# Inth

> Inth checks your code, live site and consent setup for privacy changes, and keeps the evidence with each change.

Important positioning:
- Category: privacy change management, with privacy auditing of code changes and live websites.
- Product surfaces: Code audit, Website audit, Inth Agent, Consent banner, and the shared review record around them.
- Inth helps teams investigate and operate privacy work; it does not provide legal advice or promise compliance.

## When to use Inth

Use Inth when a software team or agent needs to:
- Review a pull request or codebase for privacy-impacting data flows, SDKs, trackers, logging, or vendor calls.
- Inspect a production website for scripts, cookies, vendors, consent state, and Global Privacy Control handling.
- Compare product behaviour with privacy policies, contracts, consent rules, or legal requirements.
- Keep evidence, decisions, owners, and remediation attached to a product change.

Do not use Inth as a substitute for legal advice or as proof that a product complies with every applicable law.

## Core pages

- [Home](https://inth.com/): A cookie banner built into your app: on screen in 27 ms (Next.js desktop median) on CookieBench, styled like your product, with regional rules and a record of every choice. [Markdown](https://inth.com/index.md).
- [About](https://inth.com/about): Why Christopher Burns started with c15t, what cookie banners revealed about product privacy and how that led to Inth. [Markdown](https://inth.com/about.md).
- [Blog](https://inth.com/blog): Notes from building Inth, c15t and privacy tooling for software that changes every day. [Markdown](https://inth.com/blog.md).
- [Inth Agent](https://inth.com/agent): Ask Inth Agent privacy questions about your product and get answers grounded in product evidence, review history, policies and cited privacy law. [Markdown](https://inth.com/agent.md).
- [Consent Banner](https://inth.com/consent-banner): A consent banner that ships inside your app with c15t, with regional rules, script blocking and consent records. On CookieBench its banner is on screen in 27 ms (Next.js desktop median). [Markdown](https://inth.com/consent-banner.md).
- [Code audit](https://inth.com/code-audit): Find privacy risks in pull requests before they ship. Inth Code Audit maps data flows, detects trackers and SDKs, and preserves review evidence. [Markdown](https://inth.com/code-audit.md).
- [Open source](https://inth.com/oss): A portal for c15t, DSAR, Leadtype, inrepo, hexbus, readie, and the open-source projects Inth builds in public. [Markdown](https://inth.com/oss.md).
- [Pricing](https://inth.com/pricing): Start free with 500 consent sessions and 100 AI Credits. Starter, Pro and Business add sessions, projects and AI Credits each month. [Markdown](https://inth.com/pricing.md).
- [Privacy requests](https://inth.com/privacy): Ask Inth to access, correct, export, restrict, or delete your personal data or account, and receive a reference you can quote about your request. [Markdown](https://inth.com/privacy.md).
- [Sales](https://inth.com/sales): Ask Inth about Code Audit, Website Audit, consent and pricing for your team. Tell us what you need and we will get back to you by email. [Markdown](https://inth.com/sales.md).
- [Security](https://inth.com/security): Report a security concern or vulnerability to the Inth security team. Describe what you found and receive a reference for your report. [Markdown](https://inth.com/security.md).
- [Support](https://inth.com/support): Contact Inth support with a product question or problem. Tell us what happened and receive a reference to quote when you follow up. [Markdown](https://inth.com/support.md).
- [Trust center](https://inth.com/trust): The security frameworks Inth is working towards, the policies and controls behind them, its subprocessors and how to request documents for your review. [Markdown](https://inth.com/trust.md).
- [Website audit](https://inth.com/website-audit): Find third-party scripts, cookies and vendors on your site. Inth Website Audit checks live behavior against your consent controls and privacy policies. [Markdown](https://inth.com/website-audit.md).
- [YC founder verification](https://inth.com/yc): Y Combinator founders: send the link from YC founder verification and the email on your Inth account, and Inth checks your founder status. [Markdown](https://inth.com/yc.md).
- [Privacy enforcement and litigation library](https://inth.com/enforcement): Compare privacy enforcement cases, GDPR decisions, plaintiff lawsuits and private settlements, with source links, procedural status and technical checks. [Markdown](https://inth.com/enforcement.md).
- [Inth vs react-cookie-consent: Website Consent Comparison](https://inth.com/comparison/react-cookie-consent): Compare Inth Consent and react-cookie-consent for website consent: implementation, records, pricing and migration. [Markdown](https://inth.com/comparison/react-cookie-consent.md).
- [Inth vs Cookiebot: Website Consent Comparison](https://inth.com/comparison/cookiebot): Compare Inth Consent and Cookiebot for website consent: implementation, records, pricing and migration. [Markdown](https://inth.com/comparison/cookiebot.md).
- [Inth vs CookieConsent v3: Website Consent Comparison](https://inth.com/comparison/cookieconsent): Compare Inth Consent and CookieConsent v3 for website consent: implementation, records, pricing and migration. [Markdown](https://inth.com/comparison/cookieconsent.md).
- [Inth vs Didomi: Website Consent Comparison](https://inth.com/comparison/didomi): Compare Inth Consent and Didomi for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/didomi.md).
- [Inth vs Klaro!: Website Consent Comparison](https://inth.com/comparison/klaro): Compare Inth Consent and Klaro! for website consent: implementation, records, pricing and migration. [Markdown](https://inth.com/comparison/klaro.md).
- [Inth vs Silktide Consent Manager: Website Consent Comparison](https://inth.com/comparison/silktide): Compare Inth Consent and Silktide Consent Manager for website consent: implementation, records, pricing and migration. [Markdown](https://inth.com/comparison/silktide.md).
- [Inth vs Ketch: Website Consent Comparison](https://inth.com/comparison/ketch): Compare Inth Consent and Ketch for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/ketch.md).
- [Inth vs Enzuzo: Website Consent Comparison](https://inth.com/comparison/enzuzo): Compare Inth Consent and Enzuzo for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/enzuzo.md).
- [Inth vs Cookie Control: Website Consent Comparison](https://inth.com/comparison/cookie-control): Compare Inth Consent and Cookie Control for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/cookie-control.md).
- [Inth vs Osano: Website Consent Comparison](https://inth.com/comparison/osano): Compare Inth Consent and Osano for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/osano.md).
- [Inth vs iubenda: Website Consent Comparison](https://inth.com/comparison/iubenda): Compare Inth Consent and iubenda for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/iubenda.md).
- [Inth vs CookieYes: Website Consent Comparison](https://inth.com/comparison/cookieyes): Compare Inth Consent and CookieYes for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/cookieyes.md).
- [Inth vs OneTrust: Website Consent Comparison](https://inth.com/comparison/one-trust): Compare Inth Consent and OneTrust for website consent: implementation, performance, records, pricing and migration. Source-backed guidance for your team. [Markdown](https://inth.com/comparison/one-trust.md).
- [Inth vs Ethyca: Website Consent Comparison](https://inth.com/comparison/ethyca): Compare Inth Consent and Ethyca for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/ethyca.md).
- [Inth vs Usercentrics: Website Consent Comparison](https://inth.com/comparison/usercentrics): Compare Inth Consent and Usercentrics for website consent: implementation, performance, records, pricing and migration. [Markdown](https://inth.com/comparison/usercentrics.md).
- [Inth vs tarteaucitron.js: Website Consent Comparison](https://inth.com/comparison/tarteaucitron): Compare Inth Consent and tarteaucitron.js for website consent: implementation, records, pricing and migration. [Markdown](https://inth.com/comparison/tarteaucitron.md).
- [Federal Wiretap Act: one-party consent and the crime-tort exception in pixel cases](https://inth.com/enforcement/laws/federal-wiretap-act): The federal Wiretap Act is a one-party consent statute, so a website can usually consent for its vendor. The crime-tort exception matters in pixel cases. [Markdown](https://inth.com/enforcement/laws/federal-wiretap-act.md).
- [Arizona TUCSRA: the email tracking pixel theory, and why it failed on appeal](https://inth.com/enforcement/laws/arizona-tucsra): Arizona's Telephone, Utility and Communication Service Records Act was written to stop "pretexting" for phone and utility records. [Markdown](https://inth.com/enforcement/laws/arizona-tucsra.md).
- [Standing in tracking cases: TransUnion, Popa, Cook, broken promises and testers](https://inth.com/enforcement/laws/article-iii-standing): A tracking statute can award USD 5,000 per violation, but federal courts need a concrete harm. How TransUnion, Popa and Cook ended suits before the merits. [Markdown](https://inth.com/enforcement/laws/article-iii-standing.md).
- [CCPA: opt-outs, Global Privacy Control and what California regulators have fined](https://inth.com/enforcement/laws/ccpa): For adults the CCPA is an opt-out law, not a consent law. The opt-out failures California regulators have fined, from ignored GPC to broken opt-out links. [Markdown](https://inth.com/enforcement/laws/ccpa.md).
- [CIPA §631: wiretapping claims over pixels, chat widgets and session replay](https://inth.com/enforcement/laws/cipa-631-wiretapping): Section 631 is a 1967 wiretap statute California courts apply to internet communications. How it is used against pixels, chat widgets and session replay. [Markdown](https://inth.com/enforcement/laws/cipa-631-wiretapping.md).
- [CIPA §632 and §632.7: recording confidential communications in apps, chat and AI tools](https://inth.com/enforcement/laws/cipa-632-recording): Section 632 forbids recording a confidential communication without everyone's consent. How courts apply it to health apps, therapy chat and AI notetakers. [Markdown](https://inth.com/enforcement/laws/cipa-632-recording.md).
- [CIPA §638.51: pen register claims against websites, and what SB 690 changes](https://inth.com/enforcement/laws/cipa-638-51-pen-register): Plaintiffs argue a tag that receives a visitor's IP address is an unlicensed pen register or trap and trace device. The rulings, and what SB 690 changes. [Markdown](https://inth.com/enforcement/laws/cipa-638-51-pen-register.md).
- [California CMIA: when a pixel on a health site or app discloses 'medical information'](https://inth.com/enforcement/laws/cmia): The CMIA bars health care providers, and businesses it treats as providers, from disclosing medical information without authorisation. How pixels raise it. [Markdown](https://inth.com/enforcement/laws/cmia.md).
- [Florida Security of Communications Act: all-party consent, pixels, chat and session replay](https://inth.com/enforcement/laws/florida-fsca): Florida's wiretap act makes interception lawful only if all parties consent and allows USD 1,000 per plaintiff. How it applies to pixels, chat and replay. [Markdown](https://inth.com/enforcement/laws/florida-fsca.md).
- [FTC Act Section 5 and the Health Breach Notification Rule: health data, pixels and broken promises](https://inth.com/enforcement/laws/ftc-act-and-hbnr): Federal privacy enforcement against websites and apps runs mostly through Section 5 of the FTC Act, which bans "unfair or deceptive acts or practices". [Markdown](https://inth.com/enforcement/laws/ftc-act-and-hbnr.md).
- [GDPR and ePrivacy cookie rules: how the CNIL enforces Article 82](https://inth.com/enforcement/laws/gdpr-and-eprivacy-cookies): In the EU, storing or reading anything on a device needs prior consent unless strictly necessary. How the CNIL enforces the rule, and the fines on record. [Markdown](https://inth.com/enforcement/laws/gdpr-and-eprivacy-cookies.md).
- [Massachusetts wiretap act: why web browsing is not a 'communication' after Vita](https://inth.com/enforcement/laws/massachusetts-wiretap-act): Massachusetts's wiretap act needs every party's prior authority. In Vita, its highest court held that browsing a hospital site is not a communication. [Markdown](https://inth.com/enforcement/laws/massachusetts-wiretap-act.md).
- [Pennsylvania WESCA: all-party consent, interception at the browser, and the standing wall](https://inth.com/enforcement/laws/pennsylvania-wesca): Pennsylvania's Wiretapping and Electronic Surveillance Control Act requires every party's consent and allows USD 1,000 in liquidated damages per plaintiff. [Markdown](https://inth.com/enforcement/laws/pennsylvania-wesca.md).
- [Video Privacy Protection Act: pixels on video pages, and the Supreme Court's 'consumer' case](https://inth.com/enforcement/laws/vppa): How plaintiffs use the 1988 Video Privacy Protection Act against video sites that run the Meta Pixel, and the Supreme Court case on who is a consumer. [Markdown](https://inth.com/enforcement/laws/vppa.md).
- [Washington's privacy laws: RCW 9.73 after Baker, and the My Health My Data Act](https://inth.com/enforcement/laws/washington-privacy-act-and-mhmda): Washington's 1967 privacy act and the 2023 My Health My Data Act both reach website tracking. After Baker in 2026 they point in opposite directions. [Markdown](https://inth.com/enforcement/laws/washington-privacy-act-and-mhmda.md).
- [Session replay and chat recording: when a vendor sees what visitors type](https://inth.com/enforcement/issues/session-replay-and-chat-recording): How courts treat session replay and chat vendors under wiretap laws, with tagged cases, checks for your own site and short answers to common questions. [Markdown](https://inth.com/enforcement/issues/session-replay-and-chat-recording.md).
- [Sensitive context in event data: when a tracking event reveals health, money or location](https://inth.com/enforcement/issues/sensitive-context-in-event-data): How page URLs, event names and parameters can reveal health, financial or location data to ad platforms, with tagged cases, checks and FAQs. [Markdown](https://inth.com/enforcement/issues/sensitive-context-in-event-data.md).
- [IP addresses and device identifiers: the pen-register and trap-and-trace claims](https://inth.com/enforcement/issues/ip-addresses-and-device-identifiers): How plaintiffs use IP addresses and device identifiers in pen-register and wiretap claims, which rulings went each way, and what to check on your site. [Markdown](https://inth.com/enforcement/issues/ip-addresses-and-device-identifiers.md).
- [Notice, consent scope and assent: what the visitor actually agreed to](https://inth.com/enforcement/issues/notice-consent-scope-and-assent): Why a privacy notice, terms link or partner's consent may not cover what your product does, with tagged regulator and court cases, checks and FAQs. [Markdown](https://inth.com/enforcement/issues/notice-consent-scope-and-assent.md).
- [Identifying video-viewing disclosures: pixels on pages that play video](https://inth.com/enforcement/issues/identifying-video-viewing-disclosures): How the VPPA reaches pixels on video pages, the settlements and Supreme Court case in the library, and what to check on your own video routes. [Markdown](https://inth.com/enforcement/issues/identifying-video-viewing-disclosures.md).
- [Undisclosed data exchanges: sharing that the notice did not describe](https://inth.com/enforcement/issues/undisclosed-data-exchanges): Cases where customer, health or lead data reached partners the notice did not describe, with what regulators found, checks for your systems and FAQs. [Markdown](https://inth.com/enforcement/issues/undisclosed-data-exchanges.md).
- [Unequal choices or identity checks: when saying no takes more work than saying yes](https://inth.com/enforcement/issues/unequal-choices-or-identity-checks): Cases where refusing or opting out took more steps or more data than agreeing, with regulator decisions, checks for your own flows and FAQs. [Markdown](https://inth.com/enforcement/issues/unequal-choices-or-identity-checks.md).
- [Failed opt-out controls: when the request is recorded but nothing stops](https://inth.com/enforcement/issues/failed-opt-out-controls): Cases where opt-out forms, portals or app settings failed to stop tracking or marketing, with regulator outcomes, checks to run and short FAQs. [Markdown](https://inth.com/enforcement/issues/failed-opt-out-controls.md).
- [Opt-outs across devices or services: one choice, many systems](https://inth.com/enforcement/issues/opt-outs-across-devices-or-services): Cases where an opt-out or objection did not carry across devices, apps or databases, with regulator outcomes, checks for your systems and FAQs. [Markdown](https://inth.com/enforcement/issues/opt-outs-across-devices-or-services.md).
- [Ignored opt-out signals: Global Privacy Control and account-level opt-outs](https://inth.com/enforcement/issues/ignored-opt-out-signals): California cases on ignoring Global Privacy Control and opt-outs that did not follow the account, with outcomes, checks for your site and short FAQs. [Markdown](https://inth.com/enforcement/issues/ignored-opt-out-signals.md).
- [Cookies before choice or after refusal: what the banner says versus what the browser stores](https://inth.com/enforcement/issues/cookies-before-choice-or-after-refusal): CNIL cases where cookies were placed before consent or read after refusal or withdrawal, with the fines, checks for your own site and short FAQs. [Markdown](https://inth.com/enforcement/issues/cookies-before-choice-or-after-refusal.md).
- [International data transfers: where personal data can be reached from](https://inth.com/enforcement/issues/international-data-transfers): GDPR decisions on transfers of EU data to the US and China, covering safeguards, remote access and transparency, with checks for your systems and FAQs. [Markdown](https://inth.com/enforcement/issues/international-data-transfers.md).
- [Consent before collection: asking before the recorder or tag starts](https://inth.com/enforcement/issues/consent-before-collection): Court rulings on recording or tracking that started before consent was asked, with what each held at its stage, checks for your forms and FAQs. [Markdown](https://inth.com/enforcement/issues/consent-before-collection.md).
- [Children's privacy defaults: what a new young user gets before changing anything](https://inth.com/enforcement/issues/childrens-privacy-defaults): The DPC's TikTok decision on public-by-default child accounts and privacy choice design, with checks for your own defaults and short FAQs. [Markdown](https://inth.com/enforcement/issues/childrens-privacy-defaults.md).
- [Breach notices not sent: when sharing health data for ads is a breach](https://inth.com/enforcement/issues/breach-notices-not-sent): How the FTC treated unauthorised sharing of health data for ads as a breach needing notice, in the GoodRx case, with checks and short FAQs. [Markdown](https://inth.com/enforcement/issues/breach-notices-not-sent.md).
- [Consent banner for developers](https://inth.com/consent-banner/developers): c15t puts the consent banner in your bundle as React components and hooks. Style it with props, build your own UI, hold embeds back and debug each decision. [Markdown](https://inth.com/consent-banner/developers.md).
- [Compare Inth Consent](https://inth.com/comparison): Compare Inth Consent with OneTrust, Cookiebot, Usercentrics, Didomi, iubenda, Osano, CookieYes, Ketch and open-source consent libraries. [Markdown](https://inth.com/comparison.md).
- [Consent rules by region](https://inth.com/consent-banner/regions): Inth Consent finds where each visitor is and applies the matching policy: opt-in under the GDPR and Law 25, opt-out with Global Privacy Control in California. [Markdown](https://inth.com/consent-banner/regions.md).
- [Free codebase scan](https://inth.com/run-free-codebase-scan): Run a free Inth codebase scan to find privacy risks before merge, including affected files, lines, trackers, SDKs, vendor calls, data flows, and prioritized remediation guidance. [Markdown](https://inth.com/run-free-codebase-scan.md).
- [Contact us](https://inth.com/contact-us) [Markdown](https://inth.com/contact-us.md).
- [How Inth scans public websites](https://inth.com/web-scan): How Inth scans public websites and honours site opt-out requests.

