1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 DAWN FREGOSA, Case No. 25-cv-01094-CRB

8 Plaintiff, ORDER DENYING MOTION TO 9 v. DISMISS

10 MASHABLE, INC., Docket No. 34 11 Defendant.

12 13 I. INTRODUCTION 14 Plaintiff Dawn Fregosa brings this putative class action against Defendant 15 Mashable, Inc. (“Mashable”) under the California Invasion of Privacy Act (“CIPA”), Cal. 16 Penal Code §§ 630, et seq. Fregosa alleges that Mashable violated the Pen Register Act by 17 embedding third-party trackers on its website. According to the Second Amended 18 Complaint (“SAC”), these trackers unlawfully recorded users’ IP addresses and device 19 identifiers and transmitted that data to third parties for advertising and profiling. 20 Mashable moves to dismiss the SAC under Rule 12(b)(6), raising three arguments: 21 (1) that the Pen Register Act applies only to person-to-person communications rather than 22 general website activity; (2) that even if the Pen Register Act applies, Fregosa has not 23 plausibly alleged a violation of the Act; and (3) that the rule of lenity requires dismissal 24 because the Pen Register Act is ambiguous. 25 For the reasons set forth below, each argument is unavailing. The statutory text, 26 structure, and purpose, as well as recent decisions from this District, establish that CIPA’s 27 pen register prohibition extends to software processes that record addressing information 1 plausibly alleges installation of trackers and use of resultant information by Mashable, and 2 no grievous ambiguity warrants applying the rule of lenity. Accordingly, the motion to 3 dismiss is DENIED. 4 II. BACKGROUND 5 A. Factual Background 6 Defendant Mashable owns and operates a digital news and entertainment website. 7 Second Am. Compl. (SAC) (Dkt. 30) ¶ 1. Plaintiff Dawn Fregosa is a California resident 8 who regularly visited Mashable’s website between 2017 and December 2024. SAC ¶ 187. 9 Fregosa alleges that when she visited the Mashable website from her home in 10 California, Mashable’s servers instructed her browser to install and run third-party trackers 11 operated by Microsoft, Wunderkind, and PubMatic. SAC ¶¶ 2–6. These trackers collect 12 users’ IP addresses and “device fingerprints” (device type, browser type, persistent 13 identifiers) enabling cross-site recognition and targeted advertising. Id. Third parties 14 operate these trackers and use them to engage in targeted advertising based on website 15 visitors’ location (which can be determined by IP address) and browsing data. Id. 16 Fregosa describes the mechanics of website tracking broadly as follows: when a 17 user loads the Mashable webpage, the user’s browser sends an HTTP request to 18 Mashable’s server. Id. ¶¶ 22–24. The server responds with instructions on how to 19 properly display the website (e.g., what images to load, the text to display, music to play, 20 etc.). Id. As part of this process, Mashable’s servers also send instructions to browsers 21 that install trackers on the user’s browser. Id. ¶ 24. These trackers, supplied by Microsoft, 22 Wunderkind, and PubMatic, prompt the browser to transmit identifying information — 23 including the user’s IP address and device metadata — to the third parties. Id. The 24 trackers enable those entities to recognize the same device on subsequent visits, whether to 25 Mashable’s site or to other websites that deploy their code. Id. The SAC further alleges 26 that Mashable and these third-party operators actively participate together in the broader 27 data-brokerage and online advertising ecosystem. Id. ¶¶ 57–186. 1 telephone numbers by capturing “dialing, routing, addressing, or signaling information.” 2 She alleges that the trackers here perform the same functional role by recording addressing 3 information associated with outgoing HTTP requests, and that Mashable “installed” and 4 “used” those trackers without first obtaining a court order as required by CIPA. Id. ¶¶ 49– 5 56; see

(a) (“[A] person may not install or use a pen register or a 6 trap and trace device without first obtaining a court order . . . .”). 7 B. Procedural History 8 Fregosa’s First Amended Complaint was dismissed for lack of personal jurisdiction, 9 with leave to amend. Dkt. 12; 19. Fregosa filed her SAC with expanded jurisdictional 10 allegations and additional detail about Mashable’s contacts with California. Fregosa seeks 11 to represent a class defined as “all California residents who accessed the Website in 12 California and had their IP address collected by the Trackers.”

