Privacy & Information Security Law Blog

In the latest evolution of lawsuits challenging technologies that track website users, California class action plaintiffs have begun to file under a new theory—the pen register and trap and trace device theory under Section 638.51 of the California Invasion of Privacy Act (“CIPA”).

Over the last two years, courts have seen an influx of putative class action lawsuits targeting businesses with websites that utilize technology to track users’ website interactions. Most of the lawsuits have been filed in California under CIPA. These previous lawsuits alleged a violation of section 631 of CIPA, which protects against (1) intentional wiretapping of any telegraph or telephone wire, line or cable; (2) willfully and without the consent of all parties attempting to learn the contents of a communication in transit; and (3) attempting to use or communicate information obtained as a result of engaging in either activity. The statutory penalty is $5,000 per violation.

The cases have often failed at the motion to dismiss stage. Courts have dismissed some suits for lack of standing given the absence of a concrete injury. A number of courts have found that the information collected must in itself have a reasonable expectation of privacy. Plaintiffs are now trying their luck under the pen register and trap and trace theory.

Plaintiffs suing under the pen register theory are claiming the use of certain software (such as website cookies, web beacons, pixels, script, or software code) that track a user’s location, search terms, browsing history or purchase history is akin to the use of a “pen register.” Pen registers were physical machines used by law enforcement to trace signals from phones or computers to their destination, creating what is similar to an outgoing call log. Ultimately, state laws went into effect prohibiting the use of pen registers without a court order. CIPA defines a pen register as a “device or process that records or decodes dialing, routing, addressing or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication” and prohibits the use of a pen register without a court order. Statutory damages under the CIPA pen register provision are $2,500 per violation.

In a recently filed putative class action, Greenley v. Kochava, Inc., No. 22-CV-01327-BAS-AHG, 2023 WL 4833466 (S.D. Cal. July 27, 2023), the plaintiff alleged that the defendant data broker that provides software development kits to app developers violates section 638.51 of CIPA. Plaintiff alleged that the defendant coded its software development kits to track a user’s “geolocation, search terms, click choices, purchase decisions, and/or payment methods,” collected this tracked information and then sold it to third-party advertisers. The court found that defendant’s alleged use of software that “identifies consumers, gathers data, and correlates that data through unique fingerprinting” constitutes a “process” that records routing information as defined under the CIPA pen register provision and denied the motion to dismiss. Following this decision over 50 new cases have been recently filed in California state and federal courts under the CIPA pen register provision.

Accordingly, businesses should evaluate their use of software to gather data and their privacy policy. The CIPA pen register provision allows “a provider of electronic or wire communication service” to use a pen register “[i]f the consent of the user of that service has been obtained.” Although California courts have not yet interpreted this CIPA pen register consent provision, courts have found that a user’s affirmative consent has been fatal to other CIPA claims.