Variety Media v. Superior Court could reshape California’s wave of CIPA website-tracking lawsuits by expanding the statute to internet communications while simultaneously narrowing what plaintiffs must show to plead a pen-register claim.
A closely watched California appellate case over whether decades-old pen-register law can be applied to modern website tracking has produced a tentative ruling — and neither side is getting everything it wanted.
The California Court of Appeal, Second Appellate District, Division Three, issued a tentative ruling in Variety Media, LLC v. Superior Court, Case No. B350578, ahead of oral argument scheduled for August 25, 2026.
The court tentatively concludes that California’s pen-register statute is not limited to traditional telephone surveillance and can reach internet communications.
That is a significant victory for plaintiffs pursuing California Invasion of Privacy Act claims against websites using third-party tracking technologies.
But the court simultaneously concluded that the plaintiff’s existing allegations do not state a valid pen-register claim.
The reason could prove just as important as the broader internet question:
A visitor’s IP address identifies the source of a communication. A pen register, according to the court’s tentative interpretation, must capture information identifying the destination of an outgoing communication.
The tentative ruling therefore would direct the trial court to sustain Variety Media’s demurrer — but with leave for plaintiff Sean Rose to amend his complaint.
The result is an unusual but potentially important split decision: CIPA’s pen-register provisions may extend to the internet, but the IP-address theory underlying many website-tracking claims may not be enough.
The California appellate docket confirms the tentative ruling was issued August 21, 2026. Oral argument is scheduled for August 25 at 1:30 p.m., meaning the decision remains tentative and could still change before the court issues its final opinion.
What Variety Media Was Fighting
The underlying lawsuit alleges that when someone visits Variety Media’s website, third-party tracking technologies are placed in or interact with the visitor’s browser and transmit information including the visitor’s IP address and device information to third parties.
The plaintiff contends that those technologies qualify as “pen registers” under California Penal Code Sections 638.50 and 638.51.
Section 638.51 generally prohibits installation or use of a pen register or trap-and-trace device without a qualifying court order, subject to statutory exceptions. The statute also contains exceptions for certain uses by providers of electronic or wire communication services, including where user consent has been obtained.
Variety argued that California’s pen-register provisions were intended for telephone surveillance — not ordinary website technologies such as cookies, pixels, analytics tools or advertising trackers.
That issue has generated sharply different results in California litigation.
Several federal courts have allowed internet-based Section 638.51 theories to proceed, while other courts have focused on the statutory references to telephone lines and rejected attempts to transform ordinary website technologies into pen registers.
The significance of Variety Media is that a California appellate court is now addressing the statutory interpretation question directly.
The case has become important enough that federal courts handling other CIPA tracking cases have stayed proceedings while awaiting the appellate court’s answer, including litigation involving BetterHelp and other defendants.
The Court Tentatively Says CIPA Pen Registers Can Extend Beyond Telephones
On the broad statutory question, Variety appears to be losing — at least under the tentative opinion.
The appellate court tentatively concludes that California’s definition of a pen register should be read consistently with the federal definition from which California borrowed its language.
Rather than limiting the term to equipment physically connected to traditional telephone lines, the court views the statutory definition as sufficiently technology-neutral to encompass metadata associated with internet communications.
The court’s reasoning focuses heavily on the Legislature’s adoption of the pen-register provisions in 2015.
California Appeals Court Tentatively Rules CIPA Pen Register Law Can Reach Website Tracking — But IP Addresses Alone May Not Be Enough
According to the tentative analysis, California created its own statutory mechanism in part so California law enforcement could obtain pen-register information while satisfying California’s stronger probable-cause protections and remaining consistent with federal law.
The court therefore appears unwilling to interpret California’s definition more narrowly than the corresponding federal definition.
This is not a small holding.
If it survives oral argument and appears in the final opinion, defendants may have considerably more difficulty winning dismissal simply by arguing:
“A website tracker cannot be a pen register because pen registers only apply to telephones.”
The court also tentatively rejects Variety’s argument that applying the statute to internet activity creates an irreconcilable conflict with the California Consumer Privacy Act.
