Fregosa v. Mashable Inc.

Background

Dawn Fregosa brought a putative class action against Mashable, Inc. under the California Invasion of Privacy Act. She alleged that Mashable embedded third-party trackers operated by Microsoft, Wunderkind, and PubMatic on its website. According to the Second Amended Complaint, the trackers collected visitors’ IP addresses and device fingerprints, including device type, browser type, and persistent identifiers, and transmitted that information to third parties for advertising and profiling.

Fregosa alleged that when users visited Mashable’s website, their browsers sent HTTP requests to Mashable’s servers and then received instructions that installed and ran the third-party trackers. The trackers allegedly caused browsers to transmit IP addresses and device information to the outside companies. Fregosa claimed that Mashable installed or used pen registers without first obtaining a court order, as required by California Penal Code section 638.51.

Fregosa sought to represent a class of California residents who accessed the website in California and had their IP addresses collected by the trackers. The court noted that an earlier complaint had been dismissed for lack of personal jurisdiction, with permission to amend. Mashable did not challenge jurisdiction in this motion.

Mashable’s Motion

Mashable moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which allows dismissal when a complaint does not state a legally sufficient claim. Mashable argued that the California Pen Register Act applies only to person-to-person communications, such as telephone calls, text messages, or email, and not to general website activity.

Mashable also argued that Fregosa had not adequately alleged a pen-register violation because the trackers captured information different from telephone numbers, website visits were not qualifying electronic communications, Mashable was the intended recipient of users’ communications, and the third-party vendors—not Mashable—operated the trackers. Mashable further argued that the rule of lenity required a narrow interpretation of the statute because it was ambiguous. The rule of lenity is a principle that may favor a narrower interpretation of an unclear penal law.

Court’s Analysis

The court concluded that the California statute’s definition of a pen register is broad and technology-neutral. It covers a “device or process” that records or decodes dialing, routing, addressing, or signaling information. The court reasoned that the statute focuses on the function of the information-collection process rather than whether the tool is traditional telephone hardware or website software.

The court held that the alleged trackers could plausibly qualify as pen registers because they recorded IP addresses and device identifiers associated with users’ outgoing HTTP requests. An IP address was plausibly addressing information because it identifies the device sending the communication and helps determine where the data should be routed. The court also held that an HTTP request from a browser to a website server is an electronic communication covered by the statute, even though it does not involve an exchange between two people.

The court rejected Mashable’s argument that it could not be liable because it was a party to the initial communication or because third-party vendors technically operated the trackers. At the pleading stage, the allegations that Mashable embedded the trackers in its website, caused users’ browsers to run them, and used the resulting data were enough to allege that Mashable itself installed or used a covered process. The court characterized Fregosa’s theory as based on Mashable’s own conduct rather than secondary liability for the vendors’ actions.

The court also declined to rely on Senate Bill 690, explaining that the bill had not been enacted and that courts could not use an unenacted proposal to narrow the existing statute. Finally, the court held that the statute did not contain the kind of extreme ambiguity required to apply the rule of lenity.

Other Rulings and Disposition

The court granted Mashable’s requests for judicial notice of several California superior court orders and a transcript concerning a legislative hearing, but stated that those materials could be noticed for their existence or occurrence rather than for the truth of disputed factual statements.

The court denied Mashable’s motion to dismiss the Second Amended Complaint. This was a pleading-stage ruling: it determined that Fregosa’s allegations were legally sufficient to continue, not that Mashable was ultimately liable or that a class should be certified.