California Court Considers CIPA’s Application to Online Tracking as New Law Limits Private Actions

1. CIPA May Apply to Online Communications: A California court tentatively held that CIPA’s pen register provisions cover metadata associated with telephone and online communications.
   
   
2. IP Addresses May Not Establish a Pen Register Claim: The court tentatively found that the complaint did not adequately allege a pen register violation because an IP address identifies the communication’s source rather than its destination.
   
   
3. New Law Limits Enforcement to The Attorney General: Legislation signed on September 30, 2026, eliminates the private right of action for certain online pen register violations and authorizes enforcement only by the California attorney general.

In Rose v. Variety Media,^[1] plaintiff Sean Rose alleged violations of the California Invasion of Privacy Act (CIPA), asserting that Variety installed web trackers on its web site, variety.com, that collect users’ IP addresses and other device “fingerprint” information.^[2] Rose also alleged that the users’ IP addresses identified “the outgoing ‘routing, addressing, or signaling information’ of the user.”^[3]

CIPA defines a “[p]en register” as a “device or process that records or decodes dialing, routing, addressing, or signaling information.”^[4] In other words, a pen register records outgoing information, e.g., the phone number dialed or the website visited. Variety argued that the CIPA’s pen register provisions only apply to telephones and not to internet-based communications. The Court tentatively rejected this argument and tentatively held that a pen register includes “a device or process that records or decodes metadata associated with either telephonic or online communications”^[5] under the pen register provisions of the CIPA.

However, the Court also tentatively held that, despite its holding that the CIPA’s pen register provisions apply, Rose had not adequately alleged that the trackers on variety.com qualify under the pen register provisions because the complaint only alleges that the trackers collect information about the users and does not allege “the destination to which the communication is directed.”^[6] A “user’s IP address identifies the source of the communication—not its destination.”^[7] The Court further held that Rose is entitled to amend the complaint.

To the extent that this tentative ruling may have been a victory for plaintiffs, a bill^[8] unanimously passed by the California State Assembly and Senate on August 28, 2026, significantly limits that victory. The bill eliminates the private right of action for violations of California Penal Code section 638.51 (making it illegal to “install or use a pen register … without first obtaining a court order”^[9]) and limits action to the Attorney General (“action against a private actor for violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought … only by the Attorney General.”)^[10] The bill was signed by Governor Newsom on September 30, 2026.

Endnotes

[1] Rose v. Variety Media, LLC, No. 25STCV01865 (Cal. Super. Ct. January 23, 2025).

[2] Id. ¶ 3.

[3] Id. ¶ 53.

[4] Cal. Penal Code, § 638.50(b).

[5] Variety Media, LLC v. Super. Ct. of L.A. Cnty., Cal. Ct. App., 2d Dist., No. B350578, at 1.

[6] Id. at 2.

[7] Id.

[8] S.B. 690 (Cal. 2025) (https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB690).

[9] Cal. Penal Code, § 638.51(a).

[10] S.B. 690 (see Note 8), proposed amendment to Cal. Penal Code § 637.2(d)(1).