Spears v. Campbell’s: a Reject button that leaves third-party cookies running is a broken promise

Click "Reject all" on your own site and watch the network panel. If Meta, Google or The Trade Desk still receive requests, the banner promises something the code does not do. Here that broken promise gave the shoppers standing after Popa.

US District Court, Northern District of California · CIPA §631 and §638.51, privacy, fraud · Motion to dismiss denied, 8 September 2026

The problem

Three Californians said they visited Campbell’s, Rao’s, Pacific Foods and Michael Angelo’s websites, saw the cookie banner and rejected tracking cookies. The amended complaint alleges that third-party cookies kept collecting their search strings, clicks, page views and identifiers after that choice (order, pp. 5–6). These are allegations. The court has not decided whether they are true.

Case record

Court: US District Court, Northern District of California
Case number: 3:26-cv-02385-TSH
Judge: Magistrate Judge Thomas S. Hixson, with the parties' consent
Parties: Melvin Colman, Gail Spears and Revital Yogev v. The Campbell's Company and Pacific Foods of Oregon LLC
Counsel: Plaintiffs: Gutride Safier LLP ([docket](https://www.courtlistener.com/docket/72513561/spears-v-the-campbells-company/)). Defendants: Sheppard, Mullin, Richter & Hampton LLP ([stipulation](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_26-cv-02385/pdf/USCOURTS-cand-3_26-cv-02385-2.pdf))
Laws: CIPA §631 and §638.51; California constitutional privacy; intrusion upon seclusion; fraud; unjust enrichment
Stage: Motion to dismiss and request for stay denied; case proceeds
Amount: None. Damages and an injunction are sought; no figure is stated in the order
Source review: 17 October 2026

The problem
Case record
What was alleged
Technical issue
Timeline
Outcome
What it cost
Why it matters
How Inth catches this
Checks for your own systems
Sources and limits

What was alleged

What was alleged
Claim	What the law requires	Facts alleged	Result
Invasion of privacy (Cal. Const.) and intrusion upon seclusion	Reasonable expectation of privacy and a highly offensive intrusion	Banner offered a Reject option; third parties kept collecting browsing data and profiling visitors across sites (FAC ¶¶ 4, 59–90)	Survived. The opt-out "created a reasonable expectation" of privacy ([order](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_26-cv-02385/pdf/USCOURTS-cand-3_26-cv-02385-3.pdf), p. 19)
CIPA §631 (aiding a third party to read communications in transit)	Third party reads contents in transit; site owner knowingly assists	Sites "affirmatively programmed" the third parties' cookies and "did not disable the cookies when users opted out"	Survived (pp. 20–22)
CIPA §638.51 (pen register)	Device or process recording routing, addressing or signalling data without a court order	The cookies and code are pen registers (FAC p. 100 ¶ 201)	Survived; statute's plain text is not limited to telephones (pp. 22–24)
Fraud	Misrepresentation, knowledge, intent, reliance, damage	Banner said users could reject all non-necessary cookies; plaintiffs relied on it	Survived (pp. 24–26)
Unjust enrichment	Benefit retained at plaintiffs' expense	Defendants profited from data taken after opt-out	Survived (pp. 26–27)

Technical issue

Tools or vendors: Meta, Google (DoubleClick, Google Analytics, YouTube), TikTok, The Trade Desk (adsrvr.org), Amazon (amazon-adsystem), Yahoo, Microsoft Bing, Pinterest and X, as listed in the complaint (FAC ¶ 4, quoted at p. 3).
Where: four consumer food brand sites and their cookie banners.
What the banner said: the order does not quote the banner. The complaint describes each banner as disclosing cookie use while giving "the option to reject all cookies other than those necessary for the Website to operate" (FAC ¶ 1, quoted at pp. 5–6).
What kept firing: after opt-out, the sites allegedly still sent "search strings, user IDs, button clicks, pages viewed, IP address, device information, and data allowing Facebook and Google to track users across other websites" (p. 6). Some cookies allegedly persist for over a year (FAC ¶ 33).
Server-side: the order describes browser cookies and third-party code only. It does not mention the Meta Conversions API or any server-side relay.
How it came to light: the complaint says the traffic is visible only with "specialized tools" such as Chrome Developer Tools (FAC p. 83 ¶ 131). The order does not say who made the captures.

Inth’s technical interpretation: a Reject button usually fails in one of three places. The handler writes a consent cookie, but tags loaded with the page keep running. The tag manager’s triggers have no consent condition. Or identifiers set before the choice (such as _fbp, or DoubleClick’s IDE cookie) stay in the browser and ride along on later requests. A fix has to cover any server-side relay too: a server container or Conversions API call can forward the same event after the browser tag is blocked.

Illustrative pattern, not the defendant’s code.

// Bad: tags load on every page; Reject only hides the banner
fbq('init', 'PIXEL_ID');
fbq('track', 'PageView');
gtag('config', 'DC-XXXXXXX');

document.querySelector('#reject-all').addEventListener('click', () => {
  document.cookie = 'cookie_choice=rejected; path=/; max-age=31536000';
  banner.hidden = true; // the pixel, GTM and the server are never told
});

Illustrative pattern, not the defendant’s code. Generic consent API, not a c15t call.

