Hi CIPAWorld! Kelly here again, with a new case on the application of CIPA’s exception for service providers.
In D’Antonio v. Cable News Network, Judge Victor Marrero denied Cable News Network Inc.’s (“CNN”) motion to dismiss D’Antonio’s complaint. D’Antonio v. Cable News Network, Inc., No. 24 CV 3132 (VM), 2026 WL 960032 (S.D.N.Y. Apr. 9, 2026). The court found that D’Antonio had sufficiently alleged the use of a pen register in support of his CIPA claim and that CNN was not safeguarded by the exception for service providers.
CNN owns and operates the website CNN.com, providing current multinational news to consumers on politics, business, health, science and entertainment. CNN’s website allegedly used third party trackers like PubMatic, Microsoft and OpenX to collect user data, identify and deanonymize website users, and target them with specific advertisements. The tracking technologies work to match user information and collected metadata with comprehensive profiles to create a more complete portrait of the user, including the user’s name, hobbies, interests and attributes. These compiled profiles are then sold to advertisers to better target users, resulting in increased advertising revenue for CNN.
D’Antonio was a user on CNN.com when the website showed him a banner for “Jaguar Land Rover.” He later sued CNN, alleging that the third-party tracker PubMatic had received a response from “Jaguar Land Rover” for this advertisement based on the metadata collected from him without his knowledge or consent while using the website.
Under CIPA Section 638.51, “a person may not install or use a pen register or a trap and trace device without first obtaining a court order.” Additionally, Cal. Penal Code § 638.51(b)(1), provides an exception for service providers, allowing “a provider of electronic or wire communication service may use a pen register…[t]o operate, maintain and test a wire or electronic communication service.”
Here, CNN argued that even if D’Antonio had sufficiently stated a claim under CIPA Section 638.51, they were safeguarded by section (b)(1) of the statute for two reasons. First, because the online news and information provided on CNN’s website was transmitted by wire, qualifying them as a provider of wire communication service. Second, the exception applied because the allegedly collected device and browser metadata were required to properly operate and load the website, meeting the operation requirement in the statute.
Judge Marrero relied on the case of Garon v. Keleops USA, Inc., No. 25-CV-02124, 2025 WL 2522374, at *6 (N.D. Cal. Sept. 2, 2025) to determine if this exception for service providers could be resolved on a motion to dismiss. However, in applying Garon, the court found that this determination was a question of fact that was not suitable for resolution on a motion to dismiss due to the breadth of data alleged to have been tracked in the case.
The case here suggests that defendants involving the service provider exception under Cal. Penal Code § 638.51(b)(1) are unlikely to have the case dismissed at the outset merely for this exception.
CIPAWorld 