## Blog

- [Privacy change management is the missing layer between shipping and compliance](https://inth.com/blog/privacy-change-management): Privacy work becomes operational when the unit of review is a product change—not a quarterly audit, spreadsheet, or policy refresh. [Markdown](https://inth.com/blog/privacy-change-management.md).
- [Code review is becoming privacy review](https://inth.com/blog/code-review-is-privacy-review): The pull request is the last place where a new data flow still has an author, a reason, and enough context to fix it cleanly. [Markdown](https://inth.com/blog/code-review-is-privacy-review.md).
- [Your consent banner can be correct while your product drifts](https://inth.com/blog/consent-correct-product-drifting): A configured banner describes intent. Runtime monitoring shows whether scripts, vendors, and domains actually respect it. [Markdown](https://inth.com/blog/consent-correct-product-drifting.md).
- [Evidence should ship with the change](https://inth.com/blog/evidence-should-ship-with-the-change): The cheapest evidence is created while the owner, source, review, and fix are already in the same workflow. [Markdown](https://inth.com/blog/evidence-should-ship-with-the-change.md).
- [The Inth enforcement library is open](https://inth.com/blog/enforcement-library): Regulator decisions, plaintiff claims and private settlements about tracking, side by side, with sources, procedural stages and checks for your own systems. [Markdown](https://inth.com/blog/enforcement-library.md).
- [c15t 3.1: one event call for your analytics integrations](https://inth.com/blog/c15t-3-1): Send an event once to PostHog, Google Analytics, and other supported integrations. Version 3.1 exposes the shared dispatcher in every framework, with consent checks built in. [Markdown](https://inth.com/blog/c15t-3-1.md).
- [c15t v3: one consent engine for every framework](https://inth.com/blog/c15t-v3): c15t v3 is a rebuild. One consent engine, adapters for eight frameworks and a script tag, and banners that arrive with the page. [Markdown](https://inth.com/blog/c15t-v3.md).
- [Inth CLI: install with curl and update from your terminal](https://inth.com/blog/inth-cli-curl-install-and-updates): Install the Inth CLI with curl, without Node.js or npm, and use the built-in updater to get new releases from your terminal. [Markdown](https://inth.com/blog/inth-cli-curl-install-and-updates.md).
- [How small and fast can a TypeScript CLI get?](https://inth.com/blog/how-small-and-fast-can-a-typescript-cli-get): Can a TypeScript CLI match the binary size and startup speed of one written in Zig, Rust, or Go? [Markdown](https://inth.com/blog/how-small-and-fast-can-a-typescript-cli-get.md).
- [Introducing the Inth CLI](https://inth.com/blog/introducing-inth-cli): Create Inth projects from your terminal, discover commands through structured help, and give coding agents JSON output they can read. [Markdown](https://inth.com/blog/introducing-inth-cli.md).
- [Inth now has stricter privacy audits and actions](https://inth.com/blog/changelog-inth-now-has-stricter-privacy-audits-and-more): Inth strengthens privacy audit verification, evidence handling and repair recommendations to help teams make better-supported decisions about what to act on. [Markdown](https://inth.com/blog/changelog-inth-now-has-stricter-privacy-audits-and-more.md).
- [How to add LinkedIn Insight Tag to Next.js with c15t](https://inth.com/blog/how-to-add-linkedin-insight-tag-nextjs-c15t): Add LinkedIn Insight Tag to a Next.js App Router project with c15t so the tag loads only after marketing consent, then track custom conversions safely. [Markdown](https://inth.com/blog/how-to-add-linkedin-insight-tag-nextjs-c15t.md).
- [How privacy governance shows up in startup due diligence](https://inth.com/blog/how-privacy-governance-shows-up-in-startup-due-diligence): Privacy governance often becomes visible during M&A, fundraising, and enterprise sales. This guide explains how Inth helps startups prepare consent, tracking, and product evidence before diligence starts. [Markdown](https://inth.com/blog/how-privacy-governance-shows-up-in-startup-due-diligence.md).
- [How to add Google Tag Manager to Next.js with c15t](https://inth.com/blog/how-to-add-google-tag-manager-nextjs-c15t): Add Google Tag Manager to a Next.js App Router project with c15t, then use Consent Mode v2 so GTM-managed tags wait for the right consent state. [Markdown](https://inth.com/blog/how-to-add-google-tag-manager-nextjs-c15t.md).
- [How to test consent gates in a Next.js app with Playwright](https://inth.com/blog/test-consent-gates-nextjs-playwright): Use Playwright to test that consent-controlled scripts, requests, cookies, and storage stay blocked before consent, load after consent, and stop after withdrawal in a Next.js app. [Markdown](https://inth.com/blog/test-consent-gates-nextjs-playwright.md).
- [What is the difference between c15t, Inth, and CookieConsent v3?](https://inth.com/blog/c15t-inth-vs-cookieconsent-v3): Compare c15t hosted through Inth with CookieConsent v3, with a focus on backend-backed consent records, audit trails, and why browser-only consent state is not enough for many EU and UK setups. [Markdown](https://inth.com/blog/c15t-inth-vs-cookieconsent-v3.md).
- [What Trump v. Slaughter could mean for EU-US data transfers](https://inth.com/blog/what-trump-v-slaughter-could-mean-for-eu-us-data-transfers): The EU-US Data Privacy Framework remains in force, but developers and privacy teams should review transfer records, SCC assessments, and US processor dependencies after Trump v. Slaughter. [Markdown](https://inth.com/blog/what-trump-v-slaughter-could-mean-for-eu-us-data-transfers.md).
- [What is the AEPD’s guidance on GDPR accuracy rules for AI data?](https://inth.com/blog/what-is-aepd-guidance-gdpr-accuracy-ai-data): Spain’s data protection authority says AI data quality and GDPR accuracy should be assessed against the processing purpose, not treated as an absolute demand for perfect data. [Markdown](https://inth.com/blog/what-is-aepd-guidance-gdpr-accuracy-ai-data.md).
- [Should You Build Your Own Cookie Banner? Build vs Buy Guide](https://inth.com/blog/cookie-banner-build-vs-buy): Should you build your own cookie banner or use a consent tool? Learn when custom cookie banners make sense, where they become consent infrastructure, and why c15t is a better default for modern JavaScript apps. [Markdown](https://inth.com/blog/cookie-banner-build-vs-buy.md).
- [How to integrate Meta Pixel in Next.js with c15t](https://inth.com/blog/how-to-integrate-meta-pixel-nextjs-c15t): Add Meta Pixel to a Next.js App Router project with c15t so the pixel loads only after marketing consent, then track page views and conversion events safely. [Markdown](https://inth.com/blog/how-to-integrate-meta-pixel-nextjs-c15t.md).
- [How to add PostHog to Next.js with GDPR-aware consent](https://inth.com/blog/how-to-add-posthog-to-next-js-with-gdpr-aware-consent): Implement PostHog in a Next.js App Router project with c15t, then use a GDPR-aware consent setup that waits for measurement consent before loading analytics. [Markdown](https://inth.com/blog/how-to-add-posthog-to-next-js-with-gdpr-aware-consent.md).
- [How to implement Consent Mode v2 as a product control](https://inth.com/blog/developer-guide-to-consent-mode-v2): Implement Google Consent Mode v2 with denied defaults, clear consent mapping, update calls, and consent records your team can review later. [Markdown](https://inth.com/blog/developer-guide-to-consent-mode-v2.md).
- [This is How You Get Higher Consent Rates Without Dark Patterns](https://inth.com/blog/this-is-how-you-get-higher-consent-rates-without-dark-patter) [Markdown](https://inth.com/blog/this-is-how-you-get-higher-consent-rates-without-dark-patter.md).
- [How cookie banners affect landing-page performance](https://inth.com/blog/cookie-banner-google-ads-core-web-vitals) [Markdown](https://inth.com/blog/cookie-banner-google-ads-core-web-vitals.md).
- [How we built a cookie banner with a 27 ms desktop median](https://inth.com/blog/how-we-made-the-fastest-cookie-banner) [Markdown](https://inth.com/blog/how-we-made-the-fastest-cookie-banner.md).
- [c15t 2.0: A New Foundation for Consent Infrastructure](https://inth.com/blog/c15t-2-0-a-new-foundation-for-consent-infrastructure) [Markdown](https://inth.com/blog/c15t-2-0-a-new-foundation-for-consent-infrastructure.md).
- [Inth, Our New Name and Direction](https://inth.com/blog/inth-our-new-name) [Markdown](https://inth.com/blog/inth-our-new-name.md).
- [Christopher Burns — Author](https://inth.com/blog/author/christopher-burns): Posts by Christopher Burns
- [Kaylee Williams — Author](https://inth.com/blog/author/kaylee-williams): Posts by Kaylee Williams
- [Inth Engineering — Author](https://inth.com/blog/author/inth-engineering): Posts by Inth Engineering
- [Will De Ath — Author](https://inth.com/blog/author/will-de-ath): Posts by Will De Ath
- [Inth Research — Author](https://inth.com/blog/author/inth-research): Posts by Inth Research

## Handbook

- [Why cookie banners are our wedge](https://inth.com/handbook/company/why-cookie-banners-are-our-wedge): Cookie banners look like a small UI problem. They are a live test of performance, consent, and whether a product honours what its users chose. [Markdown](https://inth.com/handbook/company/why-cookie-banners-are-our-wedge.md).
- [Handbook](https://inth.com/handbook): A public record of the product and the choices behind it. [Markdown](https://inth.com/handbook.md).
- [What is Inth?](https://inth.com/handbook/company/what-is-inth): Inth is privacy change management for software companies that ship fast. It connects what a company has promised to what its engineers just shipped. [Markdown](https://inth.com/handbook/company/what-is-inth.md).
- [Privacy should move with the product](https://inth.com/handbook/company/privacy-should-move-with-the-product): Every software company makes promises about data. Those promises are implemented in code, and every product change can make them untrue. [Markdown](https://inth.com/handbook/company/privacy-should-move-with-the-product.md).
- [We have to look like a big deal](https://inth.com/handbook/company/we-have-to-look-like-a-big-deal): A small company does not get a smaller standard. If we want companies to trust Inth with an important problem, every part of the product has to show that we understand the weight of it. [Markdown](https://inth.com/handbook/company/we-have-to-look-like-a-big-deal.md).
- [Docs are becoming a runtime dependency](https://inth.com/handbook/company/docs-are-becoming-a-runtime-dependency): Documentation used to sit beside the product. Now it can decide which product gets chosen, what code gets written, and whether an agent implements it correctly. [Markdown](https://inth.com/handbook/company/docs-are-becoming-a-runtime-dependency.md).

