Motorola Faces Suit Over Data Sharing, Privacy Claims

Motorola Mobility is facing a privacy lawsuit that reads like a modern internet parable: a user sees a cookie banner, clicks “Reject All,” and expects the digital equivalent of closing the curtains. According to the complaint, however, the curtains may have stayed wide open. The lawsuit, Gabrielli v. Motorola Mobility LLC, claims Motorola’s website continued allowing third-party tracking technologies to collect and transmit visitor data even after a California user attempted to reject non-essential cookies.

The case matters because it touches a nerve that millions of internet users understand instantly. Cookie banners have become the pop-up pigeons of the web: always appearing, often ignored, and somehow still making a mess. But when a website offers a clear privacy choice, courts are increasingly asking whether that choice actually works behind the scenes. In July 2025, a federal judge in the Northern District of California allowed several privacy-related claims against Motorola to move forward, while dismissing some claims with leave to amend. That ruling does not decide whether Motorola violated the law; it means the plaintiff alleged enough for parts of the case to proceed.

What the Motorola Privacy Lawsuit Is About

The proposed class action was filed by California resident Jonathan Gabrielli against Motorola Mobility LLC. The complaint alleges that Gabrielli visited Motorola’s website several times between 2022 and 2024 to browse product information. During those visits, he says he encountered a cookie consent banner stating that Motorola used cookies and similar technologies to personalize content and ads, analyze traffic, and share information with partners.

The banner allegedly gave visitors the option to reject all non-essential cookies. Gabrielli claims he clicked that option. The core allegation is that Motorola’s website still loaded third-party scripts that placed tracking cookies on his device and transmitted browsing data to companies such as Google, TikTok, Amazon, Howl Technologies, and Emplifi. In plain English: the plaintiff says he pushed the privacy brake, but the tracking car kept rolling downhill.

The lawsuit claims the data at issue included browsing history, website interactions, user inputs, demographic information, shopping behavior, referring URLs, session information, IP addresses, geolocation data, device information, and other identifiers. The complaint further alleges that this information could be used to build behavioral profiles and support targeted advertising.

Why the Court Let Key Claims Move Forward

Motorola moved to dismiss the case and also asked the court to strike the class allegations. U.S. District Judge Jon S. Tigar granted the motion in part and denied it in part. The court dismissed Gabrielli’s breach of contract, implied covenant of good faith and fair dealing, and trespass to chattels claims with leave to amend. But the court allowed other claims, including invasion of privacy, intrusion upon seclusion, certain California Invasion of Privacy Act claims, fraud or misrepresentation, and unjust enrichment, to continue at this stage.

That distinction is important. A motion to dismiss is not a mini-trial. The court generally assumes the factual allegations in the complaint are true and asks whether they are legally sufficient. Motorola argued, among other things, that any continued cookie activity may have resulted from a malfunctioning button or a bona fide error. The court found that this defense raised factual issues that could not be resolved at the pleading stage.

The court also found that Gabrielli had sufficiently alleged a concrete privacy injury for standing purposes. The alleged injury was not merely annoyance at a cookie banner. It was the claimed loss of control over personal information related to digital activity, including tracking after an attempted opt-out.

The Big Legal Issue: Does “Reject All” Mean Reject All?

The Motorola data sharing lawsuit highlights a basic question that has become surprisingly complicated: when a website says users can reject non-essential cookies, must the website actually prevent those trackers from firing?

For consumers, the answer feels obvious. If a button says “Reject All,” people expect it to mean “no thanks,” not “no thanks, but also yes.” For businesses, the implementation can be technically complex. Many websites rely on consent management platforms, analytics tools, advertising pixels, tag managers, embedded social media scripts, affiliate marketing tools, customer support widgets, and testing software. If those systems are not carefully mapped and controlled, a privacy banner can become decorative rather than functional, like a “Do Not Enter” sign painted on a revolving door.

California privacy law raises the stakes. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives consumers the right to opt out of the sale or sharing of personal information, including sharing for cross-context behavioral advertising. California regulators have also emphasized that businesses should avoid dark patternsinterface designs that confuse, manipulate, or frustrate users trying to exercise privacy rights.

Why Third-Party Tracking Is Under Legal Pressure

Third-party tracking is not new. Cookies, pixels, SDKs, and device identifiers have powered online advertising for years. What is changing is the legal and cultural tolerance for invisible data flows. Consumers may understand that websites show ads. Fewer understand that visiting a product page can trigger a behind-the-scenes relay race involving advertising networks, analytics providers, social platforms, affiliate tools, and data brokers.

In the Motorola case, the allegation is not simply that tracking occurred. The allegation is that tracking continued after the user took an affirmative privacy action. That matters because privacy laws increasingly focus on choice, consent, disclosure, and honoring opt-out signals. A privacy promise that fails in practice can create more legal risk than no promise at all, because it may support claims of misrepresentation.

