[Enforcement library](/enforcement)

# Smith v. Target: Arizona's records statute does not reach email open pixels

Open-tracking pixels in marketing emails record when you read a message, where and on what device. A wave of Arizona class actions said that made retailers liable under a telephone-records statute. In a published opinion, the Arizona Court of Appeals said no. The tracking still happens; this statute just does not cover it.

Arizona Court of Appeals, Division One · A.R.S. §44-1376.01 (TUCSRA) · Dismissal affirmed, 13 November 2025

## The problem

Kiloh Smith alleged that Target put "spy pixels", a one-by-one image, into its marketing emails to extract data without his consent, including when he opened an email and whether he forwarded it ([Op. ¶ 2 and n.1](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf)). He sued under Arizona's Telephone, Utility and Communication Service Records Act, which bars procuring a "communication service record" without the customer's authorisation.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | Arizona Court of Appeals, Division One (Becke, J., with Gass, P.J., and Brown, J.) |
| Case number | 1 CA-CV 25-0120; Maricopa County Superior Court CV2024-025462 |
| Parties | Kiloh Smith v. Target Corporation and Target Stores, Inc. |
| Counsel | Smith: Gilbert & Sackman; Bursor & Fisher. Target: Jones, Skelton & Hochuli; Fredrikson & Byron |
| Law | A.R.S. §44-1376.01(A)(1) |
| Stage | Published opinion affirming dismissal with prejudice |
| Amount | None; Target awarded taxable costs on appeal |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| TUCSRA §44-1376.01(A)(1) | No one may knowingly procure a resident's "communication service record" without the customer's authorisation or by deception | Pixels logged email opens ("access logs") and forwarding ("records of the path of an electronic communication") | Dismissed with prejudice; affirmed |

The superior court (Judge M. Scott McCoy, retired) dismissed with prejudice after Target also raised personal jurisdiction, standing and CAN-SPAM pre-emption ([Op. ¶¶ 3–4](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf)). The appeal turned only on the statute.

## Technical issue

- **Tools or vendors:** a 1x1 tracking image embedded in marketing emails; the email service provider is not named.
- **Where:** Target's marketing emails.
- **What data:** the court listed "\[l\]ogs of email access, logs of associated email addresses, email client types, email path data, recipient locations, IP addresses, email forwarding data, and device information" ([Op. ¶ 18](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf)).
- **When:** each time the email was opened and images loaded, with no consent step.
- **How it came to light:** not stated; open tracking is a standard feature of email platforms.

**Inth's technical interpretation:** an open pixel is an image URL unique to the recipient. When the mail client fetches it, the sender's platform logs the time, the IP address (and so rough location) and the user agent. Some mail clients proxy or prefetch images, which hides the IP and inflates opens, so the data is noisier than the complaint suggests. Forwarding is inferred when the same unique URL loads from a new address.

Illustrative pattern, not the defendant's code.

```html
<!-- Bad: per-recipient open pixel and link tracking by default in every campaign -->
<img src="https://t.esp.example/o/{{recipient_id}}/{{campaign_id}}.gif"
     width="1" height="1" alt="" style="display:none">
```

```html
<!-- Fixed: open tracking only for recipients who agreed to it; none otherwise -->
{% if recipient.consents.email_tracking %}
<img src="https://t.esp.example/o/{{recipient_id}}/{{campaign_id}}.gif" width="1" height="1" alt="">
{% endif %}
```

## Timeline

| Date | Event |
| --- | --- |
| 2024 | Class complaint filed in Maricopa County Superior Court (\[Op. ¶ 2\](https://storage.courtlistener.com/pdf/2025/11/13/smith\_v.\_target\_corp.pdf)) |
| 16 December 2024 | Carbajal v. Home Depot (D. Ariz.) rejects the same theory; the superior court later adopts its reasoning (\[Op. ¶ 4\](https://storage.courtlistener.com/pdf/2025/11/13/smith\_v.\_target\_corp.pdf)) |
| 16 April 2025 | Williams v. Pacific Sunwear (D. Ariz.) agrees (\[Op. ¶ 12\](https://storage.courtlistener.com/pdf/2025/11/13/smith\_v.\_target\_corp.pdf)) |
| 13 November 2025 | Court of Appeals affirms (\[opinion\](https://storage.courtlistener.com/pdf/2025/11/13/smith\_v.\_target\_corp.pdf)) |

## Outcome

The court read the statute alongside Arizona's Eavesdropping and Communications Act, which supplied the identical definition and ties "communication service records" to "communication service providers". It held that the term "refers to records about subscribers maintained by communication service providers" ([Op. ¶ 15](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf)). "Access logs" are records of a subscriber's access to a communication service, "not marketing metrics collected by retailers about email engagement" ([¶ 16](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf)). Forwarding falls outside "the path ... between the point of origin and the point of delivery", because delivery to Smith ends the path ([¶ 17](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf)). Because Smith did not allege he subscribed to a provider whose records Target obtained, the claim failed, and the court did not reach standing ([¶ 18](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf)).

This is a published opinion of the Arizona Court of Appeals, so it binds Arizona trial courts unless the Arizona Supreme Court says otherwise. Federal courts in Arizona had already reached the same view.

## What it cost

| Item | Record |
| --- | --- |
| Damages | None |
| Costs on appeal | Awarded to Target; amount not stated in the cited record |

## Why it matters

- **The Arizona email-pixel theory is closed at the appellate level.** Two federal judges in Arizona had already rejected it ([Op. ¶¶ 4, 12](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf)); now the state appellate court has too. See [Arizona TUCSRA](/enforcement/laws/arizona-tucsra).
- **The data is still personal data.** The court did not say open tracking is lawful everywhere; it said this statute is about carriers' records. Consent rules for email tracking in the EU and UK are a separate question.
- **Statute-shopping.** Plaintiffs reach for old telephone and wiretap laws when no tracking-specific law applies. Compare the pen-register theory under [CIPA §638.51](/enforcement/laws/cipa-638-51-pen-register), which [SB 690](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690) (Stats. 2026, ch. 976) makes Attorney General only for website and app claims from 1 January 2027.

## How Inth catches this

- **Code audit:** can flag a pull request that adds a tracking image or link-tracking domain to an email template kept in the repository.
- **Website audit:** does not apply. Email opens happen in mail clients, not on your site.
- **Consent banner:** does not apply to email open tracking.
- **Evidence:** a Code audit finding records the template change and who approved it.

Limit: open tracking switched on in an email platform's settings, outside your code, is invisible to both audits.

## Checks for your own systems

### In the repository

- Search email templates for 1x1 images and per-recipient tracking URLs.
- Check whether link tracking rewrites every URL through a vendor domain.

### In the browser and network

- Send yourself a campaign, view the raw source, and list every remote image and link domain.

### With the people responsible

- Ask the email team which platform settings enable open and click tracking, and for which audiences.
- Decide whether EU and UK recipients get tracking only with consent.

## Sources and limits

- [Smith v. Target Corp., No. 1 CA-CV 25-0120, opinion](https://storage.courtlistener.com/pdf/2025/11/13/smith_v._target_corp.pdf) (13 November 2025)
- [Womble Bond Dickinson alert](https://www.womblebonddickinson.com/us/insights/alerts/arizona-court-appeals-affirms-dismissal-arizona-spy-pixel-class-action) (secondary)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Target's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Arizona TUCSRA](/enforcement/laws/arizona-tucsra) · [IP addresses and device identifiers](/enforcement/issues/ip-addresses-and-device-identifiers)