US companies are on course to pay more than $1.4 billion in 2026 to settle class actions alleging that their websites and mobile apps shared personal data without proper consent, according to the 2026 Website & App Privacy Litigation Report that Privado AI published on October 5, 2026. The New York privacy software company puts the rise at 36% on 2025. Its estimate rests on 116 publicly disclosed settlements reached between January 2025 and August 2026, a set in which Meta's advertising tracker is named 100 times, healthcare providers account for nearly two in three defendants and wiretapping statutes written in the 1960s carry most of the legal weight.

In Short

Many companies put small pieces of code from Meta, Google and other ad firms on their websites and apps, and people are suing those companies for passing along what visitors do there without asking first. A firm that sells privacy-checking software studied 116 of these cases that ended in settlements and estimates that companies will pay more than $1.4 billion in 2026, mostly under old phone-tapping laws that let anyone sue. A new California law shuts off one kind of these claims from January 2027, but the cases it covers made up only 3% of those in the study.

What Privado AI counted

Privado AI, founded in 2020 and based in New York, sells software that audits websites and apps for privacy compliance. In September 2026, according to the report, the company reviewed every publicly available website and app privacy class action settlement it could find with an agreement date between January 1, 2025 and August 31, 2026. For each one it recorded the defendant, the settlement amount, the laws allegedly violated, whether the tracking happened on a website or in an app, and the third-party trackers named in the allegations.

That produced 76 settlements from 2025 and 40 from 2026. According to the report, the 2025 group represents 43% of an estimated 175 website and app privacy class action settlements agreed that year, and the 2026 group 29% of an estimated 140 agreed between January and August. "Very little is publicized about most website and app privacy settlements," the report states.

The definitions are broad on one side and narrow on the other. A website and app privacy lawsuit, in Privado AI's terms, is any suit against a company "for unlawful collection or sharing of personal data from the company's websites or mobile apps." Data breach cases, where stolen data was not properly secured, are excluded.

The annual figures are modeled rather than counted. Lawsuit volumes were extrapolated from Duane Morris research, americanbar.org, hipaajournal.com and claimdepot.com. Figures for 2026 are annualized from filings recorded through August and from growth rates between 2022 and 2025. Each year's total settlement amount is the estimated number of settlements multiplied by a mean settlement amount; for 2025 and 2026 that mean comes from the 116 cases, while for 2022 to 2024 it is extrapolated from sampled settlements.

Privado AI sells tools aimed at the risk the report measures. A section of the report describes its Web Auditor and App Auditor products, which scan live websites and apps and record whether each visitor's consent choice is honored.

From 200 lawsuits to a projected 3,500

The report's macro estimates show how quickly the volume has grown since 2022.

Year Website and app privacy lawsuits filed Class actions filed Class action settlements Total settlement amount
2022 200 125 20 $0.45bn
2023 600 400 60 $0.30bn
2024 1,050 525 120 $0.72bn
2025 1,900 750 175 $1.03bn
2026 (January to August) 2,350 640 140 $0.94bn
2026 (annualized) 3,500 950 210 $1.41bn

On those numbers, lawsuits filed rose roughly 18-fold between 2022 and 2026, class actions filed about eight-fold and class action settlements about 11-fold. The total paid is up 370% since 2023. The 2022 total exceeds 2023's despite there being a third as many settlements, because of a single $90 million payment in the In re Facebook Internet Tracking case; according to the report, only about 19 other settlements were agreed that year. The mean settlement has climbed from $5 million in 2023 to $6.7 million in 2026.

Even the 3,500 figure, according to Privado AI, misses most of the activity. The report cites an estimate by the law firm Constangy of 50,000 to 100,000 website or app privacy claims between 2022 and 2025, and Privado AI's announcement adds that most demand letters are settled privately. Constangy's own newsletter of February 18, 2026 presents that range as an extrapolation covering claims since 2022 and notes that there is no general consensus on the number.

"Privacy claims are rising fast," said Vaibhav Antil, chief executive of Privado AI. "Most of the companies facing litigation had a consent management platform in place, and they are not as covered as they thought. The 116 public settlements we have analyzed in our report are the tip of the iceberg. It's estimated there were as many as 100,000 privacy claims against companies between 2022 and 2025. Many will have settled privately, so the real cost to companies is likely far higher than the $1.4 billion paid out in public class action settlements."

The $1.4 billion has not been paid out. It is a projection for the full year, built from an estimated 210 settlements and a mean drawn from 35 of them.

