On June 30, 2026, Judge Rita F. Lin of the U.S. District Court for the Northern District of California granted preliminary approval to a $6,362,167 settlement in Cochrane v. People Data Labs, Inc., resolving a class action that accused the data aggregation company of listing Colorado residents' cell phone numbers in an online directory without their consent. Class representative Janelle Cochrane filed the case on September 29, 2025, alleging the practice violated Colorado's Prevention of Telemarketing Fraud Act, a state consent law that predates most of the privacy statutes now driving data broker litigation nationwide.
The settlement class is defined narrowly but still lands on a huge number of people. According to ClassAction.org's coverage of the settlement, it covers everyone in People Data Labs' database with an inferred mobile number, a Colorado area code, and an inferred Colorado location, current or historical, whose data was sourced on or after September 2022 and disclosed at least once between September 1, 2022 and March 3, 2026. Based on the company's own records, that definition captures 908,881 people, close to one in six Colorado residents.
Source: ClassAction.org, $6.3M+ People Data Labs Settlement Ends Colorado Phone Number Privacy Lawsuit, captured August 2026.
What the Colorado telemarketing law actually covers
The statute behind this case is easy to confuse with Colorado's better known privacy law, but it is a different piece of legislation entirely. The Colorado Privacy Act (CPA) is the state's general consumer data law, covering opt outs, sale disclosures, and data minimization. The Prevention of Telemarketing Fraud Act is older and narrower: according to the court authorized settlement notice, it restricts listing a Colorado resident's cellular telephone number in a directory without first obtaining proper consent, a fact pattern built for phone books and reverse lookup tools, not the modern data broker business model.
People Data Labs describes itself as a business to business data provider, selling contact and identity records to other companies rather than marketing directly to consumers. That distinction did not shield it from the PTFA claim: the complaint alleged PDL sourced and disclosed Colorado cell numbers as part of its data products from September 2022 through March 2026 without securing the consent the statute requires, regardless of who PDL's actual customers were. A business can be fully compliant with the Colorado Privacy Act's consumer facing disclosures and still fall afoul of a narrower, older consent statute like this one if the underlying data practice was never built around it.
Why $6.36 million doesn't mean $7 a person
Figure: $6,362,167 divided evenly across the full 908,881-person class works out to $7.00 each, but that number is not what any individual class member will actually receive.
Splitting the settlement fund evenly across all 908,881 class members produces a clean $7.00 figure, and it is tempting to treat that as the payout. It is not. The settlement notice states that People Data Labs will establish a $6,362,167 fund, and only after deducting notice and administration costs, any award of attorneys' fees, litigation costs, and a service award for the class representative does the remaining balance get divided, pro rata and with no proof required, among class members who file a valid and timely claim by September 29, 2026. Everyone else gets nothing, and the class members who do not opt out still give up the right to sue PDL separately over the same conduct.
Claims made settlements like this one routinely see only a small fraction of an eligible class actually file, which is the other half of the math the naive $7.00 figure misses: a lower claim rate means a larger share of the leftover fund for each person who does file. Our research on what data breach settlements actually pay per person found an industry average under $5, and this settlement's real per claimant payout, once fees and costs are subtracted and only actual claimants divide what's left, could land above or below that benchmark depending entirely on how many of the 908,881 eligible Coloradans bother to file.
| Detail | Figure |
|---|---|
| Case | Cochrane v. People Data Labs, Inc., No. 3:25-cv-09533-RFL (N.D. Cal.) |
| Settlement fund | $6,362,167 |
| Class size | 908,881 Colorado residents |
| Class period | September 1, 2022 to March 3, 2026 |
| Claim deadline | September 29, 2026 |
| Final approval hearing | November 17, 2026 |
How this fits the bigger data broker enforcement wave
People Data Labs is not the only data broker facing money penalties over how it sources and discloses consumer records in 2026. California's privacy regulator has been building its own enforcement record against the industry, documented in our coverage of the CPPA's 2026 data broker case list and its newer Data Broker Strike Force. New Jersey took a different approach entirely, passing steep annual registration fees for data brokers before delaying enforcement of them, covered in our piece on New Jersey's data broker fee enforcement delay.
What makes the PDL case distinct from all three is the legal theory. Those actions run through general data broker registration and consumer privacy statutes. This one runs through a narrow, decades-old telemarketing consent law that most compliance teams are not tracking as a data broker risk at all. Colorado itself has been busy on the privacy front this year well beyond the CPA, including a full repeal and replacement of its AI Act earlier in 2026, and this settlement is a reminder that older, narrower state statutes can still carry real exposure even while attention stays fixed on the newer comprehensive laws.
What this means for your privacy policy
If your business buys, sells, or licenses contact data that includes phone numbers, this settlement is a reminder that consent obligations for that data do not all live in one place. A privacy policy built around CCPA style opt outs and a general "we may share your information with partners" line does not address a state specific consent requirement like Colorado's PTFA, and a company can get this wrong even when its consumer facing privacy disclosures otherwise look complete.
Our Privacy Policy Generator keeps state specific data sharing and consent disclosures current as narrower statutes like this one surface in litigation, so your policy reflects what a state actually requires for a given data category, not just the general opt out language most templates default to.
Bottom Line
A federal court has preliminarily approved a $6,362,167 settlement covering 908,881 Colorado residents whose cell numbers People Data Labs allegedly listed without consent, under a telemarketing fraud statute most data broker compliance programs are not built around. The headline number sounds like real money, but the actual per person payout depends entirely on how many of those 908,881 people file a claim by September 29, 2026, not on the size of the settlement fund itself. For any business handling phone numbers as part of a data product, the practical lesson is that consent requirements can come from statutes well outside the comprehensive privacy law everyone is watching.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
