Publications
CIPA in the Digital Age: What Businesses Need to Know About the Variety Media Appeal
For businesses operating websites in California, a pending appellate case may soon reshape the legal landscape. Variety Media, LLC v. Superior Court, now before California’s Second District Court of Appeal, could produce the first published California appellate decision addressing whether the California Invasion of Privacy Act (“CIPA”) applies to commonplace website technologies, including cookies, analytics tools, and advertising pixels.
Why This Case Matters
CIPA was enacted to address telephonic wiretapping, but plaintiffs across California have increasingly alleged that routine online tools (e.g., cookies, pixels, analytics platforms, advertising technologies, and fraud-prevention services) constitute unlawful pen registers or trap-and-trace devices under the statute. These claims have generated lawsuits, demand letters, arbitrations, and substantial settlement pressure attributable to CIPA’s statutory damages provisions.
The irony is significant: the very technologies enabling privacy compliance, including preference management tools, consent mechanisms, and privacy notices, are themselves being challenged under CIPA. Unlike the California Consumer Privacy Act (“CCPA”), which includes detailed regulations addressing data sharing through website cookies, CIPA offers no roadmap for how businesses can deliver website functionality while avoiding liability. California trial courts have reached divergent conclusions, federal district court decisions also remain inconsistent, and businesses devote substantial resources to compliance efforts without a clear standard to guide them.
The Court of Appeal’s decision to exercise original writ jurisdiction, rather than awaiting a traditional appeal following final judgment, underscores the case’s significance. At present, the appellate record contains 17 substantive briefs from the parties and amici, including business associations, technology companies, media organizations, privacy advocates, civil liberties groups, and academic institutions.
The Legal Framework at Issue
Under CIPA, a pen register is a device that records or decodes dialing, routing, addressing, or signaling information, while a trap-and-trace device captures the incoming equivalent. The central dispute in Variety Media is whether information exchanged between a user’s device and a website, such as IP addresses, device identifiers, URLs, and metadata, falls within these statutory definitions.
The appeal raises interconnected questions: Does CIPA Section 638.51 reach routine software processes on commercial websites, or does it remain confined to law enforcement surveillance? Even if the statute can apply to internet activity, do the specific trackers at issue constitute “pen registers” under Section 638.50(b), or are they excluded as “tracking devices” under Section 629.51(a)(3)? What role should the federal Pen Register Act play in construing CIPA? And should CIPA be interpreted narrowly given California’s broader privacy regulatory landscape, including the CCPA?
The Competing Arguments
Appellant Variety contends that CIPA’s text, structure, and legislative history demonstrate the pen register provisions were designed to regulate telephonic surveillance rather than routine website communications. From Variety’s perspective, extending those provisions to common website technologies would expand CIPA beyond its intended scope and expose businesses to liability for ordinary internet operations.
Sean Rose, the plaintiff below and the real party in interest on the appeal, advances the contrary position, arguing that CIPA is technology-neutral and applies whenever challenged technologies perform functions falling within its statutory definitions, irrespective of whether the Legislature contemplated internet communications. Under this reading, IP addresses, device identifiers, routing information, and metadata may qualify as CIPA-regulated information.
The parties further disagree on the relevance of federal law. Variety maintains that Congress amended the federal Pen Register Act to address internet communications while California made no corresponding amendment to CIPA and that online privacy is governed by statutes, such as the CCPA. Rose counters that CIPA’s existing language already encompasses evolving technologies, that amendments to federal law do not constrain California’s interpretation of its own statute, and that the CCPA complements rather than supplants CIPA.
Perspectives from Interested Parties
The amicus briefs expand the scope of the appeal. Business organizations, including the U.S. Chamber of Commerce, Alliance for Legal Fairness, California Chamber of Commerce, California Retailers Association, Retail Litigation Center, and Association of Corporate Counsel, concentrate on the practical ramifications of applying CIPA to routine website operations. As the Association of Corporate Counsel observes, each new website tool that becomes a litigation target compels businesses to spend “countless hours and resources guessing at how best to avoid CIPA liability—while still maintaining CCPA compliance.”
A separate brief filed jointly by Asana, Eventbrite, GoPro, ClickUp, Reddit, the Software & Information Industry Association, MasterClass, and Yelp supplies technical context on how IP addresses, cookies, pixels, and device data support website functionality, cybersecurity, fraud prevention, and analytics. Additional amici, including News/Media Alliance, Digital Content Next, the Movement for an Open Web, and the Southwestern Law School Amicus Project, address implications for digital publishers and CIPA’s statutory history.
The amici supporting Rose (i.e., the ACLU of Northern California, ACLU of Southern California, and Oakland Privacy) argue that metadata and browsing information can reveal substantial details about individuals’ online activity, that the CCPA complements rather than supersedes CIPA, and that privacy protections should evolve alongside technology.
The Court’s Supplemental Questions
In May 2026, rather than proceeding directly to oral argument, the Court directed supplemental briefing on several questions. The Court inquired about the relationship between CIPA and the federal Pen Register Act; specifically, whether a California company could violate the federal statute by collecting internet metadata even if California’s pen register provisions were interpreted more narrowly, and whether CIPA should be construed to avoid conflict with federal law.
The Court also asked whether the specific tracking technologies at issue (e.g., cookies that collect IP addresses, browser type, and similar device-level metadata) fall within CIPA’s definitions or are excluded as “tracking devices” under Penal Code Section 629.51. Finally, it questioned whether the pen register provisions apply only to communications containing “content,” and whether merely visiting a website constitutes a “communication” within the meaning of the statute.
While the parties largely adhered to their original positions in supplemental briefing, Variety reiterated that Congress amended the federal Pen Register Act for internet communications while California made no comparable amendments to CIPA. Rose responded that CIPA’s existing language already reaches evolving technologies. The Court’s questions do not signal how it will ultimately decide, but they illuminate the issues likely to receive the most attention at oral argument.
What Comes Next
With briefing concluded, attention turns to the oral argument scheduled for August 25, 2026. Although the parties and amici disagree on CIPA’s application, they largely concur on how the underlying technologies function. The central questions have crystallized: whether CIPA reaches internet communications, whether the challenged tools fall within its definitions, and how CIPA should be interpreted alongside the CCPA.
In summary, the disagreement transcends statutory interpretation. Variety and its supporters stress statutory limitations and potential business consequences, whereas Rose and his supporters emphasize consumer privacy and the imperative for CIPA’s protections to keep pace with technological change. The outcome could determine whether routine website data practices fall under CIPA’s surveillance provisions, California’s contemporary privacy framework, or both.
Our next article will provide firsthand coverage from the courtroom, examining the panel’s questions, the parties’ responses, and what the argument reveals about how the Court may resolve this closely watched appeal.
Read more
