Greetings CIPAWorld!

What a year here at Troutman Amin. As today is New Year’s Eve, many of us find ourselves reflecting on the past year—or maybe even scrolling through Zillow, dreaming about the homes we might own someday. But this year, Zillow.com isn’t just the backdrop for house hunters—it’s at the center of a privacy lawsuit. In the Southern District of California, the federal court just dropped a ruling highlighting how tech companies handle your data. See Mata v. Zillow Grp., Inc., No. 24-cv-01095-DMS-VET, 2024 U.S. Dist. LEXIS 229061 (S.D. Cal. Dec. 18, 2024). Turns out, every time you watch a video home tour on Zillow, Facebook might be watching you back.

The case focuses on Meta’s tracking pixel, embedded in Zillow’s website, which allegedly captures and transmits user data in real-time. In turn, the Court’s analysis of California’s wiretapping statute, CIPA, cuts straight to the point of modern web tracking. As I’ve been stressing in my past blogs, for a CIPA claim to stick, the interception must capture actual content during transmission. Underhill v. Kornblum, 2017 WL 2869734, at *6 (S.D. Cal. Mar. 16, 2017).

So you may ask yourself, what counts as “content”? Well, the Ninth Circuit draws a clear line: it’s “the intended message conveyed by [a] communication,” not just metadata. In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014). When Meta’s pixel grabs data about which videos you watch, it’s not just collecting statistics—it’s peering into your “personal interests, queries, and habits.” Davis v. Facebook, Inc. (In re Facebook Inc. Internet Tracking Litig.), 956 F.3d 589, 605 (9th Cir. 2020). This isn’t abstract. Courts are increasingly connecting personally identifiable information (“PII”) with the specifics of what makes you, you. It’s not just what you click—it’s what those clicks say about your life.

Timing matters too. The data must be snagged “during transmission, not while in electronic storage.” Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 2002). The Court found that embedding code that captures real-time data fits the bill. See Esparza v. UAG Escondido A1 Inc., 2024 U.S. Dist. LEXIS 24429, 2024 WL 559241, at *3 (S.D. Cal. Feb. 12, 2024).

And Zillow isn’t just on the hook for using the pixel—it’s also facing claims for aiding Meta in violating privacy laws. Simply embedding tracking technologies counts as “substantial assistance” in privacy violations. This follows an increasing trend where companies can’t hide behind third-party tools anymore. See Heiting v. Taro Pharms. USA, Inc., No. 2:23-cv-08002-SPG-E, 2024 WL 3738055, at *6 (C.D. Cal. July 31, 2024). If tracking pixels alone can open companies to liability, the implications stretch beyond Zillow, straight into the core of e-commerce, media, and tech networks. Please take note.

The Video Privacy Protection Act (“VPPA”) adds another layer. Unlike businesses that only use videos as a marketing tool, Zillow’s core model relies on video tours. The Court likened Zillow to streaming services—just as Vizio facilitated access to Netflix and Hulu, Zillow’s video walkthroughs define its platform. In re Vizio, Inc., 238 F. Supp. 3d 1204, 1222 (C.D. Cal. 2017).

Let me go a little deeper to make this clear as claims asserting VPPA are increasing. Under the VPPA, PII isn’t limited to your name or address. It includes any information linking you to specific videos you’ve watched—like your email address, Facebook ID, or even cookies tied to your browsing habits. When Meta’s pixel tracks which video users view and combines that data with personal information, it builds a detailed profile of their interests, behaviors, and preferences. That’s what makes this data so powerful—and legally significant.

So, what makes someone a “subscriber” under this law? You don’t need to pay money. See Ellis v. Cartoon Network, Inc., 803 F.3d 1251, 1256 (11th Cir. 2015). Just sharing your email or personal information is enough. See Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 489 (1st Cir. 2016); Salazar v. NBA, 118 F.4th 533, 552-53 (2d Cir. 2024). As such, providing personal information, such as an email address, transforms casual users into subscribers, bringing them squarely under the VPPA’s protective umbrella.

All in all, the Court ultimately denied Zillow’s Motion to Dismiss both claims. On the VPPA claim, it found Zillow qualifies as a video service provider, and sharing personal information through account registration makes users “subscribers” under the law. For the CIPA claim, the Court held that Meta’s direct interception of user data and Zillow’s role in embedding the tracking technology could violate the statute. Zillow’s argument that videos are peripheral to its real estate services didn’t fly—the Court clarified that video walkthroughs aren’t optional window dressing; they’re essential to Zillow’s business model.

So, what’s the takeaway as we head into 2025? This ruling isn’t just about Meta, Zillow, or even real estate platforms. It’s about every company that relies on invisible tracking tools to power their business. It reminds us that every line of embedded code carries legal weight. And for consumers, it’s a chance to ask a long-overdue question: What are we giving away in exchange for the convenience of modern web features?

As we close out 2024 at Troutman Amin, we remain committed to helping our clients navigate these challenges and find innovative solutions.

Here’s to a Happy and Healthy New Year! We look forward to continuing to make a difference together in 2025.

As always,

Keep it legal, keep it smart, and stay ahead of the game.

See you next year!