The California Court of Appeal, Second Appellate District, has issued its tentative ruling in Variety Media, LLC v. Superior Court, the closely watched writ proceeding that asks whether the pen register provisions of the California Invasion of Privacy Act (“CIPA”) apply to common website tracking technologies. The tentative decision would grant Variety’s petition in part and direct the trial court to sustain Variety’s demurrer with leave to amend. The court’s reasoning cuts in both directions. The panel would hold that CIPA’s pen register statute reaches internet communications, rejecting the threshold defense that has anchored many motions to dismiss. But it would also hold that a pen register captures only metadata identifying the destination of an outgoing communication, and that a website visitor’s IP address identifies the source of a communication rather than its destination. Under that construction, the complaint before the court fails to state a claim.

Background

Penal Code section 638.51 prohibits installing or using a pen register without a court order or the user’s consent. Over the past three years, plaintiffs and pro se litigants have filed hundreds (if not thousands) of lawsuits, arbitration demands, and pre-suit letters alleging that cookies, pixels, analytics tools, and similar technologies are unlawful pen registers because they collect visitors’ IP addresses and device information. Trial courts have divided on whether the statute, enacted with telephone surveillance in mind, reaches these tools at all. No California appellate court has answered the question in a published decision.