Crumbl Cookies Lawsuit: Did They Share Your Private Info with Stripe?

A California customer who visited the Crumbl website to buy the company’s signature cookies, says she also came away with “tracking cookies” — a wiretap system that had been surreptitiously installed into her browser to collect and monetize her private information. 

Plaintiff Kristen Lockhart filed the proposed class action lawsuit against Crumbl LLC on May 1 in a California federal court, alleging violations of the California Invasion of Privacy Act (CIPA).  

Lovers of baked goods know Crumbl sells its signature cookies through the website www.crumblcookies.com, Lockhart says. What they don’t know is that, when they visit the website, Crumbl knowingly helps the company Stripe, Inc. to intercept and collect their confidential information, she alleges.

The Utah-based cookie company is now being sued by consumers who say their privacy was breached when they visited its website to browse or buy sweet treats. 

Crumbl accused of partnering with Stripe to embed tracking software

Stripe is one of the world’s largest payment processing companies, the lawsuit says. 

It alleges this is partly because, unlike its competitors, Stripe “engages in the surreptitious interception and collection of sensitive information, including consumers mouse movements and clicks, keystrokes, IP address, geolocation, and financial information.”  

Stripe does this by embedding wiretaps — or tracking cookies — in the computer code of websites that it works with, like Crumbl, Lockhart says. Stripe gets access the moment a consumer enters the Crumbl website, she says.

She alleges Crumbl assisted Stripe in installing the wiretaps on its website, which track consumers’ online activity as they navigate through other websites, the lawsuit says.

Lockhart details alleged tracking by Crumbl and Stripe

Lockhart says she made several purchases through Crumbl’s website —most recently in approximately June 2023 — and became aware of the allegedly illegal activity in Aug. 2023. 

She says, as soon as she entered Crumbl’s website, the company assisted Stripe with installing the Stripe.js software code onto her web browser “without her knowledge or consent.”  

Lockhart says, while purchasing cookies she entered her credit card information to complete the transaction. She alleges that Crumbl then disclosed that private and sensitive information to Stripe without her knowledge or consent. 

“Stripe also continued monitoring Ms. Lockhart’s online activity through the Stripe.js software long after her transaction on the website was completed,” the lawsuit alleges. “This allowed Stripe to intercept additional information, including Ms. Lockhart’s IP address and geolocation.”

Lockhart says she would not have bought cookies on the Crumbl website if she knew that Crumbl was assisting Stripe in “monetizing her private information” to its network of merchant customers. 

A history of legal issues for Crumbl and Stripe

Crumbl and Stripe have faced a number of lawsuits in the past. In 2020, Stripe agreed to pay $120,000 to resolve allegations that its risk monitoring and fraud prevention and mitigation practices violated Massachusetts’s consumer protection law by processing payments that resulted in the fraudulent and unregistered sale of cryptocurrency.

In 2021, Stripe was ordered to face claims from consumers that it invaded their privacy under California law by collecting data on purchases and sharing it with merchants and customers, Bloomberg Law reported.

Last year, Crumbl was hit with a class action lawsuit by two California women alleging the company concealed a 2.95% service fee added to every customer’s purchase. It is also facing a separate class action lawsuit that alleges it failed to provide accurate calorie information for its cookies on menus and advertisements. 

Lockhart is looking to represent anyone in California who made a purchase from Crumbl’s website. She is seeking certification of the class action, damages, fees, costs and a jury trial.

The plaintiff and the proposed class are represented by Sarah N. Westcot of Bursor & Fisher P.A. 

The Crumbl data privacy class action lawsuit is Lockhart v. Crumbl LLC, Case No. 4:24-cv-02607-KAW  in the U.S. District Court for the Northern District of California.