Judge tosses Crypto.com cookie suit on grounds the exchange never raised

A federal judge in California dismissed the cookie-tracking class action against Crypto.com’s operator after finding that the two plaintiffs lacked standing to sue.

Judge Edward M. Chen brought up the issue and gave the two plaintiffs 30 days to file again.

The judge invoked the court’s independent duty of checking jurisdiction

On October 6, Chen signed the order for Ortiz v. Foris Dax, Inc. The company’s motion targeted the complaint for failing to state a claim, but made no mention of standing.

Nonetheless, the judge raised standing, claiming that a federal court has an “independent duty” to police its own jurisdiction. The court cannot hear the case if there is no concrete injury.

Jose Ortiz and Javier Hernandez, both from California, filed a lawsuit in October 2025 over Crypto.com’s cookie banner. Visitors can select “Accept All,” “Disable All,” or “Customize Settings” from the banner.

They stated that they chose “Disable All,” but the site still placed cookies. The data was allegedly sent to Meta, Google, X, and Snap.

The lawsuit alleged fraud, unjust enrichment, invasion of privacy, intrusion upon seclusion, and violations of the California Invasion of Privacy Act. Plaintiffs claimed that their financial interests and investment research were being tracked.

IP addresses and browser IDs failed to cause a concrete injury

Chen relied on Popa v. Microsoft. In that case, the Ninth Circuit determined that a tool that detected a shopper’s “pet-store preferences and her street name” was more akin to “a store clerk’s observing shoppers” than a privacy violation.

According to the Supreme Court’s Spokeo and TransUnion rulings, simply breaking a statute is insufficient. A plaintiff still must demonstrate the type of harm that courts have long recognized.

According to the order, the only identifiers sent from Crypto.com were IP addresses, user-agent strings, and cookie or browser IDs. Neither man claimed to have created an account, logged in, or entered a name, email address, or payment information into the website.

Chen noted that they had been monitoring cryptocurrency prices and market data, but none of it revealed anything about their personal finances. Screenshots attached to the complaint revealed little more than page URLs and titles, timestamps, and screen and browser information.

According to the order, deception can push a privacy claim toward a “highly offensive” intrusion, which is known as a plus factor. However, a broken opt-out promise does not get there on its own when the data is so mundane.

Chen used another recent ruling to make his point. “The key is the sensitivity of the information collected.”

The judge could not conclude that a new complaint would be pointless, so the case was dismissed with leave to amend. The 30-day period runs until November 5.

On May 21, Chen agreed to part of a previously filed motion to dismiss. The plaintiffs amended their complaint on June 22, and Foris Dax filed a new motion to dismiss in July.

Foris Dax is a Delaware company headquartered in Tyler, Texas. Citadel Securities invested $400 million in Crypto.com in July, valuing it at $20 billion, and the UAE central bank granted a payments license to a Foris DAX unit.