Lesh v. Cable News Network, Inc.

Background

Carol Lesh brought a proposed class action against Cable News Network, Inc. (CNN), alleging violations of California Penal Code § 638.51, part of the California Invasion of Privacy Act (CIPA). Lesh alleged that CNN’s website installed third-party trackers on her browser. The trackers collected her internet protocol address, used it to identify her geographic location and coordinates, and stored a cookie that could help identify repeat visitors. Lesh alleged that she did not consent and that CNN did not obtain a court order before installing or using the trackers.

CNN moved to dismiss the amended complaint for failure to state a legally sufficient claim under Federal Rule of Civil Procedure 12(b)(6). CNN also moved to strike Lesh’s class allegations. The court considered the factual allegations as true for purposes of the motion and drew reasonable inferences in Lesh’s favor.

CIPA Claim and Statutory Standing

CIPA prohibits a person or entity from installing or using a “pen register” or “trap and trace device” without first obtaining a court order, subject to statutory exceptions. CIPA defines a pen register as a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the communication’s contents.

CNN argued that Lesh lacked statutory standing because collecting internet protocol addresses did not fall within CIPA’s protected interests. The court rejected that argument. It explained that Fourth Amendment cases concerning privacy in internet protocol addresses did not control whether CIPA provided a statutory right to sue. Lesh alleged that CNN-installed trackers sent her internet protocol address to third parties for advertising purposes and that she did not expect or agree to that tracking. The court held that these allegations plausibly showed an injury covered by CIPA and that Lesh had statutory standing.

Trackers as Pen Registers

The court held that Lesh adequately alleged that CNN’s trackers qualified as pen registers under CIPA. The trackers could qualify as a “device or process” because they were software that identified users, gathered data, and correlated that data. The court also concluded that internet protocol addresses could qualify as “addressing information” because they contain information about the location of a device, including its state, city, and zip code.

The court further found that Lesh adequately alleged transmission of an electronic communication. According to the complaint, her browser sent a request to CNN’s server, CNN’s server sent instructions that installed the trackers, and the trackers prompted the browser to send her internet protocol address. The court rejected CNN’s argument that CIPA’s pen-register provisions apply only to telephone information. It relied on the statute’s reference to electronic communications and found no limitation in the statutory definition restricting pen registers to telephone lines.

Because Lesh alleged that CNN installed two trackers on her browser, that the trackers collected her internet protocol address and used it to determine her location, and that CNN lacked a court order, the court found that she adequately stated a CIPA claim.

Consent

CNN argued that a CIPA exception allowed it to use a pen register when the user of the service had consented. The court rejected CNN’s argument that CNN’s own consent to installing the trackers could satisfy that exception. Lesh was also a user of CNN’s website, and she alleged that she did not consent to the trackers’ collection of her information. The court stated that accepting CNN’s interpretation could allow entities to avoid liability based on their own consent to trackers they installed or caused to be installed.

Website Terms and Class Waiver

CNN also argued that Lesh had agreed to the website’s terms of use, which CNN said disclosed third-party tracking, selected New York law, and barred participation in a class action against CNN. CNN submitted screenshots of archived website pages from the Wayback Machine to support this argument.

The court declined to take judicial notice of the screenshots because Lesh disputed their authenticity and CNN’s attorney was not a representative of the Wayback Machine. The court also found that the screenshots were not incorporated into the amended complaint. Even if the court had considered them, it concluded that deciding whether the website’s pop-up gave Lesh notice of the terms and obtained her consent would require further factual development. The court therefore accepted Lesh’s allegation at this stage that she had not given CNN prior consent to install or use the trackers.

Disposition

The court denied CNN’s motion to dismiss the amended complaint. It separately denied CNN’s motion to strike Lesh’s class allegations. The court ordered CNN to answer the amended complaint within 21 days of the February 20, 2025 order and directed the clerk to close the motion on the docket.