The California Court of Appeal, Second Appellate District, has issued its tentative ruling in Variety Media, LLC v. Superior Court, the closely watched writ proceeding that asks whether the pen register provisions of the California Invasion of Privacy Act (“CIPA”) apply to common website tracking technologies. The tentative decision would grant Variety’s petition in part and direct the trial court to sustain Variety’s demurrer with leave to amend. The court’s reasoning cuts in both directions. The panel would hold that CIPA’s pen register statute reaches internet communications, rejecting the threshold defense that has anchored many motions to dismiss. But it would also hold that a pen register captures only metadata identifying the destination of an outgoing communication, and that a website visitor’s IP address identifies the source of a communication rather than its destination. Under that construction, the complaint before the court fails to state a claim.
Background
Penal Code section 638.51 prohibits installing or using a pen register without a court order or the user’s consent. Over the past three years, plaintiffs and pro se litigants have filed hundreds (if not thousands) of lawsuits, arbitration demands, and pre-suit letters alleging that cookies, pixels, analytics tools, and similar technologies are unlawful pen registers because they collect visitors’ IP addresses and device information. Trial courts have divided on whether the statute, enacted with telephone surveillance in mind, reaches these tools at all. No California appellate court has answered the question in a published decision.
The plaintiff in Variety Media alleges that trackers on Variety’s website transmitted his IP address and device information to third-party data brokers, which allegedly used the information to identify visitors and build advertising profiles. Variety demurred on the ground that CIPA’s pen register provisions apply only to telephonic surveillance devices. The trial court overruled the demurrer, Variety sought writ relief, and the Court of Appeal took the unusual step of issuing an order to show cause, signaling that it viewed the question as one warranting immediate appellate review.
The Tentative Ruling
The tentative rejects several of Variety’s threshold statutory arguments but accepts a narrower argument concerning the distinction between source-identifying and destination-identifying metadata. The panel would hold that CIPA’s definition of pen register largely tracks the federal definition on which the Legislature modeled it, reaching a device or process that records metadata associated with either telephonic or online communications. The court reasons that the Legislature added the pen register provisions in 2015 to give California law enforcement a state-law mechanism aligned with federal law, which already covered internet communications, and that a telephone-only reading would defeat that purpose.
The tentative ruling also rejects Variety’s arguments that the California Consumer Privacy Act (“CCPA”) displaces CIPA for online data collection and that the rule of lenity requires a telephone-specific construction. On the CCPA point, the court reasons that the CCPA makes informing the consumer necessary but not sufficient for lawful collection, and that CIPA’s consent requirement does not displace that condition but incorporates and exceeds it. In other words, CCPA-compliant notice and opt-out disclosures do not by themselves supply the consent that section 638.51 requires.
The panel would nonetheless sustain the demurrer based on a narrower argument Variety raised in its reply brief. Drawing on the historical operation of pen registers and the parallel trap and trace definition, which focuses on source-identifying information, the court would construe section 638.50, subdivision (b) to reach only a device or process that records or decodes metadata likely to identify the destination of an outgoing communication. A visitor’s IP address does not qualify because it identifies where the communication came from, not where it was going. That distinction matters because the statute separately defines a “trap and trace device” as one that identifies the source of a communication, while a “pen register” identifies destination information. The tentative ruling also finds the plaintiff’s screenshots showing captured “domain,” “Origin,” and “Referer” fields insufficient, because the pleading does not make clear whether the trackers recorded destination metadata about an outgoing communication as it occurred or merely generated a separate after-the-fact report about a past communication.
Because the destination argument surfaced for the first time in the reply brief, the tentative ruling would give the plaintiff leave to amend to attempt to plead facts satisfying this construction.
Why It Matters
A tentative ruling is not a decision. The panel can change course after oral argument, set for August 25, and the ultimate opinion may or may not be published. But the tentative offers the first detailed look at how a California appellate court would analyze the theory driving a large share of active privacy litigation in the state, and its two holdings point in opposite directions. Although it provides a strong indication of the panel’s current analysis, the court may revise its reasoning or disposition following oral argument.
The internet-scope holding is likely to be viewed as unfavorable by defendants. If it stands, businesses can no longer expect to defeat these claims on the categorical ground that CIPA does not apply online, and trial courts that have dismissed on that basis may see the issue revived.
The destination-metadata holding, by contrast, would undermine the standard complaint. The overwhelming majority of pen register claims rest on the collection of visitor IP addresses and device information, which is source data under the tentative ruling’s construction. Plaintiffs therefore would need to allege facts showing that a challenged process records destination-identifying metadata about an outgoing communication as it occurs, rather than merely transmitting or reporting information about a completed communication. Expect plaintiffs to test the boundaries of the construction through amended pleadings built on referrer and destination fields. Plaintiffs may also attempt to reframe source-identifying allegations under CIPA’s separate trap and trace definition, although the tentative ruling does not decide whether the trackers alleged here would satisfy that definition.
The Broader Landscape
The tentative arrives at a pivotal moment. Senate Bill 690, as amended in July, would give the California Attorney General exclusive authority to bring pen register and trap and trace claims arising from websites and online or mobile applications, eliminating the private right of action that fuels the current wave. As of August 21, 2026, SB 690 had been ordered to a third reading in the Assembly. It would still need final legislative approval, including Senate concurrence in any Assembly amendments, before the Legislature’s August 31 deadline.
The timing is significant. This tentative ruling issued just days before that deadline, and the legislative and appellate tracks are now converging. If enacted in its current form, the bill would apply its enforcement limitation retroactively to qualifying pending claims commenced within the two years preceding its operative date, which could reach many private section 638.51 claims regardless of the final opinion. If the bill stalls, the Variety opinion, which must issue within 90 days after the matter is submitted following oral argument, could become the first appellate authority addressing the scope of section 638.51 and is likely to have substantial influence on trial courts confronting these claims. A second appellate proceeding that had presented a similar question, Reuters News & Media, Inc. v. Superior Court, was voluntarily dismissed in June 2026, leaving Variety Media as the principal pending California appellate vehicle addressing the issue. And neither the tentative ruling nor SB 690 touches claims under CIPA’s wiretapping provision, section 631, which plaintiffs assert against the same technologies on a contents-interception theory.
Takeaways
Businesses facing pending section 638.51 claims, arbitration demands, or pre-suit letters should reassess their positions in light of both the tentative ruling and SB 690. If the court adopts the tentative’s source-versus-destination distinction, complaints based solely on the collection of a visitor’s IP address may face a substantial pleading obstacle. If SB 690 is enacted in its current form, it could separately eliminate private enforcement of qualifying website- and application-based pen register and trap and trace claims, including certain pending claims. Settlement and litigation decisions should nevertheless account for the technology alleged, the procedural posture, the possibility of amendment, and the remaining uncertainty surrounding both the final opinion and the legislation.
We will report on developments following the August 25 oral argument and issuance of the court’s final decision.
Recent Comments