CookieGate
Start free trial

Asercion v. Ulta: a privacy policy alone was not consent to tracking

4 min read By Comply Ark

Regulation: CCPA/CPRA

In this post

The ruling

On 21 August 2026, Judge Rita F. Lin of the U.S. District Court for the Northern District of California largely denied Ulta Salon, Cosmetics & Fragrance’s motion for judgment on the pleadings in Asercion v. Ulta Salon, Cosmetics & Fragrance, Inc., No. 26-cv-02442-RFL. The case began in state court and was removed to federal court by Ulta in March 2026.

The plaintiff, Arny Asercion, alleges that he visited Ulta’s website in May 2025 to browse for Mother’s Day gifts and that code embedded in the site installed tracking technology on his browser. He alleges the trackers collected his browsing activity, including product views, in real time and sent it to third parties for targeted advertising and profiling. The complaint counts 201 trackers on the site.

Two claims under the California Invasion of Privacy Act (CIPA) survived: Section 631(a), which prohibits reading or learning the contents of a communication in transit without the consent of all parties, and Section 638.51(a), which prohibits installing or using a pen register without a court order. Claims under the federal Wiretap Act, the California Comprehensive Computer Data Access and Fraud Act and the California Constitution’s privacy right also survived. Only the Unfair Competition Law claim was dismissed, for failure to plead economic injury, with leave to amend.

Ulta argued that both CIPA claims failed because its privacy policy disclosed the use of trackers. The court rejected that argument. Even assuming the policy could be considered at that stage, “the mere existence of the policy does not equate to consent without any indication that the user saw the policy or agreed to it.”

The court then went a step further. Because the plaintiff alleged that the trackers were installed when he visited the site, it was reasonable to infer that the installation happened “before Plaintiff could have possibly been aware of the privacy policy and the disclosures it contained.” Ulta’s argument that the site must have offered some consent mechanism was, in the court’s view, a factual question that could not be resolved on the pleadings.

The court also rejected Ulta’s argument that the pen-register provision covers only telephone technology, noting that other decisions in the Northern District apply it to internet tracking, and held that a single component of a tracker that collects addressing information such as IP addresses can be a pen register “process.”

What has happened since

The plaintiff filed an amended complaint on 11 September 2026, and Ulta’s deadline to respond has been extended to 2 November 2026.

On 2 October 2026, the court issued an order to show cause on subject-matter jurisdiction. The court noted that while the complaint adequately alleges statutory standing under CIPA, it does not appear to plausibly allege Article III standing for a federal court, because it does not allege that the profiles built from the tracking contain sensitive information or are detailed enough to become sensitive. Ulta, as the party that removed the case, must explain by 16 October 2026 why it should not be remanded to state court. The plaintiff may respond by 23 October.

That matters for how this case is read. If the case is remanded, the claims would continue in California state court rather than before Judge Lin. The standing question is about which court can hear the case, not about the consent reasoning in the August order.

How far the ruling goes

This is a trial-court ruling at the pleading stage. It does not decide that Ulta violated CIPA, it is not binding on other courts, and it does not establish that every pixel is a pen register. It holds that, on these allegations, a posted privacy policy was not enough to defeat the claims at the outset.

The practical point is narrower and more useful than a headline. The court focused on two facts: there was no indication the user saw or agreed to the policy, and the trackers allegedly loaded on arrival, before he could have seen it. A privacy policy describes what a site does. On this reasoning, it does not by itself authorise the tracking it describes.

What to check

Load your site in a private window and look at what fires before the visitor does anything. If analytics, advertising pixels or session-replay scripts load on arrival, the timing problem the court identified applies to you, whatever your privacy policy says. A consent choice only answers that problem if trackers are actually held until the choice is made, and if a refusal is enforced at the script and network level rather than recorded and ignored.

Holding trackers until a visitor decides, and keeping a record of the decision, is the problem CookieGate is built around.

Sources

enforcementlitigationpixelsconsent

Comply Ark Regulatory infrastructure company. Builds CookieGate.

If this applies to your site.

CookieGate holds non-essential tags until the visitor decides, resolves the right law by location, and prints a receipt per decision.

Start free trial

15 days. Card required. Nothing is charged before day 15.

How CookieGate handles the CCPA/CPRA