An average lifted by two cases

According to the report, the average settlement in 2026 is $6.7 million, 12% above the $6.0 million recorded for 2025. The report attributes the increase to two large cases: In re Google Assistant Privacy Litigation, at $68 million, and Frasco v. Flo Health, Inc., Meta Platforms, Inc., Google LLC, and Flurry, Inc., at $59.5 million.

The report's case list allows a closer look. By PPC Land's calculation, 35 of the 40 settlements from 2026 disclose a total, and those totals add up to $235.7 million. The Google Assistant and Flo cases account for $127.5 million of it, or 54%. The median 2026 settlement is $1.93 million, down from $2.85 million across the 53 settlements from 2025 with disclosed amounts. Without the two largest cases, the 2026 mean falls to about $3.3 million. Put through Privado AI's own formula of 210 settlements multiplied by the mean, that would give a 2026 total near $690 million, roughly half the headline figure. The report presents neither a median nor a range.

The dating of the Flo settlement matters too. PPC Land reported on August 7, 2025 that Google had settled the Flo case in July 2025 and Flo Health in early August, while a federal jury found on August 4, 2025 that Meta had violated the California Invasion of Privacy Act through its software in the Flo app. Meta did not settle. The report books the $59.5 million as a 2026 agreement without explaining the date. Had it been counted in 2025, PPC Land's calculation puts the 2026 average of disclosed settlements at about $5.2 million and the 2025 average at about $7.0 million, which would turn the 12% rise into a fall. The Google Assistant timing is clearer: Google sought preliminary approval of the $68 million deal in January 2026.

A further 28 of the 116 settlements disclose no total at all and are left out of the averages. Most involve hospitals and health systems that agreed claims-made settlements or fixed per-person payments, typically between $15 and $38, often with credit monitoring. Banner Health's 2026 settlement covers 1,028,000 class members at $20 each plus monitoring; Akron Children's Hospital's 2025 deal covers 313,700 people at $19 each. Across all 88 settlements with a disclosed amount, the documented total for the 20 months comes to about $555 million, by PPC Land's count.

Wiretap statutes do the heavy lifting

The legal finding at the center of the report is that laws drafted for telephones, not modern privacy statutes, are producing the settlements.

The Federal Wiretap Act was enacted in 1968 to cover wire and oral communications and amended in 1986, as part of the Electronic Communications Privacy Act, to cover electronic ones. It appears in 58% of the 2025 settlements and 53% of those from 2026, according to the report. The California Invasion of Privacy Act, passed in 1967 to stop covert recording of phone calls, rose from 20% to 43%, an increase of 115%. Wiretap laws in eight other states rose from 25% to 38%.

The reason is who may sue. California's Consumer Privacy Act and the more than 20 state privacy laws enacted since 2020 do not allow a private right of action, according to the report; only regulators can enforce them. Wiretap statutes let any individual or group file suit and set fixed damages per violation, which the report puts at $10,000 per violation under the federal act and $5,000 under CIPA. According to the report, 54% of settlements involving the federal statute also included state wiretap allegations. "Lawyers have figured out through the courts that wiretapping laws are general enough to cover any device that is recording or intercepting an individual's communication without proper consent," the report states.

The contrast with California's flagship privacy law is stark. "In comparison to the tens of companies that have paid penalties for violating CCPA since enforcement began in 2020, thousands of companies have been sued for allegedly violating CIPA in just the past few years," according to the report. Forty-nine states have had active wiretap laws since 1996, the report notes, yet significant settlements against website operators began only in 2022.

Beyond wiretapping

More than 20 statutes appear across the 116 settlements. The federal Video Privacy Protection Act, which covers sharing of video viewing data with personally identifiable information, fell from 26% of settlements in 2025 to 10% in 2026. California's Confidentiality of Medical Information Act held roughly steady at 16% and 15%. State consumer protection and deceptive practices acts dropped from 14% to 8%.

Several state wiretap laws grew from small bases. Florida's Security of Communications Act rose from 5% to 13%, the Illinois Eavesdropping Act from 4% to 10% and Pennsylvania's Wiretapping and Electronic Surveillance Control Act from 5% to 8%. California's Unfair Competition Law climbed from 3% to 10%. Ohio's Wiretap Act and the Washington Privacy Act, each present in 4% of 2025 settlements, appear in none from 2026. One newcomer in 2026 stands apart: the Pennsylvania Uniform Firearms Act appears in two settlements, 5% of the 2026 total, both against outdoor retailers, The Sportsman's Guide and Sportsman's Warehouse.

