Lesh v. Cable News Network, Inc. (CNN)

• Court: District Court, S.D. New York
• Decided: February 20, 2025
• Docket: 1:24-cv-03132
• Status: Unknown

Opinion

VUOoly OLIni DOCUMENT ELECTRONICALLY FILED UNITED STATES DISTRICT COURT DOC #: SOUTHERN DISTRICT OF NEW YORK DATE FILED: _2/20/2025 _ CAROL LESH, individually and on behalf of all others similarly situated, 24 Civ. 03132 (VM) Plaintiff, DECISION AND ORDER - against - CABLE NEWS NETWORK, INC., Defendant.

VICTOR MARRERO, United States District Judge. Plaintiff Carol Lesh (“Lesh”) brings this class action against defendant Cable News Network, Inc. (“CNN”), alleging violations of California Penal Code Section 638.51 (hereinafter “CIPA” or “Section 638.51.”). (See Amended Complaint (“Am. Compl.”), Dkt. No. 25.) Before the Court is CNN’s Motion to Dismiss the Amended Complaint and/or Strike Plaintiff’s class allegations pursuant to Federal Rule of Civil Procedure 12(b) (6) (“Rule 12(b) (6)”). (See Dkt. No. 32.) For the reasons discussed below, CNN’s Motion is DENIED.

I. BACKGROUND1 A. THE CNN WEBSITE CNN owns and operates the website CNN.com (the “Website”), which uses third-party trackers [“Trackers”]2 to collect Website visitors’ IP addresses to “analyze the

performance of marketing campaigns and target specific users or specific groups of users for advertisements.” (Amended Compl. ¶ 74.) An IP address is a unique identifier for an electronic communication device, which indicates the network the device accesses and the specific device being used. The IP address contains geographical location information and can be used to determine the state, city, and zip code where the device is situated at a particular point. The Website installs these Trackers on a visitor’s internet browser upon accessing the Website through the following process. To load the Website, a user’s browser sends a request, known as an “HTTP request,” to CNN’s server. In

reply, CNN’s server sends an “HTTP response,” which provides instructions to the user’s browser on how to load the Website.

1 Except as otherwise noted, the following background derives from the Amended Complaint. The Court takes all facts alleged therein as true and construes all justifiable inferences arising therefrom in the light most favorable to the plaintiff, as required under the standard set forth below in Section II. 2 These Trackers are individually referred to as the “PubMatic tracker,” “Magnite tracker,” and “Antiview tracker.” All trackers are developed by third-party software companies which sell certain technology that helps companies place advertisements on their websites. CNN’s HTTP response includes directions to install the Trackers on the user’s browser cache, a form of temporary storage.3 The Trackers then instruct the browser to send it the user’s IP address. The Tracker also stores a “cookie”4 on the user’s browser so that when the user subsequently visits

the Website, the Trackers locate the cookie identifier stored on the user’s browser. The Trackers then cause the browser to send the cookie along with the user’s IP address to the third- party app that created the Tracker, thus identifying repeat visitors to the Website. By collecting a visitor’s IP address, the third-party app can use the IP address to target advertisements towards customers based on their geographical location. When Lesh visited the Website, the Website’s code caused the Trackers to be installed on Lesh’s browser. Pubmatic and Magnite specifically used Lesh’s IP address to ascertain her location and specific coordinates. Lesh did not give consent

to CNN before its Website installed or used the Trackers and

3 See “Web cache,” PC MAG, https://www.pcmag.com/encyclopedia/term/web- cache (defining cache as “a folder full of Web pages in the user’s computer that is maintained by the Web browser for a period of time.”) 4 Cookies are “strings of data that a web server sends to the browser. When a browser requests an object from the same domain in the future, the browser will send the same string of data back to the origin server.” See “What are cookies? What are the differences between them (session vs persistent,” Cisco.com, https://www.cisco.com/c/en/us/support/docs/security/web-security- appliance/117925-technote-csc-00.html. CNN did not obtain a court order granting it permission to install or use the Trackers. B. PROCEDURAL HISTORY Lesh filed this class action suit on January 25, 2024, in California Superior Court. (See Dkt. No. 1-1 at 9.) CNN

removed the action to the Northern District of California on March 5, 2024. (See Dkt. No. 1.) On April 24, 2024, the parties stipulated to transfer the case to the Southern District of New York. (See Dkt. No. 9.) On June 14, 2024, Lesh filed the First Amended Complaint. (See Dkt. No. 25.) After an exchange of pre-motion letters pursuant to this Court’s Individual Practices (see Dkt. Nos. 26, 27, 28), CNN made its Motion to Dismiss the Amended Complaint (see Dkt. No. 32) supported by a memorandum of law (see Dkt. No. 33 [hereinafter “Def. Mem.”.]) Lesh thereafter filed a response (see Dkt. No. 35 [herein “Pl. Mem.”]), to which CNN replied (see Dkt. No. 36 [herein “Def. Reply Mem.”]).

