/>iWell folks, it looks like CNN is about to get a course in the ABC’s of CIPA! If you’ve ever wondered what happens behind the scenes when you visit a news website, a recent court case might make you think twice before clicking on your next headline. A federal judge in New York just rejected CNN’s Motion to Dismiss a class action lawsuit, putting the media giant on the defensive in what’s shaping up to be a significant showdown over digital privacy rights. CNN might be in the business of breaking news, but now they’re possibly breaking privacy laws too—allegedly, of course. It sounds like they need Troutman Amin on the speed dial. The case can potentially expose how the invisible machinery of web tracking operates—and whether it violates California privacy law.
Remember our CIPA queen, Queenie, who first broke the news on this case back in January 2024? She predicted this wave of pen register litigation after the Greenley v. Kochava ruling opened the floodgates. Well, her crystal ball was spot-on once again!
What started as a lesser-known facet of CIPA has become the next major battleground in privacy litigation. For those keeping score at home, Queenie’s batting a thousand on predicting CIPA litigation trends—from chat box cases to web session recording and now these pen register claims. If I were a betting person, I’d put my money on whatever she predicts next.
For a refresher on Queenie’s original deep dive into this case and its significance, check out her blog post here: CNN BREAKING NEWS: CNN Targeted In Massive CIPA Case Involving A NEW Theory Under Section 638.51!
So let’s get into the update. In Lesh v. CNN, Inc., No. 24 Civ. 03132 (VM), 2025 U.S. Dist. LEXIS 30743 (S.D.N.Y. Feb. 20, 2025), pits a seemingly routine website visit against a state privacy law initially designed for telephone surveillance. Plaintiff, an ordinary visitor to CNN.com, found herself the lead plaintiff in a lawsuit alleging that CNN secretly installed tracking software on her browser without consent. But this isn’t just about one person’s browsing habits—it’s about whether companies can legally monitor users in ways most people never realize.
Of course, we are dealing with a CIPA claim here. Specifically, Section 638.51 prohibits installing or using what’s called a “pen register” without a court order. For those new to CIPA litigation, let’s break it down. I think it’s important to first break down the basics for aspiring future lawyers in this space or just for your own general knowledge to brush up on.
Originally, pen registers were devices used to record telephone numbers dialed from a specific phone line without capturing the actual conversations. Think of those old spy movies where agents track which numbers a suspect is calling. However, Judge Victor Marrero didn’t let the outdated terminology limit his interpretation. He ruled that how CNN’s trackers collect and transmit user data might qualify as a modern equivalent of a pen register. In other words, what once applied to landlines may now apply to websites silently gathering data behind the scenes.
Next, let’s talk about what CNN’s website actually does when you visit it (at least allegedly, according to the court documents). When your browser sends a request to CNN’s server, the server doesn’t just send back news articles. It also allegedly sends instructions that result in the installation of trackers from third-party companies like PubMatic, Magnite, and Antiview. These trackers, developed by third-party software companies that sell technology to help businesses place advertisements on their websites, then collect users’ IP addresses—a unique identifier that reveals their approximate location—and store cookies on their browsers to recognize them on future visits. The Court noted that these trackers don’t just passively log visits—they actively gather and transmit data about users, allegedly without their explicit consent.
What’s particularly clever about Judge Marrero’s analysis is how he breathes new life into an old statute. He rejected CNN’s argument that CIPA only applies to telephones, reasoning that “the plain text of Section 638.50 clearly does not limit the application of pen registers to telephones.” Lesh, 2025 U.S. Dist. LEXIS 30743, at *11. He continued, “[T]he Court cannot ignore the expansive language in the California Legislature’s chosen definition [of pen register],” which is “specific as to the type of data [collected],” but “vague and inclusive as to the form of the collection tool.” Lesh, 2025 U.S. Dist. LEXIS 30743, at *11-12 (quoting Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1050 (S.D. Cal. 2023)).
In other words, the law wasn’t designed to protect telephones—it was designed to protect information. And if a website tracker is secretly capturing addressing information, the court says that’s fair game for regulation under CIPA. Judge Marrero’s reasoning builds on the framework established in Greenley, where another court applied CIPA to modern digital tracking tools, rejecting the idea that pen registers are limited to phone lines.
