Capital One Data Tracking Lawsuit, They Secretly Sent Your Financial Data to Meta and Google Lawsuit Alleges

Capital One customers have asked a California federal judge to certify a class action over claims the bank secretly sent their personal financial information — including account details, credit card application data, and employment information — to Meta Platforms, Google, and Microsoft through hidden website tracking tools, without customer consent. U.S. District Judge Trina L. Thompson heard arguments on the class certification motion during an April 21, 2026 hearing in San Francisco but did not rule from the bench, indicating she would issue a written decision later.

Quick Facts

Field	Detail
Case Name	Shah, et al. v. Capital One Financial Corp., et al.
Case Number	No. 3:24-cv-05985
Court	U.S. District Court, Northern District of California, San Francisco Division
Date Filed	August 27, 2024
Settlement Amount	TBD — no settlement has been reached; case is in litigation
Claim Deadline	TBD — no settlement or claim process is open at this time
Who May Be Affected	Capital One customers who visited the bank’s website and had personal financial data transmitted to third parties without consent
Case Status	Class certification pending — decision expected from Judge Thompson
Alleged Violations	Electronic Communications Privacy Act (ECPA), California Consumer Privacy Act (CCPA), California Invasion of Privacy Act (CIPA), and others
Lead Plaintiffs	Gary Ingraham, Deia Williams (current lead plaintiffs)
Last Updated	April 24, 2026

Current Status

• April 21, 2026: Judge Thompson heard oral arguments on class certification in San Francisco and took the motion under advisement — a written ruling is forthcoming.
• Two proposed nationwide classes seek certification under the federal Electronic Communications Privacy Act (ECPA), plus two California subclasses under the CCPA and CIPA.
• No trial date, opt-out deadline, or settlement has been scheduled — this case remains in the class certification stage, and consumers do not need to take any action right now.

What Is the Capital One Lawsuit About? Shah et al. v. Capital One Financial Corp., No. 3:24-cv-05985

Capital One Financial Corp. is facing a proposed class action alleging the financial giant disclosed the personal and financial information of millions of consumers to Meta Platforms, Google, Microsoft, and other third parties without their consent. Plaintiffs allege Capital One accomplished this by embedding third-party tracking tools — including the Meta Pixel and Google Analytics — directly into its website. These tools allegedly operated invisibly to customers, capturing sensitive data in real time and transmitting it to outside companies the moment a customer interacted with Capital One’s site.

The tracking code allegedly disclosed information about customers’ accounts, credit card applications, and employment. The Meta Pixel, for example, captures Facebook user IDs — unique identifiers that can match a person’s financial behavior on Capital One’s website directly to their Facebook profile, enabling targeted advertising without the customer’s knowledge or approval.

The lawsuit asserts violations of the Electronic Communications Privacy Act (ECPA) — a federal law that prohibits the unauthorized interception of electronic communications — as well as the California Consumer Privacy Act (CCPA), which requires businesses to disclose and allow customers to opt out of sharing personal information with third parties, and the California Invasion of Privacy Act (CIPA).

 The court denied Capital One’s motion to dismiss the ECPA claims, holding that plaintiffs plausibly alleged an unlawful interception of electronic communications via embedded tracking technologies that captured the contents of consumers’ communications in real time and transmitted them to third parties without authorization. This case sits within a growing wave of financial institution data tracking lawsuits reshaping how banks must disclose third-party data relationships to customers.

Who Could Be Affected by the Capital One Lawsuit?

Lead plaintiffs Gary Ingraham and Deia Williams seek to represent two nationwide classes based on the federal ECPA claim and two California subclasses for state law claims under the CCPA and CIPA.