Averages differ sharply by statute. Settlements with CIPA claims averaged $9.44 million across 30 cases, those citing the medical information act $9.11 million across 17, federal wiretap cases $6.49 million across 41, wiretap laws outside California $4.25 million across 25 and video privacy cases $3.73 million across 22. Three settlements carrying both CIPA and medical information claims pulled the California averages up, according to the report: Flo Health at $59.5 million, Kaiser at $46 million and GoodRx at $32 million.

Statutory claims anchor almost everything. They appear in all of the 2025 settlements and 98% of those from 2026; the exception is a $220,000 settlement by Mount Sinai Medical Center in Miami Beach that rested on common-law claims alone. Seven common-law theories recur, led by invasion of privacy or intrusion upon seclusion, unjust enrichment and negligence. "Common law allegations are critical for strengthening the overall complaint, and they sometimes survive dismissal when wiretapping allegations do not," according to the report.

SB 690 reaches 3% of the cases

California has just narrowed one of these routes. The state Assembly approved SB 690 by 66 votes to none on August 28, 2026 and the Senate concurred 40 to none the same day, PPC Land reported. Governor Gavin Newsom signed it on September 30, the last day available to him. From January 1, 2027, only the Attorney General may sue over website, online app or mobile app tracking under CIPA Section 638.51.

That section bans installing or using a "pen register or a trap and trace device" without a court order. Historically, a pen register recorded the numbers dialed from a phone and a trap and trace device captured incoming numbers. According to the report, plaintiffs argue that analytics scripts, pixels, ad-tech tags, session replay tools and chat widgets serve the same function online, sending IP addresses, device and browser identifiers, referring URLs and similar "dialing, routing, addressing, or signaling" data to third parties in real time.

The report's data suggest the reform touches a small slice of the money. Only 3% of the 116 settlements, three cases, included Section 638.51 allegations. All three come from 2026 and all three involve publishers, by PPC Land's reading of the case list: Forbes paid $10 million in a case naming LinkedIn Ads and Microsoft Ads, the Los Angeles Times $3.85 million and Fandom's GameSpot $1.2 million, the last two in cases naming TripleLift, GumGum and Audiencerate.

CIPA appears in 28% of all 116 settlements. Of those, 88% included Section 631, the wiretapping provision, which SB 690 leaves intact; 13% included Section 632 and 9% Section 638.51. According to the report, Section 631 bars any third party, or a company that "aids" a third party, from intercepting or duplicating a communication in transit. Plaintiffs argue that pixels, analytics scripts, SDKs or real-time bidding tools violate it when they send visitor data to Google, Meta or other vendors before consent is obtained. Section 632 covers the recording of "confidential communications" without the consent of all parties; plaintiffs use it against session replay tools, chatbots, search bars, fillable forms and any tracking that captures keystrokes.

Matthew Pearson, a privacy partner at the law firm Frankfurt Kurnit, is quoted in the report. "The signing of SB 690 into law is a welcome change to the current privacy-litigation landscape in California. But web- and app-based tracking claims are not going away," he said. "We are already seeing plaintiffs pivot to other sections of CIPA (i.e., 631 and 632) and to different statutes altogether (i.e., California's Comprehensive Computer Data Access and Fraud Act)." The bill, he added, "in no way eliminates the risk of web- and app-based tracking claims."

That reading matches an IAB legal paper written by FTI Consulting and distributed on October 1, which warned that websites still face $5,000 wiretap claims after SB 690 and that the reform is no substantive safe harbor for ad tech. The scale of the litigation remains disputed. Figures of roughly 4,000 lawsuits circulated around the signing, but the sources behind them do not agree on what that number counts. Privado AI's own estimates put website and app privacy lawsuits at 1,900 in 2025 and 2,350 in the first eight months of 2026.

Hospitals settle most often, apps cost more

Healthcare companies make up 64% of the 2025 and 2026 settlements, followed by media and entertainment at 16%, e-commerce at 9%, technology at 4%, insurance and health and fitness at 3% each and education at 1%. "Sharing health data causes the most settlements, likely because it's easiest for plaintiffs to show harm compared to other types of data sharing," the report states, adding that for healthcare websites and apps "any personal data shared almost always includes health data."

Healthcare settlements are frequent but modest, averaging $5.15 million across 49 cases with disclosed amounts and 25 without. The largest averages belong to technology, at $26.84 million across four disclosed settlements, and health and fitness, at $22 million across three. Insurance follows at $8.72 million, media and entertainment at $3.86 million, e-commerce at $2.65 million and education at $2.25 million from a single case.

