California District Court Draws Critical Line Between Browsing Data and “Contents” of Communications Under CIPA
Recent years have seen a surge in privacy litigation over websites’ use of tracking technologies for routine data collection, including numerous cases under the California Invasion of Privacy Act (“CIPA”), California’s principal wiretapping and electronic surveillance statute. Originally enacted in 1967 to address traditional telephone wiretapping, CIPA has become a central vehicle for these claims. Courts have often allowed such claims to survive motions to dismiss based on broad interpretations of CIPA’s statutory elements. A recent district court ruling, however, offers a welcome development for defendants by narrowing the scope of actionable conduct under CIPA.
On September 14, 2026, in Wiley v. Universal Music Investments, the United States District Court for the Northern District of California dismissed CIPA claims for wiretapping and unlawful use of a pen register because mere website browsing activity—including the collection of full-string URLs, session data, and device information—does not constitute the “contents” of a “communication” for CIPA purposes. The court, however, denied UMI’s motion to dismiss on Article III standing grounds, finding that the plaintiffs’ allegations of deceptive cookie opt-out practices supported a “highly offensive” privacy invasion.
Background
Universal Music Investments (“UMI”) is a global music-based entertainment company. UMI operates several websites and, according to the complaint, it embeds third-party cookies on those websites. In connection with this practice, UMI’s websites feature a pop-up banner that provides visitors with a direct link to UMI’s Privacy Policy, informs them about the information the cookies collect, and provides visitors options to manage their cookie choices.
Plaintiffs Christine Wiley and Vishal Shah alleged that, even after they declined cookies through the pop-up banner, UMI nonetheless permitted multiple third parties like Meta and Google to place cookies on their devices that tracked their browsing activity.
Shah alleged that he visited two UMI websites and clicked on links and buttons for concert tour dates and merchandise. Wiley similarly alleged that she visited UMI websites and clicked on links and buttons for merchandise. The plaintiffs alleged that third parties collected information about these interactions through cookies UMI enabled on its websites. The third parties also allegedly collected session data, user identifiers, device information, referring and clicked full-string URLs, and geolocation data. Although both plaintiffs alleged that they clicked on links and browsed content on UMI’s websites, neither alleged that they entered content into a field or search bar or otherwise sent messages through the websites.
Based on UMI’s alleged conduct, the plaintiffs filed suit against UMI, bringing claims for (1) invasion of privacy; (2) intrusion upon seclusion; (3) violation of California Penal Code § 631; (4) violation of California Penal Code § 638.51; and (5) unjust enrichment.
The Wiley Court’s Findings
CIPA Wiretapping Claim: Dismissed With Prejudice
Section 631(a) is CIPA’s wiretapping provision. A defendant may be liable under it in three ways: (1) intentional wiretapping; (2) willfully attempting to learn the contents or meaning of a communication in transit over a wire; and (3) attempting to use or communicate information obtained through either of the first two activities.1 Section 631 also prohibits anyone from aiding or abetting another in committing any of those acts.2 The Wiley plaintiffs alleged that UMI aided and abetted the third parties’ violation of clauses two and three by configuring its websites so that the third-party cookies could collect the plaintiffs’ information.
Under the second clause of Section 631(a), the key distinction is between the “contents” of a communication and mere “record” information associated with it. “Contents” refers to the substance or intended message conveyed, while “record” information is “information regarding the characteristics of the message that is generated in the course of the communication.”3 As applied to websites, the Ninth Circuit has explained that a URL containing a search term may constitute “contents” of a communication, whereas a URL that includes only basic identification and address information would not.4
The Wiley court’s analysis of the Section 631 claim focused on whether the allegedly intercepted information—full-string URLs, session information, user identifiers, device information, button interactions, and geolocation data—constituted the “contents” of a communication or merely “record” information. It found that this information constituted browsing activity, not the “contents” of any communication with the websites.
Critically, the court noted that the plaintiffs had expressly excluded user-input search queries from the allegedly intercepted information. Accordingly, the court concluded that “plaintiffs ha[d] only alleged that they visited particular websites, not that they communicated anything in particular to those websites.” The court distinguished the plaintiffs’ allegations from D’Antonio v. Smith & Wesson, 2026 WL 2653811 (N.D. Cal. Sept. 8, 2026). There, the plaintiffs had alleged that their search queries had been collected, and the court found this was sufficient to state a CIPA wiretapping claim.5
Because the Wiley plaintiffs failed to allege the “contents” element under clause two, they also failed to state a claim under clause three, and their aiding and abetting claim accordingly lacked any predicate violation.
