Much has been written about the recent avalanche of pen-register lawsuits filed in California courts against website operators and e-commerce companies. These lawsuits typically allege that the defendants use unlawful pen registers and/or trap-and-trace devices on their websites that collect website visitors’ IP addresses and other “personal” information. Web beacons, scripts, and pixels associated with TikTok and Meta have, for example, been characterized as pen registers and/or trap-and-trace devices in these complaints. Only a small fraction of these cases actually gets litigated, however, meaning courts have had limited opportunity to evaluate the plaintiffs’ allegations, claims, and legal theories.
The last significant development in this area of law came in the Spring of 2024, when two judges in Los Angeles County issued contradictory rulings within weeks of one another. In Levings v. Choice Hotels International, Inc., a judge overruled the defendant’s demurrer, finding the plaintiff’s allegations to be sufficient to state a claim for violation of the CIPA against a hotel chain. The Choice Hotels judge allowed the case to proceed to the discovery phase. In sharp contrast, a judge in Licea v. Hickory Farms LLC sustained a demurrer to a complaint that contained allegations identical to those made in Choice Hotels. The Hickory Farms judge concluded that CIPA’s application was limited to telephonic calls and devices, like cell phones, and not to IP addresses and Internet-connected devices.
California courts have largely been silent on this issue since the Choice Hotels and Hickory Farms decisions. But on Monday, September 9, 2024, another judge in Los Angeles County issued an order delivering a blow to the plaintiffs’ bar. In Casillas v. Transitions Optical, Inc., the court sustained a demurrer to a CIPA claim and dismissed the case on grounds similar to those stated in Hickory Farms. The Transitions Optical decision:
- Recognized that the “legislative purpose” of CIPA’s pen-register provision “was to authorize law enforcement to seek orders for telephone surveillance. [It] does not address the privacy rights of Internet users.”
- Held that CIPA “did not, and does not, criminalize the process by which all websites communicate with all users who choose to access them.”
- Concluded that, “[e]ven if it is assumed that the ability of a website operator to obtain a user’s IP address constitutes operating a pen register,” a plaintiff does not have “a reasonable expectation in the privacy of her computer’s IP address” when she “chose to access [the defendant’s] website.”
The Transitions Optical court dismissed the case without leave to amend because the plaintiff failed to allege a CIPA cause of action and had not shown a reasonable possibility of curing the complaint’s defects.
The Transitions Optical decision is significant. Defendants in several cases that are currently pending have made the same arguments that the defendant’s in Transitions Optical successfully made. When coupled with the Hickory Farms order, Transitions Optical can serve as a blueprint for courts to dismiss CIPA complaints that are premised on IP addresses. We will continue to monitor these cases to see how other judges in Los Angeles County and California react to Transitions Optical.
For more information on data privacy, please contact Jason Kelly, Esq., CIPP/US/E at [email protected].
