The Superior Court of California, San Francisco County, overruled a demurrer, allowing a privacy class action to proceed based on allegations that website trackers collected users’ IP addresses and device metadata without consent, potentially violating California’s pen register statute (Penal Code § 638.51(a)).
Allegations
Plaintiff alleges that, between 2020 and August 2024, visiting the subject website resulted in the installation of trackers that enabled third parties to collect users’ IP addresses, device metadata, and set unique user IDs. This data allegedly allowed pervasive tracking across multiple sessions and websites, deanonymization, and the creation or matching of user profiles for targeted advertising and monetization—all without user consent or a court order.
Standing:
Defendant argued that the plaintiff lacked standing because IP addresses and device metadata are not sensitive personal information. The court rejected this argument, finding that California Penal Code § 637.2 provides a private right of action to any person injured by a violation of the statute, and that the plaintiff sufficiently alleged injury through unauthorized tracking and data collection.
Definition of “Pen Register”:
A central issue was whether the trackers qualify as “pen registers” under Penal Code § 638.50(b), which covers devices or processes that record “dialing, routing, addressing, or signaling information” from electronic communications. The court found that the plaintiff’s allegations—that the trackers captured IP addresses, device metadata, and unique user IDs—were sufficient to meet this definition at the pleading stage.
Interpretation of the Statute:
Defendant contended that applying the pen register statute to website trackers would lead to absurd results. The court disagreed, emphasizing that the statute is broadly written to protect privacy and is intended to adapt to new technologies. The court cited persuasive federal authority supporting the application of the statute to similar tracking technologies.
No Need to Prove Actual Damages:
The court clarified that, under the statute, a plaintiff may seek statutory damages of $5,000 per violation without needing to prove actual damages, provided the conduct constitutes the unconsented installation of a pen register or trap and trace device.
Scarlett v. Future US, LLC, No. CGC-25-621912, 2025 WL 2614587 (Cal.Super. Sep. 05, 2025).
