Zeta Global Holdings Corp. must defend itself against a securities fraud lawsuit alleging the marketing technology company misrepresented how it obtained consent for a data set the company once described as covering 240 million opted-in individuals in the United States. U.S. District Judge Dale Ho of the Southern District of New York denied Zeta's motion to dismiss on July 8, 2026, in a 29-page ruling that found investors had adequately alleged the company made materially misleading statements about its data collection practices.

"Plaintiffs have adequately alleged materially misleading statements regarding Zeta's opted-in data set," Ho wrote, according to MediaPost. The ruling does not decide the case on its merits. Instead, it clears the path for the lawsuit to move into discovery, where both sides will gather evidence to support their positions.

A Zeta spokesperson said the company denies the "meritless claims" and expects "to prevail when this case is finally determined." The spokesperson added that Zeta remains "confident that our data gathering and management, as well as our privacy policies and practices, comply with applicable law and support our mission of delivering value for our clients and generating long-term shareholder value."

What the lawsuit alleges

The case, formally captioned In re Zeta Global Holdings Corporation Securities Litigation, centers on a 160-page amended class action complaint filed May 12, 2025, in the Southern District of New York. Lead plaintiffs Allegheny County Employees' Retirement System and Amir Konigsberg bring the suit on behalf of a proposed class of investors who bought Zeta stock between February 27, 2024 and March 10, 2025. Named defendants include Zeta itself, chief executive David A. Steinberg, chief financial officer Christopher Greiner, chief data officer Neej Gore, and chief privacy officer Benjamin Hayes.

gov.uscourts.nysd.632276.92.0
gov.uscourts.nysd.632276.92.0.pdf
5 MB
download-circle

At the heart of the complaint is a claim that ran through years of Zeta's public statements: that the company's flagship data asset, marketed as the foundation of its Zeta Marketing Platform, consisted of more than 240 million "opted-in" individuals in the United States and more than 535 million globally, each tied to an average of more than 2,500 data attributes. Defendants described this data set as "philosophically" central to the business, a phrase Greiner used when discussing Zeta's model with analysts, and one that recurred throughout the company's public filings and earnings calls.

According to the complaint, that description was false. The plaintiffs allege that when Zeta finally disclosed the actual scope of consumer opt-in consent, at a December 2024 investor event, the real figure was less than half of what had been claimed for years.

The December 2024 admission

On the morning of December 9, 2024, Zeta hosted what it called the "Zeta Data Summit," an event the company framed as an opportunity to provide "Greater Data Transparency" following weeks of market turmoil. During that presentation, defendant Gore made a disclosure the complaint characterizes as a turning point in the case. Rather than confirming the long-touted figure of 240 million opted-in Americans, Gore said the actual number of individuals with opt-in email permission was approximately 110 million, a subset of a broader 245 million people for whom Zeta claimed a different kind of "digital permission."

The complaint quotes Ari Waldman, a law professor at the University of California, Irvine, who characterized the admission bluntly: "Calling your data set the largest 'opted-in' data set and then admitting that less than half the people in that data set actually opted in is a straight up lie." Zeta's shares fell from an opening price of $26.10 to close at $22.97 that same day, according to the complaint, on unusually high trading volume.

Two and a half months later, on February 26, 2025, Zeta filed its annual report with the Securities and Exchange Commission. The filing removed every reference to "opted-in" data that had appeared in prior disclosures. Shares dropped from an opening price of $20.48 to close at $17.77 that day, then continued falling to $16.65 the following session, the complaint states.

The final piece of the alleged fraud, according to the complaint, emerged on March 10, 2025, when a subscription publication called The Capitol Forum reported on the language change and quoted a Zeta spokesperson who said the correction was made "to provide shareholders with clear and accurate disclosures" and to ensure the company's "terminology aligns with the nature of permissions across our data assets to prevent misinterpretations." The complaint argues this amounted to a tacit admission that the prior "opted-in" language had been neither clear nor accurate. Zeta's stock closed that day at $14.03 per share, the complaint states, down nearly 62% from its Class Period closing high of $36.74.