CIPA Pen Register Claim: Dismissed With Prejudice
CIPA Section 638.51 prohibits the installation or use of a pen register without a court order under specified circumstances.6 A pen register is defined as “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.”7
The Wiley court dismissed the plaintiffs’ Section 638.51 claim for reasons similar to those supporting dismissal of the Section 631 claim. Although the plaintiffs alleged that the cookies collected “routing, addressing, or signaling information” in the form of their IP address and user-agent information, the court found that they failed to connect that information to any “communication” that was recorded or decoded. The court likewise noted that the plaintiffs did not allege that they communicated any message to the websites—they alleged only that the cookies collected their browsing activity. It explained that “mere browsing activity is not analogous to a phone call because phone calls are communicative actions while browsing, absent further allegations establishing dialogic communications, generally is not.” Because the plaintiffs alleged only passive browsing rather than active communication, the pen register statute was inapplicable.
Motion to Dismiss on Article III and Untimeliness Denied
UMI also argued that, under the Ninth Circuit’s recent decision in Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025), the plaintiffs lacked Article III standing to bring any of their claims. In Popa, the plaintiff alleged that the defendant’s session replay technology collected her browsing information without her consent, in violation of her privacy rights.8 She identified more than 30 categories of information, including “the date a user visited the website, the device the user accessed the website on, the type of browser the user accessed the website on, the operating system of the device used to access the website, the country where the user accessed the website from, a user’s mouse movements, a user’s screen swipes, text inputted by the user on the website, and how far down a webpage a user scrolls.”9 The Ninth Circuit held that the plaintiff had to show a “highly offensive” intrusion of privacy to establish Article III standing, but found her allegations insufficient because she “identifie[d] no embarrassing, invasive, or otherwise private information collected.”10
UMI, relying on Popa, argued that the plaintiffs had not alleged collection of embarrassing, invasive, or otherwise private information and therefore lacked Article III standing.
The court rejected this argument for two reasons. First, it noted that determining whether a privacy invasion was “highly offensive” is a mixed question of law and fact that often cannot be resolved at the pleading stage. Second, it found that the plaintiffs adequately alleged a “highly offensive” invasion because UMI’s conduct involved both the disclosure of personal browsing information that could be “embarrassing, invasive, or otherwise private,” and deceit. Unlike the defendant in Popa, UMI affirmatively indicated to users that it would not track their activities after they declined cookies. The Wiley court held that “[d]eceit can be a kind of ‘plus’ factor” in the highly offensive analysis.
The court also rejected UMI’s argument that plaintiffs’ claims were untimely under CIPA’s one-year statute of limitations, holding that plaintiffs adequately pleaded entitlement to tolling under the doctrine of fraudulent concealment. The court credited plaintiffs’ allegations that UMI misled users about the effect of opting out of cookies. Based on this allegation, the court found that users had no reason to know that cookies were still being placed on their devices despite declining them, and the plaintiffs lacked the technical knowledge to verify whether the websites honored their opt-out requests. The court also rejected UMI’s argument that the heightened pleading standard of Rule 9(b) applies to the fraudulent concealment doctrine, holding that because fraudulent concealment is not a standalone cause of action, Rule 9(b)’s requirements do not attach.
Practical Takeaways
The Wiley decision offers practical takeaways for companies that use website tracking technologies. In particular, it clarifies the types of browsing data that are less likely to support CIPA claims while highlighting ongoing risks relating to user-inputted information and cookie opt-out mechanisms.
- URLs and browsing metadata are not “contents” under CIPA § 631. The decision reinforces the line between the substantive “contents” of a communication and its associated metadata. For companies using third-party tracking technologies, the collection and sharing of URLs, session data, device information, and similar information—without capturing the substance of user-input communications such as search queries—is less likely to give rise to a viable CIPA wiretapping claim.
- Search queries and other user-inputted information remain a critical risk area. The court drew a clear contrast with D’Antonio v. Smith & Wesson, where the interception of user search queries was found sufficient to state a CIPA claim. Companies whose websites use third-party tools that capture the contents of user inputs like search queries, text typed into a form by a user, or radio button/checkbox selections by the user, still face meaningful exposure under Section 631 after Wiley.
- Non-functional cookie opt-out mechanisms create significant litigation risk. The court’s analysis on standing and tolling underscores a critical message: companies that present cookie consent banners and opt-out mechanisms must ensure those mechanisms actually work as represented. The court held that UMI’s alleged misrepresentations about its cookie practices (a) constituted a “plus factor” supporting the “highly offensive” standard for Article III standing, and (b) supported fraudulent concealment tolling, potentially extending the limitations period. Companies that offer opt-out choices but continue tracking in the background face heightened exposure on both the merits and timeliness defenses.
1 Cal. Penal Code § 631(a).
2 Id.
3 In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014).
4 Id. at 1108-09.
5 D’Antonio, 2026 WL 2653811, at *3.
6 Cal. Penal Code § 638.51.
7 Id. § 638.50(b).
8 153 F.4th at 786-87.
9 Id. at 786.
10 Id. at 791.
