Early this month, a Northern District of California judge dismissed, with prejudice, a putative class action complaint asserting five privacy-related causes of action, concluding the “issue of consent defeat[ed] all of Plaintiffs’ claims.”  Lakes v. Ubisoft, Inc., –F. Supp. 3d–, 2025 WL 1036639 (N.D. Cal. Apr. 2, 2025).  Specifically, the Court dismissed plaintiffs’ claims under the (1) Video Privacy Protection Act (“VPPA”); (2) Federal Wiretap Act; (3) California Invasion of Privacy Act (“CIPA”) § 631; (4) common law invasion of privacy; and (5) Article I, Section 1 of the California Constitution. 

The two plaintiffs in this case asserted that Defendant Ubisoft, Inc., a video game company, used a third-party website pixel that allegedly collected and disclosed plaintiffs’ personal information and website activity without plaintiffs’ consent.  Ubisoft moved to dismiss, arguing, among other grounds, that “an essential element of each of Plaintiffs’ claims [was] lack of consent,” but plaintiffs had in fact “consented to the use of cookies and pixels . . . at least three times during the purchase process”: when plaintiffs (1) “interacted with the Cookies Banner” upon first visiting the website; (2) created accounts, which required them to affirmatively “accept Ubisoft’s Terms of Use, Terms of Sale, and Privacy Policy”; and (3) “made purchases,” when plaintiffs were again shown the Privacy Policy.  

The Court agreed.  Taking judicial notice of certain Ubisoft policies and website pages, including its Privacy Policy, Cookies Banner, and Cookies Settings, the Court held that plaintiffs’ consent defeated each of plaintiffs’ claims:

• Federal Wiretap Act Claim:  The court held Ubisoft had established that the Wiretap Act’s consent exception applied.  Section 2511(2)(d) of the Wiretap Act authorizes interception of communications where “one of the parties to the communication has given prior consent to such interception,” provided the interception is not “for the purpose of committing any criminal or tortious act[.]”  Here, the court found that Ubisoft “clearly disclose[d]” that it “allows partners to use cookies on the Website,” that “specific analytics and personalization cookies would be used,” and that “cookie identifiers and other similar data connected to the use of the site could be collected and shared.”  The Court found no support for requiring the sort of “highly granular disclosure” urged by plaintiffs, who argued that Ubisoft must disclose by name the third-party partner that would collect data through the website pixel and Ubisoft’s “specific practice of exposing Plaintiffs’ [personally identifiable information].”  Finally, the court rejected plaintiffs’ argument that the crime-tort exception to consent applied, concluding plaintiffs had not alleged that “the purpose of the interception” was to “perpetuate torts on millions of Internet users,” but rather, to “make money.”
• CIPA, California Constitution, and Common-Law Invasion of Privacy Claims:  The Court held that consent was also a “defense to all three claims” under CIPA, the California Constitution, and California common law, citing two Northern District of California cases, and dismissed them for the same reasons as the federal Wiretap Act claim.
• VPPA Claim:  Finally, the court held that Ubisoft’s disclosures satisfied each element of VPPA’s consent provision.  Section 2710(b)(2)(B) of the VPPA authorizes disclosure of a consumer’s personally identifiable information with the consumer’s “informed, written consent”—defined as: (i) “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer”; (ii) given when “the disclosure is sought” or “in advance for a set period of time” not exceeding two years; and (iii) where the consumer received “an opportunity, in a clear and conspicuous manner,” to opt out.  Here, the Court concluded that Ubisoft’s Cookies Banner satisfied the “written” and “informed” elements, and that its Privacy Policy and Cookies Banner satisfied both (i) the “distinct and separate” requirement—agreeing that “courts routinely classify such policies as ‘disclosures’ or ‘statements’ by companies, not as obligations of the users”—and also (ii) the timing requirement, since “consent is elicited with each and every purchase on the Website . . . which for every class member, must have fallen within the last two years.”

The Court denied plaintiffs’ request for leave to amend and dismissed the claims with prejudice, concluding amendment would be “futile” because plaintiffs could not “amend their complaint to overcome the issue of consent.”  This decision illustrates a company’s ability to wield a consent argument to potentially defeat, at the pleading stage, federal and state-law claims arising from their use of commonplace website marketing or analytics pixels.