CIPA Sections 631 and 638.51 in Meta Pixel Demand Letters

If a Meta Pixel demand letter has a dollar figure that makes a finance team sit down, that figure is probably coming from the California Invasion of Privacy Act. Sections 631 and 638.51 are claim (l) in the stacked letters we are seeing sent to e-commerce and website operators, but they are not an afterthought. They are the statutes that authorize $5,000 per violation without proof of actual damages, and they are the statutes counsel multiply by every third-party domain in a HAR file. We have already explained CIPA as a whole, section 631 in litigation, and how pen-register claims are being used against website tracking. This article is about a narrower problem: how those two sections are being paired with an ECPA procurement theory in Meta Pixel demand letters, and how the same request is being counted twice.

What the two sections actually say

Penal Code section 631 is the older wiretap provision. It reaches a person who taps or makes an unauthorized connection, who willfully and without the consent of all parties reads or attempts to read the contents of a communication while it is in transit, or who uses information obtained that way. It also reaches a person who aids, agrees with, employs, or conspires with someone else to do those things. That last clause is why installing the Meta Pixel can be described as employing Meta. Civil recovery is available under section 637.2, which allows the greater of $5,000 or actual damages for each violation.

California is an all-party consent state for this purpose. In Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022), the Ninth Circuit’s unpublished memorandum disposition held that section 631 requires prior consent and that later agreement does not authorize an earlier interception. Plaintiff firms treat that decision as the reason a banner that appears after the pixel has fired cannot save the business. We covered the practical version of that problem in when the cookie banner becomes exhibit A.

Section 631 is about contents. A URL that is only an address may or may not qualify, depending on how much it reveals. A search term, a form field, or a path that discloses what the visitor was reading looks more like contents than an IP address. Federal courts applying CIPA to new technologies have said the statute is not limited to copper telephone lines. Matera v. Google Inc., No. 15-cv-04062-LHK, 2016 WL 8200619 (N.D. Cal. Aug. 12, 2016), is a frequently cited example of that broader reading in the email context.

Section 638.51 is a different rule. It generally prohibits installing or using a pen register or a trap-and-trace device without a court order, subject to exceptions that include the consent of the user. Section 638.50 defines a pen register as a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument from which a wire or electronic communication is transmitted, but not the contents of a communication. In other words, the pen-register statute is built for non-content metadata. Demand letters that want section 631 to treat a URL as contents and section 638.51 to treat the same URL as non-content routing information are trying to have both readings at once.

How Meta Pixel letters multiply the two statutes

In the letters that begin with ECPA procurement, CIPA is where the arithmetic happens. Counsel download a HAR file, count the third parties that received a request, and claim $5,000 under section 631 for each of them. They then claim another $5,000 under section 638.51 for each of the same requests. A single visit can be presented as tens of thousands of dollars before the $10,000 ECPA figure is added. Whether a court would count each vendor, each page view, or each session as a separate “violation” is contested, and defense strategies in CIPA cases often start by attacking that multiplier.

The factual story is the pixel’s parallel request to Meta, plus any other advertising or analytics calls visible in the HAR file. Off-Facebook activity is used to show that Meta received a page-view event. From those exhibits counsel infer both an interception of contents and the use of a pen register. The business is said to have aided Meta under section 631 and to have installed or used a pen-register process under section 638.51 by placing the pixel.

That dual characterization is the letter’s most important drafting choice. It is also its internal tension. If the strongest “contents” story is a search term or a sensitive URL, that evidence helps section 631 and sits uneasily with a statute that excludes contents. If the only data sent is an IP address, a cookie ID, and a generic page path, section 638.51 may be the better statutory fit, and section 631 may be the weaker one. Some courts have been especially skeptical that an IP address alone supports a pen-register claim, a point we discussed in our coverage of a Variety Media ruling on IP addresses.

Where courts actually are

There is no single California rule that every advertising pixel is, or is not, a CIPA violation. There is a growing pile of pleading-stage decisions.

