What Is the Crunchyroll Lawsuit?
The Crunchyroll lawsuit is actually two separate, legally distinct federal class actions filed against Crunchyroll, LLC in March 2026, not a single consolidated case.
Agress v. Crunchyroll, LLC, No. 3:26-cv-02553, filed March 24, 2026 in the U.S. District Court for the Northern District of California, alleges Crunchyroll failed to reasonably secure customer data ahead of a March 2026 breach. Cabonios v. Crunchyroll, LLC, No. 2:26-cv-02373, filed March 5, 2026 in the U.S. District Court for the Central District of California, separately alleges Crunchyroll disclosed subscribers' video-viewing activity to a marketing company without consent, in violation of the federal Video Privacy Protection Act.
Crunchyroll, LLC, a Delaware corporation headquartered in Los Angeles and owned by Sony, is the named defendant in both cases. The company has not publicly admitted liability in either lawsuit, and neither case has reached a settlement.
“This is a consumer digital privacy class action complaint brought on behalf of users and subscribers of the Crunchyroll mobile application (the "App"), which is owned and operated by Defendant Crunchyroll, LLC. Through its App, Crunchyroll has systematically breached the VPPA by knowingly disclosing users' personally identifiable information concerning their video viewing activity to Braze Inc., formerly Appboy Inc., a third-party marketing and analytics company.”
Source: Cabonios et al. v. Crunchyroll, LLC, Case No. 2:26-cv-02373 (C.D. Cal.), Class Action Complaint, Document 1, pp. 2-3 (filed March 5, 2026)
Why Are People Filing Crunchyroll Lawsuits?
People are filing Crunchyroll lawsuits because plaintiffs in two separate cases allege the company mishandled subscriber data in different ways. Each case rests on its own distinct set of facts.
In the data-breach case, plaintiff Max Agress alleges an employee at Telus, one of Crunchyroll's business-process outsourcing partners, executed malware that let an unauthorized third party access Crunchyroll's systems for roughly 24 hours on March 12, 2026, downloading about 8 million customer support tickets from Crunchyroll's Zendesk instance, including 6.8 million unique email addresses, full names, usernames, IP addresses, approximate location data, and partial payment card details. The complaint alleges Crunchyroll failed to meet Federal Trade Commission cybersecurity guidance and did not notify affected users until March 22, 2026, ten days after the breach occurred.
In the video-privacy case, plaintiffs Francisco Cabonios and several other named subscribers allege Crunchyroll embedded a software development kit from Braze Inc., a marketing and analytics company, into its mobile app, and used it to transmit subscribers' email addresses, persistent device identifiers, and the titles of specific videos they watched, without obtaining the written, standalone consent the Video Privacy Protection Act requires.
What Injuries Are Included in the Crunchyroll Lawsuit?
The Crunchyroll lawsuit includes two distinct categories of alleged harm, one from each case. Each is defined in plain language below before the specific allegation.
Exposure of Personally Identifiable Information
Personally identifiable information, or PII, is data that can be used on its own or combined with other data to identify a specific individual, such as a name, email address, or government ID number.
The Agress complaint alleges the March 2026 breach exposed full names, usernames, email addresses, IP addresses, approximate location data, the text of customer support conversations, and partial payment card details for millions of Crunchyroll users, leaving them at increased risk of identity theft, phishing, and other fraud.
Unauthorized Disclosure of Video-Viewing History
Under the Video Privacy Protection Act, a video-viewing disclosure claim alleges a company shared a specific person's video-viewing history with a third party without the separate, written consent the statute requires.
The Cabonios complaint alleges Crunchyroll's Braze integration let a third-party marketing company build profiles tied to specific subscribers' viewing habits, including which anime titles they watched, information the VPPA treats as sensitive enough to require standalone consent, not consent bundled into a general terms-of-service agreement.
Who Qualifies for the Crunchyroll Lawsuit?
You may qualify if:
- You are a Crunchyroll user or subscriber whose personal information was exposed in the March 2026 data breach, or who received a breach notification from Crunchyroll
- You are a Crunchyroll App user or subscriber who watched videos while logged in and had your viewing activity transmitted to Braze through the App
You may not qualify if:
- You never used the Crunchyroll website or mobile App, or you used it only before either company's alleged conduct began
- You are a judge assigned to either case, an immediate family member of that judge, or an officer or director of Crunchyroll, LLC
Neither case has reached a settlement or certified a final class as of this writing. Only a qualified attorney reviewing your own account and breach-notification records can confirm which case, if either, you may currently qualify for.
What Is the Current Status of the Crunchyroll MDL?
The current status of the Crunchyroll lawsuit is two separate cases in early pretrial proceedings, both filed in March 2026 federal court, with neither one settled.