. 13 Mashable does not challenge jurisdiction this time. See MTD (Dkt. 34). Mashable 14 instead moves to dismiss solely under Rule 12(b)(6), arguing that the SAC fails to state a 15 claim under CIPA § 638.51. 16 C. Statutory Framework 17 CIPA was enacted to protect Californians’ privacy rights. See

630. The chapter contains several distinct provisions regulating different types of 19 surveillance. At issue here is the Pen Register Act, codified at §§ 638.50–638.55. The Pen 20 Register Act prohibits the installation or use of a pen register or trap-and-trace device 21 without first obtaining a court order or user consent.

(a)–(b). 22 CIPA provides a private right of action with statutory damages of $5,000 per violation or 23 three times the amount of actual damages, whichever is greater, as well as injunctive relief. 24

. 25 The Act defines a “pen register” broadly as “a device or process that records or 26 decodes dialing, routing, addressing, or signaling information transmitted by an instrument 27 or facility from which a wire or electronic communication is transmitted, but not the 1 and trace device” is similarly defined as a process that captures incoming addressing 2 information.

(c). 3 Historically, these terms described devices attached to telephone lines that recorded 4 outgoing or incoming phone numbers dialed. But more recent litigation in this district has 5 tested whether software trackers embedded in websites qualify as “pen registers” when 6 they collect users’ IP addresses, device identifiers, and browsing data. Several judges in 7 this district, including Judges Lin, Orrick, Pitts, Ryu, Tigar, and the undersigned, have held 8 that such allegations suffice at the pleading stage. See, e.g., Shah v. Fandom, Inc.,

Supp. 3d 924 (N.D. Cal. 2024) (Lin, J.) (holding that courts should focus “less on the form 10 of the data collector and more on the result” and that trackers are “at least a ‘process’ 11 because it is ‘software that identifies consumers, gathers data, and correlates that data”); 12 Mirmalek v. L.A. Times Commc’ns LLC, No. 24-cv-1797-CRB,

(N.D. 13 Cal. Dec. 12, 2024) (Breyer, J.) (Courts cannot ignore the “expansive language in the 14 California Legislature’s chosen definition [of pen register]” which is “vague and inclusive 15 as to the form of the collection tool (i.e., ‘device or process’)”) (brackets in original); In re 16 Meta Pixel Tax Filing Cases, No. 22-cv-07557-PCP,

(N.D. Cal. Aug. 6, 17 2025) (Pitts, J.); Gabrielli v. Haleon US Inc., No. 25-cv-02555-WHO,

18 (N.D. Cal. Aug. 29, 2025) (Orrick, J.); Garon v. Keleops USA, Inc., No. 25-cv-02124- 19 DMR,

(N.D. Cal. Sept. 2, 2025) (Ryu, J.); Riganian v. LiveRamp 20 Holdings, Inc., No. 25-cv-00824-JST (N.D. Cal. July 18, 2025) (Tigar, J.). 21 Courts in the District have emphasized that the inclusion of the term “process” in 22 the definition of a pen register was intended to extend the statute’s reach beyond physical 23 telephone hardware to include software tools that carry out materially similar functions. 24 See Mirmalek v. L.A. Times Commc’ns LLC, No. 24-cv-01797-CRB,

, 25 at *3 (N.D. Cal. Dec. 12, 2024) (denying motion to dismiss and stressing the “vague and 26 inclusive” language in the statute’s definition of “pen register”). 27 III. REQUESTS FOR JUDICIAL NOTICE 1 dismiss and its reply brief in support of its motion to dismiss. Dkt. 35, Dkt. 40. 2 The first request is for the court to take judicial notice of four exhibits, all of which 3 are California superior court orders dismissing CIPA pen register claims: Sanchez v. 4 Cars.com Inc., No. 24STCV13201,

(Cal. Super. Jan. 27, 2025); 5 Rodriguez v. Plivo Inc., No. 24STCV08972,

(Cal. Super. Oct. 2, 2024); 6 Casillas v. Transitions Optical, Inc., No. 23STCV30742,

