Yahoo Tracking Class Action: ConnectID Email-Based Tracking Lawsuit

The case centers on Yahoo ConnectID, an advertising identifier Yahoo introduced in 2020, originally under the name Verizon Media ConnectID. According to the complaints, when you log in to a participating site or app with your email address, the site can pass that address, often as a hashed value, to Yahoo. Yahoo matches it to an existing ConnectID or creates a new one, and that ID can then be attached to ad requests wherever you go.

The lawsuit says ConnectID is implemented across nearly 50,000 publisher domains and has identified more than 300 million logged-in users worldwide, including over 200 million in the U.S. Participating properties named in the case and in coverage include Yahoo Mail, Yahoo Sports, AOL, TechCrunch, Engadget, CBS Sports, Realtor.com, Us Weekly, HuffPost, and FanDuel.

The plaintiffs make three core claims:

• It defeats privacy controls. Because the ID is rebuilt from your email each time you log in, clearing cookies, using private browsing, or blocking third-party cookies does not break the link the way it would with cookie-based tracking.
• It captures communications. The complaints allege Yahoo intercepts search terms, full page URLs, IP addresses, and device identifiers as users interact with partner sites.
• It builds profiles without consent. Yahoo allegedly combines ConnectID data with its own services, analytics, and machine learning tools to build "highly profitable" profiles for ad targeting.

The complaint quoted by the plaintiffs' firm says Yahoo does not tell users about ConnectID, how it works, or that it is tied directly to their email addresses. Yahoo disputes the claims, and nothing has been proven.

Hashing an email does not make it anonymous. The FTC made that point in a July 2024 technology blog post: the same email always produces the same hash, which is exactly what makes it useful for matching a person across companies.

Baker v. Yahoo Inc., No. 1:25-cv-02797, was filed in early April 2025 in the U.S. District Court for the Southern District of New York against Yahoo Inc. and Yahoo Ad Tech LLC. A second case, Caplan v. Yahoo Inc., No. 1:25-cv-02943, filed a few days later, was consolidated into Baker by an order of April 15, 2025. The case is assigned to Judge Denise L. Cote.

The November 2025 ruling was not a win on the merits for either side. According to case summaries, the court found the complaint too vague on account creation and consent and ordered the plaintiffs to plead more specifically. As of the last public docket report in August 2026, the court had not ruled on Yahoo's January 30, 2026 motion to compel arbitration.

Separately, the plaintiffs' firm Milberg announced a mass arbitration campaign against Yahoo over ConnectID in 2026, filing individual arbitration claims for users who agree to Yahoo's terms. No class has been certified, no settlement has been reached, and the allegations are unproven.

The Milberg complaint proposes two nationwide classes:

1. All U.S. residents whose ConnectID or other identifiers were intercepted or assigned by Yahoo.
2. All U.S. residents whose communications with third parties were intercepted or used by Yahoo without consent.

In practice, you are most likely to be covered if you logged in with an email address to a site or app that uses ConnectID, or used Yahoo's own services while logged in. California residents have a stronger footing because of the California Invasion of Privacy Act, and Pennsylvania residents because of that state's wiretap act.

Who may not qualify:

• People who only browsed partner sites without logging in, since ConnectID is built from an email address.
• People bound by Yahoo's terms of service if the court sends claims to individual arbitration. That would not erase the claim, but it would mean pursuing it one person at a time.
• People outside the U.S.

Yahoo's terms include an arbitration clause and a class action waiver, which is what the pending motion is about. Our guide on class actions versus individual claims explains what changes if a case goes to arbitration.

No settlement or verdict exists, so there is no payment amount. The laws cited in the complaints carry these remedies:

Under California Penal Code § 637.2, a person injured by a violation of the California Invasion of Privacy Act may sue for $5,000 per violation, and does not need to prove actual damages. That large number is why CIPA shows up in so many website tracking cases. In practice, courts often scrutinize these claims closely, and settlements in tracking cases usually pay far less per person than the statutory figure. Past privacy settlements are listed on our settlements page, including the Google Assistant $68 million settlement.

Nothing here means you will receive money.

The complaints rely on wiretap and privacy statutes written before modern ad tech, which is why these cases are contested:

• California Invasion of Privacy Act (CIPA). Makes it unlawful to read or learn the contents of a communication in transit without the consent of all parties. Plaintiffs argue ad tech that captures search terms and URLs as you browse is that kind of interception.
• Pennsylvania Wiretapping and Electronic Surveillance Control Act. A state wiretap law that also generally requires all-party consent.
• Computer data access claims. Coverage of the complaint also describes a computer data access and fraud claim, a theory that usually requires proof of loss or damage.
• New York General Business Law § 349. Bars deceptive business practices.

The key defense arguments are consent through Yahoo's and publishers' privacy policies, that a party to a communication cannot eavesdrop on it, and that arbitration clauses bar class claims. Yahoo's motion to compel arbitration, filed January 30, 2026, will decide whether this case continues as a class action at all. For how tracking claims play out in other cases, see our pages on Google privacy lawsuits and health app data sharing.

If the court enforces Yahoo's arbitration clause, the class action would largely end and each user would have to bring a claim individually before a private arbitrator. That is why some law firms have turned to mass arbitration: filing hundreds or thousands of individual arbitration claims at once for people who sign up.

Mass arbitration works differently from a class action:

• You must sign up with a law firm and agree to be its client. In a class action, you are included automatically.
• Each claim is decided separately, though companies often settle large groups of claims together.
• Fees are structured differently. Under the consumer rules of major arbitration providers, the company usually pays most of the filing and arbitrator fees, which is part of why mass filings put pressure on companies to settle.
• Results are usually confidential, so you will not see public settlement amounts the way you would in a class settlement.

Joining a mass arbitration is a choice, not a requirement, and you should read the engagement agreement carefully, including how fees are split if you recover money. If the court instead keeps the class action alive, you would be part of it automatically unless you opt out.

Whatever happens in court, a few steps reduce how easily your activity can be linked across sites:

1. Use different email addresses or aliases for different sites. Several email providers and phone makers offer masked or relay addresses that forward to your inbox. Because ConnectID is keyed to your email, separate addresses make cross-site matching harder.
2. Review ad settings in your Yahoo privacy dashboard and on partner sites where you have accounts.
3. Log out of sites you do not need to be logged in to. The lawsuit says ConnectID is assigned when you log in or sign up with an email.
4. Limit ad tracking on your phone through its privacy settings.

These steps protect you going forward. They do not affect any claim about past tracking, and changing your settings now does not count as consenting to what happened before. If you later join a case, the email addresses you used over the years are what connect you to the alleged tracking, so write them down before you close old accounts.

• No claim deadline yet. There is no settlement.
• Class membership is automatic while the proposed class action is pending, and filing generally pauses the statute of limitations for class members.
• Wiretap claims can have short limits. Some state privacy claims have limitations periods as short as one year, so older tracking may already be out of time for individual claims. An attorney can check the rules for your state.
• Arbitration has its own steps. Yahoo's terms may require a notice of dispute before arbitration can begin.

1. List your logins. Write down the email addresses you used and the Yahoo and partner sites where you had accounts, with rough dates. Include old addresses you no longer use.
2. Review Yahoo's privacy controls. Yahoo's privacy dashboard lets you manage some ad personalization settings. Changing them now does not waive past claims.
3. Keep Yahoo emails about terms changes, especially any mentioning arbitration.
4. Be careful with sign-up sites. You never need to pay to be part of a class action. See our guide to settlement scams.

Independent attorneys who handle privacy cases can explain whether a class claim or an individual arbitration claim fits your situation. A free case review takes about two minutes.