II. LEGAL STANDARD “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “The assessment of whether a complaint’s factual allegations plausibly give rise to an entitlement to relief ‘does not impose a probability requirement at the pleading stage; it simply calls for enough fact to raise a reasonable expectation that discovery will reveal evidence of illegal’ conduct.” Lynch v. City of New York, 952 F.3d 67, 75 (2d Cir. 2020) (quoting Twombly, 550

U.S. at 556); see Iqbal, 556 U.S. at 678 (“A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”). In determining whether a complaint states a claim that is plausible, courts must “give no effect to assertions of law or to legal conclusions couched as factual allegations, but [must] accept as true the factual allegations of the complaint, and construe all reasonable inferences that can be drawn from the complaint in the light most favorable to the plaintiff.” Anderson News, L.L.C. v. Am. Media, Inc., 680 F.3d 162, 185 (2d Cir. 2012) (cleaned up); see Iqbal, 556

U.S. at 678. III. DISCUSSION Section 638.51 of CIPA prohibits a person or entity from “install[ing] or us[ing] a pen register or a trap and trace device without first obtaining a court order.” Cal. Penal Code § 638.51(a). The statute defines “pen register” as a “device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of the communication.” Cal. Penal Code § 638.50(b). Lesh argues that CNN’s use of the Trackers violates

Section 638.51(a) of CIPA. She claims that the Trackers function as a pen register because they capture “website visitors’ ‘routing, addressing, or signaling information’” in the form of IP addresses. (Amended Compl. ¶ 3 (quoting Cal. Penal Code § 638.50(b)). In response, CNN argues that Lesh’s claim fails because (1) Section 638.51 does not apply to the collection of IP addresses, (2) Section 638.51 does not cover trackers installed on web browser, (3) CNN’s consent to the use of Trackers bars Lesh’s claim and, (5) even if the statute applied to Lesh’s claims, the claims are barred by various provisions in CNN’s Terms of Use (“Terms”) and Privacy Policy, including a provision wherein she consented to the use of

Trackers and a Class Action Waiver. A. Statutory Standing CNN argues that the collection of IP addresses does not “fall within the zone of interests” protected by CIPA, citing to criminal cases holding that individuals do not have a privacy interest in their IP addresses under the Fourth Amendment. (Def. Mem. at 22.) However, cases regarding the limits of the Fourth Amendment have no bearing on whether an individual has standing to sue under CIPA, as CIPA provides protection beyond the floor set by the Fourth Amendment. In United States v. Ulbricht, the Second Circuit not only held that individuals do not have a privacy interest in their IP

addresses but that they also do not have a privacy interest in any pen registers under the Fourth Amendment. 858 F.3d 71, 96 (2d Cir. 2017) (abrogated on other grounds by Carpenter v. United States, 585 U.S. 296 (2018)). Applying this interpretation to CIPA would essentially void the statute of any effect. Further, Lesh has standing to sue under CIPA. Section 637.2 confers a private right of action on “[a]ny person who has been injured by a violation of this chapter.” Cal. Pen. Code § 637.2(a). Lesh alleges that CNN installed Trackers, owned by third-party entities, which then received her IP address for purposes of advertisement placement. These facts

plausibly suggest that Lesh did not expect the disclosure of this information to third parties, placing the conduct alleged within the scope of CIPA. Shah v. Fandom Inc., No. 24-cv-01062, 2024 WL 4539577, at *5 (N.D. Cal. Oct. 21, 2024). (finding standing because plaintiffs “were injured by being tracked across multiple visits for marketing and advertising purposes, and [] they did not expect or agree to such tracking.”). Therefore, taking the allegations in the Amended Complaint as true, Lesh has statutory standing to sue under CIPA.

