[Enforcement library](/enforcement)

# Shah v. Fandom: a visitor who sends you an IP address has not agreed to send it to your ad vendors

Treat consent as specific to each recipient. A browser must send its IP address to your server to load the page; this court held that does not mean the visitor agreed to send it to the ad companies your code calls.

US District Court, Northern District of California · CIPA §638.51 · Order denying motion to dismiss, 21 October 2024

Same lawsuit as [Fandom (GameSpot)](/enforcement/fandom-gamespot), which covers the USD 1.2 million settlement (final approval 19 May 2026). This page covers the motion-to-dismiss ruling.

## The problem

Vishal Shah and Jayden Kim alleged that gamespot.com's server told visitors' browsers to install trackers from GumGum, Audiencerate and TripleLift, which sent their IP addresses to those companies on the first visit and again, with a cookie, on every later visit until the cache was cleared ([Order, Dkt. 34 at 1–2](https://fkks.com/uploads/news/Shah_v._Fandom_.pdf), citing FAC ¶¶ 37, 47, 56).

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, N.D. Cal. (Judge Rita F. Lin) |
| Case number | 3:24-cv-01062-RFL |
| Parties | Vishal Shah and Jayden Kim v. Fandom, Inc. |
| Counsel | Plaintiffs: Bursor & Fisher, P.A. (\[FAC\](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.15.0.pdf)). Defendant: Tyz Law Group PC (\[Dkt. 20\](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.20.0.pdf)) |
| Laws | Cal. Penal Code §§ 638.50(b), 638.51(a), 637.2 |
| Stage | Motion to dismiss denied; later settled (see \[GameSpot settlement\](/enforcement/fandom-gamespot)) |
| Amount | None in this ruling. The later settlement fund was USD 1,200,000 |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What the law requires | Facts alleged | Result |
| --- | --- | --- | --- |
| CIPA §638.51(a) (pen register) | A "device or process that records or decodes dialing, routing, addressing, or signaling information" from an electronic communication, but not its contents, installed or used without a court order | Each tracker records the IP address carried with the browser's HTTP request to load GameSpot and sends it to the tracker's operator for ads and analytics (FAC ¶¶ 32–61, 68–70) | Motion to dismiss denied |

## Technical issue

- **Tools or vendors:** GumGum, Audiencerate and TripleLift trackers.
- **Where:** gamespot.com.
- **What data:** IP addresses, plus cookie identifiers on repeat visits.
- **When:** from the first page load, before any consent.
- **How it came to light:** plaintiffs' own network captures. The amended complaint shows requests to GumGum endpoints, an Audiencerate pixel URL carrying the IP address, and a TripleLift request with the IP encoded in Base64 ([FAC ¶¶ 37–58](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.15.0.pdf)).

**Inth's technical interpretation:** the court split the traffic in two. The "communication" is the browser's request to GameSpot; the trackers copy its addressing information out to someone else. In engineering terms, every third-party script tag on a page is a separate disclosure of the visitor's IP address, and each one needs its own justification.

Illustrative pattern, not the defendant's code.

```html
<!-- Bad: each vendor tag sends the visitor's IP to a new company on load -->
<script async src="https://tags.vendor-a.example.com/t.js?site=SITE_ID"></script>
<script async src="https://tags.vendor-b.example.com/sync.js"></script>
```

Illustrative pattern, not the defendant's code. Generic consent check, not a specific product's API.

```js
// Your server needs the IP to answer. A vendor only gets it if you load the vendor.
const vendors = ['https://tags.vendor-a.example.com/t.js?site=SITE_ID',
                 'https://tags.vendor-b.example.com/sync.js'];
if (consent.has('marketing')) {
  for (const src of vendors) {
    const s = document.createElement('script');
    s.async = true; s.src = src; document.head.appendChild(s);
  }
}
```

## Timeline

| Date | Event |
| --- | --- |
| 21 February 2024 | Complaint filed |
| 29 April 2024 | First amended complaint |
| 21 October 2024 | Motion to dismiss denied |
| 18 November 2024 | Fandom notified the Attorney General of a First Amendment challenge to the statute (\[Dkt. 52\](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.52.0.pdf)) |
| 16 December 2024 | Reconsideration and interlocutory appeal refused (\[Dkt. 48\](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.48.0.pdf)) |
| 19 May 2026 | Class settlement finally approved |

## Outcome

Judge Lin held, on the pleadings:

- **Process:** following Greenley v. Kochava, software that records IP addresses is plausibly a "process".
- **Addressing, not contents:** an IP address is "addressing" information (In re Zynga). The relevant contents are the request to load the page, not the trackers' later transmission of the IP address, "inside a cookie, or through some other transmission method".
- **Sender or recipient:** the definition covers addressing information "regardless of whether that addressing information pertains to the sender or the recipient of the communication at issue" ([Dkt. 34 at 6](https://fkks.com/uploads/news/Shah_v._Fandom_.pdf)).
- **Installation:** integrating third-party scripts into the site plausibly meant Fandom installed the trackers.
- **Consent and standing:** Fandom dropped its consent argument at the hearing. Its statutory-standing point was waived, and in any event the plaintiffs "plausibly alleged that they were injured by being tracked across multiple visits for marketing and advertising purposes" without expecting or agreeing to it (at 10).

