CNN’s CIPA Tracking Case: Court Focuses On IP Addresses And Pen Registers

A recent ruling against CNN illustrates how courts beyond California continue to grapple with that state’s wiretap law: the California Invasion of Privacy Act (“CIPA”). Among other things, CIPA regulates use of “pen registers” which are typically used by law enforcement to collect dialing, routing, addressing, or signaling information. Class action plaintiffs have argued that CIPA’s pen‑register provision should apply to website tracking of IP addresses and related technical data. The CNN case is part of a broader wave of CIPA litigation targeting online tracking technologies used for analytics and advertising.

In the current case, D’Antonio v. Cable News Network, Inc., plaintiffs allege that CNN deployed third‑party trackers on its website that collect visitors’ IP addresses and other “dialing, routing, addressing, or signaling information.” This case is similar to another CIPA action filed against CNN last year (Lesh v. Cable News Network, Inc.). Not only did a CIPA plaintiff target the same defendant, the parties drew the same judge. And the New York federal court once against ruled the plaintiff’s CIPA claim could go forward.

Building on the Lesh ruling, the D’Antonio court held that the plaintiff adequately alleged Article III standing by asserting that his IP address and related information were collected and shared without his prior express consent. The court further concluded that (i) the alleged tracking code could fit CIPA’s broad definition of a pen register, and (ii) the IP addresses at issue qualify as “addressing information” transmitted by an instrument or facility from which an electronic communication is sent. The court found those allegations sufficient to state a claim and defeat CNN’s motion to dismiss.

CNN had argued that CIPA should not apply to third-party trackers because the statute was drafted decades ago with telephone lines in mind. CNN also argued that any tracking concerned “content” – not covered by CIPA – rather than dialing or addressing information. But the court rejected those arguments at the pleading stage, emphasizing that CIPA can provide broader statutory protection than the Fourth Amendment’s ban on unreasonable searches and seizures. Interpreting the statute’s text, the court further found CIPA does not limit pen registers to traditional telephone systems. In other words, CIPA’s restrictions can be applied to new technologies that did not exist when the law was enacted.

Putting It Into Practice: While this ruling from a New York trial court is not dispositive, it is a cautionary reminder to companies that deploy web trackers, pixels, or similar tools. In the absence of regulatory certainty, review your disclosure and consent processes for these tools. While full audits can be burdensome, conducting them prior to possible litigation may be easier than post-litigation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.