The CHEQ-Up: The Camplin v. Adidas Case Could Reshape Online Tracking

TL;DR

A lawsuit against Adidas under the California Invasion of Privacy Act (CIPA) is challenging a core assumption of the modern internet: that common advertising and analytics pixels are legal.

The case argues that these tools function as “pen registers,” collecting IP addresses and device identifiers in ways that resemble surveillance. A judge has already allowed the case to proceed, rejecting the argument that passive privacy policies count as user consent.

If the courts ultimately side with the plaintiff, the ruling could force companies to rethink how adtech, analytics, and third-party tools operate online.

The Case That Could Redefine Digital Tracking

The Camplin v. Adidas lawsuit is quickly becoming one of the most closely watched privacy cases in the United States.

At the center of the case is a legal argument that many digital tracking technologies may violate CIPA, a law originally designed to prevent unauthorized surveillance.

Pixels are being compared to “pen registers.”
The lawsuit argues that tracking technologies such as advertising and analytics pixels capture information like IP addresses and device identifiers in ways similar to traditional pen registers used in telecommunications.

The court accepted a broader interpretation of the law.
A judge denied Adidas’s motion to dismiss, signaling that the argument has enough legal merit to proceed through discovery.

The implications extend beyond one company.
If the interpretation holds, the ruling could apply to a wide range of third-party tools used across the web.

Passive Consent May No Longer Be Enough

One of the most important early signals from the case involves the question of user consent.

Historically, many companies have relied on privacy policies or terms of service to justify tracking activity.

Passive disclosure was rejected.
The court ruled that simply placing consent language in a privacy policy or footer link does not meet CIPA’s standard.

Consent must be “affirmative and conspicuous.”
Under this interpretation, companies may need clear banners or pop-ups requiring users to actively agree before any tracking occurs.

Tracking may need to be suppressed by default.
If courts maintain this standard, advertising and analytics pixels may not be allowed to fire until explicit user consent is granted. For many organizations, this would require a significant shift in how websites handle data collection.

The Financial Stakes Could Be Massive

CIPA carries penalties that make cases like this particularly significant for large organizations. Unlike some privacy laws, financial harm does not need to be proven in order for damages to be awarded.

Each violation can carry a $5,000 penalty.
This amount applies regardless of whether the plaintiff suffered measurable financial loss.

Scale creates enormous risk.
If violations are interpreted per user, per visit, or per tracking event, the potential exposure for large websites could quickly reach millions of dollars.

Common adtech tools could become legal targets.
Pixels from platforms such as Meta, Google, and TikTok could be pulled into similar lawsuits if the legal theory gains traction. This combination of scale and statutory damages is why many legal observers see the case as a major moment for the digital advertising ecosystem.

Courts Are Divided on the Pen Register Argument

While the Adidas case has gained momentum, the broader legal landscape is still unsettled. Different courts have reached different conclusions about whether IP addresses and similar identifiers qualify as protected communications.

Some judges view IP addresses as public information.
In these rulings, collecting an IP address alone does not qualify as surveillance.

Other courts see the practice differently.
The Camplin case reflects a growing view that device identifiers and IP data can still represent private digital activity.

The outcome may hinge on future rulings.
As similar lawsuits move through the courts, the legal definition of digital tracking may continue to evolve. For now, companies are operating in a fragmented legal environment where interpretations vary by jurisdiction.

Why This Case Matters Beyond California

While the lawsuit focuses on California law, the broader implications could reach far beyond the state. California has historically been a major driver of privacy legislation and enforcement trends.

California often sets the regulatory tone.
Policies that emerge in the state frequently influence other jurisdictions.

The case could reshape digital advertising practices.
If the ruling expands liability for tracking pixels, companies may need to redesign how marketing and analytics systems operate.

The industry may need new approaches to consent.
Organizations could begin exploring clearer, more transparent ways to collect and manage user permissions.

What Privacy and Marketing Teams Should Be Watching

The Camplin v. Adidas case highlights a broader trend: courts are increasingly applying older surveillance laws to modern digital technologies. That trend is unlikely to slow down.

Legacy laws are being reinterpreted for the internet.
Statutes written for telephone surveillance are now being used to evaluate browser-level data collection.

Tracking technologies are facing greater scrutiny.
Tools that once operated quietly in the background are becoming the focus of litigation.

Consent standards are rising.
Regulators and courts are pushing for clearer, more explicit user permission before tracking occurs.

Businesses may need contingency plans.
Companies that rely heavily on advertising and analytics pixels should begin considering how their data collection strategies might evolve.

The final outcome of the Adidas case is still unknown. But one thing is clear: the legal framework surrounding digital tracking is changing quickly, and organizations should be paying close attention.

Listen to the podcast version below.