[Enforcement library](/enforcement)

# Spears v. Campbell's: a Reject button that leaves third-party cookies running is a broken promise

Click "Reject all" on your own site and watch the network panel. If Meta, Google or The Trade Desk still receive requests, the banner promises something the code does not do. Here that broken promise gave the shoppers standing after *Popa*.

US District Court, Northern District of California · CIPA §631 and §638.51, privacy, fraud · Motion to dismiss denied, 8 September 2026

## The problem

Three Californians said they visited Campbell's, Rao's, Pacific Foods and Michael Angelo's websites, saw the cookie banner and rejected tracking cookies. The amended complaint alleges that third-party cookies kept collecting their search strings, clicks, page views and identifiers after that choice ([order](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_26-cv-02385/pdf/USCOURTS-cand-3_26-cv-02385-3.pdf), pp. 5–6). These are allegations. The court has not decided whether they are true.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, Northern District of California |
| Case number | 3:26-cv-02385-TSH |
| Judge | Magistrate Judge Thomas S. Hixson, with the parties' consent |
| Parties | Melvin Colman, Gail Spears and Revital Yogev v. The Campbell's Company and Pacific Foods of Oregon LLC |
| Counsel | Plaintiffs: Gutride Safier LLP (\[docket\](https://www.courtlistener.com/docket/72513561/spears-v-the-campbells-company/)). Defendants: Sheppard, Mullin, Richter & Hampton LLP (\[stipulation\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_26-cv-02385/pdf/USCOURTS-cand-3\_26-cv-02385-2.pdf)) |
| Laws | CIPA §631 and §638.51; California constitutional privacy; intrusion upon seclusion; fraud; unjust enrichment |
| Stage | Motion to dismiss and request for stay denied; case proceeds |
| Amount | None. Damages and an injunction are sought; no figure is stated in the order |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| Invasion of privacy (Cal. Const.) and intrusion upon seclusion | Reasonable expectation of privacy and a highly offensive intrusion | Banner offered a Reject option; third parties kept collecting browsing data and profiling visitors across sites (FAC ¶¶ 4, 59–90) | Survived. The opt-out "created a reasonable expectation" of privacy (\[order\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_26-cv-02385/pdf/USCOURTS-cand-3\_26-cv-02385-3.pdf), p. 19) |
| CIPA §631 (aiding a third party to read communications in transit) | Third party reads contents in transit; site owner knowingly assists | Sites "affirmatively programmed" the third parties' cookies and "did not disable the cookies when users opted out" | Survived (pp. 20–22) |
| CIPA §638.51 (pen register) | Device or process recording routing, addressing or signalling data without a court order | The cookies and code are pen registers (FAC p. 100 ¶ 201) | Survived; statute's plain text is not limited to telephones (pp. 22–24) |
| Fraud | Misrepresentation, knowledge, intent, reliance, damage | Banner said users could reject all non-necessary cookies; plaintiffs relied on it | Survived (pp. 24–26) |
| Unjust enrichment | Benefit retained at plaintiffs' expense | Defendants profited from data taken after opt-out | Survived (pp. 26–27) |

## Technical issue

- **Tools or vendors:** Meta, Google (DoubleClick, Google Analytics, YouTube), TikTok, The Trade Desk (adsrvr.org), Amazon (amazon-adsystem), Yahoo, Microsoft Bing, Pinterest and X, as listed in the complaint (FAC ¶ 4, quoted at p. 3).
- **Where:** four consumer food brand sites and their cookie banners.
- **What the banner said:** the order does not quote the banner. The complaint describes each banner as disclosing cookie use while giving "the option to reject all cookies other than those necessary for the Website to operate" (FAC ¶ 1, quoted at pp. 5–6).
- **What kept firing:** after opt-out, the sites allegedly still sent "search strings, user IDs, button clicks, pages viewed, IP address, device information, and data allowing Facebook and Google to track users across other websites" (p. 6). Some cookies allegedly persist for over a year (FAC ¶ 33).
- **Server-side:** the order describes browser cookies and third-party code only. It does not mention the Meta Conversions API or any server-side relay.
- **How it came to light:** the complaint says the traffic is visible only with "specialized tools" such as Chrome Developer Tools (FAC p. 83 ¶ 131). The order does not say who made the captures.

