Crunchyroll is facing two separate class action lawsuits filed in March 2026 alleging unauthorized disclosure of user personal information to third-party companies and a significant data breach affecting approximately 100 GB of customer data. The first lawsuit, filed between March 5-10, alleges the anime streaming platform violated the Video Privacy Protection Act (VPPA) by sharing user email addresses, persistent device identifiers, and specific video content viewing history with Braze Inc., a third-party marketing and analytics company, without user consent. The second lawsuit, filed on March 27, targets a separate cybersecurity incident where attackers accessed sensitive user data through Telus Digital, a third-party vendor, including full names, usernames, email addresses, IP addresses, approximate locations, and full text of user support tickets.
This article explains what happened, who may be eligible to file claims, and what compensation might be available based on these lawsuits and Crunchyroll’s 2023 settlement history. These are not the first privacy-related legal actions against Crunchyroll. In 2023, Sony Pictures and Crunchyroll settled a similar VPPA class action for $16 million after the company shared user data with Facebook, Google, Adobe, and other third parties without proper consent. Individual claimants in that settlement received approximately $30 per valid claim, suggesting the current lawsuits could follow a similar settlement pattern depending on class size and negotiated recovery amounts.
Table of Contents
- What Data Was Exposed in the Crunchyroll Breaches?
- Understanding the Legal Claims—VPPA vs. Negligence
- How Crunchyroll’s Prior Settlement Provides a Roadmap
- What Options Do Affected Users Have?
- Important Limitations and Claim Requirements
- Crunchyroll’s Obligations and Your Rights Going Forward
- What Comes Next for Crunchyroll Users
What Data Was Exposed in the Crunchyroll Breaches?
The March 2026 Crunchyroll incidents exposed two different categories of user information through different mechanisms. In the Braze SDK case, the platform embedded the Braze software development kit directly into its mobile application, which automatically transmitted user email addresses, unique device identifiers that persist across app sessions, and the specific titles of anime and other video content that users watched. This transmission occurred without explicit user consent, according to the complaint filed by plaintiff Francisco Cabonios in california federal court. The data sharing was particularly problematic because it included content viewing preferences, which can reveal sensitive information about user interests and viewing habits.
The second breach involved approximately 100 GB of data accessed by cybercriminals through a compromised Telus Digital employee system in India. According to court filings and breach reports, the exposed data included full names, usernames, email addresses, IP addresses (which can pinpoint approximate geographic locations), and the complete text of user support tickets. Support tickets often contain sensitive personal information beyond what users might expect to be at risk, as customers may include payment details, account recovery questions, or other identifying information when requesting technical assistance or reporting account issues. The timeline of discovery shows the breach likely occurred no later than March 12, 2026, though the exact date unauthorized access began remains unclear from public sources. This distinction matters because companies have varying legal obligations depending on when they discover versus when a breach actually occurs, and notification timing can affect class action deadlines.
Understanding the Legal Claims—VPPA vs. Negligence
The first lawsuit centers on the Video Privacy Protection Act (VPPA), a federal law enacted in 1988 that prohibits video rental and subscription services from disclosing personal information about the videos a customer watches without explicit, informed consent. The VPPA was originally designed to protect video rental customers’ privacy, but courts have expanded it to cover digital streaming services like Netflix and Crunchyroll. Statutory damages under the VPPA are significant: up to $2,500 per violation per class member. This means if you’re a member of the Crunchyroll VPPA class and the company is found liable, you settlement negotiations and the total number of claimants who submit valid claims. The second lawsuit filed by Emilia Enfield takes a different legal approach, alleging negligence under Washington state consumer protection laws. This claim argues that Crunchyroll failed to implement reasonable security measures to protect user data when working with third-party vendors like Telus Digital. Washington’s consumer protection statute allows for damages up to $25,000 per class member in some circumstances, though this represents a statutory maximum rather than a guaranteed award. However, it’s important to note that VPPA damages and negligence damages may not stack together for the same user—courts typically award under one theory or the other, not both, though parties can make arguments about which applies to which data categories.
How Crunchyroll’s Prior Settlement Provides a Roadmap
Crunchyroll’s 2023 settlement offers valuable insight into how current lawsuits might be resolved. In that case, Sony Pictures Entertainment and Crunchyroll paid $16 million to settle allegations that they shared user information with Facebook, Google, and Adobe Analytics without consent. The settlement involved multiple third-party data sharing similar to the current Braze dispute, though it included several companies rather than just one.
