Shah v. Fandom, Inc.
3:24-cv-01062
| N.D. Cal. | Oct 21, 2024Background
- Plaintiffs Vishal Shah and Jayden Kim filed a class action against Fandom, Inc., alleging that gamespot.com deploys third-party tracking software ("Trackers") to collect and transmit users' IP addresses to companies without user consent.
- Plaintiffs claim this violates California's pen register statute (CIPA Section 638.51(a)), which prohibits installing or using a pen register (a device/process that records addressing info about electronic communications) without a court order.
- The Trackers allegedly installed cookies and repeatedly transmitted users' IP addresses to third parties (GumGum, Audiencerate, TripleLift) for advertising/analytics purposes without users' knowledge or consent.
- Fandom moved to dismiss, arguing such IP transmission is a standard, expected part of web activity, and users consent by visiting the site.
- At the motion to dismiss stage, the court must accept plaintiffs' factual allegations as true and determine only whether the complaint plausibly alleges a claim under the statute.
- The court denied Fandom's motion to dismiss, allowing the suit to proceed.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Are Trackers "pen registers" under CIPA? | Trackers record users' IP addresses (addressing info), meeting statute's definition. | Trackers don’t function like traditional pen registers, don’t collect recipient info, and don’t fall under statute. | Trackers plausibly fit statutory definition of "pen register" as processes that collect addressing info. |
| Do Trackers capture contents of communications (which would exclude them from CIPA)? | Only addressing info (IP), not contents, is collected. | IP addresses sent through cookies are "contents." | Trackers only collect addressing info, not contents; argument rejected. |
| Did Fandom "install" the Trackers? | Fandom integrated third-party code into its website, thus installed Trackers. | Third parties, not Fandom, are responsible for installation/operation. | Fandom’s alleged integration of code is sufficient to plausibly plead installation. |
| Was there user consent to transmission of IP addresses? | Plaintiffs did not knowingly consent to sharing IPs with third parties for tracking. | Users necessarily and voluntarily disclose IPs by accessing the site, implying consent. | No showing of consent as a matter of law; consent issue inappropriate for dismissal. |
Key Cases Cited
- Ashcroft v. Iqbal, 556 U.S. 662 (plausibility standard for pleadings)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (pleading requirements for federal court complaints)
- Levitt v. Yelp! Inc., 765 F.3d 1123 (standard for Rule 12(b)(6) motions)
- In re Zynga Litig., 750 F.3d 1098 (IP addresses constitute addressing information, not contents, under communications law)
- Satterfield v. Simon & Schuster, Inc., 569 F.3d 946 (statutory interpretation—plain meaning of text)
- Flanagan v. Flanagan, 41 P.3d 575 (California Supreme Court mandates broad, privacy-protective reading of CIPA)