MeUndies class action alleges tracking technologies shared consumer data with tech giants

MeUndies class action lawsuit overview:

• Who: Plaintiff Haley Gray filed a class action lawsuit against MeUndies Inc.
• Why: Gray claims MeUndies unlawfully shared consumers’ personally identifiable information without their consent despite promises of data privacy.
• Where: The MeUndies class action lawsuit was filed in California federal court.

A new class action lawsuit alleges MeUndies secretly intercepts customers’ personal information and shares it with major advertising companies despite promising shoppers their data would remain private.

Plaintiff Haley Gray filed the MeUndies class action lawsuit on June 15, claiming the underwear and loungewear retailer embeds tracking technologies from Meta, Google, TikTok, Snapchat and AppLovin on its website without disclosing their true function to customers.

Gray alleges MeUndies warrants to customers that its website cookies “do not store any personally identifiable information” — a promise the complaint alleges the company knowingly violates.

In August 2025, Gray claims she visited meundies.com and purchased bralettes, during which she alleges her identity and purchase information were intercepted and transmitted to third parties without her knowledge or consent.

The MeUndies complaint alleges the interceptions capture a wide range of personally identifiable information, including customers’ names, email addresses, phone numbers, locations and detailed purchase information, all of which are funneled to advertising companies to build targeted ad profiles.

MeUndies lawsuit details data Meta, Google, TikTok and others allegedly received 

The MeUndies class action lawsuit alleges that Meta’s Pixel technology captures users’ Facebook IDs, cookie identifiers, IP addresses and purchase details in real time as they navigate the website, transmitting that data to Meta, where it is stored and used to build advertising audiences.

The complaint claims that Google’s tracking technologies intercept customers’ email addresses, phone numbers, first and last names, and partial addresses during checkout — encoded in a format that Google can decode and link to individual user profiles.

TikTok and Snapchat receive similarly detailed information, the lawsuit claims, with Snapchat specifically receiving customers’ hashed email addresses, names, city and ZIP code, alongside product details, and AppLovin receiving hashed emails and purchase information.

The complaint further alleges that hashing customer data does not render it anonymous, citing Federal Trade Commission guidance stating that hashed information “can still be used to identify users, and their misuse can lead to harm.”

Gray asserts MeUndies is guilty of violating the federal Electronic Communications Privacy Act, the California Invasion of Privacy Act, the California Comprehensive Computer Data Access and Fraud Act and the California Constitution.

The plaintiff demands a jury trial and requests compensatory damages, statutory damages of $5,000 per violation, disgorgement, punitive damages and injunctive relief for herself and all class members.

Currently, over two dozen websites are being investigated for alleged data privacy violations. See if you qualify to join a website tracking and data privacy class action investigation.

Do you believe you ever had your data intercepted on MeUndies’ website? Let us know in the comments.

The plaintiff is represented by Philip L. Fraietta of Bursor & Fisher P.A.

The MeUndies class action lawsuit is Gray v. MeUndies Inc., Case No. 2:26-at-01023, in the U.S. District Court for the Eastern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

• Motorola accused of using license plate cameras to track drivers’ movements
• AmazonFresh collective action claims company misclassifies assistant store managers
• Gas station class action claims retailers used software to inflate fuel prices
• Madison Square Garden class action alleges biometric data exposed in cyberattack