Anime Fans Sued Crunchyroll Twice Over Viewing Privacy | Complete Lawsuit Update

Crunchyroll, the anime streaming service owned by Sony Pictures Entertainment, has been sued twice under the Video Privacy Protection Act for sharing subscribers’ personal viewing data with third-party companies without consent. The first case settled for $16 million in early 2024. The second was filed on March 5, 2026, alleging that Crunchyroll continued violating the same federal privacy law despite agreeing in the 2023 settlement to modify its tracking practices.

The 2026 case, Cabonios et al. v. Crunchyroll, LLC, Case No. 2:26-cv-02373, is pending in the U.S. District Court for the Central District of California. It targets Crunchyroll’s use of Braze Inc., a third-party marketing and analytics company, whose software development kit Crunchyroll allegedly embedded in its mobile app to systematically transmit users’ email addresses, device identifiers, and the specific anime titles they watched, all without obtaining proper consent.

Crunchyroll Lawsuit Timeline and Updates

September 2022 — First VPPA Lawsuit Filed Against Sony and Crunchyroll

Plaintiff Beltran and co-plaintiffs filed a class action in September 2022 in the U.S. District Court for the Northern District of Illinois, Case No. 1:22-cv-04858, against Sony Pictures Entertainment Inc. doing business as Crunchyroll. The complaint alleged Crunchyroll violated the VPPA by using the Facebook Pixel tracking tool and web beacons to share subscribers’ personally identifiable information with Meta’s Facebook, Google, Adobe, and other third parties without user consent.

The data at issue included each subscriber’s Facebook ID, device identifiers, and the specific video content URLs they accessed on Crunchyroll’s website and mobile app. Under the VPPA, a video service provider cannot knowingly disclose information that identifies a specific person as having requested or obtained specific video materials without that person’s informed written consent. The complaint alleged Crunchyroll’s tracking infrastructure systematically violated that prohibition at scale across its entire subscriber base.

September 2023 — Settlement Agreement Reached

The parties reached a class action settlement on September 15, 2023. Sony Pictures and Crunchyroll agreed to pay $16 million to resolve all claims, without admitting wrongdoing. As part of the settlement, Crunchyroll agreed to modify its use of tracking technologies to bring its practices into compliance with the VPPA going forward. The settlement class covered all U.S. registered users of Crunchyroll who had viewed videos on any Crunchyroll-owned or controlled website, app, or video-on-demand service between September 8, 2020, and September 20, 2023.

December 2023 — Claims Deadline and Final Fairness Hearing

The claims deadline for eligible class members was December 12, 2023. The final fairness hearing was held December 19, 2023. Eligible class members were required to submit a claim using a class member ID emailed to their registered address. Class counsel estimated each eligible claimant would receive approximately $30.00, with the final per-claim payout coming in at $31.24 based on actual claim volume. Kroll Settlement Administration managed the distribution process.

January 17, 2024 — Final Approval and Settlement Paid

The court granted final approval of the Beltran settlement on January 17, 2024. Payments were distributed approximately 90 days after final approval. The $16 million settlement resolved all claims from the class period. The 2023 settlement claim deadline has permanently closed. No new claims are accepted for the Beltran case.

2022-2026 — Crunchyroll Continues Alleged Privacy Violations via Braze SDK

The 2026 lawsuit alleges Crunchyroll began sharing user data with Braze Inc. starting approximately in 2022, the same year the Facebook Pixel lawsuit was filed. According to the complaint, Crunchyroll embedded Braze’s software development kit directly into its mobile application. That embedded code created an automatic data pipeline: every time a subscriber watched a video, the Braze SDK transmitted their email address, their device’s persistent identifier, and the title of the content they watched back to Braze’s servers.

Braze Inc. is a customer engagement platform that enables companies to send in-app notifications, push messages, and targeted email campaigns. The complaint alleges Crunchyroll knew Braze would receive and combine the identifying and behavioral data to build individual viewing profiles. Those profiles were then used to target Crunchyroll subscribers with personalized marketing based directly on the anime they had been watching. The complaint notes that several Crunchyroll titles include mature, violent, explicit, and sexually suggestive content, making the unauthorized disclosure of specific viewing habits a particularly invasive form of privacy violation.

March 5, 2026 — New Class Action Filed in California

Francisco Cabonios, joined by four co-plaintiffs including a minor subscriber, filed Cabonios et al. v. Crunchyroll, LLC in the U.S. District Court for the Central District of California on March 5, 2026. The other named plaintiffs are J.T., a minor who brings the action through parent and guardian Oskar Toruno, Anthony Gonzales, Matthew Newton, and Alicia Taylor.

Lead plaintiff Francisco Cabonios became a Crunchyroll subscriber in April 2024 when he was a minor. The complaint alleges Crunchyroll disclosed his personal viewing information to Braze without consent throughout his subscription. Plaintiff Anthony Gonzales subscribed around January 2025 and experienced the same unauthorized disclosure during 2025.

The complaint charges Crunchyroll with a single count of violation of the Video Privacy Protection Act. Plaintiffs seek statutory damages of $2,500 per violation per class member, plus attorney’s fees, costs, injunctive relief, declaratory relief, and punitive damages sufficient to deter future conduct. A jury trial is demanded. The complaint explicitly references the 2023 settlement and characterizes Crunchyroll’s continued use of tracking technology as a willful disregard for the privacy commitments it made in that settlement.

What the VPPA Is and Why It Applies to Crunchyroll

Congress enacted the Video Privacy Protection Act in 1988 after a Washington newspaper published the video rental history of Supreme Court nominee Robert Bork, obtained from a local video store. Senator Patrick Leahy, who introduced the bill, argued that video and book selections sit at “the core of any definition of personhood,” revealing interests, ambitions, fears, and values that people should control.

