Hi CIPAWorld! The Baroness here.
I have a new CIPA pen register case to report and these cases continue to spike.
Lets dive in.
Plaintiff alleges that CNN embedded third-party trackers (PubMatic, Microsoft, OpenX) on CNN.com that: collected IP addresses and device metadata, created unique user identifiers via cookies, synced with data brokers, built non-anonymous user profiles, and sold those profiles in real-time bidding auctions to advertisers.
And because of these trackers, Plaintiff alleges he got served a Jaguar Land Rover ad as a result.
Consequently, Plaintiff sued CNN for purported violations of CIPA’s pen register provisions.
CNN moved to dismiss on three grounds: (1) that Plaintiff failed to demonstrate he had Article III standing, (2) that CNN did not use a “pen register” and (3) even if the Court finds for Plaintiff on 1 and 2, that CIPA’s exception applies.
The Court rejected all three grounds.
Article III Standing
We’ve seen a major split on whether these tracking allegations = concrete injury.
But the Court was persuaded by the district courts that have declined to grant a motion to dismiss on the basis of lack of Article III standing.
Plaintiff alleged that: (1) CNN “causes numerous trackers” owned by the Third Parties “to be installed on Website visitors’ internet browsers”; (2) “the Third Parties are data brokers or sync with the Linked Data Brokers to uniquely identify and de-anonymize Website users by matching users’ their IP addresses, Device Metadata, and unique ID values with comprehensive profiles held by the Linked Data Brokers (or the Third Parties themselves)”; (3) “the Third Parties share that information amongst one another and with other entities like the Linked Data Brokers to create the most complete user profile they can (through cookie syncing), which includes a more complete and non-anonymous portrait of the user”; and (4) “those profiles are offered up for sale through the real-time bidding process to the benefit of Defendant, the Third Parties, and the Linked Data Brokers and to the detriment of users’ privacy interests.”
That, according to the Court, was close enough to a traditional privacy harm to survive the pleading stage.
Are Trackers “Pen Registers”?
Next, CNN argued that it did not use a “pen register” as defined by CIPA.
Under CIPA, a “pen register” is a “device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Cal. Penal Code § 638.50(b) (emphasis added).
CNN argued that the pen register definition does not apply here because Plaintiff alleges tracking of the content of his communication.
However, the Court acknowledged there were further allegations regarding “fingerprinting” and “behavior profiling” which tracks and collects “as much personal and demographic information as possible.”
Again, there is a split authority on this issue of whether “fingerprinting” constitutes collecting content.
And the “Court [was] once again persuaded to follow the trend of other courts that have found that trackers collecting fingerprinting information or other similar data do not necessarily collect the ‘content’ of that information such that exclusion from CIPA’s purview is warranted.”
Interesting.
Exception
Lastly, CNN argues that even if the Court finds that Plaintiff stated a claim, CNN should be shielded from liability because “[a] provider of electronic or wire communication service may use a pen register … [t]o operate, maintain, and test a wire or electronic communication service.” Cal. Penal Code § 638.51 (emphasis added).
CNN contends that the news and information on its website is comprised of writing, images, sounds, data or intelligence of any nature and is transmitted by wire. And the exception applies because CNN “requires the allegedly collected information” – including the “related device and browser metadata” – “to properly operate and load” the Website.
But here’s the problem: the Court found this question raises factual issues not suitable to be resolved on a motion to dismiss.
So the Court denied CNN’s motion to dismiss on all three grounds and this case will push forward.
To note, courts are increasingly willing to permit CIPA tracker cases proceed past the pleading stage when plaintiffs allege identity-level tracking and monetization.
Learn more about how to stay complaint with CIPA and other related privacy statutes during my panel at the Law Conference of Champion May 6, 2026!
CIPAWorld 