Run a free scan

Variety Media: a California appeal court’s tentative view that a visitor’s own IP address is not pen register data

Know what your trackers send besides the IP address, such as the page URL in a Referer header. The first California appellate court to look at website pen register claims tentatively said the statute covers the internet, but that a visitor’s own IP address is not the kind of data a pen register records.

Los Angeles County Superior Court and California Court of Appeal · CIPA §638.51 · Tentative ruling 21 August 2026; resubmitted 15 October 2026 after SB 690 briefing

The problem

Sean Rose alleged that when someone visits Variety’s website, Variety causes third-party "Trackers" to be installed in the visitor’s browser, and that they transmit the visitor’s IP address and other device information to data brokers, who identify visitors and compile profiles for sale to advertisers (tentative ruling at 1). He filed on 23 January 2025 with a single §638.51 cause of action (Court of Appeal letter of 1 October 2026, on the docket).

Case record

Courts
Los Angeles County Superior Court, Dept. 11 (Judge David S. Cunningham III); Court of Appeal, Second District, Division Three
Case numbers
25STCV01865; B350578
Parties
Sean Rose v. Variety Media, LLC (writ: Variety Media, LLC v. Superior Court)
Counsel
Rose: Bursor & Fisher, P.A. and Gupta Wessler LLP ([answer to amici](https://www.guptawessler.com/wp-content/uploads/2026/05/2026.5.21.-Rose.-Consolidated-Response-to-Amicus-Briefs.pdf)). Variety: Theodore Joseph Boutrous, Jr. and others listed on the [docket](https://appellatecases.courtinfo.ca.gov/search/case/dockets.cfm?dist=2&doc_id=3146811&doc_no=B350578)
Laws
Cal. Penal Code §§ 638.50(b), 638.51
Stage
Writ petition submitted for decision on 15 October 2026; trial court stayed
Amount
None
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
CIPA §638.51 (pen register)A device or process that records or decodes "dialing, routing, addressing, or signaling information" from an outgoing communication, used without a court order or consentThe trackers sent IP addresses and device data to data brokers; screenshots showed "domain", "Origin" and "Referer" fields identifying variety.comTrial court overruled Variety's demurrer. Court of Appeal tentative: sustain the demurrer with leave to amend

Technical issue

  • Tools or vendors: third-party trackers; the cited record does not name them.
  • Where: Variety’s public website.
  • What data: IP address and device information; screenshots also showed domain, Origin and Referer fields naming variety.com.
  • When: on page load, as alleged.
  • How it came to light: the complaint’s own screenshots, which the tentative discusses.

Inth’s technical interpretation: the tentative turned on two kinds of data. The IP address tells a tracker who sent a request. The Origin and Referer headers, which browsers attach to third-party requests, tell it which site and page the visitor was on. The court tentatively said only the second kind could fit the pen register definition, and asked whether the trackers saw it "as it occurred" or reported it afterwards. You can control how much page information leaves with each request, and when the request is made.

Illustrative pattern, not the defendant’s code.

<!-- Bad: full page URL sent to every third party, tracker loads at once -->
<meta name="referrer" content="unsafe-url">
<script async src="https://tracker.example.com/t.js"></script>

Illustrative pattern, not the defendant’s code. Generic consent check, not a specific product’s API.

<meta name="referrer" content="strict-origin-when-cross-origin">
<script>
  if (consent.has('marketing')) {
    const s = document.createElement('script');
    s.src = 'https://tracker.example.com/t.js';
    s.referrerPolicy = 'no-referrer'; // the tag request carries no page URL
    document.head.appendChild(s);
  }
</script>

Timeline

Timeline
DateEvent
23 January 2025Complaint filed
2025 (date not in the cited record)Trial court overrules Variety's demurrer
21 November 2025Variety petitions for a writ of mandate
8 January 2026Order to show cause; trial court stayed
8 April 2026Amicus applications from business groups, technology companies and the ACLU of Northern and Southern California
11 May 2026Court asks for supplemental briefs on federal pen register law
21 August 2026Tentative ruling
25 August 2026Argued and submitted
1 October 2026Submission vacated; mootness briefing ordered after SB 690
8 and 15 October 2026Letter briefs filed; matter resubmitted 15 October ([docket](https://appellatecases.courtinfo.ca.gov/search/case/dockets.cfm?dist=2&doc_id=3146811&doc_no=B350578))

Outcome

There is no decision yet. The tentative ruling (PDF) would:

  • Reject the telephone-only argument: CIPA’s definition is "coextensive with the federal definition", reaching metadata "associated with either telephonic or online communications" (at 1).
  • Reject a conflict with the CCPA: "The CCPA makes informing the consumer necessary, but not sufficient, for lawful collection" (at 2).
  • Reject lenity.
  • Narrow the definition: §638.50(b) "reaches only a device or process that records or decodes metadata likely to identify the destination of an outgoing communication", and the complaint fails "because the user’s IP address identifies the source of the communication" (at 2).
  • Leave the screenshots open: it was unclear whether the trackers recorded destination data "as it occurred, or whether this data reflects only a separate communication the Trackers generated about a past communication after the fact" (at 2).
  • Allow amendment, because Variety raised the source-destination point first in its reply.

Rose’s counsel argued the point was waived and wrong, relying on Shah v. Fandom (answer to amici at 17 fn. 2). A tentative ruling is not an opinion and binds no one.

What it cost

What it cost
ItemAmount
Damages, settlement or feesNone; the claim is undecided

Why it matters

This is the first California appellate treatment of website pen register claims. The tentative splits the difference: it accepts the technology-neutral reading that federal courts used in Greenley v. Kochava and Shah, but rejects Shah’s view that sender and recipient data both count. On the tentative’s reasoning, a complaint resting only on the visitor’s IP address, like the one in Casillas, would fail.

SB 690 status: SB 690 (Stats. 2026, ch. 976), signed 30 September 2026, lets only the Attorney General sue a private actor over §638.51 conduct on websites and apps from 1 January 2027 (the default effective date for a 2026 statute). It applies to pending claims in actions filed on or after 1 January 2025, and leaves §631, §632 and §632.7 untouched (bill text). Rose filed on 23 January 2025, inside that window. On 1 October 2026 the Court of Appeal asked whether that "renders this writ proceeding moot and, if so, whether an exception to the mootness rule applies" (docket). Rose filed his letter brief on 8 October and Variety on 15 October; the docket shows no decision as of 17 October 2026. Commentators note the court could still decide the merits under a public-interest exception (reported by Jones Walker).

How Inth catches this

  • Code audit: flags a pull request that adds a tracker or audience-data script, and traces which page data (URL, title, identifiers) flows into its requests.
  • Website audit: records each tracker request with the page, domain, time, region and consent state, and links the domain to a vendor record.
  • Consent banner: holds marketing scripts until their category is granted. Inth’s default California policy is opt-out, which lets tags run before a choice. If CIPA claims are a concern for you, configure a California opt-in policy.
  • Evidence: dated runtime observations and consent records.

A browser observation shows what a tracker request carried; it cannot show what a data broker did with it afterwards, which is where this complaint placed the harm.

Checks for your own systems

In the repository

  • Check your Referrer-Policy header and any referrerpolicy attributes on third-party tags.
  • List trackers whose vendors describe themselves as identity or data-broker services.

In the browser and network

  • For each third-party request, inspect the Referer and Origin headers and any URL parameters that repeat the page address.
  • Compare first load, after Reject and after Accept.

With the people responsible

  • Ask which vendors resell or enrich visitor data, and whether your privacy notice says so.
  • Agree who tracks this appeal and SB 690 for any open demand letters.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Variety Media’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.