A Lawsuit Against Mazda Asks a Simple Question: What Does "Decline All" Actually Mean?

A class action lawsuit filed in the US District Court for the Northern District of California alleges that Mazda Motor of America's website continued tracking visitors after they clicked "decline all" on its cookie consent banner. The case raises a question that applies to far more websites than Mazda's: when a user declines consent, does that choice have any practical effect?

What the plaintiffs allege

Vishal Shah and Brian Heinz claim they visited mazdausa.com between 2022 and 2024 to research vehicles, including Mazda's CX-series and CX-50 models. Both say they were presented with a cookie consent banner before browsing and clicked the option to decline.

The banner told visitors: "We use technologies to personalize and enhance your experience on our site. If you agree to our use of these technologies, please select 'I Agree' below." The option to decline was presented alongside the option to agree.

According to the complaint, selecting decline did not stop the tracking. Cookies from Google's YouTube service and Adobe were placed on the plaintiffs' devices regardless of their stated choice, allowing those companies to capture browsing history, shopping behaviour, and geolocation data.

How the tracking was documented

The complaint notes that the only practical way for a user to verify what a website is actually sending to third parties is to use a specialised network traffic tool. Most users have no reason to know this and no practical way to do it.

The plaintiffs' counsel used the Network tab in Chrome Developer Tools, which logs a browser's incoming and outgoing traffic, to examine what mazdausa.com was sending after opt-out. According to the complaint, the site continued sending HTTP requests carrying cookies to youtube.com and omtrdc.net, Adobe's domain, after "decline all" had already been clicked.

"Even when consumers like plaintiffs tried to protect their privacy by declining 'ALL' cookies, Mazda failed to prevent cookies from being intercepted by the third parties, enabling them to track user behavior and communications," the complaint states.

The legal claims

The lawsuit accuses Mazda of privacy invasion, wiretapping, unlawful use of a pen register, fraud, and unjust enrichment. The plaintiffs are seeking to represent a nationwide class of website visitors who clicked "decline all" on mazdausa.com, as well as a California subclass, and are demanding a jury trial.

Shah and Heinz argue that the tracking deprived them of the ability to control how their personal information is used and diminished its value. The case is Shah, et al. v. Mazda Motor of America Inc., Case No. 4:26-cv-08744.

Why this case matters beyond Mazda

The Mazda case is not an isolated complaint. The gap between what a consent interface promises and what a website actually does has been documented across multiple industries and jurisdictions. It requires specialised tools to detect, which means most users have no way of knowing whether their stated preferences are being respected.

Fairpatterns' cookie scanner scans the underlying code of consent implementations directly, rather than relying on what the interface displays. In roughly 30% of scans, when a user clicks "no," the code says "yes.”

‍