B. Third-Party Trackers as “Pen Registers”

To state a claim for relief under Section 638.51, Lesh must adequately allege that the Trackers are “pen registers,” as defined by CIPA, and that CNN installed them without a court order. At this stage, Lesh has adequately pleaded these facts. CIPA defines “pen register” as a “device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Cal. Penal Code § 638.50(b). Thus, the Court must determine whether the Trackers constitute a “device or process” that records

“addressing information” transmitted by a facility from which an electronic communication is transmitted, but not the contents of the communication. First, the Trackers qualify as a “device or process” because they constitute “software that identifies consumers, gathers data, and correlates that data.” (Amended Compl. ¶¶ 38, 47, 56) (quoting Greenley v. Kochava, 684 F. Supp. 3d 1024, 1050 (S.D. Cal. 2023). As one federal district court in California has held, the statute is “specific as to the type of data a pen register collects . . . but it is vague and inclusive as to the form of collection tool –‘a device or process.’” Greenely, 684 F. Supp. At 1050 (quoting Cal. Penal

Code § 538.50(b)). Therefore, courts “should focus less on the form of the data collector and more on the result.” Id. Hence, because the Trackers collect data, they are a “process” under the statute. Moreover, the Trackers must run on “some kind of computing device.” (Amended Compl. ¶¶ 39, 48, 57) (quoting James v. Walt Disney Co., 701 F. Supp. 3d 942, 958 (N.D. Cal. 2023) (holding that software can constitute a device)). Under the inclusive language of CIPA, Lesh sufficiently alleges that the Trackers constitute a “device or process” under section 638.50. Mirmalek v. Los Angeles Times Communications LLC, No. 24-cv-01797, 2024 WL 5102709, at *3 (N.D. Cal. Dec. 12, 2024).

Next, the IP addresses collected by the Trackers qualify as “addressing information” under the statute. An IP address contains information related to geographical location which can be used to determine the location of a device’s state, city, and zip code. (Amended Compl. ¶ 24-25.) See In re Zynaga Litig., 750 F.3d 1098, 1108 (9th Cir. 2014) (“IP addresses constitute addressing information and do not necessarily reveal any more about the underlying contents of the communication than do phone numbers.” (internal citation omitted)); see also Shah, 2024 WL 4539577, at *3. Finally, IP addresses are “transmitted by an instrument or facility from which a wire or electronic communication is

transmitted.” Cal. Penal Code § 638.50. When a user first visits the Website, the browser sends an “HTTP request” to CNN’s server, which then responds with instructions that install the Trackers. Such Trackers prompt the browser to send the user’s IP address. These facts adequately allege the transmission of an electronic communication. See Shah, 2024 WL 4539577, at *3 (N.D. Cal. Oct. 21, 2024) (finding that the transmission of the HTTP request from the user’s computer to the website meets the definition of “electronic communication”). CNN argues that CIPA’s prohibition on pen registers does not apply to the Website but instead applies solely to the

capture of telephone information. (See Def. Mem. At 18.) The Court is not persuaded that the scope of the statute is so narrow. When interpreting a statute, courts start with the text. Salazar v. National Basketball Association, 118 F.4th 533, 546 (2d Cir. 2024). Section 638.50 defines pen register as a device or process that records information “transmitted by an instrument or facility from which a wire or electronic communication is transmitted.” Cal. Penal Code § 638.50(b) (emphasis added). The statutory text includes no limitation to information transmitted by telephone or over a phone line. Nor does such a narrow limitation comport with CIPA’s purpose.

CIPA was passed, in part, because “the development of new devices and techniques for the purpose of eavesdropping upon private communications . . . has created a serious threat to the free exercise of personal liberties.” Cal. Penal Code § 630. Consistent with this legislative intent, the definition of pen register in CIPA encompasses a variety of “electronic communications.” CNN takes issue with two recent decisions, Shah v. Fandom Inc., 2024 WL 4539577, at *4; and Mirmalek v. Los Angeles Times Communications LLC, 2024 WL 5102709, at *3, which similarly concluded that pen registers apply to trackers that collect IP addresses.

CNN argues that these cases overlook Section 638.52, which outlines requirements for a warrant to install a pen register on a communication device, referencing terms like “telephone number” and “telephone line.” However, this language is insufficient to support a reading of “telephone” into the definition of “pen register.” Section 638.52 lists requirements authorizing a warrant for a pen register on a telephone line but does not redefine “pen register” in Section 638.50. Section 638.52 “merely lists requirements relating to a particular type of pen register: one that is installed on a telephone line” but does not otherwise “alter the statutory definition of a pen register stated in § 630.50(b)”.

