A tentative California appellate ruling says CIPA’s pen-register law may reach internet tracking, but IP-address allegations alone may not establish a claim. SB 690 separately targets private enforcement.
The ruling was discussed in a CIPAWorld article published August 31, 2026. The post also examined California Senate Bill 690 (SB 690), which had passed both legislative chambers and, according to the report, was awaiting the Governor’s action.
The two developments address different questions. Variety Media concerns how the existing statute may apply to internet tracking technology. SB 690, as described in the article, would change who can bring certain claims under that statute.
The case concerns allegations that tracking technologies on Variety Media’s website transmitted a visitor’s IP address and other device information to third parties.
The plaintiff alleged that the trackers collected information about website visitors and sent it to third parties. Variety Media argued that CIPA’s pen-register provisions were designed for telephone surveillance and should not extend to internet communications.
The trial court rejected Variety Media’s argument at the pleading stage. Variety Media then sought appellate relief.
The Court of Appeal’s August 21, 2026 tentative ruling addressed the statutory question and the sufficiency of the plaintiff’s allegations. As CIPAWorld reported, the panel’s tentative position did not accept a categorical telephone-only interpretation of the law.
CIPAWorld reported that the court considered the language of CIPA’s pen-register definition alongside the federal definition on which it was based.
The court’s tentative analysis treated the definition as technology-neutral rather than limited to traditional telephone equipment. Under that interpretation, the statute may extend to processes that record or decode metadata associated with internet communications.
The court also tentatively rejected arguments that applying the provision to internet communications would conflict with the California Consumer Privacy Act (CCPA), or that the rule of lenity required a narrower, telephone-specific reading.
This part of the tentative ruling could matter in website-tracking disputes because it would leave open the possibility that certain internet-based technologies fall within the statute’s scope. It does not mean that every cookie, pixel, analytics tool, or software development kit automatically qualifies as a pen register.
Although the court tentatively rejected the broad telephone-only argument, it also considered what information a pen register must capture.
According to CIPAWorld, the court tentatively concluded that the relevant metadata must identify the destination of an outgoing communication. The plaintiff’s allegations that the trackers collected IP addresses and device information did not, by themselves, establish that requirement.
The distinction is between information identifying the source of a communication and information identifying where that communication is directed. An IP address associated with a website visitor may identify the visitor’s device, but the tentative ruling treated that as source-identifying information, not necessarily destination-identifying metadata.
The plaintiff also relied on screenshots showing fields such as “Domain,” “Origin,” and “Referer.” CIPAWorld reported that the court did not find those allegations sufficient at that stage because the complaint did not clearly explain how the trackers captured the information.
The tentative ruling also drew attention to the difference between information captured from an outgoing communication as it occurs and information included in a later communication generated by a tracking tool.
That distinction is important to the statutory theory. A tracker might send information about a user’s earlier activity, but the fact that a later transmission contains that information does not necessarily establish that the tracker captured destination-identifying metadata from the original outgoing communication.
As reported by CIPAWorld, the complaint did not adequately explain how the trackers captured the cited information or how that information met the statute’s destination-related requirement.
For future disputes, the technical operation of a tracking tool may therefore be central. Relevant questions can include what information the tool captures, when it captures it, where the information is sent, and what the captured information identifies.
The August 21 ruling was tentative, not a final appellate opinion. CIPAWorld reported that the court indicated it would grant Variety Media’s petition in part and direct the trial court to sustain Variety Media’s demurrer, while allowing the plaintiff another opportunity to amend.
That proposed outcome would not necessarily end the litigation. Leave to amend would give the plaintiff an opportunity to add factual allegations addressing the deficiencies identified by the court.
The final opinion could differ from the tentative ruling. The article’s discussion of the likely next steps should therefore be understood in that procedural context.
CIPAWorld’s August 31 article reported that SB 690 had passed both the California Senate and Assembly. As described in the post, the amended bill would provide that only the California Attorney General could bring an action against a private actor for an alleged violation of CIPA Section 638.51 arising from conduct on a website, online application, or mobile application.
The proposed change concerns the private right of action for specified pen-register claims. It does not decide whether a particular tracking technology meets the statutory definition of a pen register.
The CIPAWorld article also noted a retroactivity provision that could reach certain claims filed within the two years before the bill’s operative date. Whether that provision applies to a particular case would depend on the final enacted text and the case’s facts and procedural posture.
Because the bill’s status was still described as awaiting the Governor’s action in the August 31 report, readers should check the official legislative record for any later action before relying on it.
The tentative ruling and SB 690 address different parts of the legal landscape:
The developments therefore should not be treated as establishing that all website tracking is unlawful or that all website-tracking litigation is over.
The case concerns whether CIPA’s pen-register provisions can apply to website tracking technologies and whether the plaintiff adequately alleged that the trackers captured information covered by the statute.
According to CIPAWorld, the court tentatively rejected the argument that the statute is limited to telephone communications. It also tentatively found that the complaint did not adequately allege capture of destination-identifying metadata.
The tentative ruling distinguished information identifying the source of a communication from information identifying its destination. The complaint’s allegations about IP addresses did not, by themselves, establish that the trackers captured destination-identifying metadata.
No. The August 21, 2026 ruling discussed by CIPAWorld was tentative. The article reported that the court contemplated allowing the plaintiff to amend the complaint.
As described in the August 31 CIPAWorld article, SB 690 would reserve enforcement of certain website- and application-related Section 638.51 claims against private actors to the California Attorney General.
No. The reported amendment addresses the private right of action for specified Section 638.51 claims. Other CIPA provisions, including Section 631, are separate and were not described as eliminated by that change.
This article is for informational purposes only and is not legal advice. It summarizes a tentative ruling and legislative developments as reported by CIPAWorld. A tentative ruling is not a final opinion, and a bill’s status or language may change. Allegations are not established facts. Consult the official court and legislative records, along with qualified legal counsel, before relying on these developments in a particular matter.
Receive offers, product allerts, styling inspiration and more.
Learn what DNC.com does, how its TCPA and Do Not Call compliance tools work, Litigator Insights, reassigned-number screening, integrations, and its 2026 transition to Sonera.
Lawyer.com connects consumers with attorneys while operating a legal lead-generation and marketing platform. Explore its TCPA consent practices, automated calls, mass tort leads, compliance claims, and lawsuit history.
Cox Media Group has faced significant legal scrutiny, including an FTC Active Listening enforcement action and a Texas TCPA case involving defamation and free speech.
Explore Cox Media Group (CMG), its history, ownership, television and radio operations, digital advertising business, consumer data practices, privacy policy, Active Listening controversy, leadership and 2026 developments.
Explore MindSift’s data marketing platform, the Active Listening controversy, FTC allegations, 2026 consent order, consumer consent issues and legal implications.
Learn about MindSift, its audience intelligence and data platform, consumer and B2B databases, Visitor ID, Buyer Intent, OutReach Mining, advertising services, Active Listening controversy and 2026 FTC order.