(Cal. Super. 7 Ct. Sept. 9, 2024); and Licea v. Hickory Farms LLC, No. 23STCV26148,

1798147 (Cal. Super. Mar. 13, 2024). These are matters of public record and may be 9 judicially noticed for their existence and procedural posture, though not for the truth of any 10 disputed facts. 11 The second request is for the court to take judicial notice of a transcript of the 12 testimony of California State Senator Anna Caballero at an April 29, 2025 hearing 13 regarding Senate Bill 690, which addresses CIPA litigation. Legislative history materials 14 are properly subject to judicial notice for the fact that they were made, though not for the 15 accuracy of statements therein. 16 Accordingly, the Court GRANTS Mashable’s requests for judicial notice. 17 IV. LEGAL STANDARD 18 Under Rule 12(b)(6), the Court may dismiss a complaint for failure to state a claim 19 upon which relief may be granted. The Court may base dismissal on either “the lack of a 20 cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal 21 theory.” Godecke v. Kinetic Concepts, Inc.,

(9th Cir. 2019) (cleaned 22 up). A complaint must plead “sufficient factual matter, accepted as true, to state a claim to 23 relief that is plausible on its face.” Ashcroft v. Iqbal,

(2009) (cleaned 24 up). A claim is plausible “when the plaintiff pleads factual content that allows the court to 25 draw the reasonable inference that the defendant is liable for the misconduct alleged.”

26 “Threadbare recitals of the elements of a cause of action, supported by mere conclusory 27 statements, do not suffice” to survive a 12(b)(6) motion.

(citing Bell Atlantic v. 1 “must presume all factual allegations of the complaint to be true and draw all reasonable 2 inferences in favor of the nonmoving party.” Usher v. City of L.A.,

(9th 3 Cir. 1987). “[C]ourts must consider the complaint in its entirety, as well as other sources 4 courts ordinarily examine when ruling on Rule 12(b)(6) motions to dismiss, in particular, 5 documents incorporated into the complaint by reference, and matters of which a court may 6 take judicial notice.” Tellabs, Inc. v. Makor Issues & Rights, Ltd.,

, 322 7 (2007). 8 V. DISCUSSION 9 Mashable argues that the SAC should be dismissed for three key reasons: 10 1. Mashable contends that California’s pen register provisions apply only to 11 “person-to-person communications, i.e., communications between or among people that 12 occur on services like phone, text messages, email, and the like. It was never intended to 13 govern commercial websites that do not provide people with any means to communicate 14 with one another.” SAC MTD at 1. Mashable emphasizes statutory text and legislative 15 history, specifically recent legislative discussions about an amendment to the pen register 16 law that would prevent its application to commercial tools for online advertising.

at 4– 17 8. 18 2. Mashable argues that even if the pen register statute applied, the SAC fails to 19 state a pen register claim. Id. at 2. Specifically, (a) pen registers capture outgoing data, 20 but the data collected here is not analogous to “the outgoing numbers that someone dials 21 from a monitored phone;” (b) Fregosa has not alleged a qualifying “communication with 22 content” because accessing a public website is not communication with content; (c) 23 Mashable is the intended recipient of any alleged communications, and the Pen Register 24 Act does not prohibit a defendant from capturing information about users who contact or 25 communicate with that defendant; and (d) to the extent Fregosa alleges third party 26 collection of data, CIPA does not impose aiding-and-abetting liability. Id. at 2. 27 3. Mashable finally states that CIPA is, at best, ambiguous as to whether it 1 lenity requires the Court to construe it narrowly. Id. at 2–3. 2 For the reasons set forth below, the Pen Register Act applies to the use of trackers 3 under these circumstances, the SAC properly states a claim for a Pen Register Act 4 violation, and the rule of lenity does not require dismissal. Accordingly, the motion to 5 dismiss is DENIED. 6 A. Applicability of Pen Register Act to Internet Trackers 7 To state a claim for a violation of the Pen Register Act, a plaintiff must allege that a 8 defendant installed or used a pen register without a court order.