Likewise, it tentatively rejects application of the rule of lenity as a reason to restrict Section 638.51 to telephone surveillance.
But that is only half the ruling.
The Court Then Narrows What a Pen Register Actually Has to Collect
The more immediate defense victory comes from a different question:
What information must the alleged pen register record?
A pen register traditionally identifies information associated with the destination of an outgoing communication.
A trap-and-trace device, by contrast, historically identifies information concerning the source of an incoming communication.
That distinction matters enormously on the internet.
Plaintiffs in website-tracking lawsuits frequently focus on the collection or transmission of the visitor’s IP address.
But the visitor’s IP address ordinarily identifies the visitor — the source of the communication.
The tentative ruling concludes that this is not enough to satisfy the definition of a pen register.
According to the court’s tentative construction, Section 638.50(b) reaches a device or process recording or decoding metadata that is likely to identify the destination of an outgoing communication.
That could substantially change how these lawsuits must be pleaded.
A complaint that effectively says:
A tracker collected my IP address, therefore it was a pen register
may no longer survive.
The plaintiff would instead have to sufficiently allege that the technology recorded qualifying routing, addressing or signaling information identifying where an outgoing communication was directed.
Why Origin, Referer and Domain Data Suddenly Matter
The tentative ruling does not end the case because the plaintiff included allegations involving additional information.
Among the fields discussed are:
domainOriginReferer
Those fields can potentially contain information concerning websites, hosts or locations involved in an HTTP communication.
The appellate court does not tentatively hold that those fields automatically establish a pen-register violation.
Instead, it identifies another critical factual and technical distinction.
The question is whether the tracker was actually positioned to capture destination-identifying metadata as the outgoing communication occurred, or whether the tracker simply generated a separate communication afterward containing information describing a previous event.
That distinction could become one of the most important technical questions in future CIPA pen-register litigation.
It moves the inquiry away from merely asking:
“Did a tracker receive information?”
and toward asking:
“What network communication occurred, who initiated it, where was it going, what metadata accompanied it, and exactly when and how did the alleged tracker obtain that information?”
That is a substantially more technical analysis.
The Court Is Giving the Plaintiff Another Opportunity
The tentative ruling would not dismiss the case permanently.
Instead, the appellate court proposes directing the trial court to sustain Variety’s demurrer with leave to amend.
That matters because the destination-versus-source argument was raised comparatively late in the appellate briefing.
The court therefore believes the plaintiff should have an opportunity to plead additional facts concerning how the trackers allegedly operate and whether fields including domain, Origin and Referer qualify as destination-identifying metadata.
In other words, Variety may win dismissal of the existing complaint while potentially losing the broader statutory interpretation that could affect hundreds of other businesses.
The next complaint will likely provide a preview of how plaintiffs attempt to adapt their theories to the destination requirement.
There Is Still a Major Problem With the Court’s Internet Interpretation
Variety has another statutory argument that remains particularly important.
California’s definition of a pen register contains technology-neutral terminology referring to wire and electronic communications.
But the statute that tells someone how to obtain the required court order — Penal Code Section 638.52 — remains unmistakably written around telephone surveillance.
Among other requirements, Section 638.52 instructs that an order identify, when known, the subscriber associated with the telephone line and the number and physical location of the telephone line to which the pen register or trap-and-trace device will be attached.
The California appellate court itself highlighted this precise problem when it ordered supplemental briefing earlier this year.
Variety argued that although California borrowed the federal definition of “pen register,” California did not adopt the corresponding federal amendment expanding the court-order language from a “telephone line” to a telephone line or other facility.
The official appellate docket records Variety’s argument that this difference demonstrates that California retained a statutory scheme centered on telephonic surveillance.
That creates a significant statutory-structure question.
Section 638.51 says a person generally cannot install or use a pen register without obtaining an order under Sections 638.52 or 638.53.
Yet Section 638.52 describes an application made by a peace officer investigating a crime and requires information concerning the telephone line to which the device will be attached.