## Enforcement cases

- [TaxAct: tax-return figures in pixel events led to a USD 14.95 million settlement still held up on appeal](https://inth.com/enforcement/taxact): Filers alleged TaxAct's Meta and Google pixels sent AGI, refunds and filing status. A USD 14.95 million settlement was approved; an appeal delays payment. [Markdown](https://inth.com/enforcement/taxact.md).
- [Montana v. General Motors: a "decline" button that warned of losing services the buyer never had](https://inth.com/enforcement/montana-v-general-motors): Montana's attorney general alleges GM and OnStar enrolled buyers in connected services at the dealership and sold their driving data to brokers and insurers without consent. Allegations only; no ruling. [Markdown](https://inth.com/enforcement/montana-v-general-motors.md).
- [New Mexico v. Meta: USD 25 billion for telling users they controlled their data](https://inth.com/enforcement/new-mexico-v-meta-cambridge-analytica): A Santa Fe jury found 43.9 million willful Unfair Practices Act violations in Facebook's privacy and Cambridge Analytica statements. The judge set a USD 25 billion penalty. [Markdown](https://inth.com/enforcement/new-mexico-v-meta-cambridge-analytica.md).
- [Hinton v. Planned Parenthood: "where there's smoke, there must be fire" is not class proof](https://inth.com/enforcement/hinton-v-planned-parenthood): Judge Donato denied class certification in a CIPA pixel case over Planned Parenthood's reproductive-health pages: plaintiffs had no common proof that Meta or Google linked page views to identities. [Markdown](https://inth.com/enforcement/hinton-v-planned-parenthood.md).
- [Allina Health: USD 12.5 million, with portal users paid more](https://inth.com/enforcement/allina-health): A Minnesota federal court granted final approval to a USD 12.5 million settlement over pixels on Allina Health's websites, with a larger share for patient portal, bill-pay and scheduling users. [Markdown](https://inth.com/enforcement/allina-health.md).
- [NH Hotel Group: a toggle set to off still meant yes](https://inth.com/enforcement/nh-hotel-group): Spain's AEPD proposed a EUR 10,000 fine after NH Hotel Group's site set analytics and third-party cookies before consent and kept them after users switched categories off. NH paid EUR 8,000 early. [Markdown](https://inth.com/enforcement/nh-hotel-group.md).
- [FTC v. Hims & Hers: "private and secure" care, with customer lists sent to ad platforms](https://inth.com/enforcement/ftc-hims-hers): The FTC, Utah and Los Angeles County Counsel allege Hims & Hers promised private telehealth but shared health information with Meta, Snap and other ad platforms. Allegations only; no ruling. [Markdown](https://inth.com/enforcement/ftc-hims-hers.md).
- [Wiley v. Universal Music: browsing data is not contents, but ignoring a decline still counts](https://inth.com/enforcement/wiley-v-universal-music): Judge Pitts dismissed CIPA wiretap and pen-register claims against Universal Music with prejudice but let privacy and unjust enrichment claims proceed over tracking after visitors declined cookies. [Markdown](https://inth.com/enforcement/wiley-v-universal-music.md).
- [Asercion v. Ulta: 201 trackers on arrival, and a privacy policy is not consent](https://inth.com/enforcement/asercion-v-ulta): Judge Lin let CIPA wiretap and pen-register, federal Wiretap Act, CDAFA and constitutional privacy claims proceed against Ulta over trackers installed when a visitor arrived. Only the UCL claim fell. [Markdown](https://inth.com/enforcement/asercion-v-ulta.md).
- [Dutch AP: two organisations investigated for banners with no visible reject button](https://inth.com/enforcement/ap-reject-button-investigations): The Autoriteit Persoonsgegevens opened investigations into two unnamed organisations that kept cookie banners without a directly visible reject button after a warning. No finding or fine yet. [Markdown](https://inth.com/enforcement/ap-reject-button-investigations.md).
- [Orange: withdrawal had to stop cookie access, not just update the banner](https://inth.com/enforcement/orange): CNIL fined Orange EUR 50 million for inbox advertising and cookies read after withdrawal. The cookie injunction was later closed following remediation. [Markdown](https://inth.com/enforcement/orange.md).
- [Briskin v. Shopify: if your code knows a shopper is in California, you can be sued there](https://inth.com/enforcement/briskin-v-shopify): A shopper alleged Shopify's embedded checkout took his card details and set tracking cookies. The en banc Ninth Circuit upheld California jurisdiction. [Markdown](https://inth.com/enforcement/briskin-v-shopify.md).
- [Calhoun v. Google: a product-specific privacy promise can override your general policy](https://inth.com/enforcement/calhoun-v-google): Chrome users who never turned on Sync alleged Google still collected their browsing data. The Ninth Circuit reversed summary judgment on consent in 2024. [Markdown](https://inth.com/enforcement/calhoun-v-google.md).
- [GoodRx private litigation: a USD 32 million deal with GoodRx and Criteo wins preliminary approval](https://inth.com/enforcement/goodrx-private-litigation): Consumers alleged GoodRx shared prescription and health data with Meta, Google and Criteo. A USD 32 million settlement with GoodRx and Criteo won preliminary approval on 8 September 2026. [Markdown](https://inth.com/enforcement/goodrx-private-litigation.md).
- [WetterOnline: an X that says Accept & close is not consent](https://inth.com/enforcement/wetteronline): A German appeal court barred a weather site's banner that had no first-layer reject option and an X labelled Accept & close. The ruling is final. No fine. [Markdown](https://inth.com/enforcement/wetteronline.md).
- [vzbv v Google: one consent for 70 services was not valid](https://inth.com/enforcement/vzbv-v-google-account): A Berlin court held Google's 2022 sign-up consent invalid: users could not refuse fully or see which of 70 services it covered. Google has appealed. [Markdown](https://inth.com/enforcement/vzbv-v-google-account.md).
- [TikTok (UK): under-13s used the app without parental consent](https://inth.com/enforcement/tiktok-uk): The ICO fined TikTok £12.7 million over under-13s using the app without parental consent. After two tribunal losses, TikTok dropped its appeals. [Markdown](https://inth.com/enforcement/tiktok-uk.md).
- [Telekom and Google transfers: Accept all did not cover sending data to the US](https://inth.com/enforcement/telekom-google-transfers): Cologne courts barred Telekom from sending visitor IP and device data to Google in the US: the banner consent was not informed, before or after the DPF. [Markdown](https://inth.com/enforcement/telekom-google-transfers.md).
- [Sky Betting and Gaming: ad cookies fired before the banner](https://inth.com/enforcement/sky-betting-and-gaming): The ICO reprimanded Sky Betting and Gaming after skybet.com set advertising cookies before visitors could use its consent banner. No fine was issued. [Markdown](https://inth.com/enforcement/sky-betting-and-gaming.md).
- [Reddit: a ban in the terms is not an age check](https://inth.com/enforcement/reddit-uk): The ICO fined Reddit £14.47 million for processing under-13s' data with no age checks and no children's risk assessment. Reddit has appealed. [Markdown](https://inth.com/enforcement/reddit-uk.md).
- [Planet49 (BGH Cookie-Einwilligung II): a pre-ticked box is not consent](https://inth.com/enforcement/planet49): Germany's top civil court, after a CJEU ruling, held that a pre-ticked box for tracking cookies and a vague list of 57 partners did not give valid consent. [Markdown](https://inth.com/enforcement/planet49.md).
- [O'Carroll v Meta: an objection to ad profiling has to be honoured](https://inth.com/enforcement/ocarroll-v-meta): Tanya O'Carroll sued Meta for ignoring her objection to targeted ads. Meta settled before trial; the ICO said targeted ads count as direct marketing. [Markdown](https://inth.com/enforcement/ocarroll-v-meta.md).
- [Neue Osnabrücker Zeitung: refusing must be as easy as accepting](https://inth.com/enforcement/noz-cookie-banner): A German court upheld an order against the NOZ news site: refusing cookies took more effort than accepting, and Google Tag Manager loaded before consent. [Markdown](https://inth.com/enforcement/noz-cookie-banner.md).
- [Meta consent or pay (UK): the ICO's position, not an enforcement action](https://inth.com/enforcement/meta-consent-or-pay-uk): The ICO said ads under Meta's standard terms were not in line with UK law and welcomed its consent or pay switch. No enforcement action followed. [Markdown](https://inth.com/enforcement/meta-consent-or-pay-uk.md).
- [Meta Business Tools in Germany: damages for tracking without consent](https://inth.com/enforcement/meta-business-tools-germany): German courts ordered Meta to pay Facebook and Instagram users €1,500 to €5,000 each over data its pixel and SDKs collected on other sites without consent. [Markdown](https://inth.com/enforcement/meta-business-tools-germany.md).
- [Lloyd v Google: UK tracking claims need proof of harm](https://inth.com/enforcement/lloyd-v-google): The UK Supreme Court stopped a claim over Google's Safari workaround for millions of iPhone users. Damages needed proof of each person's loss or distress. [Markdown](https://inth.com/enforcement/lloyd-v-google.md).
- [Imgur (MediaLab): parental supervision in the terms is not parental consent](https://inth.com/enforcement/imgur-medialab): The ICO fined Imgur owner MediaLab £247,590. It let under-13s use Imgur with parental supervision but had no age checks and no way to get parents' consent. [Markdown](https://inth.com/enforcement/imgur-medialab.md).
- [ICO top 1,000 cookie review: the three tests UK sites must pass](https://inth.com/enforcement/ico-top-1000-cookie-review): The ICO checked cookie banners on the UK's top 1,000 websites against three tests. Most fixed problems after letters; 20 sites got preliminary notices. [Markdown](https://inth.com/enforcement/ico-top-1000-cookie-review.md).
- [Google Fonts (Munich): a font request sent the visitor's IP to Google](https://inth.com/enforcement/google-fonts-munich): A Munich court ordered a site owner to pay €100 for loading Google Fonts from Google's servers, which sent a visitor's IP to Google without consent. [Markdown](https://inth.com/enforcement/google-fonts-munich.md).
- [German regulator website sweeps: banners and analytics checked at scale](https://inth.com/enforcement/german-dpa-website-sweeps): Bavaria flagged about 350 sites with no first-layer reject, Saxony wrote to 2,300 Google Analytics users and Bremen issued five fines. No firms are named. [Markdown](https://inth.com/enforcement/german-dpa-website-sweeps.md).
- [Focus Online: a reject option in faint type behind 140 screens](https://inth.com/enforcement/focus-online): A Munich court held focus.de's banner consent invalid: Accept took one click, while Reject sat in faint type in settings spanning 140 screens. Not final. [Markdown](https://inth.com/enforcement/focus-online.md).
- [Experian v ICO: limits on telling people about offline marketing data](https://inth.com/enforcement/experian-ico): The ICO ordered Experian to change how it used UK adults' data for direct marketing. The tribunals upheld only parts, and the ICO lost its appeal. [Markdown](https://inth.com/enforcement/experian-ico.md).
- [Easylife: health guesses from shopping baskets are health data](https://inth.com/enforcement/easylife): The ICO fined Easylife for inferring customers' health conditions from what they bought and targeting them with health products. The fine fell to £250,000. [Markdown](https://inth.com/enforcement/easylife.md).
- [Bundeskartellamt v Meta: off-Facebook data needs separate consent](https://inth.com/enforcement/bundeskartellamt-meta): Germany's competition authority barred Meta from combining off-Facebook data without separate consent. The case closed in 2024 with remedies and no fine. [Markdown](https://inth.com/enforcement/bundeskartellamt-meta.md).