Agress v. Crunchyroll, LLC, No. 3:26-cv-02553 (N.D. Cal.)
Plaintiff Max Agress filed this proposed class action on March 24, 2026 in the U.S. District Court for the Northern District of California, alleging negligence, breach of implied contract, unjust enrichment, and violations of the California Consumer Privacy Act and California's Unfair Competition Law. The case is assigned to Judge Haywood S. Gilliam Jr., who held an initial case management conference on June 23, 2026. The case remains in early pretrial proceedings, with no class certified and no settlement reached.
| Proceeding Type | Federal class action complaint |
| Court | U.S. District Court, Northern District of California |
| Complaint Filed | March 24, 2026 |
| Defendant | Crunchyroll, LLC |
| Case Status | Early pretrial proceedings, no settlement reached |
Cabonios v. Crunchyroll, LLC, No. 2:26-cv-02373 (C.D. Cal.)
Plaintiffs Francisco Cabonios and several other named subscribers filed this proposed class action on March 5, 2026 in the U.S. District Court for the Central District of California, alleging Crunchyroll violated the federal Video Privacy Protection Act by disclosing subscribers' viewing information to Braze Inc. without consent. This is a separate, earlier-filed case from the Agress data-breach action above, with its own docket and its own legal theory. Judge Josephine L. Staton denied Crunchyroll's first motion to compel arbitration and transfer the case without prejudice on June 11, 2026, and plaintiffs added a sixth named plaintiff, Oscar Castaneda, in a First Amended Complaint filed June 22, 2026. Crunchyroll renewed its motions to compel arbitration and transfer the case to the Southern District of New York on July 22, 2026, and Judge Staton has set those motions for a hearing on October 2, 2026.
| Proceeding Type | Federal class action complaint |
| Court | U.S. District Court, Central District of California |
| Complaint Filed | March 5, 2026 |
| Defendant | Crunchyroll, LLC |
| Case Status | Renewed motions to compel arbitration and transfer venue pending, hearing set for October 2, 2026 |
How Much Could I Get From the Crunchyroll Lawsuit?
Neither Crunchyroll case has settled, so no payout amount exists yet, though the Agress complaint seeks damages of up to $25,000 per affected class member under a treble-damages theory. The Cabonios complaint separately invokes the Video Privacy Protection Act's statutory damages provision, which allows $2,500 per violation.
The $25,000 and $2,500 figures are each a statutory maximum a complaint is asking a court to award, not a confirmed or approved payout. Actual amounts, if either case settles or wins at trial, depend on the number of valid claims and a court's or administrator's own calculation, and cannot be estimated from these filings alone.
A prior, separate VPPA case against Crunchyroll's former owner, Sony Pictures Entertainment, settled for $16 million with individual payouts reported around $30 per claimant, but that settlement's claims deadline has already passed and it has no legal connection to either currently pending case.
Crunchyroll Lawsuit Updates and Case Status
Here is the current status of the Crunchyroll lawsuit updates, covering both active cases as new filings and rulings are confirmed.
Crunchyroll Lawsuit Timeline
Crunchyroll Renews Bid to Compel Arbitration in the Cabonios Case
Crunchyroll filed renewed motions on July 22, 2026 to compel arbitration and transfer Cabonios v. Crunchyroll to the Southern District of New York, after Judge Josephine L. Staton denied the company's first such motions without prejudice on June 11, 2026. Judge Staton set the renewed motions for a hearing on October 2, 2026 in the Central District of California. Source: emailexpert.com.
Judge Gilliam Holds Initial Case Management Conference in Agress
Judge Haywood S. Gilliam Jr. held an initial case management conference in Agress v. Crunchyroll on June 23, 2026 in the Northern District of California. Source: cand.uscourts.gov court calendar.
Cabonios Plaintiffs Add a Sixth Named Plaintiff
Plaintiffs filed a First Amended Complaint in Cabonios v. Crunchyroll on June 22, 2026, adding Oscar Castaneda as a sixth named plaintiff. Source: emailexpert.com.
Agress Files the Crunchyroll Data Breach Class Action
Plaintiff Max Agress filed a proposed class action against Crunchyroll, LLC in the Northern District of California on March 24, 2026, alleging the company's inadequate cybersecurity let an unauthorized third party access and extract millions of users' personal information.
Crunchyroll Notifies Users of the March Data Breach
Crunchyroll publicly disclosed the March 12, 2026 data breach on March 22, 2026, ten days after the intrusion occurred, according to the Agress complaint.
The Underlying Data Breach Occurs
An unauthorized third party gained access to Crunchyroll's systems on March 12, 2026 after an employee at outsourcing partner Telus allegedly executed malware, maintaining access for roughly 24 hours and downloading about 8 million customer support tickets.
