Data breaches and website tracking technologies may seem like distinct privacy risks, but the California Supreme Court’s recent decision in J.M. v. Illuminate Education could affect litigation involving both. Businesses that collect sensitive information should review how they characterize, protect, and share that information, as plaintiffs will likely rely on the decision to challenge both cybersecurity practices and disclosures involving website tracking technologies. The case arose from a cyberattack on a K-12 education software provider that stored student health-related information. A student filed a putative class action alleging violations of California’s Confidentiality of Medical Information Act (CMIA) and Customer Records Act (CRA). Although the California Supreme Court ultimately held that Illuminate was neither a covered health care provider under the CMIA nor subject to liability under the CRA because the plaintiff was not a “customer,” it adopted a broader standard for CMIA confidentiality claims. The Court held that actual viewing or misuse of compromised information is not required where a breach creates a significant risk of unauthorized access or use. The broader significance of Illuminate is the Court’s focus on exposure to unauthorized access or use rather than proof that someone actually viewed the data. Plaintiffs will likely seek to extend that reasoning beyond CMIA claims and into litigation involving the California Consumer Privacy Act (CCPA), California Invasion of Privacy Act (CIPA), and website tracking technologies. In particular, plaintiffs may argue that liability can arise from the transmission of information through cookies and pixels without proof that anyone actually viewed the data, so long as the disclosure created a significant risk of unauthorized access or use. Therefore, Illuminate should not be viewed as a case affecting only healthcare organizations or victims of data breaches. Its reasoning could ultimately affect virtually every California employer that maintains employee data and every website