Cookies, Pixels, and the Data Trail

A cookie can store a unique identifier in a browser. A pixel can record that a page loaded and send information to a third party. A tag manager can control when marketing scripts fire. An IP address can reveal approximate location. Referring URLs can show where a visitor came from. Session data can reveal how a user moved through a site. Individually, these items may seem small. Together, they can create a detailed behavioral picture.

This is why privacy lawsuits often focus on combinations of data rather than a single dramatic secret. The concern is not always “someone stole my Social Security number.” Sometimes it is “a web of companies quietly learned what I viewed, searched, clicked, compared, and considered buying.” That may not sound like a spy thriller, but in the advertising economy, it is valuable information.

Motorola’s Position and What Remains Unproven

Motorola has contested the claims. The company argued in its motion that the plaintiff’s theories were legally insufficient and that alleged cookie activity could have resulted from a button malfunction or error rather than intentional misconduct. Motorola also challenged class allegations and argued against several causes of action.

At this stage, the allegations remain unproven. The ruling does not mean Motorola has been found liable, nor does it establish that every visitor who clicked “Reject All” was tracked in the same way. The litigation process may involve discovery into Motorola’s website architecture, cookie consent logs, third-party vendor contracts, tag behavior, tracking scripts, testing records, privacy notices, and internal compliance procedures.

That discovery could become the real engine room of the case. Privacy litigation often turns on technical details: what scripts loaded, when they loaded, what data was transmitted, whether the data was tied to an identifier, whether the user consented, whether the opt-out tool suppressed the relevant tags, and whether third-party partners received information anyway.

How This Fits Into the Larger Privacy Lawsuit Trend

The Motorola suit is part of a broader wave of online tracking litigation. Courts across the United States, especially in California, have seen claims involving website pixels, session replay software, analytics tools, advertising identifiers, health data, video viewing data, and location data. Plaintiffs often argue that companies disclosed personal information to third parties without adequate notice or consent.

California’s Invasion of Privacy Act has become a particularly active battlefield. Plaintiffs have tried to apply older wiretapping and pen register concepts to modern web tracking technologies. Companies often respond that these statutes were not designed for ordinary website analytics or advertising tools. Courts have not been perfectly uniform, which keeps lawyers busy and gives compliance teams the facial expression of someone who just opened a spreadsheet with 47 tabs.

Regulators are also paying attention. The Federal Trade Commission has taken enforcement actions involving sensitive location data, data brokers, and companies accused of making privacy promises that did not match actual practices. The California Privacy Protection Agency has warned businesses about dark patterns and has emphasized that privacy choices should be easy to understand and easy to exercise.

What Businesses Can Learn From the Motorola Case

The most obvious lesson is simple: do not treat a cookie banner as a magic privacy shield. A banner is only as good as the code, contracts, and controls behind it. If a business tells users they can reject non-essential cookies, the website should be tested to confirm that non-essential third-party tags are actually blocked before they fire.

1. Audit the Website Like a Plaintiff Would

Companies should test their websites using browser developer tools, privacy scanners, consent-state testing, Global Privacy Control signals, and real user flows. It is not enough to check the homepage once and declare victory. Product pages, checkout pages, support pages, embedded videos, chat widgets, and campaign landing pages may each load different trackers.

2. Match Privacy Notices to Reality

Privacy policies should not read like ancient scrolls written by a committee of fog machines. They should accurately describe what data is collected, why it is collected, who receives it, and how users can opt out. If the website uses Google, TikTok, Amazon, affiliate networks, analytics vendors, or social media tools, the business should understand what those tools collect and disclose accordingly.

3. Control Third-Party Vendors

Many privacy disputes begin with third-party code. Businesses should review vendor contracts, data processing terms, advertising settings, restricted data use options, and whether vendors can use collected data for their own purposes. “Our vendor did it” is rarely the soothing lullaby a judge wants to hear.

4. Keep Records of Consent and Opt-Out Choices

If a user rejects tracking, a company should be able to show what happened next. Consent logs, configuration records, version histories, testing results, and change management documentation can help demonstrate that the company took privacy choices seriously.

5. Avoid Dark Patterns

Privacy controls should be symmetrical, clear, and honest. If “Accept All” is bright, easy, and one click, while “Reject All” requires a scavenger hunt through nested menus, regulators may see a problem. If rejecting cookies does not actually reject them, the problem gets much bigger.

What Consumers Can Learn

Consumers should understand that privacy settings are useful but not perfect. Clicking “Reject All” is still worth doing, but users who want stronger protection can take additional steps. Browser privacy settings, tracker-blocking extensions, private browsing modes, Global Privacy Control tools, and limiting app permissions can reduce exposure. Clearing cookies periodically can help, though it may also log users out of websites and make the internet act like it has never met them before.