638.51(a); Greenley v. Kochava, Inc.,

, 1050–51 (S.D. Cal. 2023). 10 Mashable’s principal argument is that CIPA’s pen register provisions do not apply 11 to the kind of website tracking alleged here. According to Mashable, the statute is limited 12 to “person-to-person communications,” such as telephone calls or emails, and was never 13 intended to regulate online advertising technologies or websites. MTD at 3. This 14 argument finds no support in the legislative text, legislative purpose, or the growing body 15 of decisions from this District. 16 This Court has emphasized that the Legislature intentionally employed broad 17 language to capture new uses of technologies: “‘the Court cannot ignore the expansive 18 language in the California Legislature’s chosen definition [of pen register],’ but ‘vague and 19 inclusive as to the form of the collection tool’ (i.e. ‘device or process’).” Mirmalek v. L.A. 20 Times Commc’ns LLC,

, at *3 (quomting Greenley v. Kochava, Inc., 21

, 1050 (S.D. Cal. 2023)). What matters under the statute is not the 22 form of the tool, but rather the function — specifically, whether the process records 23 routing or addressing information of a communication. See

(“[C]ourts should focus 24 less on the form of the data collector and more on the result.”). 25 The statute defines a pen register broadly as any “device or process” that records or 26 decodes “dialing, routing, addressing, or signaling information,” transmitted by an 27 instrument or facility from which a wire or electronic communication is transmitted. Cal. 1 refers to “persons,” or excludes software processes embedded in websites. See Cal. Penal 2 Code §§ 638.50, 638.51. On the contrary, the Legislature’s choice of the phrase “device or 3 process” reflects an intentional technology-neutral approach, ensuring the statute reaches 4 novel surveillance methods as they emerged. Courts interpreting CIPA have consistently 5 treated the broad statutory language as intentional and significant. In Mirmalek v. L.A. 6 Times, this Court emphasized that the legislature could have used narrower, telephone- 7 specific terminology but instead opted for expansive language to capture evolving privacy 8 threats. No. 24-cv-01797-CRB,

, at *3–4. Similarly, in Shah v. 9 Fandom, Judge Lin held that website-based tracking software could plausibly constitute a 10 pen register, rejecting the defendant’s argument that the statute is confined to telephonic 11 data. 754 F. Supp. 3d at 929–31 (“Giving effect to CIPA’s broad statutory language is 12 consistent with the California Legislature’s stated intent to protect privacy interests, as 13 well as the California courts’ approach when applying statutes to new technologies.”); see 14 also In re Meta Pixel Tax Filing Cases, No. 22-cv-07557-PCP,

, at *5 15 (N.D. Cal. Aug. 6, 2025) (recognizing “CIPA’s purpose to protect Californians’ privacy” 16 and declining to adopt defendant’s narrowed interpretation of the pen register statute); 17 Gabrielli v. Haleon US Inc., No. 25-cv-02555-WHO,

, at *11 (N.D. Cal. 18 Aug. 29, 2025) (emphasizing the elasticity of the Pen Register Act in regulating new 19 technologies). 20 The alleged trackers function similarly to traditional pen registers and fit within the 21 statutory definition. As alleged in the SAC, when a user loads Mashable’s website, their 22 browser sends an HTTP request to Mashable’s servers, and the embedded trackers cause 23 the browser to transmit the user’s IP address and device identifiers to third parties. SAC ¶¶ 24 57–186. An IP address, like a telephone number, is quintessential “addressing” 25 information transmitted by the user’s computer or smartphone in connection with an 26 outgoing HTTP request to Mashable’s website: it identifies the device sending the 27 communication and determines where the packet is to be routed. Device “fingerprints” 1 At the pleading stage, alleging that these trackers record such information, while not 2 capturing the substantive content of the communications, is sufficient to plausibly state 3 that they function as pen registers. See, e.g., Mirmalek,

, at *3–5; Shah, 4 754 F. Supp. 3d at 933; In re Meta Pixel Tax Filing Cases,

, at *4–6; 5 Garon,

, at *3–5. 6 Courts in this district have consistently recognized similar technologies as pen 7 registers. See, e.g., Shah, 754 F. Supp. 3d at 929–31 (denying motion to dismiss where 8 plaintiffs alleged that third-party trackers on news website captured IP addresses and other 9 identifiers); Mirmalek,

