Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
Theft statutes are written for taking someone else’s property. Demand letters about the Meta Pixel sometimes try to stretch that idea until a page-view event looks like stolen goods. A recent Meta Pixel demand letter, and others sent to e-commerce and website operators, lists statutory larceny under California Penal Code section 484 as claim (f). The argument is that visitor data has value, the business took it by installing the pixel, and the taking was theft. It is one of the more aggressive boards in the stack, and it is one of the least natural fits.
TL;DR
- Section 484 defines theft, including the taking of personal property by various means. It is a criminal statute that some letters also try to use as a civil predicate.
- Copying information while leaving the original with the visitor is a poor match for traditional larceny, which assumes property that can be taken away from its owner.
- A 2025 Northern District of California decision in Ramos v. The Gap, Inc. dismissed a statutory-larceny theory over tracking data after concluding the plaintiff had not shown the data was property capable of exclusive possession or control.
What section 484 actually addresses
California Penal Code section 484 is the state’s basic theft statute. It covers, among other things, feloniously stealing, taking, carrying, or driving away the personal property of another, and certain takings by false pretenses or false representation. The core idea is familiar: someone else’s property, a taking, and criminal intent.
Personal information can have economic value. Businesses pay for advertising audiences, and data brokers pay for lists. Plaintiffs have used that marketplace to argue that browsing data is “property” and that collecting it without permission is theft. The jump from “valuable” to “capable of being stolen under section 484” is the part courts have resisted. Property for theft purposes has historically been something the owner can exclusively possess. If I copy your idea or your browsing URL, you still have it. That does not make the copying automatically lawful. It does make it a strained larceny.
There are neighboring theories that letters sometimes blur together. Penal Code section 496 covers receiving stolen property and has been used in some civil business disputes after the California Supreme Court’s decision in Siry Investment, L.P. v. Farkhondehpour, 13 Cal. 5th 333 (2022). That case was about stolen partnership funds, not advertising cookies. Conversion is a civil property tort with its own elements. None of those doctrines silently converts a Meta Pixel page view into a completed theft.
How larceny appears in pixel demand letters
In the ECPA-centered letters we are seeing, section 484 is not there because counsel expects a prosecutor to file a shoplifting case about a pixel. It is there because theft is a crime, and a crime can be offered as the independent unlawful purpose that triggers the crime-tort exception. The sequence is: the business procured Meta to intercept communications in order to steal the visitor’s data, therefore one-party consent does not apply.
The same letters often pair larceny with wire-fraud citations and with trespass to chattels. Together those theories try to describe tracking as stealing, fraud, and a property invasion. The factual exhibit is still a HAR file and an off-Facebook activity report. No letter we are discussing has to show that the visitor lost exclusive control of a physical object. The “property” is the information itself.
That framing can sound persuasive to a non-lawyer, because people do feel that their data belongs to them. Feeling ownership and satisfying section 484 are different things. If every copy of information were larceny, ordinary web analytics, server logs, and even showing a page to the visitor’s own browser would need a new legal vocabulary.
How courts have treated theft-of-data theories
In Ramos v. The Gap, Inc., 2025 WL 2144837 (N.D. Cal.), the Northern District of California dismissed a statutory-larceny theory under Penal Code sections 484 and 496 in a tracking dispute. The court concluded that the plaintiff had not shown the tracking data was property capable of exclusive possession or control, which theft law requires. We cite that decision for the legal proposition it actually decided at the pleading stage, not as a verdict about every website.
Other privacy cases have similarly struggled to treat personal information as stolen property merely because it was collected or shared. Plaintiffs sometimes reframe the same facts as conversion or as unjust enrichment. Those claims have their own problems, including the difficulty of describing what was taken from the plaintiff and what should be given back. For recipients evaluating pixel litigation risk, the practical lesson is that a theft heading does not change the underlying conduct. It just assigns that conduct a more dramatic name.
As a crime-tort predicate, larceny has the same circularity problem as several other add-ons. If the alleged theft is simply the interception or copying of the communication, then the “crime” is the interception itself. Decisions such as Sussman and Caro require a purpose beyond the recording. A letter that says “you stole the data by intercepting it, therefore you intercepted it in order to steal it” is restating the same event twice.
Practical steps if section 484 appears in the stack
- Do not panic at the word “larceny.” Ask counsel to separate a criminal-sounding label from the elements of theft and from the more plausible statutory claims in the same letter.
- Document what was copied and what the visitor still had. The visitor still has their memories, their device, and usually the same information the pixel sent. That fact will not impress the sender, but it matters to the legal test.
- Watch for false-pretenses language. If the letter says the data was taken by a misleading privacy policy, that is a different subsection of section 484 and overlaps with consumer-protection theories. The response is to compare the policy to the tags, not to concede a theft.
- Reduce collection you cannot defend as necessary. Even a weak theft theory is a reminder that sending hashed emails or extra identifiers increases the amount of information a plaintiff can call “taken.”
How Captain Compliance helps without pretending data is jewelry
The useful response to a larceny heading is still operational. Collect less, disclose more accurately, and do not send advertising events before a recorded choice. Captain Compliance’s consent manager can hold the Meta Pixel until that choice exists. The scanner can show which identifiers and cookies actually leave the browser. A working DSAR process lets people ask what you hold, which is a more realistic “control” than a theft metaphor. Compliance Shield, on eligible and properly configured plans, can back qualifying consent and notice claims. None of that accepts the premise that a page view was stolen goods. It does make the underlying data flow easier to explain.
Frequently asked questions
Did we “steal” something by using analytics?
Using a pixel can create other legal issues, especially around consent and disclosure. It does not automatically satisfy the elements of theft. Copying information the visitor still has is not the same as carrying away personal property.
If data can be sold, isn’t it property?
Value in a marketplace and “property” for purposes of a theft statute are not always the same thing. Courts looking at tracking data have required something more like exclusive possession or control. A buyer’s willingness to pay for an audience does not, by itself, turn every collected URL into stolen goods.
Could a prosecutor really bring a section 484 case about a pixel?
Demand letters are not charging documents. We have not seen section 484 used in these packets as a serious preview of a criminal prosecution about ordinary advertising analytics. The citation is there to name a crime for the crime-tort exception. A business that is actually impersonating customers or breaking into accounts is in a different conversation and needs counsel immediately.
Theft is a specific crime, not a synonym for collection
Section 484 gives a demand letter a sharp word. Sharp words are not elements. The statute asks whether personal property was taken. Tracking data, copied from a browser that still holds the same information, has not fared well under that question, including in Ramos. Recipients should still tighten the data they send to Meta, because other claims in the stack do not depend on calling the transmission a theft. They should not let claim (f) set the emotional temperature of the file. It is a predicate in search of a taking.
This article is for educational purposes and is not legal advice.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
