Papa John’s Cookie Tracking Class Action, Did They Spy on You After You Said No?

Papa John’s is facing a class action lawsuit filed April 24, 2026, in the U.S. District Court for the Northern District of California, alleging the pizza chain tracks users’ personal data even after they reject cookies on its website. If you visited papajohns.com and clicked “reject” on the cookie banner, this lawsuit may include you.

Quick Facts: Papa John’s Cookie Tracking Lawsuit

Field	Detail
Lawsuit Filed	April 24, 2026
Defendant	Papa John’s International Inc.
Alleged Violation	California Invasion of Privacy Act (CIPA)
Who Is Affected	California residents who visited papajohns.com and rejected non-essential cookies
Current Court Stage	Early litigation — complaint just filed
Court & Jurisdiction	U.S. District Court for the Northern District of California
Lead Law Firm	Gutride Safier LLP (Seth A. Safier, Marie A. McCrary, Todd Kennedy)
Next Hearing Date	TBD — no hearing scheduled yet
Official Case Website	TBD — no administrator site yet; monitor PACER Case No. 3:26-cv-03504-TSH
Last Updated	May 18, 2026

What the Papa John’s Cookie Lawsuit Is Actually About: Gershzon et al. v. Papa John’s International Inc., No. 3:26-cv-03504-TSH

When you visit Papa John’s website, a cookie consent banner appears giving you the option to reject non-essential cookies. The lawsuit alleges that even when users choose to reject those cookies, Papa John’s still allows third-party companies to place tracking cookies on their devices.

The data collected allegedly includes browsing history, visit history, website interactions, user input data, demographic information, interests and preferences, shopping behaviors, device information, referring URLs, session information, user identifiers, and geolocation data. The plaintiffs say this data gets shared with companies including Facebook, Google, and Amazon — without users ever agreeing to it.

This is a consumer privacy class action built on California’s Invasion of Privacy Act, a state wiretapping law that courts have increasingly applied to digital tracking. The core argument is simple: Papa John’s showed you a choice, you made it, and then Papa John’s ignored it. That alleged deception is precisely what the lawsuit targets. For broader context on how CIPA-based consumer privacy lawsuits are playing out across California, the WhatsApp class action privacy lawsuit involves nearly identical legal theories about unauthorized data interception.

Are You Part of the Papa John’s Class Action Lawsuit?

If you visited papajohns.com from California at any point and interacted with its cookie consent banner, here is how to know whether this case likely includes you.

You may be part of this class if:

• You are a California resident
• You visited papajohns.com at any point covered by the class period (TBD — exact dates not yet defined in court filings as of May 18, 2026)
• You were presented with a cookie consent banner and chose to reject non-essential cookies
• Your browsing data, location, or device information was captured despite that rejection

You are likely NOT included if:

• You live outside California (the class is currently limited to California residents)
• You accepted all cookies when prompted
• You never visited the Papa John’s website (app-only users may not be covered — this is TBD pending class definition)

This is one of over 1,500 CIPA-based digital tracking lawsuits filed in California in the last 18 months, according to legal analysts tracking the trend. The fact that plaintiffs include three named individuals — Mikhail Gershzon, Bianca Johnston, and Daniel Wine — suggests this is a well-organized effort by a firm experienced in data privacy attorney litigation.

What Are Papa John’s Plaintiffs Asking the Court to Do?

This is not a payout article — no settlement exists yet and no claim form is open. Here is what the plaintiffs are actually asking for.

The class action argues the practice constitutes a breach of consumer trust and a violation of privacy laws. The plaintiffs are seeking damages under the California Invasion of Privacy Act and are asking the court to stop Papa John’s from continuing this tracking practice.

Under CIPA, statutory damages can be significant per violation per person. Prior Papa John’s tracking litigation sought “the greater of $10,000 or $100 per day for each violation” of the Wiretap Act as well as $2,500 in statutory damages for each violation under CIPA. The current complaint follows a similar legal theory. No confirmed damage figures exist yet for this specific case — all confirmed numbers will appear here as the case develops.

The plaintiffs are also asking for injunctive relief — meaning they want a court order requiring Papa John’s to actually honor cookie rejections going forward, not just display a banner that means nothing. Similar consumer rights lawsuits against tech-forward companies have increasingly won this type of structural change alongside any monetary recovery.

