In a landmark ruling that could reshape how companies handle user consent regarding data privacy, a California court has sided with Ubisoft, Inc. in a case concerning the use of tracking pixels on its website. In the case of Lakes v. Ubisoft, Inc., decided on April 2, 2025, plaintiffs Trevor Lakes and Alex Rajjoub alleged that the video game giant violated several privacy laws by improperly disclosing their personally identifiable information (PII) to Meta, the parent company of Facebook.
The plaintiffs claimed that when they visited Ubisoft's website to download games while logged into their Facebook accounts, a Meta/Facebook tracking pixel was installed without proper consent, leading to the unauthorized sharing of their unique and unencrypted Facebook ID, an encrypted cookie containing their Facebook ID, and their Video Request Data.
In response, Ubisoft filed a motion to dismiss the allegations, supported by a request for judicial notice of its website policies, including its Privacy Policy, Cookies Settings, and the Cookies Banner presented to users. The court granted this request, allowing Ubisoft to showcase its user consent mechanisms.
According to the court’s findings, first-time users of the Ubisoft website are greeted with a Cookie Banner that clearly states that by clicking “OK” and continuing to navigate the site, they accept the use of cookies by Ubisoft and its partners. Users can also customize their cookie preferences through a pop-up that appears when they click on a “set your cookies” hyperlink in the banner.
Furthermore, to make any purchases, users must create a Ubisoft account and explicitly agree to the Terms of Use, Terms of Sale, and Privacy Policy, which are all hyperlinked on the website. The Privacy Policy itself informs users that their information will be shared with third parties and provides instructions on how to withdraw consent.
In light of these detailed disclosures, the court ruled in favor of Ubisoft, stating that the plaintiffs were adequately informed and had consented to the use of cookies and tracking pixels on the site. The ruling emphasized that a reasonable user would understand from the Privacy Policy that they were consenting to the collection and sharing of their data.
As the court noted, “A reasonable user would understand from the Privacy Policy that he or she is consenting to the use of cookies including by third parties.” Consequently, the court dismissed the complaint in its entirety, with prejudice, concluding that further amendments by the plaintiffs would be futile due to their inability to overcome the consent issue.
This ruling is significant, especially in the context of increasing privacy litigation surrounding digital tracking practices. Companies are now reminded of the importance of maintaining robust consent mechanisms. Clear cookie disclosures on landing pages, transparent data-sharing policies, and user customization options are critical in defending against privacy lawsuits.
In a similar vein, another recent case in Pennsylvania has also underscored the issue of user consent regarding privacy policies. On March 24, 2025, a federal court granted summary judgment in favor of Harriet Carter Gifts, Inc., and its marketing partner, NaviStone, in Popa v. Harriet Carter Gifts, Inc.. The lawsuit accused them of violating the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA) by collecting data about plaintiff Ashley Popa’s website visit without consent.
Popa had visited the Harriet Carter website to search for pet stairs and alleged that NaviStone tracked her shopping activity for the purpose of delivering targeted mail advertisements. However, she admitted to not reviewing the privacy policy linked in the website’s footer, which disclosed that third parties, like NaviStone, could access consumer activity data.
The court ruled that Popa had implicitly consented to NaviStone’s activities by using the website. The judge explained that a “reasonably prudent person has a lower expectation of privacy on the internet” and concluded that Popa was on inquiry notice of the privacy policy, which was easily accessible.
In granting summary judgment, the court rejected the notion that data collected before a user could view the privacy policy constituted a violation of WESCA. The ruling clarified that accessing the website did not equate to an interception of protected content under the law.
These cases highlight a growing trend in privacy law where courts are increasingly recognizing the role of user consent in the digital landscape. As businesses navigate the complexities of data privacy, the importance of transparent practices and clear user agreements cannot be overstated.
Meanwhile, in a different realm of privacy concerns, Dominique Pelicot, a French feminist icon, is suing the magazine Paris Match for invasion of privacy. On April 17, 2025, Pelicot's lawyer, Antoine Camus, expressed outrage over the publication of seven photographs depicting Pelicot with a companion in her new hometown.
Pelicot, who gained international recognition for waiving her anonymity during her ex-husband’s trial for drugging and abusing her for nearly a decade, is taking a stand against what she perceives as a violation of her privacy. Her ex-husband was sentenced to 20 years in prison in December for his heinous acts.
Camus criticized the magazine for its decision to publish the photos, stating, “Every time the intimacy of our client's personal life is violated, we will react and seek a court decision.” He labeled the magazine's actions as shocking and disappointing, particularly given the extensive media coverage Pelicot’s ordeal has already received.
Pelicot was also recently named one of the world’s most influential people by Time magazine, a recognition that underscores her impact as a survivor and advocate. Her ongoing battle for privacy rights is emblematic of broader discussions surrounding consent and the rights of individuals in the public eye.
As these legal precedents unfold, they serve as important reminders of the evolving landscape of privacy law and the critical importance of informed consent in both commercial and personal contexts.
