Uncertainty Continues in California on CIPA Section 638.51 Claims
Highlights
- There is disagreement between California's state court and federal district courts regarding whether web-based tracking technologies that share IP addresses fall within the scope of Section 638.51 of the California Invasion of Privacy Act (CIPA). Many California state court judges have been willing to adopt a narrower interpretation of the statute, while federal district court judges appear largely united that pixels and similar tracking technologies fall under CIPA's definition of a "pen register."
- The U.S. Court of Appeals for the Ninth Circuit's recent decision in Popa v. Microsoft Corp. reaffirmed the requirements plaintiffs must meet to establish Article III standing. This decision has led many defendants in CIPA cases, including those alleging violations of Section 638.51, to raise a standing challenge.
- Despite many plaintiffs raising substantially similar, and often boilerplate, privacy-related allegations, California federal district courts' application of Popa to Section 638.51 claims have varied. A number of federal judges have relied on Popa to dismiss plaintiffs' Section 638.51 claims for lack of standing; however, others have found such allegations sufficient to satisfy the standing requirement and distinguished Popa on the facts.
The wave of California Invasion of Privacy Act (CIPA) Section 638.51 cases (i.e., pen register or trap-and-trace claims) against companies using web tracking technologies such as Meta and TikTok pixels shows no sign of slowing and continues to generate inconsistent rulings across California's courts. The U.S. Court of Appeals for the Ninth Circuit's recent decision in Popa v. Microsoft Corp. affirming dismissal of claims under the Pennsylvania wiretapping statute has further complicated the legal landscape by providing defendants in federal district courts an avenue to challenge Article III standing in privacy-related cases.1
Divide Between California State and Federal Courts
CIPA Section 638.51 prohibits the installation or use of a "pen register or trap and trace device" without "first obtaining a court order."2 A pen register is defined as "a device or process that records or decodes dialing, routing, addressing or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication."3 California state court judges have been willing to adopt a narrower construction of the statute and repeatedly found website tracking technologies and IP addresses to be outside the scope of CIPA's pen register provisions.
Federal district court judges in California, however, have consistently found that CIPA's definition of "pen registers" encompasses web-based technologies such as pixels. A point recently reiterated by Judge Charles Breyer of the U.S. District Court for the Northern District of California when he denied a digital content company's motion for interlocutory appeal on this exact issue. The defendant sought leave to certify for appeal an order denying its motion to dismiss the plaintiff's Section 638.51 claim. In denying the motion, Judge Breyer held that the defendant failed to show there are substantial grounds for differences of opinion among the federal courts.
But though California district courts have held, at the pleading stage, that web-based technologies such as pixels and the IP addresses they collect are within scope of CIPA's pen register definition, the Ninth Circuit's recent reaffirmation of the requirements for Article III standing has added another layer to the legal landscape for alleged privacy violations.
Standing Challenges Add to the Varied Outcomes for Section 638.51 Decisions
In August 2025, the Ninth Circuit stated in its Popa decision that to satisfy the injury-in-fact requirement of Article III standing, plaintiffs asserting privacy violations must show that the defendant or alleged technology collected embarrassing, invasive or otherwise private information.4 Mere violation of a statute or broad theories regarding common law privacy rights, it held, is insufficient to establish a concrete injury for Article III purposes.5 These holdings have provided defendants a window to raise a standing challenge in CIPA cases, especially those asserting Section 638.51 claims; however, California district courts' application of Popa to these claims has varied.
In the U.S. District Court for the Southern District of California, Judge Dana Sabraw dismissed plaintiffs' Section 638.51 claims for lack of Article III standing. Plaintiffs there alleged that the defendant retail company used tracking technologies, such as the TikTok pixel, to collect metadata about consumers' browsing activity on the website, including timestamp, IP address and browser information, which TikTok allegedly used for vaguely described "fingerprinting."6 Applying Popa, the district court held that the plaintiffs failed to allege that the harm they experienced – collection of IP addresses – was remotely similar to the type of harm that has traditionally been actionable under the law.7
Similarly, in the U.S. District Court for the Central District of California, Judge Kenly Kiya Kato dismissed the plaintiff's sole Section 638.51 claim, also on standing grounds. The plaintiff alleged that an automaker invaded his privacy by embedding tracking pixels on its website to collect IP addresses and metadata such as browser and device type, screen resolution, installed fonts and time zone, as well as an approximate location based on his IP address.8 Relying on Popa, the court rejected the plaintiff's broad theory of a free-roaming privacy right and held that his alleged CIPA violation under Section 638.51 did not establish an Article III injury in fact.9
Not all district court judges have aligned on standing, however. In the Northern District of California, Judge Eumi K. Lee denied a defendant entertainment company's motion to dismiss substantially identical allegations – i.e., third-party internet trackers had captured and shared the plaintiff's IP address and device metadata – in part because she found the plaintiff had sufficiently alleged standing under Article III.10 Judge Lee held that Popa did not require a different outcome because the extent of tracking alleged in Popa was significantly less intrusive than the allegations before her, and Popa delt with session replay technology rather than tracking pixels.11
Key Takeaways
All federal judges in California who have addressed the question have found that web tracking technologies fall within scope of CIPA's pen register definition; however, with the Ninth's Circuit recent decision regarding Article III standing, the district courts' patchwork of holdings in privacy-related decisions, including those raising Section 638.51 violations, will likely not slow anytime soon.
For more information or questions, please contact the author.
Notes
1 See 153 F.4th 784 (9th Cir. 2025).
2 Cal. Pen. Code Section 638.51(a).
3 Cal. Pen. Code Section 638.50(b).
4 See 153 F.4th 784, 791 (9th Cir. 2025).
5 Id. at 792.
6 See Case No.: 25-cv-00742-DMS (MMP), 2025 WL 3171740 at *1 (S.D. Cal. Nov. 12, 2025).
7 Id. at *6.
8 See Case No. 25-cv-01982-KK-SPx, 2025 WL 3786963 at * 1 (C.D. Cal. Dec. 29, 2025).
9 Id.
10 See Case No. 25-cv-06038-EKL, 2026 WL 247875 at *2 (N.D. Cal. Jan. 29, 2026).
11 Id.
Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.