Shah, 2024 WL 4539577, at *4. The Court will not read the term “telephone” into Section 638.50 just because the word is used in another section of the statute that bears little relevance here. In addition, CNN’s argument that the federal Penn Register Act is limited to information transmitted on telephone lines – and thus CIPA should be limited to telephone lines - is without merit. Lesh does not bring any claims under the federal Penn Register Act and, as explained above, CIPA broadly defines “pen register.” The Court will not use a similar federal statute so as to read a requirement into the text of a California statute. See Bell v. Farmers Ins. Exch.,

87 Cal. App. 4th 805, 817 (2001). However persuasive, such interpretation is not binding on the Court in applying the statute relevant to this proceeding. In short, the plain text of Section 638.50 clearly does not limit the application of pen registers to telephones. “[T]he Court cannot ignore the expansive language in the California Legislature’s chosen definition [of pen register],” which is “specific as to the type of data [collected],” but “vague and inclusive as to the form of the collection tool.” Greenley, 684 F. Supp. 3d at 1050. Lesh adequately alleges the remaining elements of CIPA’s prohibition of pen registers. As already stated, CIPA

prohibits “a person” from “install[ing]” or “us[ing] a pen register . . . without first obtaining a court order.” Cal. Penal Code § 638.51(a). Lesh alleges that CNN installed two of the three Trackers on her browser after she visited the Website. (Amended Compl. ¶¶ 85-86.) Lesh further alleges that these Trackers collected her IP address which was used “to ascertain her location as Santa Clara, California, along with specific latitude-longitude coordinates and zip code.” (Id. ¶ 86.) Finally, Lesh alleges that CNN “did not obtain a court order before installing or using the Trackers.” (Id. ¶ 89.) These facts are sufficient to state a claim under Section 638.51 of CIPA.

C. CNN’s Consent to the Installation of Third-Party Trackers

CNN attempts to avail itself of an exception in Section 638.51(b)(5), which states that “[a] provider of electronic or wire communication service may use a pen register or a trap and trace device . . . [i]f the consent of the user of that service has been obtained.” Cal. Penal Code § 638.51(b)(5). CNN argues that the consent language in this provision allows consent to be obtained from one party to the communication. (Def. Mem at 21.) CNN cannot apply this exception. Lesh is also a user of CNN’s Website and did not consent to the Trackers collecting her information. It would

be illogical to allow CNN’s consent to the installation of Trackers to bar claims from users like Lesh who did not give their consent. Doing so would absolve many actors from liability under CIPA based on their self-serving consent to the use of pen registers they installed or caused to be installed.

D. CNN’s Terms of Service CNN argues that Lesh’s claims are barred by her consent to the Website’s Terms of Use. To support this argument, CNN submitted the Blake J. Steinberg Declaration with Exhibits A- M, which are screenshots of the Website’s front page and Terms from archived webpages from the Wayback Machine.5 (See Dkt. No. 34.) CNN argues that when a user visits its Website, CNN displays a pop-up which notifies the visitor that by using the Website, they are agreeing to the Terms of Use. (Def.

5 The Wayback Machine is an online digital archive of web pages – “a digital library of Internet sites – run by the Internet Archive, a non- profit library in San Francisco. See Thorne v. Square Inc., 20-CV-5119, 2022 WL 542383, at *1 n.2 (E.D.N.Y. Feb. 23, 2022) (citations omitted). Mem. at 8.) According to CNN, this pop-up persisted until the visitor clicked an “X” button to permanently close the pop- up and specifically provided that “By clicking X, you acknowledge you have read and agreed to the updated Terms.” (Id.) These Terms of Use contain a choice of law provision

selecting New York law to govern claims and disputes regarding use of the Website. (Id. at 9.) The Terms also contain a Privacy Policy which purportedly discloses the use of Third- Party Trackers along with a provision barring the person’s participation in any class action when bringing claims against CNN. (Id. at 9, 22.) CNN argues that by visiting the Website, Lesh assented to these terms and accordingly (1) agreed to not bring any claims under California law, (2) consented to the installation of Third-Party Trackers on her browser, and (3) waived her right to participate in a class action against CNN. Before turning to the merits of this argument, the Court

must first address the threshold question of whether the Court should take judicial notice of Exhibits A-M. The parties disagree on whether the Court should take judicial notice of those documents. CNN argues that courts routinely take judicial notice of Wayback Machine screenshots. However, the cases cited by CNN are distinguishable because there was no dispute as to the authenticity of those documents. (Def. Reply at 2); See e.g., Golden v. NBCUniversal Media, LLC, 688 F. Supp. 3d 150, 165 n.14 (S.D.N.Y. 2023) (noting that Plaintiff did not object to the authenticity of the archived version.) Here, Lesh disputes the authenticity of these screenshots and submits that they are not properly authenticated by the