// Fixed: nothing optional loads until a grant; Reject is propagated
gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied',
  ad_user_data: 'denied', ad_personalization: 'denied' });

consent.onChange((state) => {
  const ads = state.has('marketing');
  gtag('consent', 'update', { ad_storage: ads ? 'granted' : 'denied',
    ad_user_data: ads ? 'granted' : 'denied' });
  if (ads) loadMetaPixel();               // only now inject fbevents.js
  else if (window.fbq) fbq('consent', 'revoke');
  fetch('/api/consent', { method: 'POST', body: JSON.stringify({ ads }) }); // server relay checks this
});

Timeline

Timeline
Date	Event
18 March 2026	Complaint filed by Gail Spears and Revital Yogev ([order](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_26-cv-02385/pdf/USCOURTS-cand-3_26-cv-02385-3.pdf), p. 7)
1 June 2026	Claims against Wm. Bolthouse Farms severed into a separate action (ECF No. 29)
15 June 2026	First amended complaint adds Melvin Colman (ECF No. 31)
6 July 2026	Motion to dismiss and request for a stay (ECF No. 32)
8 September 2026	Motion to dismiss and stay denied

Outcome

The court held that all three plaintiffs have Article III standing for the CIPA claims and that all six claims are plausibly pleaded. It distinguished Popa v. Microsoft directly: "it is like a store clerk telling shoppers they would not be tracked by anyone, then secretly placing tracking devices on shoppers so that third parties could follow the shoppers around outside the store for periods of time (up to a year or more)" (order, p. 17). It refused to pause the case for the Court of Appeal’s §638.51 ruling in Variety Media v. Superior Court (No. B350578), because the other claims proceed anyway (pp. 27–28).

This is a pleading-stage order by a magistrate judge. It binds no other court, and it finds no facts.

What it cost

What it cost
Item	Record
Damages or settlement	None yet; case pending
Statutory exposure pleaded	CIPA allows USD 5,000 per violation (Penal Code §637.2); the order states no total
Fees or costs	Not stated in the cited record

Why it matters

Standing after Popa and Cook. Popa v. Microsoft found no standing for session replay on a pet-supply site, comparing it to a store clerk watching shoppers (153 F.4th 784, 791; opinion). Cook v. GameStop noted that "GameStop made no promise to refrain from collecting information" (opinion). Spears applies the gap both opinions leave: a banner that offers refusal creates the expectation, and ignoring the refusal can be the concrete injury.
Deceit counts towards "highly offensive". The court cited Shah v. MyFitnessPal and called Garcia v. Blackhawk Network (C.D. Cal. 2026) an outlier (p. 16). Courts still split: Lutge v. Timex.com (N.D. Cal. 14 September 2026) found no standing for a watch retailer despite rejected cookies, as described in Shah v. Politico.
SB 690. Stats. 2026, ch. 976, signed 30 September 2026 and operative 1 January 2027 (the default effective date for a 2026 statute), makes §638.51 website and app claims Attorney General only, retroactive to pending claims in actions filed on or after 1 January 2025; §631, §632 and §632.7 are untouched (bill text). On Inth’s reading that reaches Claim 4 here; the court has not ruled on it. The §631, privacy and fraud claims are unaffected.
See cookies after refusal and CIPA §631.

How Inth catches this

Code audit: flags a pull request that adds Meta, DoubleClick or Trade Desk tags outside the consent check, and its vendor call graph links each outbound call, including server-side event code, to the consent state it depends on.
Website audit: records each request to facebook.com, doubleclick.net or adsrvr.org after the visitor rejected, with the page, time, region and consent state.
Consent banner: holds marketing and analytics tags until the visitor grants them where the policy is opt-in. After Reject, the Consent banner sends the revocation to each integration and stops loading tags that have not loaded yet; some helpers stay loaded and receive the revocation instead (the Meta Pixel helper gets fbq('consent', 'revoke'), and Google tags run under Consent Mode v2 with consent denied). Inth’s default California policy is opt-out, so tags run before a choice; a California opt-in policy is a configuration you choose.
Evidence: a consent record of the choice and policy, alongside the runtime observations of what loaded after it.

None of this shows what a vendor does with data it already received, or what a server-side integration sends; that needs server logs and vendor contracts.

Checks for your own systems

In the repository

Find the Reject handler. Check it calls fbq('consent', 'revoke'), sends a Consent Mode update with ad signals denied, and stops later script injection.
Search global layouts and _document files for tags outside any consent condition.
Check server-side event code (Conversions API, server-side GTM, Segment) reads a consent flag before each send.

In the browser and network

In a California geo, clear storage, load a product page, click Reject, then open three more pages. Filter the network panel for facebook, doubleclick, adsrvr, amazon-adsystem, bat.bing and tiktok.
Open Application, then Cookies, and list third-party cookies that already existed before the click. Note their expiry.
Run the site search after Reject and check whether the query string appears in any third-party request.

With the people responsible

List what the banner copy promises ("reject all", "only necessary") and which vendors sit behind each category.
Ask marketing which tags run server-side and who owns their consent logic.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit The Campbell’s Company’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.