- [Bounty (UK): a parenting club sold sign-ups to 39 organisations](https://inth.com/enforcement/bounty-uk): The ICO fined Bounty £400,000 for sharing about 34.4 million records from its pregnancy and parenting club with 39 organisations, including data brokers. [Markdown](https://inth.com/enforcement/bounty-uk.md).
- [Federal Press Office fan page: a court said only Meta had to get cookie consent](https://inth.com/enforcement/bfdi-federal-press-office-fanpage): A Cologne court overturned the federal regulator's ban on the government's Facebook page, holding only Meta had to get cookie consent. Appeal pending. [Markdown](https://inth.com/enforcement/bfdi-federal-press-office-fanpage.md).
- [BayLDA hashed email fine: hashing did not remove the need for consent](https://inth.com/enforcement/baylda-hashed-email-targeting): Bavaria's regulator reportedly fined a tech firm about €3.2m for ad targeting with hashed emails and no consent. The figure is second-hand; see the limits. [Markdown](https://inth.com/enforcement/baylda-hashed-email-targeting.md).
- [Spears v. Campbell's: a Reject button that leaves third-party cookies running is a broken promise](https://inth.com/enforcement/spears-v-campbells): Shoppers alleged Campbell's and Pacific Foods sites kept third-party tracking cookies running after they rejected them. In 2026 all six claims survived. [Markdown](https://inth.com/enforcement/spears-v-campbells.md).
- [Lakes v. Ubisoft: layered, provable consent ended a Meta Pixel case at the pleading stage](https://inth.com/enforcement/lakes-v-ubisoft): Gamers alleged the Meta Pixel on ubisoft.com sent game titles with Facebook IDs to Meta. The court held a banner, clickwrap and checkout proved consent. [Markdown](https://inth.com/enforcement/lakes-v-ubisoft.md).
- [Kaiser Permanente: keep ad, analytics and replay code out of the patient portal](https://inth.com/enforcement/kaiser-permanente): Members alleged Kaiser's sites and apps sent portal activity and health searches to Google, Bing, X, Adobe and Quantum Metric. Kaiser denied it. [Markdown](https://inth.com/enforcement/kaiser-permanente.md).
- [LocateSmarter: never ask for Social Security digits before an opt-out](https://inth.com/enforcement/calprivacy-locatesmarter): CalPrivacy found data broker LocateSmarter registered late and required part of a Social Security number to opt out. Fines: USD 110,490 in August 2026. [Markdown](https://inth.com/enforcement/calprivacy-locatesmarter.md).
- [Camplisson v. Adidas: a privacy policy link in the footer is not consent to a TikTok pixel](https://inth.com/enforcement/camplisson-v-adidas): Shoppers alleged adidas.com ran TikTok and Bing trackers with no consent prompt, only footer links. The court refused to dismiss the §638.51 claim. [Markdown](https://inth.com/enforcement/camplisson-v-adidas.md).
- [Amazon (CNIL): ad cookies on every landing page, including the ones reached from an ad](https://inth.com/enforcement/cnil-amazon): CNIL found amazon.fr set over 40 ad cookies before any visitor action, behind a banner with no way to refuse. It fined Amazon Europe Core €35 million. [Markdown](https://inth.com/enforcement/cnil-amazon.md).
- [Google in France: three CNIL cookie fines, from arrival cookies to a lopsided sign-up](https://inth.com/enforcement/cnil-google): CNIL fined Google €100 million in 2020 for cookies on arrival, €150 million in 2021 over refusal and €325 million in 2025 over sign-up cookies and ads. [Markdown](https://inth.com/enforcement/cnil-google.md).
- [DesignTechnica v. Swigart: why a publisher could not take 36 Meta Pixel arbitrations to federal court](https://inth.com/enforcement/designtechnica-v-swigart): Digital Trends' publisher sued a law firm and 36 Meta Pixel arbitration claimants. Dismissed in 2024: about USD 7,000 per claimant was below the threshold. [Markdown](https://inth.com/enforcement/designtechnica-v-swigart.md).
- [Doe v. Eating Recovery Center: a defence win on 'in transit' is not a reason to keep the pixel](https://inth.com/enforcement/doe-v-eating-recovery-center): A visitor alleged an eating-disorder clinic's Meta Pixel sent her browsing to Meta. Claims survived in 2024; the clinic won summary judgment in 2025. [Markdown](https://inth.com/enforcement/doe-v-eating-recovery-center.md).
- [Ford: do not make an opt-out wait for an email confirmation](https://inth.com/enforcement/ford): The CPPA found Ford held opt-out requests until people confirmed their email and identity, while selling continued. Board decision, 2026: USD 375,703 fine. [Markdown](https://inth.com/enforcement/ford.md).
- [Avast: a privacy product sold the browsing data it collected, and the anonymisation did not hold](https://inth.com/enforcement/ftc-avast): The FTC alleged Avast's software collected browsing data that its Jumpshot unit sold, re-identifiable, to 100+ firms. The order required USD 16.5 million. [Markdown](https://inth.com/enforcement/ftc-avast.md).
- [Kochava: know where your app's location data goes after the SDK sends it](https://inth.com/enforcement/ftc-kochava): The FTC sued data broker Kochava for selling precise location data tied to ad IDs, including clinic visits. A 2026 order bans sensitive location sales. [Markdown](https://inth.com/enforcement/ftc-kochava.md).
- [Gardner v. Me-TV: giving an email and zip code for free features can make a viewer a VPPA consumer](https://inth.com/enforcement/gardner-v-me-tv): The Seventh Circuit held MeTV users who gave an email and zip code for a free streaming site were VPPA consumers, reviving Meta Pixel claims. [Markdown](https://inth.com/enforcement/gardner-v-me-tv.md).
- [General Motors: data kept after the service needs it becomes a liability when someone sells it](https://inth.com/enforcement/general-motors): California alleged GM sold OnStar driving and location data of hundreds of thousands of drivers to two data brokers. Judgment, May 2026: USD 12,750,000. [Markdown](https://inth.com/enforcement/general-motors.md).
- [Greenley v. Kochava: the app SDK ruling that started California's pen register lawsuits](https://inth.com/enforcement/greenley-v-kochava): An app user alleged data broker Kochava's SDK collected and sold location and device data. In 2023 a federal court held the SDK plausibly a pen register. [Markdown](https://inth.com/enforcement/greenley-v-kochava.md).
- [Hughes v. NFL: Solomon decides Pixel video claims in the Second Circuit, even with an NFL+ subscription](https://inth.com/enforcement/hughes-v-nfl): An NFL.com newsletter and NFL+ subscriber alleged the Meta Pixel sent video titles and his Facebook ID to Facebook. The Second Circuit affirmed dismissal. [Markdown](https://inth.com/enforcement/hughes-v-nfl.md).
- [In re BPS Direct: keep card numbers out of session replay](https://inth.com/enforcement/in-re-bps-direct): Shoppers sued Bass Pro Shops and Cabela's over session replay. The Third Circuit held two buyers whose full card numbers were captured have standing. [Markdown](https://inth.com/enforcement/in-re-bps-direct.md).
- [In re Meta Pixel Healthcare: patients sued the pixel vendor, and the wiretap claims survived](https://inth.com/enforcement/in-re-meta-pixel-healthcare): Users alleged the Meta Pixel on over 660 healthcare providers' sites sent portal log-ins and health searches to Meta. Wiretap and contract claims survived. [Markdown](https://inth.com/enforcement/in-re-meta-pixel-healthcare.md).
- [In re Otter.ai: an AI notetaker that keeps conversations for its own models is pleaded as an eavesdropper](https://inth.com/enforcement/in-re-otter-ai): Meeting participants alleged Otter's AI notetaker recorded them without consent and trained models on calls. CIPA, Wiretap Act and BIPA claims survived. [Markdown](https://inth.com/enforcement/in-re-otter-ai.md).
- [Ingraham v. Capital One: a tracking class failed because each visitor's data, notices and harm differed](https://inth.com/enforcement/ingraham-v-capital-one): Card applicants alleged Capital One's application pages sent financial data to Meta, Google and others. Class certification was refused on 16 June 2026. [Markdown](https://inth.com/enforcement/ingraham-v-capital-one.md).
- [Jam City: a mobile game needs its opt-out inside the app](https://inth.com/enforcement/jam-city): California's Attorney General alleged none of Jam City's 21 mobile games offered a CCPA opt-out. Stipulated judgment, November 2025: USD 1,400,000 penalty. [Markdown](https://inth.com/enforcement/jam-city.md).
- [Jancik v. WebMD: a court certified a VPPA Pixel class by asking Meta which subscribers it has data for](https://inth.com/enforcement/jancik-v-webmd): A federal court certified a class of WebMD newsletter subscribers whose video views Meta received, using Meta's own Event Data. Certified February 2025. [Markdown](https://inth.com/enforcement/jancik-v-webmd.md).
- [Limas v. Wayfair: six social pixels that fire before any banner or notice](https://inth.com/enforcement/limas-v-wayfair): A shopper alleged wayfair.com loaded six social pixels before any privacy policy or banner. In August 2026 his §631 and trap-and-trace claims survived. [Markdown](https://inth.com/enforcement/limas-v-wayfair.md).
- [Marriott v. Sperling Kenny: a company answers a 7,000-claim pixel arbitration with evidence about the claimant firms' own pixels](https://inth.com/enforcement/marriott-v-sperling-kenny): Facing nearly 7,000 arbitration demands over the Meta Pixel, Marriott sued the two claimant firms, alleging their own intake sites used pixels. [Markdown](https://inth.com/enforcement/marriott-v-sperling-kenny.md).
- [Mitchener v. Talkspace: a dated network capture outweighed a declaration about what a pixel could send](https://inth.com/enforcement/mitchener-v-talkspace): A TikTok Pixel suit against therapy platform Talkspace was dismissed for lack of standing, and the court granted Rule 11 sanctions in part against counsel. [Markdown](https://inth.com/enforcement/mitchener-v-talkspace.md).
- [PlayOn Sports: a banner with only 'Agree' over a school ticket is not a choice](https://inth.com/enforcement/playon-sports): The CPPA found PlayOn's GoFan sites made families click 'Agree' to tracking before using tickets and ignored GPC. Board decision, 2026: USD 1,100,000 fine. [Markdown](https://inth.com/enforcement/playon-sports.md).
- [Rios v. HRB Digital: a mass-arbitration clause can fail and leave pixel claims in open court](https://inth.com/enforcement/rios-v-hrb-digital): Taxpayers alleged H&R Block's filing pixels sent return details to Meta and Google. A judge held its mass-arbitration protocol unconscionable; on appeal. [Markdown](https://inth.com/enforcement/rios-v-hrb-digital.md).
- [Rodriguez v. Autotrader: a plaintiff who sought out the tracking had no expectation of privacy to lose](https://inth.com/enforcement/rodriguez-v-autotrader): A plaintiff who pleaded she works as a privacy 'tester' sued Autotrader over trackers and search sharing. Both CIPA claims were dismissed with prejudice. [Markdown](https://inth.com/enforcement/rodriguez-v-autotrader.md).
- [Variety Media: a California appeal court's tentative view that a visitor's own IP address is not pen register data](https://inth.com/enforcement/rose-v-variety-media): A reader alleged Variety's trackers sent his IP address to data brokers. An August 2026 appellate tentative would reverse the ruling for the reader. [Markdown](https://inth.com/enforcement/rose-v-variety-media.md).
- [Salazar v. NBA: a free newsletter sign-up can make a video viewer a VPPA consumer](https://inth.com/enforcement/salazar-v-nba): The Second Circuit held a free NBA.com newsletter subscriber was a VPPA consumer with standing. On remand the claim was dismissed under Solomon. [Markdown](https://inth.com/enforcement/salazar-v-nba.md).
