Judge Vince Chhabria, in the Northern District of California, granted summary judgment in favor of a website operator, holding that the use of Meta’s tracking pixel did not violate CIPA because Meta did not “read” or “attempt to learn” the contents of user communications while they were “in transit.” The ruling highlights the ambiguity of CIPA’s statutory language when applied to modern internet technologies and calls for legislative reform.
The language of CIPA is a total mess. It was a mess from the get-go, but the mess gets bigger and bigger as the world continues to change and as courts are called upon to apply CIPA’s already-obtuse language to new technologies. Indeed, we have reached the point where it’s often borderline impossible to determine whether a defendant’s online conduct fits within the language of the statute.
- CIPA’s Ambiguity in the Digital Age: The court emphasized that CIPA, enacted in 1967 to address wiretapping and eavesdropping, is ill-suited for application to internet-based communications. The statutory language—particularly terms like “read,” “in transit,” and “intercept”—does not map cleanly onto the realities of web data collection.
- Rule of Lenity and Narrow Construction: Because CIPA is a criminal statute that also imposes punitive civil penalties, the court applied the rule of lenity, resolving ambiguities in favor of a narrower interpretation that limits liability.
- “Contents” of Communication: The court found that detailed URLs and related data collected by Meta’s pixel (such as page paths, time spent, and certain user actions) do constitute the “contents” of a communication under CIPA, as they can reveal sensitive information about a user’s activities and interests.
- “In Transit” Requirement Not Met: The dispositive issue was whether Meta “read” or “attempted to learn” the contents of communications while they were “in transit.” The court concluded that Meta’s processing of data occurred after the communication had reached its destination, and that automated filtering of data did not amount to “reading” or “learning” the contents in the statutory sense.
- No CIPA Liability for Standard Web Tracking: The court held that, under the current statutory framework, the use of third-party analytics and advertising tools like Meta Pixel—at least as configured in this case—does not trigger CIPA liability for website operators.
As difficult as it is to apply CIPA to the physical world, it’s virtually impossible to apply it to the online world. Hopefully, the Legislature will go back to the drawing board on CIPA. Indeed, it would probably be best to erase the board entirely and start writing something new.
But until that happens, courts should not contort themselves to fit the type of conduct alleged in this case into the language of a 1967 criminal statute about wiretapping. Because the evidence is
undisputed that Meta did not read, attempt to read, or attempt to learn the contents of Doe’s communications with ERC while those communications were in transit, ERC is entitled to summary judgment on Doe’s CIPA claim. Doe’s motion for summary judgment as to her CIPA claim is accordingly denied.
Jane Doe v. Eating Recovery Center LLC, 3:23-cv-05561-VC (Oct. 17, 2025 N.D. Cal.).
