Legal Insights
A recent Massachusetts Superior Court decision offers significant guidance for businesses navigating the growing wave of litigation under California’s Invasion of Privacy Act (CIPA) and other similar state and federal privacy statutes. In Anthony D’Antonio v. Tripadvisor, LLC, Case No. 2684CV00331 (Suffolk Cty. Super. Ct. Aug. 31, 2026), Justice Christopher K. Barry-Smith dismissed a CIPA claim challenging the use of a third-party advertising tracker on Tripadvisor’s website, holding that a Massachusetts choice-of-law clause in the company’s Terms of Use barred the plaintiff from proceeding under California law.
The Ruling
The plaintiff alleged that Tripadvisor caused the Casale Media[1] Tracker to be installed on users’ browsers, collecting IP addresses, device metadata, and unique identifiers, which were then matched to non-anonymous consumer profiles and sold to third parties—all without consent, in violation of CIPA Section 638.51. That section prohibits the installation or use of a “pen register” or “trap and trace device” without a court order, with limited exceptions including user consent.
After the plaintiff’s initial California filing was dismissed for failure to comply with a forum selection clause in Tripadvisor’s Terms of Use, the plaintiff refiled in Massachusetts, again asserting the same CIPA claim. Tripadvisor moved to dismiss, arguing that its Terms of Use, which the plaintiff accepted during account registration, contained a choice-of-law provision designating Massachusetts law.
The Massachusetts Superior Court agreed. Applying collateral estoppel, Justice Barry-Smith held that the California court’s finding that the plaintiff entered a valid contract through the website registration process was binding on the question of contract formation. Even independently, the court found that under the Massachusetts Supreme Judicial Court’s framework in Good v. Uber Technologies, Inc., 494 Mass. 116 (2024), Tripadvisor provided “reasonable notice” of its Terms and that the plaintiff “reasonably manifested assent” by clicking through two registration screens, each displaying the disclosure: “By proceeding, you agree to our Terms of Use.”
Critically, the plaintiff’s counsel acknowledged at oral argument that the CIPA claim could not be reframed under Massachusetts law, rendering amendment futile. The court dismissed the complaint with prejudice.
Significance in the Broader CIPA Landscape
As we have discussed in prior analyses—including CIPA Litigation Persists for Online Businesses and Pixel Litigation Trends by State—CIPA litigation targeting website tracking technologies has exploded in recent years, and plaintiffs’ firms have targeted businesses with limited contacts with California. Federal courts across California continue to grapple with whether pixels, session-replay tools, and chatbot software qualify as “pen registers” under Sections 638.50–638.51.
Adding further complexity, the California Court of Appeal, Second Appellate District, has weighed in with a significant tentative ruling in Variety Media, LLC v. Superior Court (No. B350578). In that case, the plaintiff alleged that Variety’s website caused third-party “Trackers” to be installed on visitors’ browsers, transmitting IP addresses and device metadata to data brokers who compiled profiles for sale to advertisers—conduct the plaintiff alleged violated Section 638.51’s pen-register prohibition. Variety demurred, arguing the pen-register provisions apply only to telephonic surveillance. The appellate court tentatively rejected that categorical limitation, concluding that CIPA’s pen-register definition is coextensive with its federal model and reaches devices or processes that record metadata associated with online as well as telephonic communications. The court also rejected Variety’s arguments that such an interpretation would irreconcilably conflict with the CCPA and that the rule of lenity mandated a telephone-only reading. However, the court tentatively agreed with a narrower argument: that the Trackers, as pleaded, did not qualify as pen registers because they collected source-identifying metadata (the visitor’s IP address) rather than destination-identifying metadata about outgoing communications. The court directed the trial court to sustain the demurrer with leave to amend, giving the plaintiff an opportunity to replead. If finalized, the Variety Media ruling would be among the first published California appellate decisions to address CIPA’s pen-register provisions in the website-tracking context, affirming their applicability to internet communications in principle while imposing a potentially significant pleading limitation that mere collection of IP addresses alone may not suffice.
