Coca-Cola Cookie Lawsuit: Lessons on Making "Reject" Stop the Trackers

If your website lets visitors reject advertising cookies, a court can now be asked to check whether rejecting them changed anything. That is the core of a proposed class action filed against The Coca-Cola Company on November 6, 2026, and it is a test any brand can run on its own site before a plaintiff's lawyer does.

Coca-Cola Cookie Lawsuit: Lessons on Making "Reject" Stop the Trackers

The Case

Miles et al. v. The Coca-Cola Company (No. 3:26-cv-13360) was filed in the US District Court for the Northern District of California by two California residents, Barbara Miles and Jason Mandler. It covers 12 websites run by Coca-Cola and its brands, including Sprite, Fanta, Diet Coke, Powerade, Vitaminwater, Fairlife, Smartwater, BODYARMOR and Topo Chico.

The complaint says those sites carried advertising, analytics and personalisation cookies from Meta, Google, TikTok and other companies, and showed banners that let visitors turn them off. Both plaintiffs say they changed their cookie settings before browsing. According to the complaint, the sites kept sending their browsing data to the same third parties anyway. The plaintiffs' lawyers analysed the network traffic of the sites, and screenshots filed with the complaint are said to show third-party cookie data being sent after the visitor had rejected non-essential cookies.

The claims are invasion of privacy, intrusion upon seclusion, unlawful wiretapping, fraud and unjust enrichment. The plaintiffs ask for damages, restitution, attorneys' fees and an order requiring Coca-Cola to honour visitors' cookie choices. These are allegations: no class has been certified and no court has ruled on them.

Not the First, and Not the Last

The Coca-Cola complaint follows a line of US suits built on the same test: reject cookies, then watch what the page still sends. Between December 2024 and February 2025, similar class actions were filed in the same court against Subway, Hilton, Politico, Dollar Tree, Constellation Brands and Motorola. In the Politico case, the court let invasion of privacy, intrusion and fraud claims go forward. Pfizer faces a similar suit in New York alleging its site kept sending data to Google advertising tools after visitors clicked "Decline All".

The fraud claim is what sets these cases apart from the earlier wave of pre-consent tracking suits. Those focused on tags firing before the banner was answered. Here, the banner itself becomes the evidence: a site that offers a reject option and keeps tracking is accused of making a promise it did not keep. The NFL.com case made the same point, and European Wax Center paid $5 million to settle a pixel tracking claim.

Lessons for Brands Running a Consent Banner

The banner is a promise about your tags

A banner records a choice. It only blocks something if your tags are wired to that choice. Pixels pasted into the page template, tags in Google Tag Manager with no consent condition, and scripts added by an agency for one campaign will all keep firing whatever the visitor clicks. Every tag that sends data to an advertising or analytics vendor needs a consent condition, and that includes the ones nobody remembers adding.

Test the reject path, not only the accept path

Most teams check that tags fire after "Accept", because that is where the revenue is. The lawsuits test the opposite. Open your site in a private window, click reject, and watch the network tab in your browser's developer tools as you browse a few pages. Requests to facebook.com/tr, google-analytics.com, analytics.tiktok.com or similar endpoints after a reject are exactly what these complaints are built on.

Every brand site counts

The Coca-Cola complaint covers 12 sites, not one. Large brands often run each product site with its own agency, tag container and banner settings, so one site can be configured correctly while the next one is not. Each site needs the same consent setup and the same test.

Rejecting later has to work too

A visitor who accepts and then changes their mind should be able to turn tracking off. Pixels that support a consent API, such as the Meta Pixel and the TikTok Pixel, can be paused again when consent is withdrawn. Tags that do not support one should only load after consent in the first place.

Keep the evidence

If a complaint arrives, you will need to show what the banner offered, what each visitor chose and what your site did with that choice. Consent records with timestamps, and regular scans of what your pages load, are much easier to keep than to rebuild later.

How UniConsent Makes "Reject" Mean Reject

UniConsent holds back advertising and analytics tags, such as the Meta Pixel, Google tags and the TikTok Pixel, until the visitor agrees to them. If the visitor rejects, those tags do not load. If a visitor accepts and later changes their mind, tracking stops again, and US opt-outs and Global Privacy Control signals are honoured the same way. You set this up in the UniConsent dashboard with the Tags Loader, without changing your website code.

UniConsent also scans your site every day for new cookies and keeps a record of every consent choice. That gives you a reject button that does what it says, and the records to show it.

FAQ

Is a cookie banner enough to avoid these lawsuits? No. The banner is what the plaintiffs point to. What matters is whether the tags on the page follow the visitor's choice.

Do these cases only affect California companies? No. Coca-Cola is based in Georgia and Pfizer in New York. The suits rely on where the visitors are, and California's privacy and wiretapping laws allow damages without proof of financial harm.

How do I check my own site? Reject cookies in a private browser window, browse a few pages and look for requests to advertising and analytics vendors in the network tab. Repeat it on every site you run and after every tag change.

Sign up and connect your tags to your consent banner in a few minutes.