Cabonios Files the Crunchyroll Video Privacy Class Action
Plaintiffs Francisco Cabonios and several other named subscribers filed a separate proposed class action against Crunchyroll, LLC in the Central District of California on March 5, 2026, alleging the company's Braze SDK integration disclosed subscribers' viewing history without VPPA-compliant consent.
How to File a Crunchyroll Lawsuit
Filing a Crunchyroll lawsuit typically follows the 4 steps below.
- Identify which allegation applies to you: The data-breach case (Agress) and the video-privacy case (Cabonios) are separate lawsuits with separate facts, and which one, if either, applies depends on whether your personal information was exposed in the breach or your viewing activity was shared with Braze.
- Gather your Crunchyroll account records: Keep any breach-notification email from Crunchyroll, your account creation date, and records of your subscription history, since both cases will need to verify class membership from account-level facts.
- Watch for a class notice: Neither case has reached a settlement, so no claim form exists yet; a formal notice with claim instructions, if one is issued, would come later in either case's own process.
- Consult a qualified attorney: An attorney reviewing your specific account and breach-notification records can confirm whether you may have a claim in either pending case.
Answer a few questions and a case reviewer will follow up. Free, no obligation.
A case reviewer will follow up soon.
What Did Crunchyroll Allegedly Know About Its Data Practices?
Plaintiffs in the data-breach case allege Crunchyroll knew or should have known its outsourcing partner's systems were a target for cybercriminals and failed to audit that partner's data-security practices or implement basic safeguards the Federal Trade Commission has long recommended, such as encryption and intrusion-detection systems. Plaintiffs in the video-privacy case separately allege Crunchyroll made a deliberate choice to embed the Braze SDK in its App without building in the standalone consent mechanism the VPPA requires.
Crunchyroll has not publicly admitted liability in either case. Both lawsuits remain in early pretrial proceedings, and no court has yet ruled on the merits of either set of allegations.
How Do the Two Crunchyroll Lawsuits Compare to Each Other and to Past Cases?
Beyond the two pending cases described on this page, Crunchyroll and its former owner have faced other, legally distinct matters over the years. Each is listed below for disambiguation only.
| Matter | What It Involves | Relationship to the Pending Cases |
|---|---|---|
| Agress v. Crunchyroll, LLC, No. 3:26-cv-02553 | The March 2026 data breach exposing roughly 6.8 million users' PII | One of the two currently pending cases described above |
| Cabonios v. Crunchyroll, LLC, No. 2:26-cv-02373 | Alleged VPPA violations from sharing viewing data with Braze | The other currently pending case described above |
| Beltran v. Sony Pictures Entertainment (d/b/a Crunchyroll) | An earlier VPPA video-privacy case against Crunchyroll's former owner, Sony | Separate, already-settled case for $16 million; its claims deadline has passed and it has no legal connection to either pending case |
Frequently Asked Questions
What is the Crunchyroll lawsuit about?
The Crunchyroll lawsuit refers to two separate class actions filed in March 2026: Agress v. Crunchyroll, alleging a data breach exposed roughly 6.8 million users' personal information, and Cabonios v. Crunchyroll, alleging the company shared subscribers' video-viewing history with a marketing company without consent.
Is the Crunchyroll lawsuit a class action?
Yes, both the Agress data-breach case and the Cabonios video-privacy case are proposed federal class actions, though neither has had a class certified yet as of this writing.
Has the Crunchyroll lawsuit settled?
No, neither the Agress data-breach case nor the Cabonios video-privacy case has settled. Both remain in early pretrial proceedings following their March 2026 filing dates.
How much money could I get from the Crunchyroll lawsuit?
How much money you could get from the Crunchyroll lawsuit cannot be estimated yet, since neither case has settled. The Agress complaint seeks up to $25,000 per class member under a treble-damages theory, and the Cabonios complaint invokes the VPPA's $2,500-per-violation statutory damages provision, but both are requested amounts, not confirmed payouts.
Is this the same as the earlier $16 million Crunchyroll settlement?
No, the earlier $16 million settlement resolved a separate VPPA case, Beltran v. Sony Pictures Entertainment, against Crunchyroll's former owner, and its claims deadline has already passed. It has no legal connection to either of the two lawsuits currently pending against Crunchyroll, LLC.
Was I affected by the Crunchyroll data breach?
You may have been affected by the Crunchyroll data breach if you used Crunchyroll's customer support system before March 12, 2026 and Crunchyroll sent you a breach notification; the Agress complaint alleges about 6.8 million unique email addresses were exposed, but only Crunchyroll's own records and any notice you received can confirm your individual status.