If ordinary website analytics technologies can nevertheless become pen registers, the statute begins producing an awkward question:
What practical court-order mechanism did the Legislature intend private website operators to use?
That tension is likely to remain a central issue during oral argument and in any later review of the decision.
SB 690 Could Change the Stakes Dramatically
While the courts debate what Section 638.51 means, the California Legislature is considering a much more direct response.
Senate Bill 690 has changed considerably during the legislative process.
The current July 2, 2026 version no longer broadly rewrites CIPA’s definition of commercial activity.
Instead, it specifically targets private litigation under Section 638.51 arising from internet activity.
Under the current language, a Section 638.51 action against a private actor arising from conduct on an internet website, online application or mobile application could be brought only by the California Attorney General.
The bill would therefore effectively eliminate the private right of action for the category of internet-based pen-register claims currently driving this litigation while leaving governmental enforcement available.
It also contains a retroactivity provision covering certain pending claims filed within two years before the legislation’s operative date.
And SB 690 is very much alive.
After being placed on the Assembly Appropriations suspense file on August 5, it passed out of committee 15-0 on August 13 and was ordered to third reading.
It still must complete the legislative process and become law, so businesses should not treat SB 690 as existing protection.
But its progress is particularly significant given the tentative Variety Media ruling.
If the appellate court ultimately holds that Section 638.51 reaches internet communications while SB 690 simultaneously eliminates private internet-based Section 638.51 actions, California could end up with an unusual result:
The statute could apply to website tracking, but private plaintiffs would largely lose the ability to monetize those allegations through Section 638.51 lawsuits.
What This Means for Website Operators Right Now
Businesses should not interpret the tentative ruling as meaning that the CIPA pen-register litigation problem has disappeared.
It has not.
Nor should plaintiffs interpret it as a blanket appellate endorsement of every tracker-based Section 638.51 claim.
The tentative ruling instead appears to be drawing a much more technical boundary.
For companies operating websites, the immediate questions now include:
1. What information do third-party technologies actually transmit?
Businesses should know considerably more than whether a website “uses cookies.” Network-level analysis should identify destinations, request URLs, IP addresses, query parameters, headers, identifiers and other metadata transmitted to third parties.
2. Which technologies activate before consent?
Section 638.51 expressly recognizes consent in certain circumstances. Consent architecture, blocking behavior and evidence showing what happened before and after a user’s choice remain important.
3. What do Origin, Referer, domain and routing fields reveal?
The tentative ruling specifically signals that destination-related fields may become the next battleground.
4. Can the company prove what happened during the user’s visit?
Static cookie inventories are increasingly inadequate for defending highly technical tracking allegations. Companies need evidence showing when technologies loaded, what requests were made, where data was transmitted and what consent state existed at that moment.
5. Do not assume an IP-address allegation alone proves a pen register claim.
If the tentative reasoning becomes final, the source-versus-destination distinction could provide an important defense to complaints based primarily on collection of a visitor’s IP address.
Today there’s a big hearing
Variety Media may ultimately become one of the most important decisions in the rapidly developing body of California website-tracking litigation.
The tentative ruling takes an unexpectedly middle position.
It potentially expands CIPA by concluding that pen-register protections can reach internet communications.
At the same time, it may substantially narrow the easiest version of the plaintiffs’ theory by holding that collection of the visitor’s IP address — source information — does not itself constitute the destination information associated with a pen register.
The next fight becomes far more technical:
What exactly did the tracker record, what communication did that information belong to, and did the information identify the destination of an outgoing communication?
Meanwhile, SB 690 could dramatically reduce the financial incentive behind the litigation by reserving internet-based Section 638.51 actions against private actors to the California Attorney General.
For businesses facing CIPA demands, lawsuits or website-tracking investigations, all three developments now need to be watched simultaneously:
the final Variety Media opinion, the plaintiff’s expected amended allegations, and the final legislative fate of SB 690.
For now, the ruling remains tentative.
Oral argument is scheduled for today, and the Court of Appeal can modify its reasoning before issuing its final decision.