What Should You Do If You Were Affected by Papa John’s?

Right now, you do not need to file anything. Most class members in a case like this are automatically included when a class is eventually certified by the court. Here is what makes practical sense to do today:

1. Save any records of your visits to papajohns.com — browser history screenshots, order confirmations, or emails from Papa John’s during the relevant period
2. Do nothing else yet — no claim form exists and there is no deadline to meet at this stage
3. Monitor the case docket at PACER under Case No. 3:26-cv-03504-TSH for updates on class certification and any eventual settlement
4. If you want to pursue an individual claim rather than wait for the class action, consult a private consumer rights lawyer about your specific situation
5. Do not opt out of any class without first speaking to an attorney — opting out too early could eliminate your right to any future recovery

This case is in its very early stages. The court has not certified a class, Papa John’s has not responded to the complaint, and no hearings are scheduled. Changes will happen fast once they do.

Papa John’s Cookie Lawsuit Timeline

Milestone	Date
Lawsuit Filed	April 24, 2026
Papa John’s Response Deadline	TBD — typically 21–30 days after service
Class Certification Motion	TBD — likely 12–18 months from filing
Last Major Court Ruling	TBD — case just filed
Next Scheduled Hearing	TBD — none set as of May 18, 2026
Expected Settlement Timeline	TBD — no settlement discussions confirmed

Frequently Asked Questions

Is there actually a class action lawsuit against Papa John’s for cookie tracking?

 Yes. Plaintiffs Mikhail Gershzon, Bianca Johnston, and Daniel Wine filed the complaint on April 24, 2026, in the U.S. District Court for the Northern District of California, Case No. 3:26-cv-03504-TSH. The case is real and active.

Do I need to do anything right now to be included in the Papa John’s lawsuit?

 No. In most class actions, California residents who match the class definition are automatically included once a class is certified. Save your records and watch for official notice — that is all you need to do right now.

When will the Papa John’s cookie tracking case reach a settlement? 

That is genuinely unknown at this stage. The complaint was filed April 24, 2026. Cases like this typically take 12–36 months to reach a resolution. This page will be updated as milestones are reached.

Can I file my own lawsuit against Papa John’s instead of waiting? 

Yes, you can consult a private consumer rights lawyer about an individual claim if you believe you have been harmed. However, opting out of a class action to sue individually is a significant legal decision — get professional advice before doing it.

How will I know if the Papa John’s lawsuit settles?

 If a settlement is reached, class members will receive official notice by mail or email based on records from the class period. You can also monitor the federal court docket at PACER under Case No. 3:26-cv-03504-TSH for all filings and rulings as they happen.

Has Papa John’s faced privacy lawsuits before?

 Yes. A prior case, Kauffman v. Papa John’s International Inc., Case No. 3:22-cv-01492, was filed in the U.S. District Court for the Southern District of California, accusing Papa John’s of using session replay software to intercept website visitors’ keystrokes, mouse movements, and clicks without their knowledge or consent. That case resulted in the Ninth Circuit reviewing the boundaries of CIPA in website tracking — making this new lawsuit part of an ongoing pattern of privacy litigation against the company. The Grubhub data breach class action raised similar third-party data-sharing concerns for another major food delivery platform.

What is the California Invasion of Privacy Act and why does it matter here?

 CIPA is a California state wiretapping law that courts have applied to digital tracking technology. It covers unauthorized interception of electronic communications — which plaintiffs argue includes placing tracking cookies on someone’s device after they explicitly said no. Violations can carry statutory damages of $2,500 or more per instance, which is why companies take these cases seriously.

Sources & References

• Court filing: Gershzon, et al. v. Papa John’s International Inc., Case No. 3:26-cv-03504-TSH, U.S. District Court for the Northern District of California — PACER
• Law360: Papa John’s Trims But Can’t Toss Calif. Web Tracking Suit (January 17, 2024) — law360.com
• Proskauer Privacy Law: Ninth Circuit Reviews Website Tracking Class Actions — privacylaw.proskauer.com

Prepared by the AllAboutLawyer.com Editorial Team and reviewed for factual accuracy against court records and primary legal sources on May 18, 2026. Last Updated: May 18, 2026

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Legal claims and outcomes depend on specific facts and applicable law. For advice regarding a particular situation, consult a qualified attorney.