A federal judge in California has dismissed a cookie-tracking class action against the operator of Crypto.com, ruling that the two plaintiffs lacked standing to sue. US District Judge Edward M. Chen raised the jurisdictional problem on his own initiative and gave the plaintiffs 30 days to file an amended complaint — a ruling that ends this version of the case, but not the litigation itself.

Chen signed the order in Ortiz v. Foris Dax, Inc. on October 6. Foris Dax's motion had argued only that the complaint failed to state a claim and did not address standing. The judge nonetheless took up the issue himself, writing that a federal court carries an "independent duty" to police its own jurisdiction — a case cannot proceed where no concrete injury exists. Standing is a threshold question in federal court, resolved before a judge reaches the substance of the claims themselves.

Allegations over the cookie banner

Jose Ortiz and Javier Hernandez, both California residents, filed the lawsuit in October 2025 over Crypto.com's cookie banner, which offers visitors three options: "Accept All," "Disable All," or "Customize Settings." The two men said they selectedDisable All," but the site placed cookies anyway, and the data was allegedly transmitted to Meta, Google, X, and Snap.

The complaint asserted claims for fraud, unjust enrichment, invasion of privacy, intrusion upon seclusion, and violations of the California Invasion of Privacy Act, the state's wiretapping statute. According to the plaintiffs, their financial interests and investment research were being tracked.

IP addresses and browser IDs fell short of concrete harm

Chen leaned on the Ninth Circuit's decision in Popa v. Microsoft, in which the appeals court concluded that a tool detecting a shopper's "pet-store preferences and her street name" was more akin to "a store clerk's observing shoppers" than a privacy violation. Under the Supreme Court's rulings in Spokeo and TransUnion, violating a statute alone is not enough; a plaintiff must still demonstrate the kind of harm courts have long recognized.

The order found that the only identifiers transmitted from Crypto.com were IP addresses, user-agent strings, and cookie or browser IDs. Neither man claimed to have created an account, logged in, or entered a name, email address, or payment information on the site. Chen observed that the two had been viewing cryptocurrency prices and market data, none of which revealed anything about their personal finances. Screenshots attached to the complaint showed little more than page URLs and titles, timestamps, and screen and browser information.

Deception, the order noted, can push a privacy claim toward a "highly offensive" intrusion — a so-called plus factor. But a broken opt-out promise does not reach that threshold on its own when the underlying data is so mundane. Chen drew on another recent ruling for the proposition that "the key is the sensitivity of the information collected." On that logic, placing cookies after an opt-out was not, by itself, enough to keep the suit in federal court.

Because the judge could not conclude that a new complaint would be pointless, the case was dismissed with leave to amend, with the 30-day window running until November 5. Any amended complaint would have to confront the concerns the order identified: the limited identifiers transmitted and the routine nature of the pages the plaintiffs viewed.

A docket that has moved back and forth

On May 21, Chen granted part of a previously filed motion to dismiss. The plaintiffs amended their complaint on June 22, and Foris Dax filed a new motion to dismiss in July — making November 5 the next date that determines whether this dispute advances or ends.

Foris Dax is a Delaware company headquartered in Tyler, Texas. Crypto.com's operator has drawn notable corporate attention this year: Citadel Securities invested $400 million in Crypto.com in July at a $20 billion valuation, and the UAE central bank granted a payments license to a Foris DAX unit.