, at *3–4 (highlighting the broad statutory 10 language of the Pen Register Act and holding that trackers that transmit IP addresses and 11 user identifiers plausibly fall within the Act’s scope). Mashable urges the Court to find 12 that Shah, and by extension Mirmalek, were “wrongly-decided” because they unduly 13 expanded the scope of the Pen Register Act. Reply iso MTD at 10–11. But the statute is 14 not as limited as Mashable makes it out to be, and courts must not import restrictions 15 untied to any statutory text, particularly when doing so would interfere with the statute’s 16 purpose. See, e.g., Yeager v. Blue Cross of Cal.,

(Cal. Ct.

) (“We may not make a silent statute speak by inserting language the Legislature 18 did not put in the legislation.”); Shah, 754 F. Supp. 3d at 929 (“Nothing in the statutory 19 definition limits pen registers to those that operate the same way as a traditional phone pen 20 register.”); Matera v. Google Inc.,

, at *19 (N.D. Cal. Aug. 12, 2016) 21 (Koh, J.) (“[T]he California Supreme Court has instructed courts to interpret CIPA in the 22 manner that ‘fulfills the legislative purpose of CIPA by giving greater protection to privacy 23 interests.’”) (quoting Flanagan v. Flanagan,

(Cal. 2002)). 24 For the foregoing reasons, the Pen Register Act applies to website-based trackers 25 and the telecommunications processes described in the SAC. 26 B. Sufficiency of Pleadings Under § 638.51 27 Mashable argues that even if the Pen Register Act could theoretically apply to web- 1 Pen Register Act. At this stage, however, the SAC adequately pleads the statutory 2 elements. 3 1. Website-Embedded Trackers Are “Pen Registers” 4 The threshold question is whether the “device or process” alleged qualifies as a 5 “pen register.” See

. Here, the SAC alleges that trackers record 6 addressing information associated with the user’s outgoing HTTP requests. SAC ¶¶ 57– 7 186. Mashable argues that the technology at issue here is not a “pen register,” because “a 8 pen register records the called party’s information, and not the calling party’s 9 information.” MTD at 9. The core of the argument appears to be that the process at issue 10 in this case is the reversal of a typical pen register situation, since the website trackers 11 capture incoming data, rather than outgoing data. 12 Fregosa pleads that Mashable embedded third-party trackers on its website and that, 13 when the website was visited by users, the trackers recorded the IP address and device 14 identifiers of the user and transmitted that information to Microsoft, Wunderkind, and 15 PubMatic. Under § 638.50(b), a pen register includes any “device or process” that records 16 or decodes dialing, routing, addressing, or signaling information. The definition is 17 technology-neutral, not confined to legacy telephone equipment, and not particularly 18 sensitive to the semantic distinction that Mashable seeks to draw. Courts in this district 19 have widely recognized that trackers capturing IP addresses and related metadata fall 20 comfortably within the definition of a “pen register.” See Shah, 754 F. Supp. 3d at 931 21 (“The HTTP request transmitted from users’ computers or smartphones constitutes an 22 electronic communication, and the Trackers record the addressing information associated 23 with the communication. Based on the expansive statutory definition of a pen register, 24 ‘tracking software could plausibly constitute a pen register under §§ 638.50 and 638.51.’”) 25 (quoting Moody v. C2 Educ. Sys. Inc.,

, 1076 (C.D. Cal. 2024)); see 26 also Mirmalek,

, at *4 (“Finally, the Trackers ‘record’ the addressing 27 information by ‘instruct[ing] the user’s browser to send . . . the user’s IP address’ to the 1 . . Therefore, Plaintiff adequately alleges that the Trackers record addressing information, 2 as required by CIPA.”). 3 At the pleading stage, it is sufficient that Fregosa alleges a process designed to 4 record addressing information from electronic communications. See Mirmalek,