Consumers should also read privacy notices when the topic is sensitive. That does not mean reading every 9,000-word policy like it is a beach novel. Focus on sections about cookies, advertising, sharing, sale of personal information, sensitive data, and opt-out rights. If a website provides a “Do Not Sell or Share My Personal Information” link, use it. If a browser supports Global Privacy Control, consider enabling it.

Why This Case Matters Beyond Motorola

The Motorola privacy claims matter because the case tests trust in everyday digital interfaces. The internet runs on small agreements: click here, accept this, reject that, manage preferences, sign in, continue as guest. When those choices are unclear or ineffective, trust erodes. Users begin to assume every privacy button is theater, and businesses lose credibility even when they are trying to comply.

For technology companies, the message is not that all advertising tools are illegal. The message is that privacy promises must be operational. A company can use analytics and advertising technologies, but it must be transparent, honor applicable opt-outs, and avoid telling users one thing while the code does another.

For publishers and website operators, this case is a reminder to review cookie banners before a lawsuit does it for them. No marketing campaign is worth a privacy class action caused by a misconfigured tag. A single “Reject All” button can become Exhibit A if it does not work as advertised.

Experience-Based Perspective: Living With Privacy Choices That Do Not Feel Like Choices

Anyone who has used the modern web has probably had the same tiny moment of defeat: you open a page, a cookie banner appears, and suddenly you are negotiating with a rectangle. You just wanted to read about a phone, compare a price, or check a support article. Instead, you are asked to manage “partners,” “legitimate interests,” “preferences,” “analytics,” and “personalization.” It feels less like privacy control and more like being handed the cockpit manual for a plane you did not agree to fly.

The Motorola lawsuit resonates because it reflects that everyday frustration. Users have been trained to click quickly, but privacy law increasingly assumes choices should be meaningful. When someone takes the extra second to reject non-essential cookies, that action carries an expectation. The expectation is not technical perfection in every corner of the internet, but it is reasonable follow-through. If the button says no, the site should behave like it heard no.

In real life, consumers rarely know what happens after a privacy click. There is no little dashboard that pops up saying, “Congratulations, 17 trackers have been blocked and three advertising vendors are now sulking quietly in the corner.” Most people cannot inspect network requests or decode cookie strings. They rely on the website’s representation. That reliance is exactly why privacy design matters.

From a business perspective, this is where compliance becomes more than legal paperwork. A privacy policy may be drafted by lawyers, but privacy trust is built by engineers, marketers, product managers, vendor teams, and executives. If marketing adds a new pixel before a holiday campaign, someone needs to ask whether it respects opt-out settings. If a tag manager is updated, someone needs to test whether rejection still blocks non-essential scripts. If the privacy policy promises certain controls, someone needs to make sure the site actually delivers them.

A practical example: imagine a shopper visits a smartphone product page, rejects advertising cookies, and then sees ads for that exact device across other sites. The shopper may not know which company caused the retargeting. It might be a platform, an old cookie, a data broker, a social pixel, or another site entirely. But the experience feels creepy, and the brand they remember is the one they just visited. Privacy harm is not always measured only in dollars; it is also measured in trust, comfort, and the feeling that a company respected a boundary.

The lesson for website owners is refreshingly unglamorous: test the plumbing. Privacy compliance is not just a banner, a policy, or a footer link. It is the hidden system of scripts, defaults, vendor settings, data flows, retention rules, and user choices. If that system is messy, the banner becomes a promise written on top of spaghetti code. And while spaghetti is wonderful at dinner, it is less wonderful in a federal complaint.

The lesson for consumers is equally practical. Use privacy controls, but do not stop there. Enable browser-level protections where available. Consider Global Privacy Control. Limit app permissions. Delete old cookies when needed. Use separate browsers or profiles for sensitive activities. These steps are not perfect, but they reduce the amount of passive tracking that can happen while you simply browse the web like a normal human trying to get through Tuesday.

Ultimately, the Motorola case is not just about one company or one banner. It is about whether the digital marketplace can make privacy choices honest enough for regular people to understand. The future of web privacy may not depend on making every user a cybersecurity expert. It may depend on something much simpler: when a company gives people a button that says “Reject All,” the button should do what it says.

Conclusion

The lawsuit against Motorola Mobility over alleged data sharing and privacy claims is a strong reminder that online privacy is moving from policy pages into courtroom scrutiny. The case centers on a straightforward but powerful allegation: a user rejected non-essential cookies, yet third-party tracking allegedly continued. While Motorola has not been found liable and several claims were dismissed with leave to amend, the court’s decision allowing key privacy claims to proceed shows that cookie consent tools must function in practice, not merely look compliant on screen.

For businesses, the message is clear: audit tracking tools, align privacy statements with actual data flows, honor opt-out choices, and avoid dark patterns. For consumers, the case reinforces the value of using privacy controls while recognizing that stronger browser-level protections may also be needed. In a world where data can move faster than gossip at a family reunion, meaningful privacy choices are no longer optional window dressing. They are becoming a legal, technical, and reputational necessity.