication service record" without the customer’s authorisation.

Case record

Court
Arizona Court of Appeals, Division One (Becke, J., with Gass, P.J., and Brown, J.)
Case number
1 CA-CV 25-0120; Maricopa County Superior Court CV2024-025462
Parties
Kiloh Smith v. Target Corporation and Target Stores, Inc.
Counsel
Smith: Gilbert & Sackman; Bursor & Fisher. Target: Jones, Skelton & Hochuli; Fredrikson & Byron
Law
A.R.S. §44-1376.01(A)(1)
Stage
Published opinion affirming dismissal with prejudice
Amount
None; Target awarded taxable costs on appeal
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
TUCSRA §44-1376.01(A)(1)No one may knowingly procure a resident's "communication service record" without the customer's authorisation or by deceptionPixels logged email opens ("access logs") and forwarding ("records of the path of an electronic communication")Dismissed with prejudice; affirmed

The superior court (Judge M. Scott McCoy, retired) dismissed with prejudice after Target also raised personal jurisdiction, standing and CAN-SPAM pre-emption (Op. ¶¶ 3–4). The appeal turned only on the statute.

Technical issue

  • Tools or vendors: a 1x1 tracking image embedded in marketing emails; the email service provider is not named.
  • Where: Target’s marketing emails.
  • What data: the court listed "[l]ogs of email access, logs of associated email addresses, email client types, email path data, recipient locations, IP addresses, email forwarding data, and device information" (Op. ¶ 18).
  • When: each time the email was opened and images loaded, with no consent step.
  • How it came to light: not stated; open tracking is a standard feature of email platforms.

Inth’s technical interpretation: an open pixel is an image URL unique to the recipient. When the mail client fetches it, the sender’s platform logs the time, the IP address (and so rough location) and the user agent. Some mail clients proxy or prefetch images, which hides the IP and inflates opens, so the data is noisier than the complaint suggests. Forwarding is inferred when the same unique URL loads from a new address.

Illustrative pattern, not the defendant’s code.

<!-- Bad: per-recipient open pixel and link tracking by default in every campaign -->
<img src="https://t.esp.example/o/{{recipient_id}}/{{campaign_id}}.gif"
     width="1" height="1" alt="" style="display:none">
<!-- Fixed: open tracking only for recipients who agreed to it; none otherwise -->
{% if recipient.consents.email_tracking %}
<img src="https://t.esp.example/o/{{recipient_id}}/{{campaign_id}}.gif" width="1" height="1" alt="">
{% endif %}

Timeline

Timeline
DateEvent
2024Class complaint filed in Maricopa County Superior Court ([Op. ¶ 2](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf))
16 December 2024Carbajal v. Home Depot (D. Ariz.) rejects the same theory; the superior court later adopts its reasoning ([Op. ¶ 4](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf))
16 April 2025Williams v. Pacific Sunwear (D. Ariz.) agrees ([Op. ¶ 12](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf))
13 November 2025Court of Appeals affirms ([opinion](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf))

Outcome

The court read the statute alongside Arizona’s Eavesdropping and Communications Act, which supplied the identical definition and ties "communication service records" to "communication service providers". It held that the term "refers to records about subscribers maintained by communication service providers" (Op. ¶ 15). "Access logs" are records of a subscriber’s access to a communication service, "not marketing metrics collected by retailers about email engagement" (¶ 16). Forwarding falls outside "the path ... between the point of origin and the point of delivery", because delivery to Smith ends the path (¶ 17). Because Smith did not allege he subscribed to a provider whose records Target obtained, the claim failed, and the court did not reach standing (¶ 18).

This is a published opinion of the Arizona Court of Appeals, so it binds Arizona trial courts unless the Arizona Supreme Court says otherwise. Federal courts in Arizona had already reached the same view.

What it cost

What it cost
ItemRecord
DamagesNone
Costs on appealAwarded to Target; amount not stated in the cited record

Why it matters

  • The Arizona email-pixel theory is closed at the appellate level. Two federal judges in Arizona had already rejected it (Op. ¶¶ 4, 12); now the state appellate court has too. See Arizona TUCSRA.
  • The data is still personal data. The court did not say open tracking is lawful everywhere; it said this statute is about carriers' records. Consent rules for email tracking in the EU and UK are a separate question.
  • Statute-shopping. Plaintiffs reach for old telephone and wiretap laws when no tracking-specific law applies. Compare the pen-register theory under CIPA §638.51, which SB 690 (Stats. 2026, ch. 976) makes Attorney General only for website and app claims from 1 January 2027.

How Inth catches this

  • Code audit: can flag a pull request that adds a tracking image or link-tracking domain to an email template kept in the repository.
  • Website audit: does not apply. Email opens happen in mail clients, not on your site.
  • Consent banner: does not apply to email open tracking.
  • Evidence: a Code audit finding records the template change and who approved it.

Limit: open tracking switched on in an email platform’s settings, outside your code, is invisible to both audits.

Checks for your own systems

In the repository

  • Search email templates for 1x1 images and per-recipient tracking URLs.
  • Check whether link tracking rewrites every URL through a vendor domain.

In the browser and network

  • Send yourself a campaign, view the raw source, and list every remote image and link domain.

With the people responsible

  • Ask the email team which platform settings enable open and click tracking, and for which audiences.
  • Decide whether EU and UK recipients get tracking only with consent.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Target’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.