Meanwhile, the California Legislature has moved toward its own resolution. Senate Bill 690 (Caballero), sponsored by the Alliance for Legal Fairness, passed both chambers unanimously on August 28, 2026, and has been transmitted to the Governor. As enacted, SB 690 does not broadly exempt tracking technologies from CIPA. Rather, it amends Penal Code Section 637.2 to eliminate the private right of action for Section 638.51 violations alleged to arise from conduct on internet websites, online applications, or mobile applications, making the Attorney General the exclusive plaintiff for those claims. The bill applies retroactively to pending claims filed within two years before its operative date. According to the bill’s sponsors, approximately 4,000 CIPA lawsuits have been filed against California businesses, the bulk asserting pen-register claims based on website tracking, and tens of thousands of additional demand letters have been sent.[2] Notably, the bill does not touch Sections 631 or 632, leaving wiretapping and confidential-communications claims fully intact with their existing private remedies. If signed by the Governor, SB 690 would remove the private litigation engine driving the pen-register wave while preserving public enforcement and other CIPA causes of action.
The D’Antonio ruling highlights yet another defense vector that operates independently of either appellate resolution or legislative reform: contractual choice-of-law provisions. While much of the CIPA defense playbook has centered on standing challenges, the party exception, the “in transit” requirement, and disputes over what constitutes protected “contents” of a communication, the D’Antonio decision demonstrates that well-drafted terms of use can redirect the entire legal framework away from California’s plaintiff-friendly statutory scheme. Notably, the court rejected the plaintiff’s argument that California’s fundamental public policy should override the contractual choice of law, reasoning that both Massachusetts and California recognize consent-based exceptions to their respective wiretapping statutes and that California’s interest was not “materially greater” than that of Massachusetts-headquartered Tripadvisor.
Practical Takeaways
For businesses operating websites with tracking technologies, whether pixels, analytics tools, or embedded chat functions, this decision reinforces several practical compliance considerations.
First, terms of use with enforceable choice-of-law and forum selection clauses remain a meaningful litigation shield, but only if user assent is well-documented. The court’s analysis turned on whether the registration interface provided reasonable notice and an unambiguous action manifesting assent. Companies should ensure that disclosures are prominently displayed, that hyperlinks to full terms are clearly visible, and that the user’s affirmative action (e.g., clicking “Join” or “Continue”) is connected to the relevant terms.
Second, the ruling does not eliminate CIPA exposure: it redirects it. Businesses headquartered outside California may benefit from choice-of-law provisions selecting their home state’s law, but the enforceability of such clauses will be scrutinized case by case. A provision selecting the law of a state with no substantial relationship to the transaction may not survive challenge.
Third, the decision underscores that CIPA litigation strategy is increasingly multijurisdictional. As plaintiff firms test CIPA’s reach in state and federal courts across the country, defendants must evaluate not only the substantive merits of the privacy claim but also the contractual and procedural landscape, including forum selection, choice of law, and the adequacy of online contract formation.
Fourth, practitioners should closely monitor SB 690 and the Variety Media appeal. If signed by the Governor, SB 690 would eliminate the private right of action for website-related Section 638.51 claims and retroactively extinguish thousands of pending suits, but it would not affect Section 631 or 632 claims, which remain fully actionable by private plaintiffs. The Variety Media tentative ruling, meanwhile, could establish important appellate law on the scope of the pen-register definition, including whether mere IP-address collection states a claim. Businesses should not treat either development as a blanket solution.
The D’Antonio ruling, the Variety Media tentative ruling, and SB 690 together signal that the legal landscape for website tracking under CIPA is shifting rapidly, through the courts and the Legislature simultaneously. Companies should continue to audit their tracking technologies, align their privacy disclosures with actual data practices, and ensure their terms of use are both comprehensive and conspicuously presented to users.
[1] Now known as “Index Exchange.”
[2] This number also does not include claims filed in arbitration, which is likely greater than the number of claims filed in court.
——————————————————————–
This DarrowEverett Insight should not be construed as legal advice or a legal opinion. This Insight is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. The contents are intended for general informational purposes only, and you are urged to consult your attorney concerning any particular situation and any specific legal question you may have. Please reach out to us if you need help addressing any of the issues discussed in this Insight, or any other issues or concerns you may have relating to your business. We are ready to help guide you through these challenging times.
This Insight does not constitute written tax advice as described in 31 C.F.R. §10, et seq. and is not intended or written by us to be used and/or relied on as written tax advice for any purpose including, without limitation, the marketing of any transaction addressed herein. Any U.S. federal tax advice rendered by DarrowEverett LLP shall be conspicuously labeled as such, shall include a discussion of all relevant facts and circumstances, as well as of any representations, statements, findings, or agreements (including projections, financial forecasts, or appraisals) upon which we rely, applicable to transactions discussed therein in compliance with 31 C.F.R. §10.37, shall relate the applicable law and authorities to the facts, and shall set forth any applicable limits on the use of such advice.