It is refreshing to see courts adapting old laws to new technologies rather than throwing up their hands and waiting for legislatures to catch up. Judge Marrero found that IP addresses qualify as “addressing information” under the statute, citing the Ninth Circuit’s observation that “IP addresses constitute addressing information and do not necessarily reveal any more about the underlying contents of the communication than do phone numbers.” In re Zynga Litig., 750 F.3d 1098, 1108 (9th Cir. 2014).
This decision aligns with a broader legal trend recognizing that digital tracking implicates privacy rights. In Carpenter v. United States, 585 U.S. 296, 138 (2018), the Supreme Court held that historical cell site data collection constitutes a search under the Fourth Amendment. Similarly, the Lesh ruling suggests that collecting and transmitting IP addresses without consent could be an unlawful invasion of privacy under CIPA.
CNN also attempted to argue that collecting an IP address does not violate privacy rights, citing Fourth Amendment case law. Specifically, CNN relied on cases like United States v. Ulbricht, 858 F.3d 71, 96 (2d Cir. 2017), which held that individuals do not have a reasonable expectation of privacy in their IP addresses under the Fourth Amendment. However, the Court swiftly rejected this argument, noting that CIPA imposes broader privacy protections than the constitutional floor set by the Fourth Amendment. As Judge Marrero explained, the fact that the Fourth Amendment does not recognize an expectation of privacy in IP addresses does not mean that California law cannot provide greater protections. The Court emphasized that CIPA ‘extends beyond constitutional constraints’ and is an independent statutory safeguard against unauthorized tracking. This means that even if the government could collect IP addresses without violating the Constitution, private companies might still run afoul of CIPA when doing the same thing.
What is more, CNN asserted that it was entitled to an exception in the law for situations where “the consent of the user of that service has been obtained.” But Judge Marrero wasn’t buying it, noting that it would be “illogical to allow CNN’s consent to the installation of Trackers to bar claims from users like Lesh who did not give their consent.” Lesh, 2025 U.S. Dist. LEXIS 30743, at *13. Clearly, CNN cannot simply consent to its data collection practices and then claim immunity from privacy violations.
The Court also analyzed whether CNN’s Terms of Use were enforceable under a clickwrap or browsewrap framework. CNN argued that Lesh had agreed to its Terms of Use, which supposedly disclosed the use of trackers. To prove it, they submitted screenshots from the Wayback Machine (an internet archive). But the Court refused to consider these screenshots, finding they weren’t properly authenticated. Even beyond the evidentiary issue, the Court found that CNN’s agreement wasn’t a traditional “clickwrap” contract—where users affirmatively click “I agree” before using the site. Instead, the Court characterized it as a “hybrid clickwrap-browsewrap” agreement, meaning users were presented with a pop-up but were not required to take affirmative action beyond dismissing it. Courts have repeatedly rejected these types of passive consent mechanisms when determining enforceability. See Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1176 (9th Cir. 2014) (rejecting website terms where “users were not required to affirmatively agree”).
What strikes me about this case is how it exposes the fiction of consent in our modern digital age. How many of us have actually read those terms of service pop-ups that appear when we visit websites? Be honest—when was the last time you did more than glance at one before clicking “X” to make it go away?
This decision joins other recent cases like Vishal Shah v. Fandom, Inc., No. 24-cv-01062-RFL, 2024 U.S. Dist. LEXIS 193032 (N.D. Cal. Oct. 21, 2024) and Mirmalek v. L.A. Times Commc’ns L.L.C., No. 24-cv-01797-CRB, 2024 U.S. Dist. LEXIS 227378 (N.D. Cal. Dec. 12, 2024), which have similarly found that website trackers collecting IP addresses may violate CIPA.
In both cases, Courts held that these tracking tools gather ‘addressing information’ and function similarly to pen registers, a key issue in Lesh. This interpretation of CIPA could force a significant shift in how websites operate, as it directly contradicts the assumption that IP tracking is legally harmless.
If this interpretation holds up, it could force a massive shift in how websites collect data. Nearly every major website uses similar tracking technologies to gather visitor information, often for advertising purposes. Are they all potentially violating California law? The implications of this case extend far beyond CNN—any website using third-party trackers may now face legal scrutiny.
For now, CNN must answer Lesh’s Complaint within 21 days of the Court’s order.
The internet has evolved faster than our laws, and companies may have exploited that gap. But if this case is any indication, the courts are finally starting to close it.
As always,
Keep it legal, keep it smart, and stay ahead of the game.
Talk soon!
