Website analytics and advertising tools, such as pixels, are regularly targeted in lawsuits brought under various wiretap laws, including the federal Wiretap Act and the California Invasion of Privacy Act (“CIPA”).  Over the last several months, we have featured posts discussing an important decision from Massachusetts’ highest court about the availability of website wiretap suits under Massachusetts law, an opinion from a California court about a new “pen register” theory under CIPA, and more.  These posts, and other highlights, include the following:

• Massachusetts Supreme Judicial Court Holds That Third-Party Technologies Relating to Web Browsing Do Not Violate Massachusetts Wiretap Act.  Massachusetts’ highest court rules that website operators’ use of third-party technology, including Google Analytics and Meta Pixel, to collect data on individuals’ browsing of and interactions with websites does not violate the Massachusetts Wiretap Act.  Vita v. New England Baptist Hospital, 2024 WL 4558621 (Mass. Oct. 24, 2024).

• Another California Court Holds CIPA’s Pen Register Provision Does Not Prohibit the Collection of IP Addresses.  A second California court dismisses novel lawsuit challenging businesses’ use of website tools to collect IP addresses under the “pen register” and “trap and trace device” provision of the California Invasion of Privacy Act (“CIPA”), because CIPA “does not prohibit the use of technology on a website to collect visitors’ IP addresses.”  Rodriguez v. Plivo Inc., 2024 WL 5184413 (Cal. Super. Oct. 2, 2024).

• Pennsylvania District Court Judge Remands Case After Finding No Article III Standing to Bring Wiretapping Claim.  A Pennsylvania federal court remanded to state court a putative class action under Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”) due to a lack of Article III standing, explaining that the plaintiff’s “searches for drink flavors” allegedly collected on defendant’s website “is not the type of private information that, when disclosed, creates a harm sufficient to establish standing.”  Heaven v. Prime Hydration LLC, 2025 WL 42964 (E.D. Pa. Jan. 7, 2025).

• Pennsylvania Court Dismisses A Trio of Defendants in Website Wiretapping Suit Challenging Email Marketing Program.  Reaffirming established defenses for companies facing website wiretapping suits, another Pennsylvania federal court dismissed a complaint filed against a trio of defendants under WESCA and CIPA for lack of Article III standing, lack of personal jurisdiction, and failure to state a claim.  Ingrao v. Addshoppers, Inc., 2024 WL 4892514 (E.D. Pa. Nov. 25, 2024).

• California Federal Court Allows Software Vendor to Enforce Website Operator’s Arbitration Agreement in Privacy Lawsuit.  A California federal court applied principles of fairness under the doctrine of “equitable estoppel” to allow a software vendor to enforce a plaintiff’s arbitration agreement with a website operator, rejecting the plaintiff’s attempt to sidestep the arbitration agreement with the website operator by suing only the software vendor.  Perry-Hudson v. Twilio, Inc., 2024 WL 493333 (N.D. Cal. Dec. 2, 2024).

• California Federal Court Grants Summary Judgment to CIPA Defendants.  Another California federal court granted summary judgment to defendants under CIPA, because the defendants submitted evidence establishing the software vendor did not “read, attempt to read, or learn” the contents of any of plaintiff’s “hashed” data input on the website at issue.  Williams v. DDR Media, LLC, 2024 WL 4859078 (N.D. Cal. Nov. 20, 2024).