The VPPA prohibits any “video tape service provider” from knowingly disclosing personally identifiable information about a consumer to any person without the consumer’s informed, written consent. That consent must be obtained “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer.” Burying a data-sharing authorization in a terms of service agreement is not enough.

Courts have consistently applied the VPPA to modern streaming services. The statute uses the term “video tape service provider” but courts have held the law covers any entity in the business of rental, sale, or delivery of prerecorded video content, including digital streaming. Crunchyroll’s streaming service falls squarely within that definition.

The key legal question in both cases was whether Crunchyroll’s disclosures qualified as knowing. In the Facebook Pixel case, the complaint alleged Crunchyroll installed tracking code specifically designed to send user data to Meta, a transaction the company understood and chose to implement. In the Braze SDK case, the complaint makes the same argument: Crunchyroll built the data pipeline into its app, configured it to transmit viewing data, and knew exactly what Braze would do with the information it received.

What Data Was Allegedly Shared

The Minor Subscriber Problem

The 2026 lawsuit includes a separate subclass covering minors. Two of the five named plaintiffs, Francisco Cabonios and J.T., were minors when they subscribed and when their viewing data was allegedly transmitted to Braze.

The inclusion of minors adds legal weight beyond the standard VPPA claim. Minor subscribers cannot provide legally valid consent to data-sharing arrangements. Any consent mechanism Crunchyroll relied on was ineffective as to minors by definition. Beyond contract law, the disclosure of a child’s viewing history, including content the complaint describes as mature, violent, explicit, and sexually suggestive, raises separate concerns under consumer protection frameworks that provide heightened protections for minors’ data. The complaint’s reference to sensitive content in Crunchyroll’s library is deliberate. It signals to the court that the privacy violation here was not merely technical. It involved the identifiable behavioral profiles of children watching adult-rated content being shared with a commercial marketing company.

Who Qualifies for the 2026 Lawsuit

The class has not yet been formally certified. The complaint defines the proposed class as all U.S. persons who were subscribers to and viewed video content on Crunchyroll’s app and whose personal viewing information was disclosed to Braze without consent. The complaint suggests conduct began approximately in 2022 and continued through the March 2026 filing date.

Any person who subscribed to Crunchyroll and used its mobile app during that period is a potential class member. The class is expected to be large. Crunchyroll has over 17 million paid subscribers globally and approximately 130 million registered accounts. No claim form is currently available. The case is in active litigation. A settlement, if reached, would open a claim window. Monitoring the case docket, Case No. 2:26-cv-02373 in the Central District of California, is the most reliable way to track when a claim process opens.

People who received payment from the Beltran settlement in 2024 may also qualify for the Cabonios settlement if it resolves, since the new case covers conduct that began in 2022 and continued after the class period in the earlier case.

Why the Second Lawsuit Carries More Legal Weight

The 2026 complaint is legally stronger than the 2022 filing for one specific reason: Crunchyroll settled the first case and agreed to modify its tracking practices. Then it allegedly kept doing the same thing.

In litigation, prior settlements are admissible context. The complaint explicitly cites the Beltran settlement and argues that Crunchyroll’s decision to continue tracking users through Braze despite that settlement demonstrates willful conduct. Willfulness matters under the VPPA because it can support punitive damages above the statutory $2,500 per-violation floor. It also undercuts the defense that the company did not understand its obligations, a defense that may have had more credibility before a prior settlement imposed them.

The potential damages are theoretically enormous. At $2,500 per violation per class member, applied across Crunchyroll’s subscriber base, the total exposure runs into the billions. Past streaming privacy cases have settled for far less, but the per-violation statutory structure creates negotiating leverage that the plaintiffs did not have before the first settlement established the conduct as a VPPA violation.

What This Lawsuit Teaches Consumers

The Crunchyroll VPPA cases reveal the gap between what privacy settlement commitments say on paper and what actually changes in a company’s infrastructure. In 2023, Crunchyroll agreed to modify its use of tracking technologies to comply with the VPPA. Eighteen months later, a new group of subscribers filed a lawsuit alleging the company had been sharing their viewing data through a different tool the entire time.

That pattern, settle, promise to change, continue the conduct through a different technical channel, has become a recognized problem in consumer privacy litigation. Companies treat privacy settlements as line items, not operational mandates. The SDK swap, from the Facebook Pixel to Braze, may have been a genuine compliance attempt that failed in execution. Or it may have been a deliberate workaround. Either way, the result for subscribers was the same: their anime viewing habits were being sold to a marketing company without their knowledge.

The inclusion of minors as named plaintiffs signals that future privacy litigation will increasingly focus on companies’ obligations to younger users who cannot meaningfully consent to data collection. Any streaming platform that hosts content marketed to teens and young adults while simultaneously embedding marketing analytics SDKs into its app is operating in territory that courts are increasingly treating as presumptively non-compliant.

Consumers on any streaming platform should look for, in the app’s privacy settings, an option to opt out of analytics and third-party marketing SDKs. Where no such option exists, the platform is collecting and sharing behavioral data by default. The Crunchyroll lawsuits demonstrate that this practice carries real legal exposure under a federal statute that has been on the books since 1988 and is being enforced with increasing frequency, as seen in similar cases involving the Pornhub digital platform case and the Cash App spam text settlement, both of which turned on whether a digital platform obtained proper consent before monetizing user behavior. The Prime Energy lawsuit similarly shows how consumer-facing brands face legal accountability when they profit from deceptive or non-consensual practices at scale.