LA Times

The LA Times CIPA settlement: website trackers and a $3.85M class action (2026)

Private litigation (CIPA)Last updated

At a glance

Brought by
Private litigation (CIPA)
Company
Los Angeles Times
Sector
News publishing
Law
CIPA (California wiretap law)
Amount
$3.85M, under appeal
Date
Final approval Jun 26, 2026
Status
Final approval, under appeal

Summary

A private class action alleged that three advertising trackers on the LA Times site collected visitors’ information without consent, under California’s Invasion of Privacy Act. It reached a $3.85 million settlement, which received final approval in June 2026. An objector has appealed to the Ninth Circuit. Private plaintiffs brought this, and no government regulator was involved.

What happened

The case is Mirmalek v. Los Angeles Times Communications LLC, in the U.S. District Court for the Northern District of California. The trackers at issue ran on the LA Times site and app.

The mechanism

The claim named the TripleLift, GumGum, and Audiencerate trackers, and used CIPA’s “pen register” theory: that the trackers captured device and routing identifiers as visitors arrived, without permission.

A tracker builds a request with the page, referrer and a cookie ID as the page loads, and sends it to a third-party server.
The claim's pen-register theory: that the trackers captured device and routing identifiers as visitors arrived, without permission.

Why it was preventable

Which third-party trackers load, and when, is exactly what a coverage scan reports. Knowing that TripleLift, GumGum, and Audiencerate were collecting data before consent is the kind of finding that lets a team act before a filing.

In the lawsuit’s words

The lawsuit alleged the defendant “installed and used three trackers … on Website visitors’ internet browsers, without consent and in violation of Section 638.51(a) of the California Invasion of Privacy Act (‘CIPA’).”

Timeline

  1. Jan 2023 to Dec 2025class period.
  2. Jun 26, 2026final approval.
  3. Aug 3, 2026notice of appeal filed by an objector (Ninth Circuit No. 26-5450).

Source

Official settlement site latimescipasettlement.com; docket N.D. Cal. 3:24-cv-01797.

latimescipasettlement.com

Questions

Was this a government fine?

No. Private plaintiffs brought this class action under California’s Invasion of Privacy Act (CIPA), and no government regulator was involved. The $3.85 million is a settlement fund.

What is the “pen register” theory?

It is the argument that a website’s trackers captured device and routing identifiers as visitors arrived, without permission.

Is the settlement final?

The court granted final approval on June 26, 2026, and an objector has appealed to the Ninth Circuit (No. 26-5450). Check the official settlement site for payment timing.

Private litigation (CIPA)Jul 20, 2026 (order)
No amount (prefiling order)

The CIPA serial-filer wave

Serial CIPA filer declared vexatious (at least 29 proceedings since 2021)

30-day free trial

See what your tags send before it becomes a case

DataTrue runs real journeys on your site in each consent state and reads what each tag sends, field by field. A tag sending what it should not shows up in a test.

What DataTrue checks
  • Every page, with coverage scans
  • Scheduled runs, with alerts when a result changes
  • Full journeys, like checkout and signup, in each consent state
  • What each tag sent, field by field
Also in the full platform
  • PII detection with test personas
  • iOS and Android app testing
  • Pre-publish testing for GTM and Adobe Tags
  • REST API, plus Slack and Jira alerts
Start a free 30-day trial ★★★★★ 4.6/5 on G2

The full platform, every feature, free for 30 days.

DataTrue scan overview showing scan details and page status for a scheduled daily coverage scan
A scheduled daily coverage scan in DataTrue