- [Santoro v. Tower Health: patients have standing when a hospital's pixel sends their health browsing to Meta](https://inth.com/enforcement/santoro-v-tower-health): Patients alleged Tower Health's Meta Pixel sent health-related browsing to Meta. The Third Circuit found standing but affirmed dismissal for undue delay. [Markdown](https://inth.com/enforcement/santoro-v-tower-health.md).
- [Shah v. Crain Communications: a pre-filing order for new CIPA suits in one federal district](https://inth.com/enforcement/shah-v-crain-communications): A self-represented plaintiff alleged Ad Age's site sent his search terms to vendors. In July 2026 a court declared him a vexatious litigant for CIPA suits. [Markdown](https://inth.com/enforcement/shah-v-crain-communications.md).
- [Shah v. Fandom: a visitor who sends you an IP address has not agreed to send it to your ad vendors](https://inth.com/enforcement/shah-v-fandom): Visitors alleged three GameSpot ad trackers sent their IP addresses to third parties. In October 2024 a federal judge held them plausibly pen registers. [Markdown](https://inth.com/enforcement/shah-v-fandom.md).
- [Shah v. MyFitnessPal: after an opt-out, a fitness site's search terms and sign-up answers must stay with the site](https://inth.com/enforcement/shah-v-myfitnesspal): Two Californians alleged MyFitnessPal kept sharing their activity with Facebook, Google, TikTok and others after opting out. Privacy claims survived. [Markdown](https://inth.com/enforcement/shah-v-myfitnesspal.md).
- [Shah v. Politico: a cookie toggle has to switch off every vendor behind it](https://inth.com/enforcement/shah-v-politico): Readers alleged politico.com kept sending cookies and data after they toggled off ad cookies. Privacy, intrusion and fraud claims survived dismissal. [Markdown](https://inth.com/enforcement/shah-v-politico.md).
- [Smith v. Target: Arizona's records statute does not reach email open pixels](https://inth.com/enforcement/smith-v-target): A shopper claimed spy pixels in Target's emails procured 'communication service records'. The Arizona Court of Appeals affirmed dismissal. [Markdown](https://inth.com/enforcement/smith-v-target.md).
- [Solomon v. Flipps: in the Second Circuit, a Pixel request an ordinary person cannot read is not VPPA PII](https://inth.com/enforcement/solomon-v-flipps): The Second Circuit held a Meta Pixel request with an encoded video title and Facebook ID was not personally identifiable information under the VPPA. [Markdown](https://inth.com/enforcement/solomon-v-flipps.md).
- [Tilting Point: an age screen that starts at 1953 and SDKs left on their defaults](https://inth.com/enforcement/tilting-point-media): California alleged the SpongeBob: Krusty Cook-Off app sold children's data via a biased age screen and misconfigured SDKs. Judgment: USD 500,000. [Markdown](https://inth.com/enforcement/tilting-point-media.md).
- [Torres v. Prudential: recording a form is not reading it in transit, but vendor access still mattered](https://inth.com/enforcement/torres-v-prudential): A certified class alleged TrustedForm recorded a Prudential quote form in breach of CIPA §631. Defendants won summary judgment; an appeal is pending. [Markdown](https://inth.com/enforcement/torres-v-prudential.md).
- [Tractor Supply: a Do Not Sell form must switch off the trackers, and you need an inventory to know which](https://inth.com/enforcement/tractor-supply): The CPPA found Tractor Supply's Do Not Sell form left ad trackers running and GPC was ignored until July 2024. Board decision, 2025: USD 1,350,000 fine. [Markdown](https://inth.com/enforcement/tractor-supply.md).
- [AARP: members-only video plus the Meta Pixel cost USD 12.5 million](https://inth.com/enforcement/aarp): Members alleged AARP's Meta Pixel sent video titles and Facebook IDs to Meta. AARP denied wrongdoing and paid USD 12.5 million, approved 20 February 2026. [Markdown](https://inth.com/enforcement/aarp.md).
- [Advocate Aurora Health: audit the scheduling widgets and portal pages your tags reach](https://inth.com/enforcement/advocate-aurora): Patients alleged Meta and Google pixels on Advocate Aurora's MyChart portal, app and scheduling widgets sent activity. It settled for USD 12.225 million. [Markdown](https://inth.com/enforcement/advocate-aurora.md).
- [Atrium Health: a pixel removed from the portal in 2019 still produced a 2026 settlement](https://inth.com/enforcement/atrium-health): Patients alleged Atrium Health's pixels sent website and portal data to Meta and Google. Atrium denies the claims and agreed to pay up to USD 1.8 million. [Markdown](https://inth.com/enforcement/atrium-health.md).
- [LiveRamp: collecting a visitor's IP address is how the internet works, the court said](https://inth.com/enforcement/aviles-v-liveramp): A visitor alleged a beacon on liveramp.com collected his IP address and device data. In January 2025 the court sustained LiveRamp's demurrer with leave. [Markdown](https://inth.com/enforcement/aviles-v-liveramp.md).
- [Baker v. Seattle Children's: Washington's privacy act does not cover searches answered by a server](https://inth.com/enforcement/baker-v-seattle-childrens): Parents alleged the Meta Pixel on Seattle Children's site sent their health searches to Meta. Washington's Supreme Court affirmed dismissal in 2026. [Markdown](https://inth.com/enforcement/baker-v-seattle-childrens.md).
- [BetterHelp: an intake questionnaire is health data, even behind an anonymous event name](https://inth.com/enforcement/betterhelp): The FTC alleged BetterHelp shared therapy seekers' emails, IP addresses and intake answers with ad platforms. The order set USD 7.8 million for refunds. [Markdown](https://inth.com/enforcement/betterhelp.md).
- [Bio Clarity: a footer link to terms did not bind a chat user to arbitration](https://inth.com/enforcement/byars-v-bio-clarity): A visitor sued Bio Clarity under CIPA over its website chat. In February 2025 the court refused to compel arbitration under the site's browsewrap terms. [Markdown](https://inth.com/enforcement/byars-v-bio-clarity.md).
- [OnePlus: a cookie banner does not help if the TikTok Pixel fires before it appears](https://inth.com/enforcement/cantu-v-oneplus): A visitor alleged oneplus.com loaded TikTok fingerprinting code before its cookie banner. The Los Angeles court overruled the demurrer on 30 April 2025. [Markdown](https://inth.com/enforcement/cantu-v-oneplus.md).
- [Transitions Optical: know which scripts turn a visitor's IP address into an identity](https://inth.com/enforcement/casillas-v-transitions-optical): A visitor alleged transitions.com used IP-based tracking software as a pen register. The demurrer was sustained without leave and judgment entered. [Markdown](https://inth.com/enforcement/casillas-v-transitions-optical.md).
- [Cole v. Quest Diagnostics: what a patient-portal URL tells Meta](https://inth.com/enforcement/cole-v-quest-diagnostics): Patients alleged Quest's Meta Pixel sent portal URLs to Facebook in breach of CIPA §631 and the CMIA. The Third Circuit affirmed dismissal of both claims. [Markdown](https://inth.com/enforcement/cole-v-quest-diagnostics.md).
- [Concord Hospital: in an all-party-consent state, the pixel waits for consent](https://inth.com/enforcement/concord-hospital): Patients alleged Google Analytics and Geonetric pixels on Concord Hospital's sites intercepted communications. Concord denies it and agreed USD 800,000. [Markdown](https://inth.com/enforcement/concord-hospital.md).
- [Cone Health: forms and portals on one domain need one tag policy](https://inth.com/enforcement/cone-health): A patient alleged Cone Health's website and MyChart portal sent data to Meta and Google. Cone denies it; a USD 1.765 million settlement awaits approval. [Markdown](https://inth.com/enforcement/cone-health.md).
- [Cook v. GameStop: replaying a shopper's clicks was not a concrete injury, but broken promises are different](https://inth.com/enforcement/cook-v-gamestop): A shopper sued GameStop over Microsoft Clarity session replay under Pennsylvania's wiretap act. The Third Circuit found no standing in federal court. [Markdown](https://inth.com/enforcement/cook-v-gamestop.md).
- [Disney: make an opt-out follow the account, not the device](https://inth.com/enforcement/disney): California's Attorney General alleged Disney+, Hulu and ESPN+ opt-outs stopped only some selling and sharing, often for one device. Penalty: USD 2,750,000. [Markdown](https://inth.com/enforcement/disney.md).
- [Doe v. Adobe: an analytics vendor on a health portal can be sued directly](https://inth.com/enforcement/doe-v-adobe): A Kaiser member sued Adobe, alleging its code on Kaiser's website collected medical information. A 2024 tentative let CIPA §632 and privacy claims proceed. [Markdown](https://inth.com/enforcement/doe-v-adobe.md).
- [DoorDash: a marketing co-operative can be a sale, even with no website code](https://inth.com/enforcement/doordash): California's Attorney General alleged DoorDash sold customer names, addresses and order histories to a marketing co-operative. Final judgment: USD 375,000. [Markdown](https://inth.com/enforcement/doordash.md).
- [Esparza v. CommonSpirit: a site-search vendor that uses queries for its own ads is not your tape recorder](https://inth.com/enforcement/esparza-v-commonspirit): A visitor alleged CommonSpirit's site passed search terms to a third-party search vendor and ran Neustar tracking. A tentative let the claims proceed. [Markdown](https://inth.com/enforcement/esparza-v-commonspirit.md).
- [European Wax Center: booking pages with trackers drew a Florida wiretap class settlement of up to USD 5 million](https://inth.com/enforcement/european-wax-center): Visitors alleged waxcenter.com's pixels and cookies disclosed their activity to third parties. The company agreed a settlement capped at USD 5 million. [Markdown](https://inth.com/enforcement/european-wax-center.md).
- [GameSpot: a USD 1.2 million settlement over three ad trackers, and 400,000 claims instead of 5,000](https://inth.com/enforcement/fandom-gamespot): Visitors alleged three GameSpot ad trackers sent their IP addresses to third parties. Fandom settled for USD 1.2 million, finally approved on 19 May 2026. [Markdown](https://inth.com/enforcement/fandom-gamespot.md).
- [Flo, Google and Flurry: three SDK settlements worth USD 59.5 million, separate from the Meta verdict](https://inth.com/enforcement/flo-google-flurry): Flo app users alleged Flo passed period and pregnancy answers to Google and Flurry through SDKs. The three agreed USD 59.5 million, pending approval. [Markdown](https://inth.com/enforcement/flo-google-flurry.md).
- [Forbes: a USD 10 million settlement over LinkedIn and Microsoft ad tags that loaded before consent](https://inth.com/enforcement/forbes-trackers): Visitors alleged Forbes.com sent IP addresses and IDs to LinkedIn, Microsoft and Xandr without consent. Forbes denies it; the fund is USD 10 million. [Markdown](https://inth.com/enforcement/forbes-trackers.md).
- [Formula 1: an opt-in consent banner that never said 'video' still led to a VPPA settlement](https://inth.com/enforcement/formula-one): F1 TV subscribers alleged the Meta Pixel and Salesforce received video URLs with identifiers. F1 agreed a claims-made settlement of up to USD 5.5 million. [Markdown](https://inth.com/enforcement/formula-one.md).
- [Frasco v. Meta: name your app events as if a jury will read them](https://inth.com/enforcement/frasco-v-meta): Plaintiffs' counsel reports a jury found in August 2025 that Meta's SDK recorded Flo app users' period and pregnancy answers in breach of CIPA §632. [Markdown](https://inth.com/enforcement/frasco-v-meta.md).
- [FuboTV: a live-TV streamer settled Pixel, analytics and trap-and-trace claims for USD 3.4 million](https://inth.com/enforcement/fubotv): Fubo users alleged the Meta Pixel, Google Analytics and cookies disclosed viewing data. Fubo denied wrongdoing; a USD 3.4 million settlement was approved. [Markdown](https://inth.com/enforcement/fubotv.md).
