Court: Ulta's Privacy Policy Alone Doesn't Meet CIPA Consent Rules
A California court ruled Ulta's posted privacy policy doesn’t constitute valid CIPA consent.
Why it matters: Privacy and legal teams must revisit their consent processes to comply with stricter interpretations of California's CIPA law, reducing legal risks.
- On August 21, 2026, Northern District of California denied Ulta’s motion for judgment on pleadings.
- Court found merely posting a privacy policy insufficient for valid consumer consent under CIPA.
- Plaintiff Arny Asercion visited Ulta’s website in May 2025 for browsing gifts.
- Court emphasized businesses cannot rely solely on privacy policies to obtain consent for data collection under CIPA.
On August 21, 2026, the United States District Court for the Northern District of California ruled against Ulta Salon, Cosmetics & Fragrance, Inc. in the case Arny Asercion v. Ulta Salon, Cosmetics & Fragrance, Inc. The court held that simply posting a privacy policy on Ulta's website does not equate to obtaining valid consumer consent under the California Invasion of Privacy Act (CIPA). This decision rejects Ulta's motion for judgment on the pleadings.
Arny Asercion, the plaintiff, visited Ulta's website in May 2025 to browse Mother’s Day gifts. The court noted that while the website set an expectation that user data would not be collected, it nevertheless collected data anyway, undermining any purported consent. As summarized in the court order, "The website 'set an expectation that user data would not be collected, but then collected it anyway.'"
This ruling highlights a critical shift in judicial interpretation: companies can no longer rely solely on privacy policies posted online as a mechanism for obtaining consumer consent under CIPA. Instead, businesses must adopt clear and affirmative consent measures before collecting any user data.
With CIPA's strong protections against unauthorized interception of communications, this decision serves as a warning for businesses operating online. Privacy compliance teams and in-house counsel should urgently review their consent frameworks to ensure they meet these legal standards and avoid litigation.
For more details on this ruling and implications, see NatLawReview coverage and Loeb & Loeb analysis.
By the numbers:
- August 21, 2026 — Date of court decision denying Ulta's motion
- May 2025 — When plaintiff visited Ulta's website to browse gifts
What's next: Legal teams should expect more courts to scrutinize consent mechanisms under CIPA, prompting businesses to implement explicit opt-in processes.