Individual claimants who submitted valid proof of claim received approximately $30 per claim, which suggests that despite the substantial settlement amount, per-person payouts can be modest when divided across millions of potential class members. The mathematics of the 2023 settlement indicate that roughly 500,000 valid claims were submitted (since $16 million divided by $30 equals approximately $533 million in total potential liability scaled to the actual payout). If Crunchyroll reaches a similar settlement in these 2026 cases, the per-claim amount could vary significantly based on: (1) how many users filed claims, (2) the final settlement amount negotiated, and (3) how much goes to attorneys’ fees and claim administration. Some settlements pay more per claim if fewer people file, while others with very high settlement amounts but massive class sizes result in smaller per-person distributions.
What Options Do Affected Users Have?
Crunchyroll users who believe they were affected by either incident have several paths forward. The most direct is to wait for formal class action settlements and watch for claim filing deadlines, which typically appear through claims administration websites dedicated to each settlement. When settlements are reached and approved by courts, users receive notice instructions explaining how to submit claims online, by mail, or through other methods. This passive approach requires you to actively monitor for settlement notices and meet filing deadlines—claims are not automatically paid, even if you’re confirmed as a class member.
Alternatively, individual users can contact the law firms handling the class actions and ask about eligibility questions or settlement timing. The firms bringing these cases are typically listed in the court documents filed in the California federal courts. However, if you prefer not to wait for class action resolution, some users may pursue individual claims under VPPA or state consumer protection laws, though this is significantly more expensive than joining a class action and typically only makes sense if you can demonstrate substantial individual damages beyond the statutory amounts. For most Crunchyroll users, the class action route will be the only practical option.
Important Limitations and Claim Requirements
Class action settlements come with strict claim requirements that many eligible users miss. When the Crunchyroll 2023 settlement allowed claims, many users failed to file or improperly completed their claim forms, resulting in money being returned to the defendant. Typical requirements include proving you maintained an active account during the relevant period, providing account information for verification, and submitting claims before the filing deadline—which is usually 60 to 90 days after the court approves the settlement. If you miss the deadline, you generally cannot recover, even if you were clearly affected.
The claims administration companies handling these settlements are strict about deadlines and documentation, though they do often allow for reasonable extensions if you request them before the deadline passes. A critical limitation is that past class action settlements for Crunchyroll do not necessarily protect you from current lawsuits. If you previously settled a claim related to the 2023 data sharing incident, that doesn’t make you ineligible for the 2026 breaches—these are separate incidents and separate lawsuits. However, you cannot claim twice for the same data exposure. Additionally, the amount you receive is typically a credit or check, not an account credit toward Crunchyroll service, so you cannot directly recoup a paid subscription through the settlement process.
Crunchyroll’s Obligations and Your Rights Going Forward
Following these lawsuits, Crunchyroll will likely face court-ordered injunctive relief, which means the company will be required to implement specific security and privacy practices going forward. In the 2023 settlement, Crunchyroll was required to implement additional security measures, obtain explicit opt-in consent before sharing data with third parties, and undergo periodic audits to verify compliance. Similar requirements will likely be imposed in the current cases.
These injunctions are enforceable, meaning if Crunchyroll violates them in the future, users or attorneys can petition the court to enforce penalties, though such enforcement is separate from receiving individual compensation. Understanding that Crunchyroll has now faced multiple VPPA settlements suggests systemic issues with how the platform handles third-party data integrations. This history is relevant if you decide whether to continue using the service—past settlements don’t necessarily indicate Crunchyroll is worse than other streaming platforms, but they do show the company has repeatedly chosen to integrate third-party tools and analytics without obtaining clear user consent. Many competing platforms like Netflix and Disney+ have their own privacy histories, so switching services doesn’t necessarily eliminate privacy risks, but Crunchyroll’s pattern is worth considering.
What Comes Next for Crunchyroll Users
The timeline for these lawsuits will likely stretch into 2026 and beyond, as federal class actions typically take 12 to 24 months from filing to settlement approval. Between now and settlement, both lawsuits will proceed through discovery (where the plaintiff’s attorneys obtain Crunchyroll’s internal documents and communications about data sharing practices), motion practice, and eventually settlement negotiations or trial. During this period, you don’t need to take action unless you want to opt out of the class—which is rarely advisable unless you’ve suffered substantial documented losses and want to pursue an individual lawsuit.
The broader implications of these Crunchyroll cases reflect growing regulatory and legal scrutiny of how streaming and technology companies handle user data and integrate third-party analytics tools. The VPPA, originally written for a different era, is increasingly being applied to digital services, and companies like Amazon Prime Video, YouTube, and others may face similar challenges. For Crunchyroll specifically, these settlements will likely shape future product development and how the company discloses third-party data sharing to users.