Adobe Tracking Class Action: Allegations, Class, and Status

The Adobe tracking class action lawsuit is a consolidated federal case in the Northern District of California accusing Adobe of secretly assigning cross-site identifiers to millions of internet users through its Experience Cloud marketing tools and building detailed advertising profiles without consent. The case is captioned In re Adobe Data Tracking Litigation, Case No. 5:25-cv-03032, and is pending before Judge Noel Wise.¹

How the Case Came Together

Plaintiff Nicholas Rapak filed the first complaint on April 2, 2025.² A related suit by Bianca Johnston was folded in, and a third plaintiff, Minchul Paul Chwe, intervened. On September 3, 2025, Judge Wise consolidated the cases into a single action.¹ A month later, on October 1, 2025, the court appointed DiCello Levitt, Lowey Dannenberg, and Milberg Coleman Bryson Phillips Grossman as interim co-lead counsel for the proposed class.³

What Adobe Is Accused of Doing

The complaint describes Adobe as a “centralized identity broker.” The mechanics work like this. When someone visits a website that runs Adobe’s Experience Cloud tools, Adobe’s Experience Cloud Identity Service assigns that visitor a unique identifier called an Experience Cloud ID, or ECID. The ID is stored in a cookie on the site’s own domain and paired with a second cookie on Adobe’s demdex.net domain, a tracking domain Adobe acquired in 2011.⁴ Because the demdex.net cookie persists across different websites, Adobe’s systems can recognize the same person as they move between a hotel booking site, a hospital page, or a sports retailer.⁵

From there, plaintiffs allege, Adobe’s Experience Platform Identity Service links each ECID with other personally identifiable information — IP addresses, email addresses, phone numbers, and account numbers — to build what Adobe internally calls an “identity graph” for each individual. The result, according to the complaint, is a detailed consumer profile used for targeted advertising.⁶ The suit also claims Adobe uses “domain spoofing techniques” to disguise the tracking activity.³

The complaint names specific sites as examples. It alleges that Adobe’s tools captured hotel rate searches on Marriott.com and recorded navigation on Cedars-Sinai’s healthcare site, including visits to primary care and appointment scheduling pages.⁶ Plaintiffs contend this happens regardless of the browser or device a person uses, and even when privacy settings are enabled.

The Laws Adobe Is Alleged to Have Violated

The lawsuit rests on two main California statutes. The first is California Penal Code § 631, part of the California Invasion of Privacy Act, which prohibits the unauthorized interception of communications. The second is Penal Code § 638.51(a), which bars installing a tracking device without consent.⁶ The complaint also references the California Comprehensive Computer Data Access and Fraud Act.²

Who the Proposed Class Covers

The plaintiffs seek to represent two proposed nationwide classes. The Identifier Class covers all U.S. residents for whom Adobe intercepted or stored an ECID, a demdex cookie, or other identifying information, or for whom Adobe created an identity graph. The Communications Class covers U.S. residents whose private communications with third parties were allegedly intercepted by Adobe without consent.⁶ If you have used the internet in the United States and visited sites that run Adobe’s Experience Cloud tools, the proposed definitions would likely reach you, though class certification has not yet been decided.

Where the Case Stands

The consolidated action remains pending before Judge Wise. The available record does not reflect a ruling on any motion to dismiss, developments in discovery, or a scheduled trial date.⁷ No settlement has been announced, and no claims process exists at this stage. Anyone who might fall within the class definition would receive notice through the court-approved process if and when the case reaches settlement or certification.

A Parallel Case in the Netherlands

Adobe faces a separate privacy suit in Europe over the same product line. On December 13, 2023, the Dutch Data Protection Foundation (Stichting Data Bescherming Nederland, or SDBN) filed a class action in the Court of Rotterdam alleging that Adobe’s Experience Cloud collects and shares Dutch users’ personal data without valid consent, in violation of the GDPR and the ePrivacy Directive. SDBN says Adobe’s cookies are set on sites run by KPN, the Dutch Tax Authority, TUI, and Douglas, in some cases before users interact with a cookie banner, and that Adobe embeds software development kits in mobile apps like Marktplaats and Buienradar. The foundation seeks damages on behalf of roughly seven million Dutch users affected since GDPR took effect in May 2018.⁸

Adobe argues it is only a data processor and that the websites and app operators using its tools are the ones responsible for consent and compliance.⁹ Adobe has also challenged SDBN’s standing to sue. The Court of Rotterdam has referred the standing question to the Court of Justice of the European Union, using a similar case against Amazon as its reference. As of late May 2025, the court estimated the referral would delay a verdict by at least eighteen months.¹⁰

Not the Same as the FTC Subscription Case

Adobe’s tracking case is often confused with a separate federal enforcement action over the company’s subscription cancellation practices, which Adobe agreed in March 2026 to resolve for $150 million.¹¹ That case concerns hidden early termination fees and hard-to-cancel plans under the Restore Online Shoppers’ Confidence Act. It has nothing to do with the tracking allegations and does not compensate anyone for cross-site tracking.

1
Justia. In Re Adobe Data Tracking Litigation
2
ClassAction.org. Class Action Lawsuit Claims Adobe Secretly Intercepts, Monetizes Consumer Data via Online Tracking Tech
3
DiCello Levitt. DiCello Levitt Appointed Interim Co-Lead Counsel in Data Privacy Class Action Against Adobe
4
Adobe Experience League. Understanding Calls to the Demdex Domain
5
Adobe Experience League. How the Experience Cloud Identity Service Requests and Sets IDs
6
ClassAction.org. Rapak v. Adobe Inc., Complaint
7
Top Class Actions. Adobe Class Action Claims Company Unlawfully Tracks, Monetizes User Data
8
SDBN. Press Release: SDBN Class Action Adobe
9
Privacy Web. SDBN Start Massaschadeclaim Tegen Adobe
10
CoolTechZone. Class Action Lawsuit Against Adobe Pushed
11
U.S. Department of Justice. Adobe Agrees to $150 Million Settlement and Injunction to Resolve Alleged Violations of the Restore Online Shoppers’ Confidence Act