In Shah v. Capital One Financial Corporation, the Northern District of California handed down a ruling that may shape the trajectory of litigation involving tracking technologies, online privacy policies, and California’s evolving privacy statutes, namely, the California Consumer Privacy Act (“CCPA”). The case is one of the latest in a growing line of digital privacy disputes premised on allegations that companies are disclosing personal and sensitive information to third- and fourth-party advertisers without consumer consent.