Robinson vs. Meta Platforms and the Cdafa Consent Defense

The California Comprehensive Computer Data Access and Fraud Act (CDAFA)—a 1980s computer crime statute—has become a fixture of the web tracking class action complaint, pleaded alongside California Invasion of Privacy Act (CIPA) wiretapping and pen register counts against pixels, advertising SDKs, chatbots, and session replay.

Know what’s on your site before a plaintiff’s firm does

A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.

The California Comprehensive Computer Data Access and Fraud Act (CDAFA)—a 1980s computer crime statute—has become a fixture of the web tracking class action complaint, pleaded alongside California Invasion of Privacy Act (CIPA) wiretapping and pen register counts against pixels, advertising SDKs, chatbots, and session replay tools. Utilizing a successful consent defense, Meta Platforms, Inc. recently procured the dispositive dismissal of a CDAFA class action alleging that it improperly collected and monetized Facebook and Messenger users’ voice data. Robinson v. Meta Platforms, Inc., No. 3:26-cv-01616-CRB, 2026 WL 2722540 (N.D. Cal. Sept. 15, 2026).

The dismissal turned entirely on consent. Because the plaintiff accepted Meta’s Terms of Service—which incorporated a privacy policy and jurisdiction-specific supplemental notices disclosing that “voice recordings . . . may be used to identify” users and personalize advertising—Meta could not have used the plaintiff’s data “knowingly” and “without permission,” defeating the CDAFA count outright. Robinson arrives at a consequential moment: Governor Newsom signed Senate Bill 690 (SB 690) on September 30, 2026, eliminating the private right of action for website-based CIPA pen register and trap and trace claims effective January 1, 2027, with reach-back to actions filed on or after January 1, 2025. As the plaintiffs’ bar shifts to CIPA § 631 and CDAFA, the quality of a defendant’s consent record will decide more motions than ever.

Robinson is the clearest recent articulation of a consent-based defense to CDAFA claims built on ordinary, multi-document online terms: permission obtained “in the first instance” through accepted terms negates the knowledge element; disclosures may be spread across several properly incorporated and linked documents; a broad disclosure is not an ambiguous one; and a plaintiff claiming “limited purpose” consent must allege that the company was actually put on notice of the limitation.

The bottom line: An accurately worded, well-incorporated disclosure chain can end a CDAFA tracking count before discovery—but the defense is only as good as the match between disclosure and technology, and it is weakest where the plaintiff is an anonymous visitor who never clicked “I agree.”

The Robinson plaintiff alleged Meta used audio captured through its apps to identify users and target ads, and pleaded a single claim under CDAFA § 502(c)(2), which prohibits “knowingly” and “without permission” taking, copying, or using data from a computer. Meta moved to dismiss on four grounds; the court reached only one—failure to plead that Meta knew it lacked permission.

Because “the term ‘knowingly’ modifies each element of the alleged violation,” a CDAFA defendant must have known it lacked authorization, and a defendant that obtains permission “in the first instance” does not violate the statute. The plaintiff conceded he accepted Meta’s Terms of Service, which incorporated privacy notices disclosing that “voice recordings . . . may be used to identify” users and to personalize ads. The court rejected each of his three attempts to escape that assent:

The court also distinguished Brown v. Google LLC, 525 F. Supp. 3d 1049 (N.D. Cal. 2021)—the “incognito mode” litigation where Google allegedly promised privacy and used scripts that circumvented opt-outs. Meta, by contrast, disclosed the use, and the plaintiff did not allege that it acted “surreptitiously.” Nor did a later in-app permission pop-up that failed to mention the data use undermine consent: that notification “necessarily comes after a user’s initial consent to the Terms of Service,” and permission in the first instance is all that CDAFA requires. Because plaintiff’s counsel conceded at the hearing that no amendment could cure a finding of consent, dismissal was without leave to amend.

CDAFA’s Growing Role in Web Tracking Litigation

The California web tracking complaint has followed a familiar template: CIPA § 631 (wiretapping) and § 638.51 (pen register/trap and trace) counts, a CDAFA count, intrusion upon seclusion, a constitutional privacy claim, and a UCL tag-along. CDAFA earned its place because it requires no “communication” in transit, is not subject to CIPA’s party exception, and carries its own damages and attorney’s fee provisions. That role is about to grow.

SB 690 amends CIPA § 637.2 so that only the California Attorney General may bring § 638.51 claims based on websites, online applications, or mobile applications, operative January 1, 2027. CIPA § 631, the federal Wiretap Act, and CDAFA are untouched, and plaintiffs’ shops are already re-pleading pixel allegations under § 631 alongside CDAFA.

That makes CDAFA’s knowledge and permission elements a central battleground, and recent decisions show where the line falls. Tsering v. Meta Platforms, Inc., No. 3:25-cv-01611-RFL, 2026 WL 89320 (N.D. Cal. Jan. 12, 2026), dismissed CDAFA claims over SDK geolocation data collection where the plaintiffs failed to allege Meta knew that users had not consented. Months later, in In re Meta Android Priv. Litig., 833 F. Supp. 3d 1010 (N.D. Cal. 2026), the same judge denied a bid to dismiss a CDAFA claim at the pleading stage where Meta’s modified pixel allegedly circumvented Android’s sandboxing protections to match browsing data to logged-in accounts—conduct no reasonable user could read the privacy policy to authorize, and whose secretive implementation supported an inference of knowledge.

What the Consent Defense Requires—and Where It Fails

Read together, recent decisions define the CDAFA consent defense with unusual precision. It is likely to succeed where: (1) the user affirmatively assented to terms at sign-up, checkout, or account creation; (2) the privacy policy and any cookie notice are expressly incorporated into, and linked from, those terms; (3) the disclosure describes the practice in functional terms—what is collected, with whom it is shared, and why—even if it does not name the vendor or script; and (4) the defendant did nothing surreptitious to defeat the expectations the disclosure creates. It likely fails where the technology does something a reasonable reader could not anticipate, where the company circumvents browser or platform protections, or where it has been put on notice that a user limited or withdrew consent.

Robinson v. Meta Platforms is a meaningful defense win that can be relied on by companies in defending a wide variety of pixel, SDK, and session replay disputes. Its lesson is not that any privacy policy will do; it rewards companies that build a deliberate, well-incorporated disclosure architecture, obtain affirmative assent before data flows, and whose technology does what their disclosures say. With SB 690 pushing plaintiffs toward CIPA § 631 and CDAFA, the consent record will be the first thing courts examine.

The time to involve experienced privacy counsel is before the next tag is deployed, when terms, notices, consent flows, and tag configurations can still be aligned; a proactive, conservative approach to compliance is far less costly than defending a bet-the-company class action after a complaint hits the docket.

David J. Oberly is a tech-savvy attorney and recognized thought leader in the privacy space. David provides strategic advice and counseling on all types of privacy and technology matters that arise when doing business in today’s digital world, and guides companies in navigating the full spectrum of regulatory, product, and risk management issues that impact the collection, use, and sharing of personal data. He also represents companies in the defense of privacy and technology class actions, with deep experience litigating class disputes asserting digital surveillance/wiretapping, video privacy, consumer privacy, consumer protection, and invasion of privacy claims. David can be reached at doberly@bakerdonelson.com.

Turn privacy guidance into working controls.

Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.

A tech-savvy attorney and recognized thought leader in the privacy space, David advises companies on all types of privacy and technology issues that arise when doing business in today's digital world and represents companies in the defense of bet-the-company privacy and technology class action litigation.