- [GameStop: game purchase pages that told Facebook the title led to a VPPA settlement capped at USD 4.5 million](https://inth.com/enforcement/gamestop-vppa): Buyers alleged GameStop's Facebook Pixel disclosed which video games they bought. GameStop denied it and agreed a settlement of up to USD 4.5 million. [Markdown](https://inth.com/enforcement/gamestop-vppa.md).
- [Lehmans Hardware: a chat-wiretap claim against the site needs a pleaded violation by the chat vendor](https://inth.com/enforcement/garcia-licea-and-esparza-v-lehmans-hardware): Three plaintiffs alleged lehmans.com let a chat vendor record chats for Meta ads. The §631 demurrer was sustained: no vendor violation was pleaded. [Markdown](https://inth.com/enforcement/garcia-licea-and-esparza-v-lehmans-hardware.md).
- [Garcia v. Butterfly Network: a chat vendor that routes transcripts through its servers can support an aiding claim](https://inth.com/enforcement/garcia-v-butterfly-network): A visitor alleged Butterfly Network let Drift intercept its website chat under CIPA §631. The demurrer was overruled in October 2024; the case settled. [Markdown](https://inth.com/enforcement/garcia-v-butterfly-network.md).
- [Forbes video: removing the Pixel from video pages capped the class period, and the USD 7.5 million was a ceiling](https://inth.com/enforcement/forbes-video): Subscribers alleged the Meta Pixel sent video URLs and Facebook IDs from Forbes.com. A Florida court approved a settlement of up to USD 7.5 million. [Markdown](https://inth.com/enforcement/forbes-video.md).
- [GoodRx: keep drug names and conditions out of ad pixel events](https://inth.com/enforcement/goodrx): The DOJ, for the FTC, alleged GoodRx sent medication and condition data to Facebook, Google and Criteo. A stipulated order set a USD 1.5 million penalty. [Markdown](https://inth.com/enforcement/goodrx.md).
- [Gutierrez v. Converse: a chat vendor that could read messages is not one that did](https://inth.com/enforcement/gutierrez-v-converse): A shopper alleged Converse helped Salesforce wiretap its website chat. The Ninth Circuit affirmed summary judgment: capability alone did not show access. [Markdown](https://inth.com/enforcement/gutierrez-v-converse.md).
- [Healthline: an opt-out must stop the tags, and article titles can reveal a diagnosis](https://inth.com/enforcement/healthline): California's Attorney General alleged Healthline.com kept sending identifiers and article titles to ad companies after opt-outs. Penalty: USD 1,550,000. [Markdown](https://inth.com/enforcement/healthline.md).
- [HarperCollins: dated chat disclosures defeated class certification](https://inth.com/enforcement/heiting-v-harpercollins): A putative class alleged HarperCollins let Tawk.to record website chats. In May 2025 class certification was denied: chat disclosures changed over time. [Markdown](https://inth.com/enforcement/heiting-v-harpercollins.md).
- [Postable: a chat vendor that only works for the website is an extension of it](https://inth.com/enforcement/heiting-v-postable): A visitor alleged Postable let Intercom eavesdrop on its site chat. In February 2024 the court sustained the demurrer, treating Intercom as an extension. [Markdown](https://inth.com/enforcement/heiting-v-postable.md).
- [Taylor Fresh Foods: a TikTok Pixel that fires before consent was pleaded as a trap and trace device](https://inth.com/enforcement/heiting-v-taylor-fresh-foods): A visitor alleged the TikTok Pixel on Taylor Fresh Foods' website fingerprinted her without consent. A July 2024 tentative overruled the demurrer. [Markdown](https://inth.com/enforcement/heiting-v-taylor-fresh-foods.md).
- [Thryv: a chat vendor whose policy allows its own use of data may be a third-party eavesdropper](https://inth.com/enforcement/heiting-v-thryv): A visitor alleged Thryv's website chat let Intercom intercept chats and use the data for its own ads. In June 2024 the court overruled the demurrer. [Markdown](https://inth.com/enforcement/heiting-v-thryv.md).
- [Valvoline: a chat vendor alleged to store chats for its own purposes kept the wiretap claim alive](https://inth.com/enforcement/heiting-v-valvoline): A visitor alleged Valvoline paid InContact to eavesdrop on its website chat. In May 2024 the court overruled the §631 demurrer on the chat claim. [Markdown](https://inth.com/enforcement/heiting-v-valvoline.md).
- [Honda: an opt-out must take no more steps, and no more data, than opting in](https://inth.com/enforcement/honda): The CPPA found Honda demanded eight fields and identity matching for opt-outs, and two clicks to refuse cookies but one to accept. Fine: USD 632,500. [Markdown](https://inth.com/enforcement/honda.md).
- [Wilson Sporting Goods: a judge read the TikTok Pixel as a possible trap and trace device](https://inth.com/enforcement/huff-v-wilson-sporting-goods): A visitor alleged TikTok software on Wilson's website was a trap and trace device. The court found that theory pleaded but sustained the demurrer. [Markdown](https://inth.com/enforcement/huff-v-wilson-sporting-goods.md).
- [Neiman Marcus: know what your TikTok tag is for, because the court will ask](https://inth.com/enforcement/hughes-v-neiman-marcus): A visitor alleged neimanmarcus.com used TikTok software as a trap and trace device. In March 2025 the court refused to end the claim on the pleadings. [Markdown](https://inth.com/enforcement/hughes-v-neiman-marcus.md).
- [IHOP: a website operator cannot consent to a tracker on its visitors' behalf](https://inth.com/enforcement/jane-heiting-v-ihop): A visitor alleged the TikTok Pixel on IHOP's website was an unlawful trap and trace device. In October 2024 the court overruled IHOP's demurrer. [Markdown](https://inth.com/enforcement/jane-heiting-v-ihop.md).
- [Javier v. Assurance IQ: ask for consent before a form recorder starts, not at the last step](https://inth.com/enforcement/javier-v-assurance-iq): A quote form recorded keystrokes before showing a privacy consent. The Ninth Circuit rejected retroactive consent; the claim later failed as time-barred. [Markdown](https://inth.com/enforcement/javier-v-assurance-iq.md).
- [Lee Enterprises: newspaper video pages that named the clip in the URL cost USD 9.5 million](https://inth.com/enforcement/lee-enterprises): Lee newspaper subscribers alleged the Meta Pixel sent Facebook their ID and video titles. Lee denied liability; a USD 9.5 million settlement was approved. [Markdown](https://inth.com/enforcement/lee-enterprises.md).
- [Lemonaid Health: on a telehealth site, the condition is in the URL, so the pixel learns it](https://inth.com/enforcement/lemonaid-health): Visitors alleged Lemonaid Health's pixels sent the conditions and medications they sought to Facebook and Google. Claims settled for USD 3.25 million. [Markdown](https://inth.com/enforcement/lemonaid-health.md).
- [Choice Hotels: visiting a website is not consent to the tracking code it installs](https://inth.com/enforcement/levings-v-choice-hotels): A visitor alleged choicehotels.com used pen-register software that read his device's data. In April 2024 the court overruled the demurrer. [Markdown](https://inth.com/enforcement/levings-v-choice-hotels.md).
- [Globecast America: the pen-register count fell, but de-anonymisation claims survived](https://inth.com/enforcement/licea-v-globecast-america): A visitor alleged Globecast's website de-anonymised visitors through a third-party database. The §638.51 count fell, but four other claims survived. [Markdown](https://inth.com/enforcement/licea-v-globecast-america.md).
- [Hickory Farms: an IP address alone did not make a tracking script a pen register](https://inth.com/enforcement/licea-v-hickory-farms): A visitor alleged Hickory Farms' website used pen-register software to take his IP address. The demurrer was sustained with leave in March 2024. [Markdown](https://inth.com/enforcement/licea-v-hickory-farms.md).
- [LifeStance Health: booking and telehealth pages on a mental-health site need a pixel-free path](https://inth.com/enforcement/lifestance-health): Patients alleged LifeStance's site sent therapist searches and booking activity to Meta and Google. A USD 3,027,874.44 settlement awaits approval. [Markdown](https://inth.com/enforcement/lifestance-health.md).
- [Limited Run Games: trailers and cutscene game sales brought a USD 2.72 million VPPA settlement](https://inth.com/enforcement/limited-run-games): Buyers and viewers alleged Limited Run Games' Meta Pixel disclosed their video viewing to Meta. LRG denied wrongdoing and paid USD 2.72 million to settle. [Markdown](https://inth.com/enforcement/limited-run-games.md).
- [Los Angeles Times: inventory the ad-exchange scripts your ad stack puts on every page](https://inth.com/enforcement/los-angeles-times): A reader alleged LATimes.com let TripleLift, GumGum and Audiencerate trackers act as pen registers. A USD 3.85 million settlement is on hold for an appeal. [Markdown](https://inth.com/enforcement/los-angeles-times.md).
- [Meta Ireland: standard contractual clauses did not cover US surveillance access to Facebook data](https://inth.com/enforcement/meta-eu): The Irish DPC found Meta Ireland's Facebook data transfers to the US breached GDPR Article 46(1), fined it €1.2 billion and ordered transfers suspended. [Markdown](https://inth.com/enforcement/meta-eu.md).
- [Microsoft Bing: make Reject as easy as Accept, and do not hide ad uses inside a security cookie](https://inth.com/enforcement/microsoft-bing): CNIL found bing.com set its multi-purpose MUID cookie before any choice and made refusal harder than acceptance. It fined Microsoft Ireland €60 million. [Markdown](https://inth.com/enforcement/microsoft-bing.md).
- [Mikulsky v. Bloomingdale's: real-time replay of what shoppers type can support a §631 aiding claim](https://inth.com/enforcement/mikulsky-v-bloomingdales): A shopper alleged Bloomingdale's helped session replay providers capture her communications in real time. The Ninth Circuit revived the CIPA §631 claim. [Markdown](https://inth.com/enforcement/mikulsky-v-bloomingdales.md).
- [Palacios v. Fandom: a tracker that logs the visitor's IP address records the source, not the number dialled](https://inth.com/enforcement/palacios-v-fandom): A visitor alleged code on fandom.com sent her IP address to third parties. The court held that is not pen-register data; judgment for Fandom followed. [Markdown](https://inth.com/enforcement/palacios-v-fandom.md).
- [Gorgias: the court read the pen-register statute alongside the CCPA and dismissed](https://inth.com/enforcement/palacios-v-gorgias): Marielita Palacios alleged gorgias.com used trap-and-trace tracking. The court held §638.51 was not meant for sites using data for their own purposes. [Markdown](https://inth.com/enforcement/palacios-v-gorgias.md).
- [Office Depot: an IP address alone was not an injury the statute pays for](https://inth.com/enforcement/palacios-v-office-depot): Marielita Palacios alleged officedepot.com used pen-register software to take her IP address. The court found no §637.2 injury in an IP address alone. [Markdown](https://inth.com/enforcement/palacios-v-office-depot.md).
- [Patreon: video posts behind a paid membership led to a USD 7.25 million VPPA settlement](https://inth.com/enforcement/patreon): Patreon users alleged the Meta Pixel sent video titles and Facebook IDs to Meta. After a failed First Amendment attack, it settled for USD 7.25 million. [Markdown](https://inth.com/enforcement/patreon.md).
- [Novant Health: a pixel's automatic events can read what patients click](https://inth.com/enforcement/novant-health): Patients alleged a Meta Pixel on Novant Health's website and MyChart portal sent health data to Facebook. Novant settled state claims for USD 6.66 million. [Markdown](https://inth.com/enforcement/novant-health.md).
- [Popa v. Microsoft: session replay of a pet-supply visit gave no federal standing](https://inth.com/enforcement/popa-v-microsoft): A shopper sued over Microsoft Clarity session replay on petsuppliesplus.com. The Ninth Circuit, in a published opinion, found no concrete injury. [Markdown](https://inth.com/enforcement/popa-v-microsoft.md).