The Culper Research report and its aftermath

The chain of disclosures the complaint describes traces back to November 13, 2024, when an investment research firm called Culper Research published a report alleging that Zeta operated what it termed "consent farms." PPC Land's coverage at the time detailed how the report identified two separate areas of concern: a network of roughly 40 websites the researchers said were designed to collect personal data under false pretenses, and what Culper called "two-way" contracts in which Zeta allegedly acted as both supplier and buyer of consumer data with the same partners.

The complaint alleges the November 13 report caused Zeta's stock to fall from a daily high of $28.51 to close at $17.76, a decline of just over 37% on unusually heavy trading. Zeta responded within hours, calling the report "misleading" and "riddled with misrepresentations, speculative conjecture, and categorically false statements." A week later, on November 20, 2024, the company published a more detailed rebuttal titled "Setting the Record Straight," in which it stated flatly that it "does not operate 'consent farms.'" That same day, during an investor call hosted with the financial firm William Blair, defendant Gore told participants: "The one thing I want to make really clear is that we have 240 million people in our graph that are opted-in for tracking and monitoring for digital marketing, display ads, CTV ads, calculation of intent." Defendant Hayes, on the same call, said Zeta did not "operate any sites that trick or mislead consumers into giving us their data."

Steinberg reinforced that position on November 27, 2024, appearing on CNBC to address the allegations directly. Asked whether Zeta operated consent farms, he responded: "No. We never do consent farms... We have spent hundreds of millions of dollars over the years in acquiring companies that create first party, opted-in data, where we partner with the consumer... We never do that and we have never done that." The complaint contrasts these denials with the admission made less than two weeks later at the Data Summit.

The data science expert's investigation

Beyond corroborating Culper's original findings, the complaint describes an independent investigation commissioned by the lead plaintiffs and conducted by a data science expert with a doctorate in Information Management and Systems and more than 25 years of experience, including prior testimony before Congress and the Federal Trade Commission.

Using the digital marketing analytics firm Semrush, the expert calculated that the 40 websites named in the Culper Report received approximately 161.3 million visits and 82.9 million unique users between March and November 2024, the period overlapping most of the Class Period. Of the original 40 sites, the expert found that 22 were no longer reachable by the time of the investigation, with 12 of those disabled shortly after the Culper Report's publication. Of the 18 sites still active, the expert determined that 14 relied on what the complaint calls a passive consent mechanism, and ultimately concluded that 15 of the 18 met the Federal Trade Commission's definition of a consent farm: a site that uses deceptive or manipulative design to induce visitors to hand over personal information while obscuring how that information will be used.

The complaint also describes a technique the expert calls "leaky form" behavior, in which a website transmits data entered into an online form to its servers in real time, character by character, without waiting for the user to click submit or complete the process. Under this design, according to the complaint, a website can capture a visitor's name, email address, and phone number even if that visitor abandons the page before finishing. The expert cited jobslaunch.com as one example, describing a site that displayed dozens of corporate logos, including those of Amazon, FedEx, Apple, and Disney, inserted through a URL parameter with no actual connection to those companies' job postings.

The Disqus allegations

A separate and central thread in the complaint concerns Disqus, the comment-hosting platform Zeta acquired in December 2017 for a reported $90 million, which the complaint says accounted for up to 33% of the data in Zeta's data cloud at the start of the Class Period. During an August 2023 investor conference, Greiner had told analysts that Disqus data came through "an opt-in process to be part of Zeta's data club."

The complaint disputes that characterization directly. It alleges that Disqus's registration page, largely unchanged since Zeta's acquisition of the platform, requires users to sign up and share personal information first, without any option to check or uncheck a consent box at that stage. Only afterward, the complaint states, can a user locate a separate opt-out mechanism buried within Disqus's privacy policy. "A user who signs up for Disqus must first 'Sign-Up' and share his or her information, and then, afterwards, must later access Disqus' separate privacy policy to effectuate an 'opt-out,'" the plaintiffs alleged, according to court papers that included a screenshot of the platform's sign-up page.

