California Bill Targets CIPA Website Tracking Lawsuits
A new bill would eliminate the private right of action for CIPA pen-register claims, but a recent appellate ruling and alternative legal theories mean website operators are not out of the woods.
California's legislature and one of its appellate courts have issued conflicting signals on the future of website tracking litigation. The legislature has passed and sent to the governor SB 690, a bill that would eliminate the private right of action under the California Invasion of Privacy Act’s (CIPA) pen-register provision, a favorite tool of plaintiffs' lawyers targeting common cookies and analytics pixels. If signed, the law would apply retroactively. At the same time, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court holding that CIPA’s pen-register definition is technology-neutral and can apply to internet communications. While the court rejected the specific claim because an IP address identifies a communication's source rather than its destination, the broader interpretation is a setback for defendants. Sophisticated counsel should not view SB 690 as a complete solution; instead, they should anticipate plaintiffs will pivot back to other CIPA provisions, such as Section 631(a) wiretapping claims, or pursue other common-law privacy theories. The immediate next steps are to watch for the governor's signature and the final Variety Media ruling.