- [Penn Medicine: in Pennsylvania, a portal pixel is a wiretap question, so make someone own the tag list](https://inth.com/enforcement/penn-medicine): Patients alleged Meta and Google pixels on the myPennMedicine portal broke Pennsylvania's wiretap act. Penn denies it and agreed up to USD 9.25 million. [Markdown](https://inth.com/enforcement/penn-medicine.md).
- [Deckers: map what your chat vendor keeps, because that decides whether it is a third party](https://inth.com/enforcement/ramirez-v-deckers): A shopper alleged Deckers let chat vendor Gladly intercept and keep website chats. In October 2024 the court sustained the demurrer with leave to amend. [Markdown](https://inth.com/enforcement/ramirez-v-deckers.md).
- [Fountain9: a statutory-damages claim over an IP address needed a concrete injury](https://inth.com/enforcement/rebeka-rodriguez-v-fountain9): Rebeka Rodriguez alleged a beacon on fountain9.com took her IP address. The court held §637.2 requires a concrete injury; judgment for Fountain9 followed. [Markdown](https://inth.com/enforcement/rebeka-rodriguez-v-fountain9.md).
- [Indium Software: the claim survived because the complaint listed fingerprinting data](https://inth.com/enforcement/rebeka-rodriguez-v-indium-software): A visitor alleged a beacon on indiumsoftware.com took her IP address, browser, screen, geolocation and ad IDs. The demurrer was overruled in February 2025. [Markdown](https://inth.com/enforcement/rebeka-rodriguez-v-indium-software.md).
- [Plivo: a website has to receive the visitor's IP address to work at all](https://inth.com/enforcement/rebeka-rodriguez-v-plivo): A visitor alleged plivo.com used pen-register spyware to collect her IP address. The court sustained an unopposed demurrer without leave in October 2024. [Markdown](https://inth.com/enforcement/rebeka-rodriguez-v-plivo.md).
- [Salazar v. Paramount: the Supreme Court is deciding who counts as a VPPA consumer](https://inth.com/enforcement/salazar-v-paramount): A 247Sports newsletter subscriber says Paramount's Meta Pixel sent his ID and video views to Facebook. The Supreme Court heard argument on 14 October 2026. [Markdown](https://inth.com/enforcement/salazar-v-paramount.md).
- [Glasscanopy: tracking beacons and a third-party site search both survived demurrer](https://inth.com/enforcement/sanchez-v-glasscanopy): A visitor alleged glasscanopy.com ran beacons before consent and sent search terms to a third-party provider. In February 2025 both CIPA counts survived. [Markdown](https://inth.com/enforcement/sanchez-v-glasscanopy.md).
- [Letter Four: a banner that appears after the tracker has fired was the allegation](https://inth.com/enforcement/sanchez-v-letter-four): A visitor alleged letterfour.com shared her IP address with third parties before its banner. A demurrer was sustained in April 2025, then overruled. [Markdown](https://inth.com/enforcement/sanchez-v-letter-four.md).
- [Sephora: read the Global Privacy Control signal and stop the trackers it covers](https://inth.com/enforcement/sephora): California's Attorney General alleged Sephora ignored Global Privacy Control and did not disclose sales. Final judgment 2022: USD 1,200,000 civil penalty. [Markdown](https://inth.com/enforcement/sephora.md).
- [SHEIN: test cookies on arrival, after Reject all and after withdrawal](https://inth.com/enforcement/shein): CNIL found shein.com set cookies before any choice and kept using them after Reject all and after withdrawal. It fined the SHEIN subsidiary €150 million. [Markdown](https://inth.com/enforcement/shein.md).
- [Sling TV: a cookie toggle is not a sale and sharing opt-out](https://inth.com/enforcement/sling): California's Attorney General alleged Sling TV routed CCPA opt-outs into cookie settings and offered none in TV apps. Stipulated judgment: USD 530,000. [Markdown](https://inth.com/enforcement/sling.md).
- [Smith v. Rack Room Shoes: a cookie promise kept wiretap claims alive; proof of tracking decided the class case](https://inth.com/enforcement/smith-v-rack-room-shoes): Shoppers alleged Rack Room's pixels sent browsing to Meta and Attentive. Wiretap claims survived in 2025; class claims later fell for lack of standing. [Markdown](https://inth.com/enforcement/smith-v-rack-room-shoes.md).
- [PacSun: an injunction against the TikTok Pixel needs evidence, and an unsigned expert report is not evidence](https://inth.com/enforcement/sorensen-v-pacific-sunwear): A visitor asked the court to stop pacsun.com using TikTok software. On 21 January 2025 the court denied the injunction: irreparable harm was not shown. [Markdown](https://inth.com/enforcement/sorensen-v-pacific-sunwear.md).
- [Scientific American: a USD 900,000 VPPA settlement, and a judge who cut the fees](https://inth.com/enforcement/springer-nature): A subscriber alleged the Meta Pixel sent video titles and Facebook IDs to Meta. Springer Nature settled for USD 900,000; the judge cut fees by a third. [Markdown](https://inth.com/enforcement/springer-nature.md).
- [Sutter Health: a patient portal's login page is not a neutral marketing page](https://inth.com/enforcement/sutter-health): Patients alleged Sutter's sites, including the MyHealthOnline login page, sent data to Facebook and Google. Sutter settled for USD 21.5 million. [Markdown](https://inth.com/enforcement/sutter-health.md).
- [Themis Bar Review: lecture video URLs plus Facebook cookies brought a USD 2.25 million VPPA and CIPA settlement](https://inth.com/enforcement/themis-bar-review): A subscriber alleged Themis's Facebook Pixel sent lecture-video URLs with her Facebook cookies. Themis denied it and paid USD 2.25 million to settle. [Markdown](https://inth.com/enforcement/themis-bar-review.md).
- [Thomas v. Papa John's: a website cannot eavesdrop on its own visitors, so claims target its vendors](https://inth.com/enforcement/thomas-v-papa-johns): A customer sued Papa John's over session replay under CIPA §631. The Ninth Circuit affirmed dismissal: the site was a party; no aiding claim was pleaded. [Markdown](https://inth.com/enforcement/thomas-v-papa-johns.md).
- [TikTok: child accounts must start private, and the privacy choice must not be the grey button](https://inth.com/enforcement/tiktok-eu): The DPC found infringements involving children’s public-by-default accounts, Family Pairing, transparency and fairness. It imposed €345 million in fines. [Markdown](https://inth.com/enforcement/tiktok-eu.md).
- [Todd Snyder: monitor your consent tool, because a broken banner is still your violation](https://inth.com/enforcement/todd-snyder): The CPPA alleged Todd Snyder's cookie banner failed, GPC went unprocessed and opt-outs needed a photo holding ID. Board decision, May 2025: USD 345,178. [Markdown](https://inth.com/enforcement/todd-snyder.md).
- [Viki: a mid-case arbitration clause did not stop a USD 8 million VPPA settlement](https://inth.com/enforcement/viki): Viki users alleged the Meta Pixel sent their Facebook IDs and video titles to Meta. Viki paid USD 8 million to settle; final judgment 27 October 2025. [Markdown](https://inth.com/enforcement/viki.md).
- [Vita v. New England Baptist: the Massachusetts wiretap act does not reach hospital website browsing](https://inth.com/enforcement/vita-v-new-england-baptist): A relative alleged two Boston hospitals let Meta Pixel and Google Analytics capture browsing. The SJC held browsing was not a wiretap act communication. [Markdown](https://inth.com/enforcement/vita-v-new-england-baptist.md).
- [Wellstar Health: a federal wiretap claim survived, so check what your portal sends to Meta and Google](https://inth.com/enforcement/wellstar-health): Patients alleged Wellstar's website and portal sent health data to Meta and Google. Wellstar denies wrongdoing and agreed a USD 4.25 million settlement. [Markdown](https://inth.com/enforcement/wellstar-health.md).
- [Xandr: an ad intermediary must verify consent for its own use of sensitive data](https://inth.com/enforcement/xandr-grindr-data): Datatilsynet fined Xandr NOK 92 million over Grindr users' data in real-time bidding. Relying on the publisher did not establish Xandr's own legal basis. [Markdown](https://inth.com/enforcement/xandr-grindr-data.md).
- [IQVIA Italy: a persistent patient identifier did not make health records anonymous](https://inth.com/enforcement/iqvia-italy): The Italian authority imposed a EUR 7 million fine after finding that patient records used for analytics were identifiable rather than anonymous. [Markdown](https://inth.com/enforcement/iqvia-italy.md).
- [BBVA Italy: recording an opt-out is insufficient when the sending system never receives it](https://inth.com/enforcement/bbva-marketing-objection): BBVA received a EUR 5.508 million fine after promotional app notifications continued despite a customer's marketing objection. [Markdown](https://inth.com/enforcement/bbva-marketing-objection.md).
- [Google Ireland: location controls need clear purposes, lawful processing and retention limits](https://inth.com/enforcement/google-location-data): The DPC imposed EUR 403 million in fines concerning Google's Web & App Activity, Location History and Location Accuracy features. [Markdown](https://inth.com/enforcement/google-location-data.md).
- [TikTok: an EEA hosting location did not settle the question of remote access from China](https://inth.com/enforcement/tiktok-china-transfers): The DPC fined TikTok EUR 530 million over EEA-user data transfers to China and transfer transparency, separate from its children's-privacy decision. [Markdown](https://inth.com/enforcement/tiktok-china-transfers.md).
- [Yliopiston Apteekki: medicine-shopping events exposed more than a generic page view](https://inth.com/enforcement/yliopiston-apteekki): The Finnish authority fined Yliopiston Apteekki EUR 1.1 million over tracking technologies that disclosed identifiable online-pharmacy interactions. [Markdown](https://inth.com/enforcement/yliopiston-apteekki.md).
- [CALOGA: buying leads did not remove the duty to verify consent and honour withdrawal](https://inth.com/enforcement/caloga): CNIL fined CALOGA EUR 80,000 over consent, onward transfers, withdrawal across its databases and retention of prospect data. [Markdown](https://inth.com/enforcement/caloga.md).
- [SOLOCAL: a lead supplier's promise did not substitute for proof of consent](https://inth.com/enforcement/solocal-marketing-services): CNIL fined SOLOCAL Marketing Services EUR 900,000 for electronic prospecting without valid, demonstrable consent. A lead supplier's promise was not proof. [Markdown](https://inth.com/enforcement/solocal-marketing-services.md).
- [Kaspr: restricted LinkedIn contact details were not permission for a separate prospecting database](https://inth.com/enforcement/kaspr): CNIL fined Kaspr EUR 240,000 after examining collection of restricted contact details, retention, transparency and access rights. [Markdown](https://inth.com/enforcement/kaspr.md).
- [Cegedim Santé: pseudonymous health records still required the right authorisation](https://inth.com/enforcement/cegedim-sante): CNIL fined Cegedim Santé EUR 800,000 over health-data processing that the authority found was pseudonymous rather than anonymous. [Markdown](https://inth.com/enforcement/cegedim-sante.md).
- [Avanza: new pixel features sent bank data beyond the intended marketing scope](https://inth.com/enforcement/avanza-meta-pixel): IMY fined Avanza SEK 15 million after unintended Meta Pixel functions transferred financial and identifying data beyond the intended marketing scope. [Markdown](https://inth.com/enforcement/avanza-meta-pixel.md).
- [Uber: driver-data transfers needed safeguards beyond a US server location](https://inth.com/enforcement/uber-eu-us-transfers): The Dutch authority fined Uber EUR 290 million over transfers of European drivers' data to the United States without the required safeguards. [Markdown](https://inth.com/enforcement/uber-eu-us-transfers.md).