5102709, at *4. 6 2. Website Visits Involve an “Electronic Communication” 7 Mashable suggests that website visits are not the type of “electronic 8 communication” covered by the Pen Register Act. MTD at 10. Specifically, according to 9 Mashable, merely visiting a website does not constitute a “communication” and therefore 10 does not trigger the Pen Register Act. The statutory text belies Mashable’s argument. 11 Section 638.50(b) covers information transmitted “by an instrument or facility from 12 which a wire or electronic communication is transmitted.” The statute uses expansive 13 language and does not limit “electronic communication” in the way Mashable suggests. 14 When a user enters Mashable’s website, the browser necessarily transmits an HTTP 15 request to Mashable’s server. That request includes the user’s IP address and other routing 16 data that allow the server to deliver the requested content. This is a paradigmatic 17 “electronic communication.” Courts in this District have recognized as much. In Shah, 18 the defendant operated a similar website. 754 F. Supp. 3d at 929. The court highlighted 19 CIPA’s expansive language, remarking that “[a]ll that is required [for a Pen Register Act 20 claim] is that the Trackers record addressing information transmitted by the user’s 21 computer or smartphone in connection with the outgoing HTTP request to [defendant’s] 22 website, regardless of whether that addressing information pertains to the sender or the 23 recipient of the communication at issue.” Id. The court concluded that “[t]he HTTP 24 request transmitted from users’ computers or smartphones constitutes an electronic 25 communication, and the Trackers record the addressing information associated with this 26 communication. Based on the expansive statutory definition of a pen register, ‘tracking 27 software could plausibly constitute a pen register under §§ 638.50 and 638.51.’” Shah, 1 adopted the same reasoning.

, at *4. 2 Likewise, in Gabrielli, Judge Orrick rejected the argument that web browsing falls 3 outside the statute’s scope, reasoning that CIPA’s privacy-protective purposes would be 4 frustrated by reading “communication” so narrowly as to exclude the everyday electronic 5 interactions that the statute was designed to regulate. Gabrielli v. Haleon US Inc., No. 25- 6 cv-02555-WHO,

, at *12 (N.D. Cal. Aug. 29, 2025) (“Haleon also 7 asserts, in passing, that Gabrielli’s Section 638.51(a) pen register claim cannot coexist with 8 his Section 631(a) wiretapping claim because pen registers ‘do not record contents,’ but 9 wiretaps do. . . . This argument would lead to the conclusion that any pen register that also 10 recorded the ‘contents’ of users’ information would no longer fall under the protection of 11 Section 638.51(a) of CIPA. That cannot have been the Legislature’s intent.”). 12 Mashable’s position — that there must be an interpersonal exchange — is 13 unsupported. Nothing in the text requires that a communication involve two human 14 correspondents. An HTTP request from a user’s browser to a website server is a sufficient 15 communication. By alleging that she visited Mashable’s website and that her browser 16 transmitted HTTP requests containing identifying information, Fregosa has adequately 17 alleged a qualifying communication under the statute. 18 3. Defendant’s Status as a Party to the Communication 19 Mashable argues that the Pen Register Act cannot apply to it because of its role in 20 the communications at issue. Mashable raises two related points: first, that as a direct 21 party to users’ communications, it cannot be liable for the receipt of IP addresses and other 22 identifying data; and second, that it did not itself install or use the trackers, since those 23 were operated by third-party vendors. Neither argument is persuasive at this stage. 24 First, Mashable argues that, as the operator of the website at issue, it is a direct 25 party to any communication from the user’s browser and therefore cannot be liable for 26 learning information that users necessarily disclose when visiting a website, such as their 27 IP address. MTD at 10–11. This framing mischaracterizes the SAC. Fregosa does not 1 online exchange. Rather, the SAC alleges that Mashable affirmatively embedded third- 2 party trackers that recorded and transmitted users’ identifying information to outside 3 entities for profiling and advertising purposes. Courts have rejected similar attempts to 4 dismiss complaints when the allegations involved transmission of data to third parties. In 5 Shah, the defendant raised this exact point, contending that users voluntarily disclosed 6 their IP addresses by visiting the defendant’s website. 754 F. Supp. 3d at 931. The court 7 explained that consent is limited to the narrow conduct authorized, and that a user who 8 expects to disclose information to the website operator does not thereby consent to 9 disclosure to unrelated third parties. Id. at 931–32. Here too, Mashable cannot claim a 10 categorical exemption merely because it was a party to the initial communication. 11 Second, Mashable argues that even if trackers can qualify as pen registers, 12 Mashable cannot be liable because it was the third-party vendors, and not Mashable itself, 13 that installed and operated the trackers. This defense is also insufficient at this stage. In 14 Shah, the court held that plaintiffs adequately alleged installation where the defendant 15 incorporated third-party code into its site, thereby causing users’ browsers to run the 16 trackers. Id. at 931 (“Even if third parties ‘developed and used the [Tracker] software,’ it 17 is alleged that [defendant] was responsible for integrating the third-party script into its own 18 website. Based on this, Plaintiffs’ allegation that [defendant] installed the Trackers is 19 sufficient to state a claim.”). Similarly, in In re Meta Pixel Tax Filing Cases, Meta argued 20 that it did not “use” a pen register because other entities installed the Pixel, and Meta only 21 received the data afterward. No. 22-cv-07557-PCP,