On section 638.51, Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024 (S.D. Cal. 2023), allowed a pen-register theory to proceed against a software-development kit that collected routing and identifying information from devices. Later decisions have divided on how far the definition extends to ordinary website cookies and pixels. In DellaSala v. Samba TV, Inc., No. 3:25-cv-03470-JSC (N.D. Cal. Apr. 21, 2026), Judge Jacqueline Scott Corley rejected the argument that sections 638.50 and 638.51 apply only to telephone lines, quoting other courts for the observation that third-party internet trackers often meet the technical definition of a pen register. The same order dismissed the plaintiffs’ section 631 claim because they had not plausibly alleged that Samba read communication contents while those communications were in transit. That split inside one opinion is a useful corrective to letters that treat a surviving pen-register theory as a win on every CIPA count.

Harris v. iHeartMedia, Inc., 2026 WL 247875 (N.D. Cal. Jan. 29, 2026), denied a motion to dismiss tracker-based claims involving user profiles built from device and network metadata. Other decisions, including Shah v. Fandom, Inc., 754 F. Supp. 3d 924 (N.D. Cal. 2024), and Moody v. C2 Educational Systems Inc., 742 F. Supp. 3d 1072 (C.D. Cal. 2024), have also declined to confine pen registers to hardware on telephone lines. Those rulings are not verdicts about every retail use of the Meta Pixel, but they are reasons a section 638.51 theory needs analysis rather than a shrug.

On section 631, healthcare and form-field cases remain more dangerous because the “contents” allegation is easier to understand. A generic homepage view is a thinner contents story, though installing the pixel can still be described as aiding Meta. Consent timing and data minimization therefore matter even when the URL looks boring.

Practical steps if CIPA is driving the number

1. Separate contents from metadata in your own investigation. What did the Meta Pixel send: a generic path, a search query, a hashed email, a product name that reveals something intimate?
2. Count what actually fired, and when. A letter’s vendor list may include tags that did not run on the claimant’s visit or that ran only after consent.
3. Do not accept double counting without scrutiny. Ask counsel whether the same request can be both a contents interception and a pen-register event, and whether each vendor is a separate violation.
4. Fix pre-consent firing immediately after you preserve the old configuration. Subsequent consent does not rewrite an earlier transmission, and a working consent gate is still the main forward-looking control.

How Captain Compliance addresses the CIPA facts in these letters

CIPA letters succeed or fail on what the browser sent and whether anyone agreed first. Captain Compliance’s consent manager is built to block marketing pixels, including the Meta Pixel, until a recorded choice exists, and to honor Global Privacy Control so an opt-out signal is not ignored. The scanner is designed to show pre-consent fires, leftover tags after rejection, and other gaps that become HAR-file exhibits. Signed receipts help prove what the banner displayed. On eligible plans, Compliance Shield can financially back qualifying claims connected to consent and tracking disclosures when the platform is properly deployed and recommended settings are not bypassed. Those controls do not guarantee dismissal of every CIPA theory. They go after the millisecond problem and the silent third-party request that make the theories easy to type.

Frequently asked questions

Can the same Meta Pixel request produce $5,000 under section 631 and another $5,000 under section 638.51?

That is what many letters claim, on the theory that the remedies are cumulative. The statutes aim at different kinds of information, and courts have not uniformly accepted a double recovery for a single technical event. The multiplier is advocacy until a court or arbitrator applies it to your facts.

Does every cookie become a pen register?

No. Section 638.51 requires a device or process that records routing, addressing, or signaling information, and it has a user-consent exception. Some courts have found that certain trackers meet the definition at the pleading stage. Others have limited particular theories, including some IP-address-only claims. The label “cookie” does not end the analysis.

If we disclose the Meta Pixel in our privacy policy, are we safe under CIPA?

A disclosure can help with notice and with other statutes, but Javier and later CIPA cases have focused on prior consent, not on the mere existence of a policy. A policy the visitor never saw, or a policy that appears after the pixel has already fired, is not a complete answer to section 631.

Two statutes, one pixel, and a lot of arithmetic

CIPA is the reason Meta Pixel demand letters feel expensive. Section 631 asks whether someone read communication contents in transit without all-party consent, or helped someone else do so. Section 638.51 asks whether a process recorded routing or addressing information without the user’s consent or a court order. Those are different questions, and they are both more precise than “you used a pixel.” When a letter lists them as claim (l) at the end of a long stack, do not let weaker theories distract you from this pair, and do not let this pair’s opening number pass without looking at what the pixel actually sent. The rest of the cluster explains the scaffolding. This pair carries most of the weight.

This article is for educational purposes and is not legal advice.