You may be affected if:

• You held a Capital One account and visited Capital One’s website at any point during the alleged tracking period
• You submitted a credit card application through Capital One’s website
• You logged into Capital One’s online portal and your account activity, employment data, or browsing behavior was allegedly captured by tracking tools
• You are a California resident whose personal information was allegedly shared with Meta, Google, or Microsoft without your consent
• You received no notice from Capital One that your browsing and financial data was transmitted to advertising and analytics companies

Important: The court has not yet certified a class. The above describes who the plaintiffs seek to represent. No consumer needs to take action at this time.

What Could Consumers Recover If the Lawsuit Succeeds?

The plaintiffs are seeking damages under multiple federal and California statutes. Under the ECPA, successful plaintiffs may recover actual damages or statutory damages. Under the CCPA, California consumers may be eligible for statutory damages between $100 and $750 per consumer per incident, or actual damages — whichever is greater — if the court finds Capital One violated the law’s data disclosure requirements.

The plaintiffs claim they never authorized sharing of their personal and financial data with third or fourth parties for marketing and sales purposes. The complaint does not specify individual payout amounts at this stage. Any recovery will depend on class certification, the outcome of the litigation, and the number of class members ultimately included. You can review developments in similar cases, such as the Meta Pixel financial data class actions, to understand how comparable litigation has resolved.

What Happens Next in the Capital One Lawsuit?

• April 21, 2026: Class certification hearing held before Judge Trina L. Thompson in San Francisco — decision pending in written form
• Class certification ruling: TBD — Judge Thompson took the motion under advisement and will issue a written order; no timeframe has been publicly announced
• Discovery: TBD — ongoing pending class certification outcome
• Trial date: TBD — no trial has been scheduled; certification must be decided before the case can proceed to trial
• Settlement: TBD — no settlement discussions have been publicly reported

Capital One Lawsuit, Frequently Asked Questions

Is the Capital One lawsuit a class action? 

It is a proposed class action. Plaintiffs Gary Ingraham and Deia Williams seek to represent two nationwide classes under the ECPA and two California subclasses under state privacy law. U.S. District Judge Trina L. Thompson heard class certification arguments on April 21, 2026 but has not yet issued a ruling.

Do I need to do anything right now?

 No. No settlement is open and no claim form exists at this time. If the court certifies a class and a settlement is later reached, class members will receive notice by mail or email. Check this page for updates.

Has Capital One responded to the lawsuit? 

Yes. Capital One filed a motion to dismiss, which the court denied on multiple key claims including negligence, CCPA, ECPA, CIPA, unjust enrichment, and declaratory judgment. Capital One has not publicly admitted any wrongdoing.

When will the case be resolved?

 TBD — no resolution date has been set. Class certification must be decided first. Cases of this complexity in the Northern District of California typically take two to four years from filing to resolution, though settlement is possible at any stage.

How do I find out if I am part of the class?

 If the class is certified, the settlement administrator will send notice to potential class members. You can also monitor the official docket for Case No. 3:24-cv-05985 through the federal PACER system at pacer.uscourts.gov.

What data did Capital One allegedly share? 

Plaintiffs claim the tracking tools collected vast amounts of sensitive consumer data, including Capital One customers’ account and employment information, browsing activity, credit card application details, and approval data. The Meta Pixel also allegedly captured Facebook user IDs that could link a customer’s identity to their financial activity.

What makes this lawsuit different from a standard data breach case?

 In this case, the court allowed claims to proceed based not on a data breach, but on the unauthorized disclosure of personal information via embedded tracking tools. This is a significant legal development — courts have historically applied the CCPA’s private right of action only to security breaches, not routine third-party data sharing.

Sources & References

• U.S. District Court, Northern District of California — Case No. 3:24-cv-05985 (via PACER)
• Law360, “Capital One Clients Seek Cert. Over Info Sent To Meta, Google” — April 21, 2026

Prepared by the AllAboutLawyer.com Editorial Team and reviewed for factual accuracy against Law360 reporting and the U.S. District Court docket for Shah et al. v. Capital One Financial Corp., No. 3:24-cv-05985, on April 24, 2026. Last Updated: April 24, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.