Steinberg Declaration. Because the Wayback Machine is a third-party website that is not hosted by CNN, the Court will not take judicial notice of the screenshots absent authentication by a Wayback Machine representative attesting to the authenticity of the screenshots. Novak v. Tucows, Inc., No. 06-CV-1909, 2007 WL 922306, at *5 (E.D.N.Y. Mar. 26, 2007); see also My Health, Inc. v. General Electric Company, 15-cv-80-jd-, 2015 WL 9474293, at *4 (W.D. Wisc. Dec. 28, 2015) (requiring authentication by someone with “personal knowledge of reliability of the archive service from which the screenshots were retrieved” to take judicial notice of the same.) For these reasons, CNN’s submitted declaration by

its attorney, who is not a representative of the Wayback Machine, is not sufficient to authenticate the screenshots. Moreover, it would be premature to conclude on the basis of unauthenticated Wayback Machine screenshots that the pop-up relating to Lesh appeared at the time of her use of the Website. The screenshots are also not incorporated by reference in the First Amended Complaint. The First Amended Complaint does not link to, nor quote from, the archived versions of the Website or its Terms. Instead, the First Amended Complaint alleges that the Website installs third-party tracker apps on

the browser. This statement is not sufficient to warrant incorporation by reference of the entire Website and its past versions. See Videri, Inc. v. ONAWHIM (OAW) Inc., No. 1:23- cv-2535-GHW, 2024 WL 4027980, at *8 (S.D.N.Y. Sept. 3, 2024) (finding that the FAC “did not link to, quote from, or otherwise rely on certain pages of a website” and so those pages were not incorporated by reference). As already discussed, Lesh disputes the authenticity of the screenshots. “Even if a document is ‘integral’ to the complaint, it must be clear on the record that no dispute exists regarding the authenticity or accuracy of the document.” Faulkner v. Beer, 463 F.3d 130, 134 (2d Cir. 2006). For these reasons, the Court

will not consider the Wayback Machine screenshots in resolving this motion. Nonetheless, even if the Court were to take judicial notice of the Wayback Machine screenshots, it is premature for the Court to declare, as a matter of law at this stage, that Lesh had notice of the Terms and consented to them. This action does not constitute a case in which a plaintiff was required to click “Agree” before accessing the Website, also known as a “clickwrap agreement.” Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1176 (9th Cir. 2014); Meyer v. Uber Technologies, Inc., 868 F.3d 66, 75 (2d Cir. 2017). Nor

is the instant case one in which the user must scroll to the bottom of the Website to find the hyperlinked Terms, which would have likely rendered it an unenforceable “browsewrap agreement.” See e.g., In re Zappos.com, Inc., Customer Data Breach Sec. Litig., 893 F. Supp. 2d 1058, 1064-65 (D. Nev. 2012). Instead, the pop-up remains at the bottom left corner of the screen and notifies users that if they continue using the Website, they consent to the Terms, making it a hybrid “clickwrap-browsewrap” agreement. Any decision as to whether this pop-up gave Lesh constructive or actual notice of the Terms and elicited her consent to them requires further development of the factual record.

For now, the Court is persuaded that Lesh has pled that she did not provide “prior consent” to CNN to install or use the Trackers on her browser. (Amended Compl. ¶ 88.) Taking that allegation as true, the Court cannot conclude that Lesh consented to CNN’s third-party trackers collecting her data. Iv. ORDER For the reasons stated above, it is hereby ORDERED that the motion of defendant Cable News Network (“CNN”) to dismiss the Amended Complaint of plaintiff Carol Lesh (Dkt. No. 32) is DENIED; and it is further ORDERED that the motion of defendant Cable News Network (“CNN”) to strike Plaintiff’s class allegations is DENIED; and it is further ORDERED that CNN shall answer the Amended Complaint within 21 days of the date of this Order. The Clerk of Court is respectfully directed to close the Motion at Dkt. No. 32.

SO ORDERED. Dated: 20 February 2025 New York, New York

i 2 aw □ ‘Victor Marrero U.S.D.Jd.