The technology figure says more about Google than about the sector. Three of the five technology defendants in the case list are Google matters: the Google Assistant settlement at $68 million, a YouTube children's privacy case at $30 million and a Google Play and AdMob case at $8.25 million. According to the report, the Google lawsuits had classes of more than 10 million people. The fourth disclosed amount, $1.1 million, comes from a case brought by the People of the State of California against TaxSlayer, a state action rather than a private class suit. PowerSchool's settlement amount was not disclosed. Health and fitness is shaped the same way, with Flo's $59.5 million alongside V Shred at $4 million and FitOn at $2.5 million.

Apps are where the report sees the next shift. Every settlement reached in 2025 involved a website. In the first eight months of 2026, 8% involved a mobile app alone, three cases by PPC Land's count: Google Assistant, Flo and Google Play. According to the report, settlements with any app tracking allegation paid 3.5 times more than those limited to website tracking. The case list supports that: the 23 settlements with app allegations and disclosed amounts averaged $13.3 million, against $3.8 million for 65 website-only settlements. The medians, $4.5 million and $1.9 million, put the gap nearer 2.3 times.

The report argues the gap in volume is about evidence, not conduct. "In theory, there should be just as many settlements from mobile apps because the laws apply the same and personal data sharing is equally prevalent. The only reason for the disparity is that data sharing evidence is much easier to gather on websites," it states. When app evidence can be gathered, settlements tend to be larger because apps "share more personal data clearly tied to an individual." App cases can also reach juries. In September 2025, a jury ordered Google to pay $425.7 million over data collected through its Firebase software from users who had switched off Web & App Activity, a verdict that sits outside the settlement data.

Meta's tracker in 91% of tracker cases

Among the settlements that named a third-party tracker, 91% alleged unlawful data sharing through the Meta Ads tracker, 51% named Google Analytics and 15% Google Ads, according to the report. By PPC Land's count, 110 of the 116 settlements name at least one tracker, and Meta appears in 100 of them.

Twenty other trackers surface in the allegations: LinkedIn Ads, Attentive Mobile, Audiencerate, GumGum, Microsoft Ads, TikTok Ads, TripleLift, Adobe Ads, AppsFlyer, Criteo, Datadog, Dynatrace, Flurry, Geonetric, Heap, MixPanel, Naviance, Quantum Metric, Snap Ads and X/Twitter Ads. The report cautions that the tracker data "isn't comprehensive. Plaintiffs only mention a handful of well-known trackers in the class action complaints." The $46 million Kaiser Permanente settlement, the third-largest in the set, names no Meta tracker at all; the trackers listed for it are Quantum Metric, Adobe Ads, Google Ads, Microsoft Ads, X/Twitter Ads and Dynatrace.

Most of the settling companies are the hospitals, publishers, retailers, insurers and app makers that placed the trackers. Ad platforms appear as paying defendants mainly in cases over their own products, such as Google Assistant, and in the Flo case, where Google settled alongside the app maker. Cases still in court follow the same pattern. A suit filed on March 12, 2026 accuses Ace Hardware of tracking users who had opted out of cookies, alleging that Google Analytics and a Bazaarvoice pixel kept firing after visitors declined non-essential cookies, under both the federal Wiretap Act and CIPA. In Washington, IAB filed a brief supporting Seattle Children's Hospital in April 2026, arguing that a broad reading of the state's 1967 privacy act would threaten ad measurement.

Privado AI's announcement points to a tracker that none of the settlements yet covers. According to the company, independent security research published in September 2026 found a cookie set by OpenAI recording free-tier ChatGPT users' activity across more than 1,000 merchant websites, while OpenAI's cookie policy classifies the tracker as analytics rather than marketing. "The OpenAI cookie works in the same way as the Meta pixel," according to Privado AI.

The research it cites appeared on September 20, 2026 on the blog Buchodi's Threat Intel. It describes a cookie named __obi, set on OpenAI's domain with a one-year lifetime, and counts 936 distinct advertiser pixels across 1,029 hostnames. The post states that OpenAI's cookie policy lists __obi among analytics cookies and that OpenAI did not answer the author's questions. It discusses both account-linked and logged-out sessions; the description of the users as free-tier comes from Privado AI's account rather than from the research.

OpenAI has been building ad measurement for ChatGPT for months. In May 2026, OpenAI moved ChatGPT ads toward conversion optimization, giving advertisers a JavaScript pixel and a Conversions API, with click identifiers stored in a first-party cookie. The settlement data end on August 31, 2026, so no case in the report involves OpenAI's tags.