**Inth's technical interpretation:** a Reject button usually fails in one of three places. The handler writes a consent cookie, but tags loaded with the page keep running. The tag manager's triggers have no consent condition. Or identifiers set before the choice (such as `_fbp`, or DoubleClick's `IDE` cookie) stay in the browser and ride along on later requests. A fix has to cover any server-side relay too: a server container or Conversions API call can forward the same event after the browser tag is blocked.

Illustrative pattern, not the defendant's code.

```js
// Bad: tags load on every page; Reject only hides the banner
fbq('init', 'PIXEL_ID');
fbq('track', 'PageView');
gtag('config', 'DC-XXXXXXX');

document.querySelector('#reject-all').addEventListener('click', () => {
  document.cookie = 'cookie_choice=rejected; path=/; max-age=31536000';
  banner.hidden = true; // the pixel, GTM and the server are never told
});
```

Illustrative pattern, not the defendant's code. Generic consent API, not a c15t call.

```js
// Fixed: nothing optional loads until a grant; Reject is propagated
gtag('consent', 'default', { ad_storage: 'denied', analytics_storage: 'denied',
  ad_user_data: 'denied', ad_personalization: 'denied' });

consent.onChange((state) => {
  const ads = state.has('marketing');
  gtag('consent', 'update', { ad_storage: ads ? 'granted' : 'denied',
    ad_user_data: ads ? 'granted' : 'denied' });
  if (ads) loadMetaPixel();               // only now inject fbevents.js
  else if (window.fbq) fbq('consent', 'revoke');
  fetch('/api/consent', { method: 'POST', body: JSON.stringify({ ads }) }); // server relay checks this
});
```

## Timeline

| Date | Event |
| --- | --- |
| 18 March 2026 | Complaint filed by Gail Spears and Revital Yogev (\[order\](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3\_26-cv-02385/pdf/USCOURTS-cand-3\_26-cv-02385-3.pdf), p. 7) |
| 1 June 2026 | Claims against Wm. Bolthouse Farms severed into a separate action (ECF No. 29) |
| 15 June 2026 | First amended complaint adds Melvin Colman (ECF No. 31) |
| 6 July 2026 | Motion to dismiss and request for a stay (ECF No. 32) |
| 8 September 2026 | Motion to dismiss and stay denied |

## Outcome

The court held that all three plaintiffs have Article III standing for the CIPA claims and that all six claims are plausibly pleaded. It distinguished *Popa v. Microsoft* directly: "it is like a store clerk telling shoppers they would not be tracked by anyone, then secretly placing tracking devices on shoppers so that third parties could follow the shoppers around outside the store for periods of time (up to a year or more)" ([order](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_26-cv-02385/pdf/USCOURTS-cand-3_26-cv-02385-3.pdf), p. 17). It refused to pause the case for the Court of Appeal's §638.51 ruling in *Variety Media v. Superior Court* (No. B350578), because the other claims proceed anyway (pp. 27–28).

This is a pleading-stage order by a magistrate judge. It binds no other court, and it finds no facts.

## What it cost

| Item | Record |
| --- | --- |
| Damages or settlement | None yet; case pending |
| Statutory exposure pleaded | CIPA allows USD 5,000 per violation (Penal Code §637.2); the order states no total |
| Fees or costs | Not stated in the cited record |

