TRACKED AND TRACED?: C.D. Cal. Lets CIPA Claims Against Wayfair Move Forward, But Tosses Pen Register Claim

Hi TCPAWorld!

Another website tracking case just survived a motion to dismiss. This one tackles both traditional CIPA wiretapping claims and the increasingly litigated trap-and-trace theory. In Limas v. Wayfair LLC, No. CV 25-11185-DMG (Ex), 2026 WL 2351592 (C.D. Cal. Aug. 13, 2026), the United States District Court for the Central District of California granted in part and denied in part Wayfair’s motion to dismiss a putative class action under the California Invasion of Privacy Act (“CIPA”). Plaintiff’s Section 638.51 pen register claim was tossed, but his Section 631(a) claims and Section 638.51 trap-and-trace theory survived.

Here’s what happened:

Six Tracking Tools, One Website

Plaintiff alleged that Wayfair installed tracking tools associated with TikTok, Facebook/Meta, Pinterest, Snapchat, Twitter/X, and Reddit on its website. According to the First Amended Complaint (“FAC”), the tools collected information about users’ interactions with Wayfair’s website, including products viewed and purchased, search terms, and other website activity. Importantly, Plaintiff alleged that the tools did more than collect basic identifiers. He claimed that cookies and other identifiers could be used to match a website visitor with an existing social-media account, allowing the tracking entities to connect a user’s Wayfair activity with an identifiable person. Those allegations became important to both of Plaintiff’s CIPA theories.

The Section 631(a) Claims Survive

Wayfair attacked the Section 631(a) claims from several angles. First, it argued that the tracking entities did not intercept the “contents” of communications. But the Court found Plaintiff alleged more than the collection of basic metadata. The FAC alleged that the trackers collected information across multiple devices about products viewed or purchased, users’ search queries, and other interactions with the website. Wayfair argued that Plaintiff needed to identify the specific queries he personally entered. The Court disagreed, reasoning that the FAC walks through each tracking tool in detail and provides pictures of sample website webpages and the tool’s code on the Website.” See Limas, at *4. At the pleading stage, this description was enough.

Wayfair also argued that the alleged communications were not intercepted while “in transit.” Again, the Court disagreed with Wayfair’s novel reading of Section 631. The Court explained that allegations that duplicates of communications or information were sent contemporaneously with a user’s browser interaction are sufficient to allege interception “in transit.” In this case, Plaintiff alleged that each tracking tool intercepted information before it reached Wayfair and that the information was neither stored nor encrypted at the moment of interception. That kept the “in transit” theory alive.

Then came willfulness and consent. The Court found willfulness adequately pleaded based on allegations that Wayfair used the tracking tools to collect data for purposes of improving its advertising. And Wayfair’s consent argument did not fare any better. Wayfair contended that Plaintiff had to allege Wayfair knew he had not consented, but the Court found no such knowledge requirement in Section 631 or binding authority. 

Finally, Wayfair’s status as a party to the communications did not dispose of Plaintiff’s fourth-clause Section 631(a) claim. The third-party tracking tools allegedly were not parties to the communications, and Plaintiff alleged that Wayfair intentionally installed them knowing they would intercept user information. That was sufficient to allow the claim to proceed.

So, despite attacking Section 631(a) from nearly every angle, Wayfair could not shake the claims at the pleading stage.

Pen Register Out. Trap and Trace Stays In.

Wayfair had better luck with one part of Plaintiff’s Section 638.51 claim. Plaintiff alleged that the tracking tools qualified as both pen registers and trap and trace devices. The Court dismissed the pen register theory without leave to amend after Plaintiff failed to respond to Wayfair’s argument that Smith v. LoanDepot.com, LLC, 2026 WL 1061119 (Cal. Ct. App. Apr. 8, 2026), foreclosed the claim.

But the trap-and-trace theory survived. Wayfair argued that a trap-and-trace device captures “incoming electronic or other impulses,” while the trackers allegedly captured communications outgoing from users visiting Wayfair’s website. The Court said Wayfair was looking at the wrong recipient. The question was not whether the communication was incoming to Wayfair. Instead, the Court looked at whether it was incoming to the alleged trap-and-trace device itself. Because Plaintiff alleged that the tracking tools received users’ outgoing communications before they reached Wayfair, the Court found the “incoming” requirement plausibly alleged.

That wasn’t Wayfair’s only challenge. Wayfair also argued that the information allegedly collected was not “reasonably likely to identify” the source of a communication. But unlike cases involving only an IP address or digital cookie, Plaintiff alleged that the trackers could use identifiers to match website visitors with existing social-media accounts. The Court found that alleged matching capability sufficient, at least at the pleading stage, to support a plausible inference that the information was reasonably likely to identify the user.

No Service-Provider Safe Harbor

Wayfair also invoked Section 638.51(b), which exempts certain uses of pen registers and trap-and-trace devices by providers of electronic or wire communication services. Even assuming Wayfair qualified as such a provider, the Court found another problem: purpose.

The FAC alleged that the tracking tools were used to improve product advertising. The Court concluded that this alleged purpose did not fall within the statutory exemptions Wayfair identified.

Wayfair’s rule-of-lenity and First Amendment arguments also failed to secure dismissal. The Court found no sufficiently specific statutory ambiguity to trigger the rule of lenity and concluded that Wayfair had not identified a legally protected First Amendment interest in holding or duplicating the transmissions at issue.

The Takeaway

Limas is another reminder that the details of what tracking technology collects, when it collects it, and what it can do with that information can make or break a CIPA claim at the pleading stage.

The distinction between collecting an anonymous IP address or cookie and allegedly using identifiers to match a website visitor to an existing social-media account was particularly important here. So were the allegations that tracking occurred before information reached Wayfair and before users were presented with a privacy policy or cookie banner.

Wayfair did secure dismissal of the pen register claim without leave to amend. But the Section 631(a) claims and Section 638.51 trap-and-trace theory live to fight another day.

For those deploying third-party tracking tools, Limas is one more decision worth watching as courts continue working through how a decades-old wiretapping statute applies to modern website technology.

We will keep you posted, TCPAWorld!