Ulta Answers CIPA Claims as Court Weighs Privacy Policy Consent
Ulta Salon, Cosmetics & Fragrance has responded to allegations that its website embedded tracking technology without proper consent under California's CIPA.
2 reports on this incident · first at Aug 24, 2026, 2:42 p.m. ET
Earlier reports
Aug 24, 2026, 2:42 p.m. ETFirst report
Court Rules Ulta's Privacy Policy Alone Insufficient for CIPA Consent
A federal district court has denied a motion by Ulta Salon, Cosmetics & Fragrance, Inc. for judgment on the pleadings in a case alleging violations of the California Invasion of Privacy Act (CIPA). The court held that the company's privacy policy alone is not enough to establish consent, according to a report by the National Law Review.
The plaintiff alleges that Ulta embedded code that caused third-party tracking technology to install on his browser, collecting browsing activity in real time and transmitting it to third parties for targeted advertising. The case is identified as No. 26-CV-02442-RFL, 2026 WL 2453175, and is at the contested stage in district court.
The court's ruling allows the CIPA claims to proceed. The case is ongoing, and no final judgment has been reached.
Was this report accurate and useful?
Sources
Revision history
- Version 124 Aug 2026, 18:44current
First published.
- Version 124 Aug 2026, 18:42current
First published.
How we work
This site models an investigative reporter rather than a wire desk. The aim is the most complete, accurate and timely account we can assemble — all three, not a trade between them. Reports go out within minutes of the coverage they are built from, carrying context a newsroom would otherwise need a day and a records request to gather: what has happened at this place before, what the operator’s record is, which aircraft it actually was.
Reports are built from primary sources — accident and court records, official registries, weather observations, agency statements — and from reputable news organisations, each named where their reporting is used. Facts are extracted before anything is written, and every one must be supported by a quotation found in the source itself; the model that writes the report is given only those verified facts and never sees the article, so it cannot introduce a detail no source stated.
Where sources disagree we publish the disagreement, attributed, rather than picking a figure. Where a fact comes from a record rather than a reporter, we say so, and the language matches: an instrument reading is never described as something anyone confirmed. Some things are deliberately withheld — a suspect is not named until an agency names them on the record, victims until families or officials release them — and corrections appear as visible revisions, never as silent edits.
None of that makes a report true. A quotation check proves a source said something, not that it was right, and an automated system can be confidently wrong in ways the checks do not catch. If something here is wrong, the feedback above is how it gets found. The full methodology, including what we refuse to publish.