A federal judge dismissed a proposed class action against Foris DAX, Inc., the operator of Crypto.com, on October 7, 2026, closing a lawsuit that alleged the exchange kept third-party tracking cookies running after users clicked "Disable All" on its consent banner.

Judge Edward M. Chen of the US District Court for the Northern District of California ruled that plaintiffs Jose Ortiz and Javier Hernandez failed to show the concrete injury required for Article III standing. The dismissal ends the case entirely and spares the exchange a fight on the merits of its cookie practices.

What did the plaintiffs allege?

Ortiz and Hernandez filed suit on October 17, 2025, under case number 3:25-cv-08950. Their complaint centered on a single factual claim: Crypto.com continued running third-party trackers even after visitors selected "Disable All" on the site's cookie consent banner.

They brought claims under several privacy statutes. The lead claim relied on the California Invasion of Privacy Act (CIPA), a state statute that has become a favored vehicle for litigation over how websites monitor visitors.

The case began shrinking early. On May 22, 2026, Judge Chen dismissed most of the claims in an interim ruling. One CIPA pen-register claim survived, pending amendment. A pen register, a concept rooted in telephone surveillance law, describes tools that capture information about outgoing communications. Plaintiffs in tracking cases have argued that certain website trackers function the same way.

That surviving claim was the last thread. The October 7 ruling cut it on the same ground as the rest: no concrete injury, no standing.

Why did standing sink the case?

Article III of the US Constitution restricts federal courts to actual cases and controversies. A plaintiff must first demonstrate a real, tangible harm before a court weighs whether the defendant's conduct was lawful.

That framing makes the ruling narrower than it may first appear. The dismissal addresses whether these plaintiffs could bring this claim in federal court — not whether the tracking described in the complaint was acceptable.

The decision tracks a broader shift in how California courts handle website-tracking cases since the Ninth Circuit's 2025 decision in Popa v. Microsoft. The common thread: alleging that a privacy statute was violated is not, on its own, sufficient to get into federal court.

What does this change for Crypto.com and the industry?

For Crypto.com, the immediate consequence is procedural closure. A proposed class action that had hung over the company for nearly a year is over, and the exchange avoided discovery and a merits fight over its consent-banner architecture.

For consumers, the practical takeaway is sobering. Cookie banners offer users a choice, but the case shows how hard it is to enforce that choice in federal court when the alleged harm is the tracking itself rather than downstream damage.

For the plaintiffs' bar, the message is equally direct. Future website-tracking suits against crypto platforms — or any operator — will likely need to lead with concrete, tangible injury rather than statutory language alone.

The remaining question is procedural: whether the plaintiffs attempt an appeal to the Ninth Circuit or refile in state court, where the Article III injury requirement does not apply in the same form. Absent either step, the dismissal stands as final.