The complaint quotes Alessandro Acquisti, a professor of information technology and public policy at Carnegie Mellon University's Heinz College, who told The Capitol Forum: "During the account creation phase, there is no option to set one's privacy preferences, nor is there an option to stop one's data from being used and sold that way... So: that's not an opt-in... that's a 'take it or leave it.'"

Zeta's defense

Zeta sought dismissal on several grounds. Among them, the company argued that even if the allegations were proven true, they would not establish that it misrepresented consumer data. In a July 2025 motion, Zeta wrote: "There are different types of consumer consent. For digital marketing, Zeta obtains opt-in permission from users who register for a website or agree to terms of service... For email marketing, which constitutes a subset of the 245 million users in Zeta's broader opted-in dataset, users must provide specific consent to receive emails."

On the Disqus allegations specifically, the company argued the screenshot cited by plaintiffs actually supported its position. Zeta stated the image "shows on its face that Disqus users were required to consent to the site's privacy policy and terms of service to register for the platform... exactly as Zeta disclosed... and thus opted in to sharing data."

The plaintiffs rejected that interpretation, arguing in response that the complaint "adequately alleges that Zeta's data collection practices included user data that could not be defined as 'opt-in' under any definition, such as Disqus' policy."

Judge Ho's July 8 ruling sided with the plaintiffs on the question of whether the complaint's allegations, if true, could support a finding that Zeta's statements were misleading. A Zeta spokesperson emphasized that the ruling was not a decision on the merits, noting that at this stage Ho was "required to accept the allegations in the complaint as true solely for purposes of evaluating the motion." Ho ordered both sides to submit a letter by July 22, 2026, outlining the next steps in the case.

The scienter allegations

Separate from the consent dispute, the complaint devotes substantial attention to trading activity by Steinberg during the Class Period, which the plaintiffs offer as evidence of motive. According to the complaint, Steinberg never sold a single share of Zeta common stock directly in an open-market transaction during the period covered by the lawsuit. Instead, the plaintiffs allege he divested through a network of limited liability companies and trusts, structured in a way that avoided the reporting obligations Section 16 of the Securities Exchange Act imposes on corporate officers.

Based on its own review of available filings, the complaint estimates Steinberg sold at least 13,371,398 shares of Zeta Class A common stock through these entities, for total proceeds of $270,660,177.43. Of that total, the complaint alleges more than 74%, or roughly $201.2 million, was sold under less restrictive 30-day cooling-off periods rather than the standard 90-day window applicable to corporate insiders. More than 59%, or roughly $160 million, was sold during quarterly blackout windows that Zeta's own insider trading compliance policy was designed to prevent. An additional $25,662,196.80, the complaint alleges, was sold in a manner that would ordinarily trigger the forfeiture provisions of Section 16(b)'s short-swing profit rule.

The complaint does not allege that this trading activity was itself illegal in isolation. Rather, it presents the structure and timing of the sales as evidence that Steinberg had a personal financial incentive to maintain Zeta's stock price at an inflated level while the company's public statements about its opt-in data set remained unchanged.

Why this matters for the marketing industry

The case sits at an intersection increasingly familiar to the advertising technology sector: the gap between how a company describes its data provenance to investors and customers, and how that data was actually collected. PPC Land's earlier report on Culper's initial allegations noted that the report drew explicit comparisons between Zeta's alleged practices and those of Fluent, a company the Federal Trade Commission charged in July 2023 with operating what regulators called a "massive 'consent farm' enterprise." That comparison is not incidental. It reflects a pattern regulators and plaintiffs' firms have increasingly scrutinized across the marketing data supply chain, where the legal distinction between "opt-in" and "opt-out" consent can carry significant weight for compliance exposure.

Zeta built much of its identity resolution infrastructure through acquisition, a strategy that continued well past the period covered by this lawsuit. The company's October 2024 agreement to acquire LiveIntent for $250 million added an identity graph processing more than 235 million unique hashed email addresses monthly, expanding the kind of first-party data infrastructure at the center of the current dispute. For marketers and publishers who rely on vendors' data provenance claims when making compliance decisions of their own, the outcome of discovery in this case may offer a rare, court-supervised look at how those claims are constructed internally.