## Documentation

- [Agent feedback](https://inth.com/feedback.md): Where to report Inth failures, confusing documentation, and missing capabilities through MCP, REST, or email.
- [Inth developer documentation](https://inth.com/docs): Start here for Inth accounts, projects, consent, API integrations, and agent setup.
- [Inth setup skill](https://inth.com/SKILL.md): Step-by-step account and project setup, consent management, and Inth Code Audit with the Inth CLI.
- [Inth design guide](https://inth.com/design.md): How inth.com pages are designed and reviewed: voice, layout, type, colour, evidence, motion and the patterns the site avoids.
- [Inth CLI](https://inth.com/docs/cli): Official command-line client for Inth. Install with `npm install -g @inth/cli` and use `--json` for structured output.
- [Inth CLI on npm](https://www.npmjs.com/package/@inth/cli): Published CLI packages and versions.
- [Agent authentication and onboarding](https://inth.com/docs/cli/automation): Account creation, sign-in approval, API keys, and non-interactive commands.
- [Documentation map](https://inth.com/docs/llms.txt): Curated documentation index for agents and developers.
- [Full documentation](https://inth.com/docs/llms-full.txt): Complete machine-readable Inth documentation.
- [REST API documentation](https://inth.com/docs/rest-api): Authentication, endpoints, response formats, rate limits, and stability guarantees.
- [API versioning and deprecation](https://inth.com/docs/rest-api#versioning-and-deprecation): Additive v1 changes, breaking versions, and retirement notices.
- [OpenAPI specification](https://api.inth.com/openapi.json): Machine-readable schema for the public REST API.
- [MCP endpoint](https://api.inth.com/mcp): User-delegated access for MCP clients.
- [Sitemap](https://inth.com/sitemap.xml): Canonical index of public Website v2 pages.
- [Dashboard sign up](https://inth.com/dashboard/sign-up): Create an Inth account.

## Legal and policies

- [Privacy policy](https://inth.com/legals/privacy-policy): How Inth handles personal data and privacy rights.
- [Cookie policy](https://inth.com/legals/cookie-policy): How Inth uses cookies and similar technologies.
- [Terms and conditions](https://inth.com/legals/terms-and-conditions): The terms that govern use of Inth services.

## Open source and community

- [c15t](https://c15t.com): Open-source, developer-first consent management.
- [CookieBench](https://cookiebench.com/llms.txt): Open benchmark of cookie consent managers, maintained by Inth. See [the fastest cookie banners](https://cookiebench.com/fastest-cookie-banners.md) on each framework.
- [GitHub](https://github.com/inthhq): Inth open-source projects and SDKs.
- [Discord](https://inth.com/discord): Inth community.

## Agent guidance

For product research, start with the Markdown mirror beside each page. For implementation work, use the documentation map. For REST integrations, load the OpenAPI specification before constructing requests. Use the MCP endpoint when an agent needs to act with a person's delegated access.