In Anderson, et al. v. National Collegiate Athletic Association, 2026 WL 925519 (C.D. Cal. 2026), Judge Michelle Williams Court denied the National Collegiate Athletic Association’s and Turner Sports Interactive, Inc.’s motion to dismiss a putative class action alleging that third-party trackers installed on http://www.NCAA.com operated as pen registers in violation of the California Invasion of Privacy Act, California Penal Code § 638.51.
Background. Plaintiffs alleged that NCAA.com embedded third-party trackers from Adform, Audiencerate, OpenX, Microsoft/Adnxs, and Wunderkind. According to the complaint, the site’s HTTP responses caused trackers to load on users’ browsers and transmit IP addresses, browser and device information, unique identifiers, session data, clickstream activity, geolocation, browsing history, and other information. The trackers allegedly persisted across websites and enabled third parties to build profiles for targeted advertising. The plaintiffs sued under CIPA Section 638.51 and related California privacy theories; the NCAA and Turner Sports moved to dismiss.
The Court’s Analysis. The court distinguished Popa v. Microsoft, where session-replay monitoring of routine activity on one website was compared to a store clerk observing shoppers. Here, the alleged persistent identifiers enabled broad dissemination across the internet, implicating the common-law privacy interest in controlling information about oneself and remaining anonymous. The court therefore found Article III standing even though an IP address alone ordinarily would not suffice, and treated the loss of control and broad dissemination as closely related to traditional privacy harms under TransUnion. It also held that the installed trackers plausibly captured routing and signaling information within CIPA’s definition of a pen register or trap-and-trace process. The alleged provider exception was not suitable for resolution on a motion to dismiss because the complaint did not establish that the third-party trackers were necessary to operate, maintain, or test NCAA.com.
Significance. The decision signals that the scope and persistence of tracking may matter more than any single data point. Cross-site identifiers, browsing history, and dissemination to multiple advertising partners can support standing and a CIPA claim even where the operator characterizes the data as ordinary device metadata.