The case also arrives amid a broader wave of securities and fraud actions touching the marketing technology sector. A separate matter disclosed in Zeta's own SEC filings involves subpoenas the company and its senior executives received in connection with an investigation into Kubient, a company Zeta had worked with prior to its 2021 initial public offering. That inquiry is unrelated to the opt-in data claims at issue in this lawsuit, but it reflects a sector where, as PPC Land reported when Kubient's former chief executive pleaded guilty to accounting fraud, fabricated performance claims have drawn criminal as well as civil scrutiny. Consent architecture, meanwhile, has become its own distinct battleground; PPC Land has also tracked how federal courts have begun shaping consent-related product changes at some of the largest platforms in digital advertising, a reminder that judicial oversight of data practices now extends well beyond any single company's disclosures.

For the marketing technology industry specifically, the Zeta case underscores a structural tension. Companies that built valuable, differentiated data assets through years of acquisitions face a fundamental disclosure question: what does "opt-in" mean when the consent was collected years earlier, by a different company, under a different privacy policy, and later folded into a combined data set marketed under a single figure? The complaint suggests Zeta's answer to that question shifted meaningfully between 2024 and 2025. Whether that shift reflected fraud, as the plaintiffs allege, or a legitimate refinement of imprecise language, as Zeta maintains, will now be tested through discovery rather than resolved at the pleading stage.

Timeline

  • December 2017 - Zeta acquires Disqus, the comment-hosting platform, for a reported $90 million.
  • June 10, 2021 - Zeta completes its initial public offering, pricing shares at $10 and touting its "opted-in" data set as central to its business model.
  • February 27, 2024 - The Class Period begins, coinciding with Zeta's Q4 2023 earnings call.
  • November 13, 2024 - Culper Research publishes a report alleging Zeta operates consent farms; Zeta's stock falls 37% intraday to close at $17.76.
  • November 20, 2024 - Zeta publishes its "Setting the Record Straight" rebuttal and hosts an investor call defending its 240 million opted-in figure.
  • November 27, 2024 - CEO David Steinberg denies operating consent farms in a CNBC interview.
  • December 9, 2024 - At the Zeta Data Summit, Chief Data Officer Neej Gore discloses that only about 110 million individuals had actual opt-in email permission, not 240 million.
  • February 26, 2025 - Zeta's annual report to the SEC removes all references to "opted-in" data.
  • March 10, 2025 - The Capitol Forum reports on the removed language; the Class Period ends with Zeta shares closing at $14.03, down nearly 62% from their Class Period high.
  • May 12, 2025 - Lead plaintiffs file the 160-page amended class action complaint.
  • July 2025 - Zeta files its motion to dismiss the amended complaint.
  • July 8, 2026 - Judge Dale Ho denies Zeta's motion to dismiss.
  • July 22, 2026 - Deadline for both parties to submit letters outlining next steps in the case.

Summary

Who: Zeta Global Holdings Corp., its chief executive David A. Steinberg, chief financial officer Christopher Greiner, chief data officer Neej Gore, and chief privacy officer Benjamin Hayes are defendants in a securities class action brought by lead plaintiffs Allegheny County Employees' Retirement System and Amir Konigsberg, presided over by U.S. District Judge Dale Ho.

What: A federal judge denied Zeta's motion to dismiss a lawsuit alleging the company misrepresented the scope of consumer opt-in consent behind a data set it described as covering more than 240 million individuals in the United States, when the actual figure with opt-in email permission was later disclosed as approximately 110 million.

When: Judge Ho issued the ruling on July 8, 2026. The underlying complaint covers a Class Period running from February 27, 2024 through March 10, 2025, and was filed in amended form on May 12, 2025. Both parties must submit a letter outlining next steps by July 22, 2026.

Where: The case is pending in the U.S. District Court for the Southern District of New York, where Zeta is headquartered.

Why: The ruling allows investors to proceed into discovery on claims that Zeta's public statements about its "opted-in" data set, including allegations concerning its Disqus commenting platform and a network of websites the plaintiffs describe as consent farms, were materially misleading and inflated the company's stock price before a series of disclosures caused shares to decline nearly 62% from their Class Period high.