Here’s a sentence CIPA plaintiffs don’t love hearing: California’s privacy law might not apply to you at all.
That’s the big takeaway from Chisholm v. BBC Global News US, LLC, No. 26-CV-809 (JPO), 2026 WL 3362164 (S.D.N.Y. Nov. 5, 2026). Judge J. Paul Oetken tossed the plaintiffs’ CIPA claims without ever deciding whether the BBC’s website trackers amounted to wiretapping. New York law governs, he held, and New York doesn’t let private plaintiffs sue for wiretapping or pen register violations.
The plaintiffs’ story will sound familiar. The BBC’s U.S. site offered a “Do not sell or share my personal information” button. According to the complaint, trackers from Piano, ScoreCard, and Google Ads fired as soon as the page loaded and kept firing after visitors opted out. The data allegedly included clicks, device details, location, email addresses, and the titles of videos people watched. Five plaintiffs from Alaska, California, Massachusetts, and New York sued.
A fun detail for the defense bar is that each one of the plaintiffs also visited the site “in connection with the investigation underlying this action,” which is when they clicked the opt-out button. Do with that information what you will.
Now for the main event. Everyone agreed that California and New York law clash. CIPA lets “[a]ny person who has been injured” sue whereas New York’s eavesdropping and pen register laws don’t. In a footnote, the court took a closer look at the pen register side. The BBC’s cited case, Boucher v. Dilorenzo, actually dealt with New York’s eavesdropping statute, but the court did its own homework anyway. It concluded that New York’s pen register law, Criminal Procedure Law Section 705.05, gives no private right to sue over “the [unauthorized] use of a pen register or a trap and trace device.” Borrowing from the Supreme Court in Alexander v. Sandoval, 532 U.S. 275, 289 (2001), the court found the statute carries “no implication of an intent to confer rights on a particular class of persons.” With Section 638.51 pen register claims now the hottest theory in CIPA litigation (and SB 690 set to go into effect beginning January 1, 2027), that little footnote packs a punch wherever New York law applies.
So whose law applies you ask? Well, funny enough, the BBC’s own terms of use didn’t get it there. The choice-of-law clause covered only “these Terms,” which the court read as reaching contract disputes, not privacy torts. The very next sentence, a forum-selection clause covering “any claim or dispute … relating in any way to … use of the Services,” only proved the drafters knew how to write broadly when they wanted to.
But even with the court noting that the drafters knew how to draft agreements in a broad manner, BBC won the war even if they may have lost the battle. Under New York’s choice-of-law rules, privacy laws like CIPA regulate conduct, and the law of the place where the tort happened usually controls. The plaintiffs said that was their home states, where the trackers landed on their devices. Following the Second Circuit in Licci ex rel. Licci v. Lebanese Canadian Bank, SAL, 739 F.3d 45 (2d Cir. 2013), the court looked instead to where the conduct happened and the plaintiffs’ own complaint alleged that the BBC’s decision-making “emanate[s] from its New York, New York office.” A last-minute suggestion in their brief that the decisions were really made in the U.K. didn’t help, since it wasn’t in the complaint. As a result, the court proceeded to dismiss the CIPA claims along with the intrusion upon seclusion claim right behind them given that New York doesn’t recognize that tort.
The federal Wiretap Act claim hit a familiar wall. You can’t wiretap a conversation you’re part of, and the BBC was a party to visitors’ communications with its own website. The plaintiffs tried the crime-tort exception, arguing the BBC intercepted their data in order to violate the VPPA but the court was not persuaded. The wrongful purpose has to be independent of the interception itself, and the plaintiffs alleged the interception and the disclosure happened at the same moment. As a result, plaintiffs pleaded themselves right out of the exception.
That leaves the VPPA, the BBC’s one loss that now forces it to answer the complaint. To be fair to the BBC, it did land a good punch since the court agreed that scrambled identifiers like “user_token” aren’t personally identifiable under Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025), since an ordinary person couldn’t decode them. But the complaint also alleged the trackers received plain-text email addresses alongside video titles, and an email address is about as identifying as it gets. Under Salazar v. National Basketball Ass’n, 118 F.4th 533 (2d Cir. 2024), newsletter subscribers count as consumers, and a consent defense is a tough sell to the court when the opt-out button allegedly didn’t work.
As for the rest of the complaint, the remaining claims fell for a simpler reason given that there was no real loss suffered by the plaintiffs. The UCL, New York General Business Law, and fraud claims all required some actual injury or lost money, and “loss of control” over data didn’t cut it. Unjust enrichment was dismissed as a repackaging of the other claims, and a class action waiver in the BBC’s subscription terms will wait until class certification (assuming it gets that far).
So what does this mean for your business? If you’re based outside California, it’s mostly good news. Where your tracking decisions get made can matter more than where your visitors are sitting, so know (and be able to prove) where that happens. And dust off your terms of use as a choice-of-law clause that only covers “these Terms” may not reach the claims you actually care about.
Furthermore, the VPPA claim is a reminder that the basics still matter. An opt-out button needs to actually opt you out, and someone at your company should know exactly what your pixels are sending. It’s important for the legal and IT department of any company that runs a website to ensure that the opt-opt functions presented to a user of the site work as they are supposed to.
Lastly, before anyone pops the champagne, one should note that this is a single New York district court ruling. California courts aren’t bound by it, and it won’t help a company that makes its tracking decisions in California. Still, it’s a solid roadmap for defendants everywhere else. CIPA may be California’s hit show, but in this case, it didn’t survive the trip to New York.
Talk to you soon CIPAWorld, and as always, be safe.