Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

There continues to be a significant number of privacy claims filed based on the California Invasion of Privacy Act (CIPA). These claims primarily involve the manner in which a business’s website uses third-party cookies, pixels, or tags to collect end users’ data (e.g., IP addresses, search bar terms, “contact us” forms) and often allege noncompliance with CIPA’s provisions governing wiretapping and the use of pen registers and trap and trace devices (PR/TT). In recent weeks, two California judges issued different rulings on similar CIPA PR/TT cases: one denying a defendant’s demurrer and one granting the motion. Importantly, the judge who denied the demurrer also denied the defendant’s request to strike the availability of punitive damages as a remedy, which can have significant implications for businesses looking to settle these cases before they result in litigation. The judge granting the demurrer found that CIPA’s PR/TT provisions only regulate telephonic communications and not websites or similar internet communications.

contentpilot/introduction

Rodriguez v. <a>Indium </a>Software, Inc.: Punitive Damages Available

core/heading

On April 25, 2024, plaintiff Rebeka Rodriguez filed a complaint in L.A. County Superior Court alleging that <a>Indium </a>Software, Inc. violated CIPA’s PR/TT clauses through its use of tracking technology on its corporate website. After the parties submitted various pretrial motions, Rodriguez filed an amended complaint, and on November 4, 2024, Indium filed a demurrer with a motion to strike, essentially arguing that the complaint failed to allege facts indicating that CIPA prohibits the use of website technology collecting IP addresses and federal court rulings contradict such allegations, and that CIPA does not provide for either punitive damages or attorney’s fees.

core/paragraph

On February 6, 2025, Judge Michael Shultz denied Indium’s demurrer and motion to strike, reiterating Rodriguez’s allegations that when she visited the website, the “Defendant caused a PR/TT beacon to be installed on Plaintiff’s browser to collect Plaintiff’s unique IP address as well as the user’s operating system name and version number; browser name, version number, and language; screen resolution; geolocation data, email address, mobile ad IDs, and embedded social media identities, among other personal information” and that Rodriguez did not consent to and Indium did not obtain a court order authorizing it to conduct this activity.

The court found Indium’s argument that it only collected innocuous IP-related data to be “undermined by the specific information allegedly obtained, which was unique to Plaintiff and involved more than an IP address” and the “Defendant has not persuasively distinguished” the facts at hand from Greenley v. Kochava, Inc., 684 F.Supp.3d 1024 (S.D. Cal. 2023). Here, Judge Shultz focused on key elements of that case: “Greenley underscored the court’s observation that the term ‘pen register’ was defined with ‘expansive language’ and constitutes a ‘process’ as used in the statute. Greenley did not limit ‘sensitive information’ to include only religious affiliation, sexual orientation, or medical condition.” In conclusion, Judge Schultz found that the Greenley decision described “the information likely to be collected as alleged by the plaintiff in that case.” Accordingly, because Indium did not fully address the type of data it allegedly collected in its response, the court denied its demurrer.

Judge Schultz next turned to Indium’s motion to strike the claims for recovery of punitive damages and attorney’s fees, stating that a “plaintiff may recover exemplary damages where the defendant is guilty of oppression, fraud, or malice” and the “predicate acts to support the claim must be intended to cause injury or must constitute ‘malicious’ or ‘oppressive’ conduct.” He further noted that “absent an intent to injure the plaintiff, the conduct must be ‘despicable,’ defined as ‘base, vile, or contemptible.’”

Next, Judge Schultz stated that “Plaintiff alleges that Defendant surreptitiously places software on Plaintiff’s computer that enables it to mine sensitive information unique to Plaintiff to establish a digital ‘fingerprint’ that Defendant then sells to others, all without Plaintiff’s consent.... These allegations fall within the scope of a criminal statute and adequately serve as predicate facts to support the claim for punitive damages and from which a trier of fact could determine that the conduct was ‘despicable’ and carried on with a willful and conscious disregard of Plaintiff’s rights.”

Sanchez v. Cars.com: Failure to State a Claim

On May 28, 2024, plaintiff Monica Sanchez filed a complaint in L.A. County Superior Court alleging that Cars.com, Inc. violated CIPA’s PR/TT clauses through its use of tracking technology on its corporate website. After the parties submitted various pre-trial motions, Sanchez filed an amended complaint (“FAC”), and on October 28, 2024, Cars.com filed a demurrer on the grounds the FAC failed to state a claim. On January 27, 2025, Judge Tiana J. Murillo granted Cars.com’s motion and dismissed the case without granting Sanchez leave to further amend her complaint.

Judge Murillo began her legal analysis by taking issue with the broadly worded FAC, noting that “the FAC provides a lengthy exposition of theoretical possibilities of what website operators ‘can’ do to deploy tracking software and how a website owner ‘can’ correlate a grouping of fragments to create a unique digital profile of each website visitor. The FAC uses these theories of ‘can-dos’ with very few specific allegations pertaining to Plaintiff or the Defendant and relies on ‘likening’ alleged practices of companies to Defendant.” The judge emphasized that the “Plaintiff’s FAC is nearly identical to other CIPA actions filed by other tester plaintiffs.”

Judge Murillo then turned to the legal standard at issue, stating that the court was “not aware of, nor do the parties cite, any controlling published authority in California on the issue of whether internet communications constitute ‘pen registers’ or ‘track and trace devices’ within the meaning of the CIPA.” Accordingly, the court turned to CIPA’s plain language and legislative intent, noting that “with construction of a criminal statute” – like CIPA – “the defendant must be given the benefit of every reasonable doubt as to whether the statute applies to him.”

According to Judge Murillo, the text and legislative history of CIPA’s PR/TT clause suggest that it “applies only to telephone tracking technology, not IP address-collecting software used by a website to improve its user functionality and the effectiveness of its marketing.” Further, she noted that the “California legislature enacted Assembly Bill 929, the genesis of CIPA section 638.51, in 2015 to create a comprehensive framework governing how California law enforcement officials could obtain and use a pen register or trap and trace device, just like its federal counterpart” and in doing so it “adopted the same authorization provision in CIPA section 638.52 that courts have relied on under the federal Pen Register Act to find that the Act applied only to mechanical, telephone number-tracing technology, not technology used to collect the IP address from a desktop computer.” Thus, CIPA’s legislative history indicates that PR/TT refers to technology that collects data “from telephone numbers, and not internet communications such as websites.”

Last, Judge Murillo noted that Sanchez’s allegations in the FAC “are premised on the principle that her constitutional right to privacy has been violated by the [Cars.com] Website collecting her IP address.” However, according to Judge Murillo, “even if, arguendo, the collection of Plaintiff’s IP address constitutes operation of a pen register, Plaintiff has no reasonable expectation in the privacy of her computer’s IP address since she chose to access the [Cars.com] Website.”

core/separator

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2025/03/Privacy-Cybersecurity-Update-CIPA-Litigation-Update-From-Punitive-Damages-to-Failing-to-State-a-Claim.pdf

CIPA Litigation Update: From Punitive Damages to Failing to State a Claim

Services