, at *3 (N.D. Cal. 22 Aug. 6, 2025). Judge Pitts rejected that characterization, likening it to “a prosecutor who 23 purchased a pen register, handed that pen register to a police officer and then instructed the 24 police officer to install it without a court order and further aided the officer in doing so.” 25

Under the plain language of the statute, the prosecutor would have “used” the pen 26 register.

The SAC alleges a comparable dynamic: Mashable deliberately embedded 27 third-party trackers on its website, knew that those trackers would capture visitors’ IP 1 Wunderkind, and PubMatic to facilitate targeted advertising. SAC ¶¶ 57–186. That active 2 role is enough to plead “use” under § 638.51, even if technical operations were handled by 3 third parties. 4 Finally, Mashable also refers to an “aiding-and-abetting” concern, suggesting that 5 Fregosa is improperly attempting to impose liability for the acts of third parties. MTD at 6 11–12. The SAC, however, pleads direct, not secondary, liability: it alleges that Mashable 7 embedded third-party trackers in its own website, thereby causing users’ browsers to 8 install and run them, and that Mashable used the resulting data flows. On those facts, 9 Mashable itself “installed” and/or “used” a “device or process” that records addressing 10 information, i.e., a pen register. See

, 638.51(a). This theory 11 turns on Mashable’s own conduct, not vicarious liability or aiding-and-abetting liability for 12 the acts of others. 13 For the foregoing reasons, Mashable has not established any exemption from the 14 Pen Register Act. 15 4. Effect of Senate Bill 690 on the Issues Presented 16 Mashable relies on the pending Senate Bill 690 as evidence that the California 17 Legislature disagrees with Fregosa’s interpretation of the Pen Register Act — and by 18 extension, the Northern District’s orders in Shah, Mirmalek, Gabrielli, and In re Meta 19 Pixel Tax Filing Cases. See MTD at 8. The Senate’s floor analysis describes S.B. 690 as 20 an effort to “stop the thousands of shakedown letters and lawsuits against California 21 businesses of all sizes for typical business activities, like website analytics or online 22 advertising that are already governed by” other laws.

(quoting Senate Floor Analysis 23 — Third Reading of S.B. 690 Before the S. Rules Comm., 2025–2026 Reg. Sess. (Cal. 24 2025) at 8). 25 Mashable’s argument is unpersuasive for several reasons: 26 First, S.B. 690 is not the law. It has not passed the Legislature or been signed by 27 the Governor. The Court must apply the statute as it currently exists, and the operative text 1 proper basis for judicial narrowing of statutory text. See U.S. v. King,

, 1232 2 (9th Cir. 2022) (“But we cannot rely upon unenacted bills to modify an existing statute, as 3 that is a function of Congress.”). 4 Second, as Fregosa notes, the provision that would have allowed the bill to apply 5 retroactively was removed during the legislative process. Opp. to MTD at 7 (citing 6 California Senate Bill 690, https://legiscan.com/CA/text/SB690/2025). Thus, even if S.B. 7 690 were enacted into law in its present form, it would have no effect on this case which 8 exclusively concerns conduct that occurred before the bill’s potential enactment. 9 Third, subsequent legislative activity carries little interpretive weight, particularly 10 when it post-dates the conduct at issue. See Consumer Prod. Safety Comm’n v. GTE 11 Sylvania, Inc.,

