Consumer Apps · Health/Fitness · Private litigation + Data breach
MyFitnessPal
Headline
MyFitnessPal's cookie-consent banner offers you a button to browse 'without being tracked' — a 2025 lawsuit (Shah v. MyFitnessPal, N.D. Cal. No. 25-cv-04430, which partly survived a motion to dismiss in Jan 2026)…
MyFitnessPal's cookie-consent banner offers you a button to browse 'without being tracked' — a 2025 lawsuit (Shah v. MyFitnessPal, N.D. Cal. No. 25-cv-04430, which partly survived a motion to dismiss in Jan 2026) alleges Facebook, Google, and The Trade Desk keep tracking you anyway even after you click it. That's on top of the original 2018 breach that exposed 150 MILLION accounts. Then in March 2026, a threat actor claimed a breach of Cal AI (an AI calorie tracker MyFitnessPal had acquired), allegedly exposing data on more than 3 million users, including dates of birth, height and weight records, and nutrition goals; Cal AI had not confirmed the incident when it was reported.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; the legal tier of its sources has not been assigned yet.
Primary source. cipaworld.com/2026/01/30/california-judge-puts-myfitnesspal-on-a-privacy-diet-key-privacy-claims-survive-as-court-weighs-in-on-cookie-consent-and-consumer-privacy-expectations/ — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass.
Data sharing
A 2026 plaintiffs'-firm investigation (reportedly by Milberg; the solicitation page was not retrieved, and an investigation is not a filed case) has been reported as soliciting claims alleging the MyFitnessPal Android app violates California's Confidentiality of Medical Information Act by transmitting users' personal health information — including weight-loss goals, motivations, activity levels, meal frequency, lifestyle habits, and relevant health conditions — to third-party companies for advertising/marketing WITHOUT consent.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. MyFitnessPal's cookie-consent banner offers a button to browse 'without being tracked.' | fact | unsupported | none recorded |
| 2. A 2026 lawsuit alleges third parties keep tracking users even after they click it. | fact | contradicted | 1 (0 confirmed) |
| 3. Meta (Facebook) and Google are among the parties alleged to keep tracking. | fact | supported | none recorded |
| 4. ByteDance/TikTok and Amazon are among the parties alleged to keep tracking. | fact | unsupported | none recorded |
| 5. A 2018 breach exposed 150 million MyFitnessPal accounts. | fact | unsupported | 1 (0 confirmed) |
| 6. Cal AI is MyFitnessPal's newly acquired sister app. | fact | unsupported | none recorded |
| 7. Cal AI was breached in March 2026. | fact | unsupported | 1 (0 confirmed) |
| 8. The Cal AI breach exposed 3.2 million records of eating habits, body measurements and fitness goals. | fact | unsupported | 1 (0 confirmed) |
| 9. According to researchers, at least one record belonged to a child born in 2014. | fact | unsupported | 1 (0 confirmed) |
| 10. The acquisition reportedly happened with no real security review. | fact | unsupported | none recorded |
0 of 10 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| court · 2025-05-23 | Claim 2 | Unassigned | corrected | “even after users declined advertising and analytics cookies” Quote basis: not recorded. |
| none | Claim 5 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | Claim 7 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | Claim 8 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | Claim 9 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy myfitnesspal.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service myfitnesspal.com/terms | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://cipaworld.com/2026/01/30/california-judge-puts-myfitnesspal-on-a-privacy-diet-key-privacy-claims-survive-as-court-weighs-in-on-cookie-consent-and-consumer-privacy-expectations/ Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.