Yahoo Privacy Lawsuit Claims Company Secretly Collects User Data

A Milberg class action lawsuit claims that Yahoo tracks users’ internet activity without their consent using its ConnectID tool to collect detailed profiles of their online behavior for targeted advertising.

• The lawsuit says Yahoo secretly tracks users online with an email‑based identifier
• Yahoo’s ConnectID allegedly circumvents privacy protections like cookie restrictions
• Yahoo is accused of breaking state privacy and wiretap laws
• Millions of users may be eligible to join the lawsuit as class members
• Milberg Senior Partner Vicki J. Maniatis is representing the plaintiff and class

What is the Case About?

The lawsuit, filed in U.S. District Court for the Southern District of New York (Caplan v. Yahoo Inc., case number 1:25-cv-02943) by Pennsylvania resident James Caplan, alleges that Yahoo built an enormous advertising business on the backs of unsuspecting users, collecting detailed profiles of their online behavior that Yahoo and its partners used to deliver highly targeted ads, all without their knowledge or consent.

Caplan’s allegations center on Yahoo’s use of “ConnectID,” a system that assigns unique identifiers to users. The lawsuit claims that this system allows Yahoo to track users even when they try to protect their privacy by clearing cookies or using privacy-focused browsers.

Yahoo has confirmed that, through Yahoo ConnectID, it has successfully identified over 300 million logged-in users.

While Yahoo claims its tools are “privacy-first,” the lawsuit says they’re anything but. According to the complaint, Yahoo uses ConnectID to intercept email addresses and other identifying information when users log into websites, including not just Yahoo’s own sites, but partner and third-party sites as well.

“Caplan did not consent to Yahoo intercepting his unique identifiers and other personal data, assigning, and using unique identifiers to track him across internet-enabled services and devices, or intercepting and using the contents of his private communications for profit,” the lawsuit says.

Cookies, ConnectID, and Yahoo’s Alleged Tracking Scheme

The lawsuit describes how Yahoo transformed from an early internet email provider and search engine to a significant player in data, marketing, and ad tech markets.

Beginning with its purchase of Right Media in 2007 and continuing through the buyouts of Flurry Analytics and BrightRoll in 2014, Yahoo acquired market and ad tech companies to develop a “user-based online targeting business.”

These acquisitions were so lucrative that they led to Verizon purchasing Yahoo for $4.8 billion in 2017, the complaint says.

Yahoo’s value was derived from the new forms of persistent, user-based online tracking it developed through these acquisitions. Specifically, in 2020—after Apple and Google announced they would eventually phase out third-party cookies and Apple would restrict the use of mobile identifiers—Yahoo released a new, unified way to track users across platforms and devices.

While its acquisitions gave Yahoo advanced tracking capabilities, traditional tracking cookies, which are being phased out by browsers like Safari and Chrome for privacy reasons, were still integral to its strategy, and Yahoo needed a new way to maintain its ability to track users and deliver targeted ads. ConnectID was designed to fill this gap.

• Unlike cookies, which rely on browser-based tracking, ConnectID uses email addresses as an identifier. When a user logs into a Yahoo service (e.g., Yahoo Mail) or provides their email to a partner site, Yahoo allegedly assigns a unique ConnectID tied to the email address.

• This identifier follows a user across websites, apps, and devices, allowing Yahoo to build a comprehensive profile of their online behavior that doesn’t rely on cookies or mobile device IDs.

• The lawsuit claims ConnectID is a “work-around to privacy mechanisms” because it achieves the same invasive tracking as cookies but evades browser restrictions. For example, Safari can block a third-party cookie, but ConnectID operates through server-side data collection tied to email that permits Yahoo and its partners to track users even if they clear cookies or browse in private mode.

“Yahoo does not tell its users of the ConnectID, how it works, or that this identifier is tied directly to their email addresses and assorted PII,” the complaint states. “Yahoo’s Privacy Policy makes no mention—at all—of Yahoo ConnectID. In fact, their policy expressly states that it does not share personally identifiable information (like phone number or email address) with partners, such as publishers, advertisers, ad agencies, or analytics partners. This is deceptive.”

Although Yahoo does not disclose email addresses directly, the lawsuit claims that it “intercepts and maps the user’s email address directly to a ConnectID” that it then shares with its partners and is “no better than sharing the email address itself.”

Millions May Be Able to Join the Yahoo Privacy Lawsuit

The class in the Yahoo privacy lawsuit could include anyone in the U.S. whose data was tracked and collected by Yahoo without their consent. Specifically, the complaint lists two nationwide classes:

• Identifier Class: All natural persons in the United States for whom Yahoo intercepted or assigned a ConnectID or other identifier.
• Communications Class: All natural persons in the United States who had their communications with third parties intercepted or used by Yahoo without their consent.

ConnectID has reportedly been used to successfully identify over 300 million unique, logged-in users, including more than 200 million in the U.S. The complaint names numerous “partners” and third‑party services that integrate or work with Yahoo’s ConnectID ecosystem, including Paramount, Tubi, NBCUniversal, CBS Sports, Adobe, Experian, TransUnion, and Walmart.

Potential class members do not need to determine their eligibility to join the class action lawsuit. They will be automatically joined and notified of their rights and next steps if the court certifies the case.

Possible remedies include injunctive relief to stop Yahoo’s alleged unlawful conduct, an order requiring Yahoo to delete the collected user data, and monetary damages.

Milberg’s Vicki Maniatis, named to Super Lawyers and recognized as a Mass Tort Top 25 Trial Lawyer, a Civil Plaintiff Top 100 Trial Lawyer, a Top Attorney of the NY Metro Area, and a Top Woman Attorney in the Metro Area, is handling the case.

Milberg is one of the top privacy firms in the country. Its Information Technology Practice Group attorneys work at the cutting edge of technology and law, helping to create meaningful checks and balances against tech giants like Yahoo.

Over a recent three-year period, Milberg settled on a class-wide basis more than fifty class actions involving privacy violations in state and federal courts across the country as lead or co-lead counsel. No other plaintiffs’ class action firm in the country settled and won court approval of more data breach and data privacy class actions during this period.