, 117–18 (1980) (“[V]iews of a subsequent Congress form an 12 extremely hazardous basis for inferring the intent of an earlier one.”); Carmona v. Div. of 13 Indus. Safety,

, 311 n.8 (Cal. 1975) (“First, it is well established that courts 14 will generally not rely even on statements made by individual lawmakers as a reliable 15 expression of the intent of the entire legislative body.”). 16 Finally, courts in this District have already declined to stay litigation pending the 17 outcome of S.B. 690. In Garon v. Keleops, Judge Ryu rejected a request for a stay, 18 reasoning that the bill’s status was “too tenuous to form a basis to stay the case” given that 19 “[t]here is no indication when SB690 will be enacted” or whether the proposed language 20 would survive in its final form. No. 25-cv-02124-DMR,

, at *6 (N.D. 21 Cal. Sept. 2, 2025). That reasoning applies equally here. The Court should not defer 22 adjudication or rewrite statutory text based on an unenacted proposal. 23 C. Rule of Lenity 24 Finally, Mashable invokes the rule of lenity, arguing that ambiguities in the statute 25 must be resolved in its favor. MTD at 12–15. But as courts have recognized, the rule of 26 lenity has little force in this context. 27 The rule of lenity applies “when two reasonable interpretations of the same 1 interpretations of a penal statute.” Smith v. LoanMe, Inc.,

(Cal. 2021). 2 More specifically, the rule of lenity applies “only if the court can do no more than guess 3 what the legislative body intended; there must be an egregious ambiguity and uncertainty 4 to justify invoking the rule.” People v. Super. Ct. of Riverside Cnty.,

, 5 886 (Cal. Ct. App. 2022) (internal quotations omitted); see Vera v. O’Keefe,

2d 959, 965 (S.D. Cal. 2011) (ruling in the invasion of privacy context that defendant “has 7 at most shown that a narrower interpretation” of the statute “is conceivable, but that is 8 insufficient to establish ambiguity. ‘[D]isputed words or phrases in criminal laws have in 9 many instances been interpreted broadly, defeating defendants’ claims’”) (brackets in 10 original). 11 As noted above, the statute contains no grievous ambiguity: its language, structure, 12 history, and purpose are sufficiently clear, and they leave no need for the Court to merely 13 speculate about its applicability. The statutory text is deliberately expansive, designed to 14 encompass new technologies and apply to conduct like that alleged here. See Mirmalek, 15

, at *3. 16 The district court has previously disregarded similar rule of lenity arguments in the 17 pen register context. In Riganian, Judge Tigar disposed of a similar argument, reasoning 18 that “[t]he ‘rule of lenity only applies if, after considering text, structure, history, and 19 purpose, there remains a ‘grievous ambiguity or uncertainty in the statute.’” Riganian v. 20 LiveRamp Holdings, Inc., No. 25-cv-0824-JST,

, at *12 (N.D. Cal. July 21 18, 2025) (quoting Barber v. Thomas,

, 139 (2010)). In the absence of any 22 “grievous ambiguity” in the statute’s express language, a defendant may not invoke the 23 rule of lenity. Id.; see also Garon v. Keleops USA, Inc.,

, at *6 (“Like 24 the defendant in Riganian, Keleops has not identified any ‘grievous ambiguity or 25 uncertainty’ in CIPA.”). 26 Because Mashable similarly has not identified a “grievous ambiguity” in the pen 27 register statute, the rule of lenity does not apply, and the Court should not dismiss on this 1 VI. CONCLUSION 2 For the foregoing reasons, the Court hereby DENIES Defendant Mashable’s 3 || motion to dismiss the Second Amended Complaint. 4 5 IT IS SO ORDERED. 6 7 Dated: October 9, 2025 8 9 2 fa CHARLES R. BREYER 10 United States District Judge 11 12 13 15 16

17

Oo Z 18 19 20 21 22 23 24 25 26 27 28