Yahoo Hit With Privacy Suit Over Tracker Using Email Addresses

Yahoo’s ConnectID uses email addresses, rather than third-party tracking cookies, to harvest and monetize data from millions of US residents without consent, a lawsuit filed in federal court alleged.

ConnectID allows for consistent user-level tracking across the internet by referring to individual email addresses, according to the complaint filed in the US District Court for the Southern District of New York. Media companies including Paramount, Tubi, and NBCUniversal all use Yahoo ConnectID, the complaint alleges.

Users didn’t consent to this tracking, which synergizes with Yahoo’s “existing analytics, advertising, and AI products” to Yahoo’s benefit, the complaint says.

In fact, according to the complaint, ConnectID circumvents other privacy protective measures—it doesn’t require third-party cookies that browsers allow users to clear, for example. And it collects information even if an user doesn’t subscribe to a Yahoo product. In those cases, the email address is intercepted and compared, usually in an encrypted form, to a list of existing ConnectIDs. If one doesn’t exist, one is created for the user.

“Yahoo openly tells publishers that they need not concern themselves with obtaining user consent because it already provides ‘multiple mechanisms’ for users to manage their privacy choices. This is misleading at best,” according to the complaint.

Yahoo’s privacy policy “makes no mention of sharing directly identifiable email addresses and, in fact, represents that email addresses will not be shared,” the complaint says.

Plaintiff Tyler Baker seeks to represent a nationwide class of those who have a ConnectID, and one of those whose online communications were intercepted by Yahoo. “Each of the Classes consists of well over a million individuals.”

The complaint asserts claims under New York unfair and deceptive business practices law, as well as California’s constitution, Invasion of Privacy Act, and Computer Data Access and Fraud Act. makes claims for common law invasion of privacy and unjust enrichment.

The suit seeks “statutory, actual, compensatory, punitive, nominal, and other damages” as well as restitution, disgorgement, injunctive relief, and attorneys’ fees.

Yahoo didn’t immediately respond to a request for comment.

Lowey Dannenberg PC represents the proposed class.

The case is Baker v. Yahoo Inc., S.D.N.Y., No. 1:25-cv-02797, complaint 4/3/25.