The court acknowledged Fandom's concern that the suit "could unsettle the basic operating rules of the Internet", but said narrowing the statute "rests with the Legislature, not the courts" (at 10). In December 2024 it refused reconsideration and a §1292(b) appeal, noting that three federal district courts agreed and that contrary Los Angeles trial-court rulings "are not controlling, even in the California state courts" ([Dkt. 48 at 3](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.48.0.pdf)). The order is reported at 754 F. Supp. 3d 924 (as cited in [Rose's answer to amici in Variety](https://www.guptawessler.com/wp-content/uploads/2026/05/2026.5.21.-Rose.-Consolidated-Response-to-Amicus-Briefs.pdf)) and 2024 WL 4539577. A district court order binds no other court. Judge Breyer followed it in [Mirmalek v. Los Angeles Times](/enforcement/los-angeles-times) ([Dkt. 30](https://storage.courtlistener.com/recap/gov.uscourts.cand.427006/gov.uscourts.cand.427006.30.0.pdf)).

## What it cost

| Item | Amount |
| --- | --- |
| This ruling | No money awarded |
| Later settlement | USD 1,200,000 fund; USD 399,962.96 in fees, costs and expenses (see \[GameSpot settlement\](/enforcement/fandom-gamespot)) |

## Why it matters

Shah is the leading federal statement of the website pen register theory. It sits on the opposite side of two Los Angeles lines: trial courts such as [Palacios v. Fandom](/enforcement/palacios-v-fandom), which Judge Lin addressed in a footnote, and the Court of Appeal's August 2026 tentative in [Rose v. Variety Media](/enforcement/rose-v-variety-media), which would read the pen register definition to reach only destination-identifying data, so that a visitor's own IP address does not qualify. That tentative is not a decision, and the appeal court is now considering whether SB 690 makes it moot.

Fandom also pleaded that §§ 638.50–638.51 violate the First Amendment, and the Attorney General sought time to intervene ([Dkt. 52](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.52.0.pdf)). The settlement ended the case before the court ruled on that.

**SB 690 status:** SB 690 (Stats. 2026, ch. 976), signed 30 September 2026, lets only the Attorney General sue a private actor over §638.51 conduct on websites and apps from 1 January 2027 (the default effective date for a 2026 statute). It applies to pending claims in actions filed on or after 1 January 2025, and leaves §631, §632 and §632.7 untouched ([bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)). This action was filed in February 2024 and is settled, so SB 690 does not change it, but private suits on this theory end for websites and apps.

## How Inth catches this

- **Code audit:** flags a pull request that adds a third-party ad or audience script, and maps which vendor each new outbound request reaches.
- **Website audit:** lists every third-party domain a page contacts, links it to a vendor record, and records region and consent state, so each IP disclosure is visible.
- **Consent banner:** ad-exchange scripts are not among the built-in helpers; gate them on the consent state in your code. Inth's default California policy is opt-out, which lets tags run before a choice; a California opt-in policy is a configuration choice.
- **Evidence:** the vendor record and dated observations showing which companies received requests.

None of this shows what a vendor does with an IP address after receipt.

## Checks for your own systems

### In the repository

- Count third-party script origins in your page templates and tag manager; each is a separate recipient of the visitor's IP address.

### In the browser and network

- Export a HAR file from a fresh California profile and list unique third-party hosts contacted before any choice.

### With the people responsible

- For each recipient, write down the purpose and whether the privacy notice names it or its category.

## Sources and limits

- [Order denying motion to dismiss, 21 October 2024 (Dkt. 34)](https://fkks.com/uploads/news/Shah_v._Fandom_.pdf)
- [First amended complaint, 29 April 2024 (Dkt. 15)](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.15.0.pdf)
- [Order denying reconsideration or certification, 16 December 2024 (Dkt. 48)](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.48.0.pdf)
- [Attorney General's motion to extend time to intervene, 14 January 2025 (Dkt. 52)](https://storage.courtlistener.com/recap/gov.uscourts.cand.425193/gov.uscourts.cand.425193.52.0.pdf)
- [Mirmalek v. Los Angeles Times, order of 12 December 2024 (Dkt. 30)](https://storage.courtlistener.com/recap/gov.uscourts.cand.427006/gov.uscourts.cand.427006.30.0.pdf)
- [Variety Media v. Superior Court, tentative ruling, 21 August 2026](https://www.ballardspahr.com/-/jssmedia/main/legal-alert/b350578variety-media-v-superior-cttentative-ruling.pdf)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Fandom's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [GameSpot settlement](/enforcement/fandom-gamespot), [Greenley v. Kochava](/enforcement/greenley-v-kochava), [CIPA §638.51](/enforcement/laws/cipa-638-51-pen-register).