A proposed class action against NFL Enterprises alleges NFL.com used 182 third-party trackers, including session replay and canvas fingerprinting tools, without adequate consent.
A proposed class action filed in California alleges that NFL.com used extensive website-tracking technology to collect visitors’ information and transmit it to third parties without adequate consent.
The case, Kimmons v. NFL Enterprises LLC, No. 26CV197596, was filed in Alameda County Superior Court on July 6, 2026. The complaint names NFL Enterprises LLC, the company behind NFL.com, and seeks to represent a proposed nationwide class and a California subclass.
The allegations include the use of tracking pixels and cookies, session-replay software, and canvas fingerprinting scripts. The complaint further alleges that some tracking continued even after visitors used the website’s cookie opt-out controls.
These are allegations in a complaint, not findings by a court. NFL Enterprises’ response and the eventual outcome of the case will determine how the claims proceed.
The plaintiff, described in the complaint as a San Leandro resident and 49ers fan, alleges that she visited NFL.com around January 2026 to check live scores and game schedules.
According to the complaint, the website caused tracking tools associated with Google, The Trade Desk, Rubicon Project, OpenX, LogRocket, Inc., and Shape Security to be installed in her browser.
The complaint cites forensic testing that allegedly identified 182 third-party trackers on the website. It describes those technologies as including 24 cookies, four canvas-fingerprinting scripts, and one session recorder, with information allegedly transmitted to four advertising networks.
The complaint’s central contention is that the website’s tracking practices extended beyond ordinary cookie-based advertising and captured detailed information about visitors’ browsing activity and devices.
The complaint acknowledges that NFL.com displays a cookie opt-out banner. It nevertheless alleges that the banner did not prevent all tracking.
First, the plaintiff alleges that trackers began operating as soon as a visitor arrived at the website, before the visitor could review or change privacy settings. According to the complaint, this meant that some information was collected before a visitor could make an opt-out choice.
Second, the complaint alleges that opting out of cookies did not disable technologies that operate without cookies, including session recorders and canvas-fingerprinting scripts.
It further alleges that 186 third-party trackers remained active after a visitor opted out. That figure is an allegation in the complaint; it has not been established by a court.
Whether the banner controlled the technologies at issue, what disclosures visitors received, and whether any legally effective consent was obtained are questions that may be contested as the case proceeds.
The complaint focuses heavily on a session-replay tool allegedly supplied by LogRocket.
According to the plaintiff, the tool intercepted, recorded, and transmitted website interactions in real time. The complaint alleges that the software captured the website’s Document Object Model (DOM) state and generated a visual replay of a browsing session.
The alleged captured information included:
The complaint further alleges that the technology could record keystrokes even when a user later deleted or did not submit the entry.
These allegations are central to the plaintiff’s argument that the software captured the contents of communications, rather than merely collecting technical information about a website visit.
The complaint also describes four canvas-fingerprinting scripts allegedly deployed on NFL.com. It claims that three were delivered through Google Tag Manager and one through Shape Security.
According to the complaint, the scripts collected signals associated with font rendering, geometry rendering, and canvas data extraction. The plaintiff alleges that these signals could be combined to create a device-specific signature reflecting characteristics of a user’s graphics hardware, operating system, fonts, and browser.
The complaint further alleges that some of the scripts were associated with Google advertising products and were used for advertising attribution or tracking across websites.
Unlike cookies, canvas-fingerprinting techniques may rely on characteristics of the browser or device. The plaintiff alleges that this allowed the tracking to persist even after a user cleared browser data.
These descriptions reflect the complaint’s technical allegations. Whether the scripts operated as alleged, what information they transmitted, and how that information was used remain matters for evidence and adjudication.
The complaint asserts five causes of action:
To support its CIPA theories, the complaint cites prior decisions involving session-recording technology, third-party tracking tools, and pen-register allegations. Those authorities are arguments advanced by the plaintiff; citing them does not establish that the same legal conclusions will apply to NFL.com.
The plaintiff seeks to represent a proposed nationwide class and a California subclass. The precise class definitions and any exclusions are set out in the complaint and would be subject to the court’s consideration if the case reaches class-certification proceedings.
The complaint requests several forms of relief, including:
The complaint also alleges that the behavioral information collected through the tracking technologies has economic value. It compares the information to data obtained through focus-group participation, which it says may pay participants between $30 and $500 per session.
That comparison is part of the plaintiff’s damages theory, not a court determination of the value of the information or the amount of any recoverable damages.
Several issues may be important as the litigation develops.
What did the tracking tools actually collect? The complaint describes a range of information, from IP addresses and device signals to detailed interaction records and keystrokes. Evidence about the tools’ actual operation may be important to evaluating the claims.
Did the opt-out mechanism control the challenged technologies? The complaint alleges that some scripts continued to operate after visitors opted out. The website’s configuration, disclosures, and consent processes may be disputed.
Do the alleged transmissions meet the legal requirements of each claim? The complaint relies on several different statutes, each with its own elements and defenses. Allegations sufficient for one legal theory may not necessarily establish another.
Will the court certify a class? The case was filed as a proposed class action. Class certification is a separate procedural question and has not been established merely because the complaint seeks to represent a class.
Kimmons v. NFL Enterprises LLC is a proposed class action filed in Alameda County Superior Court on July 6, 2026. It alleges that NFL.com used tracking technologies to collect and transmit visitors’ information without adequate consent.
The complaint cites forensic testing that allegedly identified 182 third-party trackers before opt-out and alleges that 186 remained active afterward. These figures are allegations, not court findings.
The complaint discusses cookies, session-replay software, canvas-fingerprinting scripts, and other third-party tracking tools.
The plaintiff alleges that tracking began before visitors could make a choice and that opting out of cookies did not disable some non-cookie technologies. Those claims may be contested.
No. The cited CIPAWorld report describes allegations in a newly filed complaint. It does not report a ruling establishing liability.
The complaint seeks statutory damages, injunctive relief, restitution, attorneys’ fees, and other relief. The availability and amount of any recovery would depend on the litigation’s outcome.
This article is for informational purposes only and is not legal advice. It summarizes allegations reported in a CIPAWorld article and attributed to a complaint. Allegations are not established facts, and no finding of liability is implied. Consult the court record and qualified legal counsel for advice about a particular matter.
Receive offers, product allerts, styling inspiration and more.
Learn what DNC.com does, how its TCPA and Do Not Call compliance tools work, Litigator Insights, reassigned-number screening, integrations, and its 2026 transition to Sonera.
Lawyer.com connects consumers with attorneys while operating a legal lead-generation and marketing platform. Explore its TCPA consent practices, automated calls, mass tort leads, compliance claims, and lawsuit history.
Cox Media Group has faced significant legal scrutiny, including an FTC Active Listening enforcement action and a Texas TCPA case involving defamation and free speech.
Explore Cox Media Group (CMG), its history, ownership, television and radio operations, digital advertising business, consumer data practices, privacy policy, Active Listening controversy, leadership and 2026 developments.
Explore MindSift’s data marketing platform, the Active Listening controversy, FTC allegations, 2026 consent order, consumer consent issues and legal implications.
Learn about MindSift, its audience intelligence and data platform, consumer and B2B databases, Visitor ID, Buyer Intent, OutReach Mining, advertising services, Active Listening controversy and 2026 FTC order.
