A recent federal court ruling in California has created uncertainty for businesses that use website tracking technology. On November 18th, the Southern District of California allowed a lawsuit against Adidas to move forward, finding that its use of tracking pixels may violate the California Invasion of Privacy Act (“CIPA”). The court concluded that Adidas collected user data without obtaining affirmative consent—despite having a privacy policy—because that policy was not clearly presented to visitors. This ruling conflicts with other California decisions that have held there is no reasonable expectation of privacy in data like IP addresses and device identifiers, suggesting that California courts are split on how CIPA applies to common tracking tools.
The lawsuit centers on whether modern website tracking tools—such as pixels—can be considered “pen registers,” a term historically used for law enforcement devices that collected phone call metadata. Plaintiffs’ attorneys increasingly argue that digital tools qualify under CIPA and are pursuing claims across large classes of website users. While many courts have rejected these claims due to lack of harm or legislative intent, the Adidas decision signals that some judges are willing to allow these cases to proceed. The result is a patchwork of rulings that make it difficult for businesses to know what is required to stay compliant.
With the legal landscape in flux, businesses using cookies, pixels, session replay tools, or other analytics technology should review their consent practices and data collection policies. Key steps include using clear cookie banners that require users to consent, keeping privacy policies updated and easy to understand, limiting data collection to what is necessary, and conducting regular audits of tracking tools—especially those added by third-party vendors.
If you have questions about how CIPA may impact your business or need guidance on strengthening your consent and compliance strategy, please contact
