Pen Registry Claims Involving the Meta Pixel Likely to Rise

Pen registry claims involving the Meta Pixel are likely to increase after two recent decisions from the U.S. District Court for the Southern District of California allowed Section 638.51 (also known as “pen registry” or “trap and trace”) claims involving the Meta Pixel to proceed past the pleading stage.

Although California’s pen registry law has been effective as of January 1, 2016, the “modern” trend of pen registry claims began after an unpublished 2023 trial court decision from a Southern District of California court held California’s “pen registry” law was broad enough to include a software development kit (SDK). The plaintiff in that case alleged the defendant had hidden code in an SDK that collected multiple types of data from the user’s phone.

Following this 2023 decision, many complaints have accused other social media pixels of violating California’s pen registry law. Plaintiffs have filed complaints that allege not only SDKs, but also cookies, third-party tracking pixels and software, and “fingerprinting” software, are unlawful pen registers or trap and trace devices.

After two decisions in October and November, future lawsuits will likely focus on the Meta Pixel, which has already been a primary target in both Section 631(a) wiretapping claims, federal Electronic Communications Privacy Act (ECPA) wiretapping claims, and federal Video Privacy Protection Act (VPPA) claims. On October 1, the court held that “the information collected by Meta Pixel includes computer transmissions regarding Plaintiff’s location data and other personal sensitive information. Meta Pixel’s collecting such information is much like that of the process found as a pen register in Greenley. At this stage of the proceedings, Plaintiff has plausibly stated a claim under § 638.51.”

Then, on November 21, the court issued another decision, finding “the Meta Pixel software meets the statutory definition of a pen register or trap and trace device because it is ‘software that identifies consumers, gathers data, and correlates that data through unique fingerprinting.'” The court continued and held “a plaintiff may state a claim for violation of § 638.51 by alleging that a defendant used the Meta Pixel on their site and that the Meta Pixel tracked record or identifying information regarding their use of the site.”

As decisions such as these allow claims to proceed against additional cookies and pixels, it becomes even more important for websites to notify users of what cookies and similar tools are being used on the website and to make sure such notification meets the standards courts have set to qualify as “reasonably conspicuous.”

If you would like to discuss this or other concerns regarding privacy litigation relating to your website, please contact a Troutman Pepper Locke attorney for more information.