- within Privacy, Litigation, Mediation & Arbitration and Corporate/Commercial Law topic(s)
- in United States
On August 21, 2026, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court (Case No. B350578), addressing whether CIPA’s pen register statute covers everyday website tracking technologies like cookies, pixels, and other third-party trackers. The court has tentatively rejected Variety’s argument that internet communications are categorically outside CIPA’s pen register statute while tentatively holding that the plaintiff’s complaint failed because the facts alleged did not establish that the trackers were capturing “destination-identifying metadata.”
The timing is interesting. Just days later, the California Legislature passed SB690 through both the Senate and Assembly. As reported earlier, SB 690 would significantly change who can bring certain CIPA pen register claims—providing that only the California Attorney General may bring an action against a private actor for alleged violations of Section 638.51 arising from conduct occurring on an internet website, online application, or mobile application.
These developments are important, but may not mean CIPA website tracking litigation is over.
In Variety Media, LLC v. Superior Court, Variety Media argued that CIPA’s pen register provisions were designed for telephone surveillance and should not apply to modern internet tracking technologies. The court tentatively rejected that argument and that CIPA is limited to telephone surveillance.
The court concluded that CIPA’s definition of a pen register is based on the federal definition that existed when California adopted its pen register provisions. In the court’s view, that definition is not limited to telephone communications and can extend to processes that record or decode metadata associated with online communications.
In other words the court did not accept the argument that CIPA’s pen register provisions are automatically irrelevant simply because the technology involved is a website cookie, pixel, SDK, or other internet based tracker—a potential loss for website operators/defendants.
The court also tentatively rejected arguments that applying CIPA to internet communications would conflict with the California Consumer Privacy Act (CCPA) or that the rule of lenity required the statute to be interpreted narrowly.
However the plaintiff still lost on the claim as pleaded and the tentative ruling provides an important narrow interpretation of what actually may qualify as a pen register. The court tentatively concluded that a pen register must capture metadata that is likely to identify the “destination of an outgoing communication.”
As plainiffs often do in these pen register cases, here the plaintiff alleged that Variety’s trackers collected visitors’ IP addresses and other device information and transmitted that information to third parties. But an IP address identifies the source of a communication—the visitor’s device—not necessarily the “destination of the communication.”
According to the tentative ruling that is not enough to state a CIPA pen register claim as the trackers alleged may not qualify as pen registers because an IP address identifies the source of a communication and not its destination.
The plaintiff also pointed to screenshots showing information such as “Domain,” “Origin,” and “Referer.”
The court did not find those allegations sufficient to save the complaint—at least not yet. The complaint did not clearly explain how the trackers captured that information. There is a difference between a tracker capturing destination-identifying metadata from an outgoing communication as that communication occurs, and a tracker later generating its own communication containing information about something that happened previously.
That technical distinction could become extremely important in future CIPA litigation (or in future Attorney General enforcement actions). For website operators and defendants this means that the mechanics of the tracking technology matter when it comes to CIPA litigation. It is not enough to say that a website collects an IP address or sends information to a third party. The question becomes what information is being captured, when it is captured, where it is sent, and what that information identifies.
Again this is a tentative ruling, not the final opinion. The court indicated that it would grant Variety’s petition in part and direct the trial court to sustain Variety’s demurrer but with leave for the plaintiff to amend—giving plaintiff another opportunity to plead facts showing that the trackers captured destination-identifying metadata.
BUT if SB 690 becomes law, the private right of action for this Section 638.51 claim at issue in Variety Media may be subject to SB690’s retroactivity provision and the claim may go away altogether come January 1.
We’ll walk through what the new law actually does, what it means for businesses, what happens to existing CIPA suits, and—most importantly—what comes next.
See you soon.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]