The report's broadest claim concerns the tools companies already use. "What surprises most companies is that they thought they were covered," Antil writes in its foreword. "Nearly all of these companies had consent management platforms (CMPs) in place, but CMPs were never built to verify compliance." The report gives no figure for how many of the 116 defendants ran a consent management platform, and its case list does not record it.

According to the report, "CMPs are designed purely to set up consent banners and limit data flows based on consent." It names three failure points. If the consent tool does not load before third-party pixels and scripts fire, data leaves before consent is collected. Many tools rely on static cookie categorization libraries, so advertising cookies get miscategorized and dropped when they should be blocked. And without strict governance, third-party tools are added to websites without the privacy team's knowledge.

The report also lists the California privacy violations that, in its view, most often turn into wiretap litigation: Global Privacy Control browser signals not honored; opt-outs through banners or forms not honored, whether through advertising cookies or network requests, or not carried across devices and environments such as web, mobile and connected TV; opt-out forms that demand personal data; sensitive data such as location or health information shared without explicit consent; and data shared with third parties without a compliant contract.

Its list of practices that raise wiretap risk when combined with third-party ad tech is specific. It includes vague privacy disclosures, sharing health or financial data without explicit consent, click-through surveys, search terms embedded in URLs and online appointment booking, along with session replay tools such as Hotjar and FullStory running without masking and third-party chatbots without disclosures. For the video privacy law, the risk it identifies is personally identifiable information shared with viewing history without explicit consent.

Antil framed the exposure in cost terms. "Consent tools don't prove compliance, and a plaintiff's lawyer needs little more than a browser to find evidence that a site has failed to honor a visitor's choice," he said. "At $6.7 million on average per settlement, a business has to catch every pixel, tag and data flow before it turns into a demand letter."

Why this matters for marketers

For the advertising industry, the report describes a liability that sits in the measurement stack. The tags that appear most often in these settlements, Meta's tracker, Google Analytics and Google Ads, followed by LinkedIn, TikTok, Snap, Criteo and AppsFlyer, are the same ones advertisers rely on for conversion tracking and audience building. In most of these cases the cost of a misfiring tag falls on the business that installed it rather than on the platform that receives the data.

The concentration in healthcare is striking: nearly two in three settling defendants are hospitals, clinics, telehealth services or other providers. Publishers, meanwhile, account for every Section 638.51 settlement in the set, cases built around supply-side tools such as TripleLift, GumGum and Audiencerate as well as LinkedIn and Microsoft tags. SB 690 removes private suits under that section from January 2027, but the Section 631 wiretap claims behind most CIPA settlements remain.

The headline figure rests on assumptions. The $1.4 billion is an annualized projection that multiplies an estimated count of settlements by a mean shaped by two cases, one of which, the Flo settlement, PPC Land reported in 2025. The direction of the report's data is consistent, though: more filings each year, a steady shift from website-only claims toward apps and more statutes in play. Whether the narrowing of one CIPA provision changes that trajectory will only show in filings from 2027.

Timeline

Summary

Who: Privado AI, a New York privacy software company founded in 2020, led by chief executive Vaibhav Antil, with commentary from Matthew Pearson of Frankfurt Kurnit. The 116 settling defendants include Google, Kaiser Permanente, GoodRx, Sutter Health, Forbes and the Los Angeles Times; healthcare providers make up 64% of them.

What: The 2026 Website & App Privacy Litigation Report projects more than $1.4 billion in US website and app privacy class action settlements in 2026, up 36% from an estimated $1.03 billion in 2025, with the mean settlement at $6.7 million. Wiretap laws dominate: the federal Wiretap Act appears in 53% of 2026 settlements and CIPA in 43%. Meta's tracker is named in 91% of settlements that identify a tracker. PPC Land's analysis of the case list finds the 2026 median fell to $1.93 million and that two cases make up 54% of disclosed 2026 dollars.

When: Privado AI published the report on October 5, 2026. It covers settlements agreed between January 1, 2025 and August 31, 2026, with litigation estimates back to 2022. California's SB 690, signed on September 30, 2026, takes effect on January 1, 2027.

Where: United States courts, with California at the center through CIPA and SB 690, alongside state wiretap laws in Florida, Illinois, Pennsylvania and other states.

Why: Wiretap statutes let individuals sue for fixed damages per violation, while the newer state privacy laws can be enforced only by regulators. SB 690 removes one CIPA route, Section 638.51, which according to the report featured in just 3% of settlements, leaving the Section 631 wiretap claims behind most CIPA cases in place. For advertisers and publishers, the trackers in these cases are the standard tools of conversion measurement, and the cost of settling falls on the companies that install them.