Being a paying subscriber to a streaming service (monthly fee, account in your name, viewing history sitting quietly on their servers) and learning that the movies you watched late at night, the ones you might not bring up at a dinner party, were being discreetly sent to a marketing firm you’ve never heard of is a unique kind of irony. That’s the claim at the heart of the most recent class action lawsuit against Crunchyroll, and the timing couldn’t be more awkward for a platform based on the devotion of a fervent and privacy-conscious fan base.
A class action lawsuit alleging Crunchyroll LLC violated the Video Privacy Protection Act, a federal law passed in 1988 that was initially intended to prohibit video rental stores from disclosing customers’ borrowing histories without consent, was filed against the anime streaming behemoth in a California federal court in March 2026. One of the more powerful legal tools available to customers dissatisfied with how digital platforms handle their viewing data is the VPPA, which has largely survived into the streaming era. According to the lawsuit, Crunchyroll integrated a software development kit from marketing and analytics company Braze Inc. directly into its mobile app. This SDK was set up to send user email addresses, persistent device identifiers, and the particular anime titles being streamed to Braze without getting the informed written consent required by the VPPA.
Francisco Cabonios is the main plaintiff, and four other people—including a minor—join him. The plaintiffs are requesting a jury trial, legal fees, and $2,500 in statutory damages for each alleged infraction. Here, there is a real risk of exposure. Tens of millions of people subscribe to Crunchyroll. The numbers quickly accumulate into a region that tends to focus corporate minds if each account represents even one infraction.
The precedent directly behind this case makes it more difficult for Crunchyroll to handle it smoothly. In 2023, the company paid $16 million to settle a nearly identical VPPA lawsuit brought by subscribers who claimed their viewing data had been shared without their consent since 2020. Payouts of about $30 were given to users who subscribed between September 2020 and September 2023 and submitted claims prior to the December 2023 deadline. Crunchyroll was not required to acknowledge any wrongdoing as part of the settlement. However, the 2026 complaint characterizes the company’s actions as “particularly egregious” because it allegedly carried on with similar practices following that previous settlement, with the Braze SDK allegedly running in its app since at least 2022, which coincides with the earlier case’s time frame.
Crunchyroll Class Action Lawsuit Sign Up 2026: Two Lawsuits, Millions of Users, and a Privacy Law That Predates Streaming
| Category | Details |
|---|---|
| Company Name | Crunchyroll LLC |
| Parent Company | Sony Group Corporation (via Funimation/Aniplex acquisition) |
| Headquarters | San Francisco, California, USA |
| Service Type | Anime streaming platform (subscription-based) |
| Estimated Subscribers | Tens of millions globally |
| Lawsuit 1 — VPPA Case | Cabonios, et al. v. Crunchyroll LLC |
| Case Number (VPPA) | 2:26-cv-02373 |
| VPPA Case Filed | March 5, 2026 |
| Court (VPPA) | U.S. District Court, Central District of California |
| Lead Plaintiff (VPPA) | Francisco Cabonios and four others, including a minor |
| Third Party Implicated | Braze Inc. — marketing and analytics software company |
| Data Allegedly Shared | Email addresses, device IDs, anime titles watched |
| Statutory Damages Sought | $2,500 per violation under the Video Privacy Protection Act |
| Lawsuit 2 — Data Breach | Separate class action alleging March 2026 data breach |
| Data Breach Scope Alleged | 6.8 million users; email addresses, IP addresses, credit card info |
| Prior Settlement | $16 million settlement (2023) for similar VPPA violations |
| Sign-Up Status (April 2026) | No active claim form — cases still in early litigation |
| Where to Monitor | ClassAction.org, Top Class Actions, Kroll Settlement Administration |
Then, a second lawsuit surfaced in 2026 before the first one had even entered the news cycle. A threat actor allegedly claimed to have exfiltrated approximately 100 gigabytes of user data, including email addresses, IP addresses, and credit card information, affecting an estimated 6.8 million users, according to reports that surfaced in late March and early April 2026 regarding a data breach affecting Crunchyroll. Crunchyroll was accused of failing to put in place sufficient security measures to safeguard user information in a different class action lawsuit. The business admitted that it was aware of the allegations and stated that it was conducting an investigation with cybersecurity specialists. That’s a cautious statement that doesn’t really solve anything.
As of early April 2026, neither the VPPA case nor the data breach action have an active claim form for subscribers who are wondering if they can sign up to join either lawsuit. Both cases are still in the early stages of litigation, long before any talks about a settlement would normally start. The practical advice for anyone with a Crunchyroll account is to keep an eye out for direct notifications if a settlement is eventually reached and a claims administrator is appointed, make sure the email address on your account is up to date, and keep an eye out for updates from reliable class action tracking sites. Similar cases have previously been handled by Kroll Settlement Administration, and any settlement would normally be followed by a special settlement website.
Reading online comments from subscribers makes it difficult to ignore the fact that the response to this lawsuit has been more regretful than furious. After receiving a $30 check from the 2023 settlement without fully understanding what it meant at the time, many members of the anime community are already skeptical about data practices and are generally technically literate. “As long as violations cost less than the money they bring in, it’s just the cost of doing business to them” is how one user on a well-known forum summed it up with the kind of dry accuracy that tends to cut through legal complexity. The VPPA’s $2,500 per-violation structure was intended to make breaking the law financially painful rather than just inconvenient, and that sentiment perfectly captures why, regardless of whether courts ultimately uphold it.
Anyone who follows digital privacy litigation has been witnessing the development of this larger context for years. Regarding smart TV viewing data, Samsung was sued by the VPPA. According to at least one person who made public mention of it, the Criterion Channel resolved a similar case by giving some subscribers $53. Similar criticism has been directed at Netflix, Hulu, and other companies. Drafted during a time when Blockbuster video dominated home entertainment, the Video Privacy Protection Act has evolved into a surprisingly pertinent piece of consumer protection legislation. It directly addresses the kinds of subtly accepted data practices that streaming platforms have built their marketing infrastructure around.
It remains to be seen if Crunchyroll settles swiftly or challenges the 2026 cases through discovery and beyond. As this develops, it becomes more evident that the company has now been sued twice for essentially similar actions, with the second lawsuit coming before the first’s cultural memory had completely faded. That is a pattern rather than an anomaly, and it implies that any compliance adjustments made after the 2023 settlement either failed or didn’t go far enough.