## Why it matters

- **Standing after Popa and Cook.** [Popa v. Microsoft](/enforcement/popa-v-microsoft) found no standing for session replay on a pet-supply site, comparing it to a store clerk watching shoppers (153 F.4th 784, 791; [opinion](https://cdn.ca9.uscourts.gov/datastore/opinions/2025/08/26/24-14.pdf)). [Cook v. GameStop](/enforcement/cook-v-gamestop) noted that "GameStop made no promise to refrain from collecting information" ([opinion](https://www2.ca3.uscourts.gov/opinarch/232574p.pdf)). Spears applies the gap both opinions leave: a banner that offers refusal creates the expectation, and ignoring the refusal can be the concrete injury.
- **Deceit counts towards "highly offensive".** The court cited [Shah v. MyFitnessPal](/enforcement/shah-v-myfitnesspal) and called *Garcia v. Blackhawk Network* (C.D. Cal. 2026) an outlier (p. 16). Courts still split: *Lutge v. Timex.com* (N.D. Cal. 14 September 2026) found no standing for a watch retailer despite rejected cookies, as described in [Shah v. Politico](/enforcement/shah-v-politico).
- **SB 690.** Stats. 2026, ch. 976, signed 30 September 2026 and operative 1 January 2027 (the default effective date for a 2026 statute), makes §638.51 website and app claims Attorney General only, retroactive to pending claims in actions filed on or after 1 January 2025; §631, §632 and §632.7 are untouched ([bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)). On Inth's reading that reaches Claim 4 here; the court has not ruled on it. The §631, privacy and fraud claims are unaffected.
- See [cookies after refusal](/enforcement/issues/cookies-before-choice-or-after-refusal) and [CIPA §631](/enforcement/laws/cipa-631-wiretapping).

## How Inth catches this

- **Code audit:** flags a pull request that adds Meta, DoubleClick or Trade Desk tags outside the consent check, and its vendor call graph links each outbound call, including server-side event code, to the consent state it depends on.
- **Website audit:** records each request to facebook.com, doubleclick.net or adsrvr.org after the visitor rejected, with the page, time, region and consent state.
- **Consent banner:** holds marketing and analytics tags until the visitor grants them where the policy is opt-in. After Reject, the Consent banner sends the revocation to each integration and stops loading tags that have not loaded yet; some helpers stay loaded and receive the revocation instead (the Meta Pixel helper gets `fbq('consent', 'revoke')`, and Google tags run under Consent Mode v2 with consent denied). Inth's default California policy is opt-out, so tags run before a choice; a California opt-in policy is a configuration you choose.
- **Evidence:** a consent record of the choice and policy, alongside the runtime observations of what loaded after it.

None of this shows what a vendor does with data it already received, or what a server-side integration sends; that needs server logs and vendor contracts.

## Checks for your own systems

### In the repository

- Find the Reject handler. Check it calls `fbq('consent', 'revoke')`, sends a Consent Mode `update` with ad signals denied, and stops later script injection.
- Search global layouts and `_document` files for tags outside any consent condition.
- Check server-side event code (Conversions API, server-side GTM, Segment) reads a consent flag before each send.

### In the browser and network

- In a California geo, clear storage, load a product page, click Reject, then open three more pages. Filter the network panel for facebook, doubleclick, adsrvr, amazon-adsystem, bat.bing and tiktok.
- Open Application, then Cookies, and list third-party cookies that already existed before the click. Note their expiry.
- Run the site search after Reject and check whether the query string appears in any third-party request.

### With the people responsible

- List what the banner copy promises ("reject all", "only necessary") and which vendors sit behind each category.
- Ask marketing which tags run server-side and who owns their consent logic.

## Sources and limits

- [Order denying motion to dismiss, 8 September 2026](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_26-cv-02385/pdf/USCOURTS-cand-3_26-cv-02385-3.pdf)
- [Stipulation naming defence counsel, May 2026](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_26-cv-02385/pdf/USCOURTS-cand-3_26-cv-02385-2.pdf)
- [Docket, 3:26-cv-02385 (CourtListener)](https://www.courtlistener.com/docket/72513561/spears-v-the-campbells-company/)
- [Popa v. Microsoft, 9th Cir., 26 August 2025](https://cdn.ca9.uscourts.gov/datastore/opinions/2025/08/26/24-14.pdf)
- [Cook v. GameStop, 3d Cir., 7 August 2025](https://www2.ca3.uscourts.gov/opinarch/232574p.pdf)
- [SB 690 bill text, published 1 October 2026](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit The Campbell's Company's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Shah v. Politico](/enforcement/shah-v-politico) · [Shah v. MyFitnessPal](/enforcement/shah-v-myfitnesspal) · [Smith v. Rack Room Shoes](/enforcement/smith-v-rack-room-shoes) · [Failed opt-out controls](/enforcement/issues/failed-opt-out-controls)