Greetings CIPAWorld!
I’m back with another exciting case to put on your radar. So, what’s the scoop? On the surface, Vishal Shah v. Fandom, Inc. may seem like a simple dispute over a few lines of code on a gaming website, gamespot.com. See Vishal Shah v. Fandom, Inc.No. 24-cv-01062-RFL, 2024 US Dist. LEXIS 193032 (ND Cal. Oct 21, 2024). However, it delves into a more important issue: the conflict between privacy rights and business practices. The ruling by the United States District Court for the Northern District of California is critical in interpreting how the California Invasion of Privacy Act (“CIPA”) applies to internet tracking practices.
CIPA, as many of you know, is about protecting personal information. At the center of this case is Cal. Penal Code § 637.7, which prohibits the installation or use of a “pen register” without a court order. The law broadly defines a pen register as “a device or process that records or decodes calling, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted.” Identity card Although initially drafted with telephone technology in mind, Plaintiff in this case argues that this definition includes Fandom’s tracking code, which allegedly captures and shares users’ IP addresses without consent. Yes.
Fandom, of course, pushed back, claiming that IP addresses are “content” and not “addressing information,” meaning CIPA’s rules wouldn’t apply. But this position directly corresponds to the Ninth Circuit’s holding In connection with Zynga Priv. Litigation.750 F.3d 1098, 1108 (9th Cir. 2014), where the Court held that “IP addresses constitute address information and do not necessarily reveal more about the underlying content of the communication.” Enter the Court Vishal Shah ran with this logic and said that IP addresses are a lot like phone numbers; in effect, they serve as ‘address information’ under CIPA.
So why does this matter?
I’m glad you asked. The Court was not shy about interpreting CIPA in a manner consistent with its goal of protecting privacy. It pointed to the California Supreme Court’s instruction in Flanagan vs. Flanagan41 P.3d 575, 581 (Cal. 2002), to read CIPA broadly. The Court has also cited Greenley v. Kochava, Inc.684 F. Supp. 3d 1024, 1050 (S.D. Cal. 2023), emphasizing that CIPA’s definition of a pen register is not about the technology used, but rather the data collected. This approach aligns with California’s goal to update its privacy statutes with digital and tracking technology.
Fandom then argued that users implicitly consented to the collection of IP addresses simply by visiting the site. It seems like a simple argument. However, the Court did not believe it. It explained that “consent is generally limited to the specific permitted conduct,” meaning that merely appearing on a website does not count as consent to have third parties collect your IP address. The Court emphasized that the real problem is whether the user specifically agreed to this kind of tracking, and that’s something Fandom hadn’t shown.
Fandom also claimed that collecting IP addresses is just part of how websites work – no big deal, right? The Court agreed that this is a common practice, but drew the line when it came down to it sharing that information with third parties without the user’s consent. According to the Court, “Plaintiffs plausibly alleged that they did not expect their IP addresses to be distributed to the companies operating the Trackers, and that they did not implicitly or expressly consent to such distribution by visiting gamespot.com.”
What’s the big picture here?
The Court took a step back to remind us of the legislative intent behind CIPA, citing Cal. Criminal Code § 630: “[t]The Legislature intends this chapter to protect the right to privacy of the people of this state.” The Court emphasized that California courts are expected to interpret CIPA broadly and apply it to new technology where it fits within the legal framework. See Matera v. Google Inc.No. 15-cv-04062, 2016 WL 8200619, at *19 (ND Cal. Aug. 12, 2016). So when Fandom argued that continuing the lawsuit could “disrupt the fundamental rules of operation of the Internet,” the Court’s response was clear: its job is to apply the law as it is written. If this causes friction, it is up to the legislator to address this.
Ultimately, the Court denied Fandom’s motion to dismiss, allowing the case to proceed. So be careful. This ruling is a reminder that websites that collect IP addresses and share them with third parties – without clear, informed consent from the user – may violate CIPA. Vishal Shah is much bigger than a video game website; it’s a look into the ongoing debate over online data privacy and user rights in the digital age.
To remind,
Keep it legal, keep it smart and stay ahead.
Talk quickly!
