As our readers are aware, California Invasion of Privacy Act (“CIPA”) lawsuits have recently dominated headlines in the California consumer privacy space. Most, if not all, of these lawsuits involve defendants that operate websites which utilize third-party tracking technology, including TikTok pixels. Plaintiff’s typically allege that use of pixel technology constitutes an unlawful wiretap or “trap and trace device” under CIPA. Over the past months, several newly-rendered decisions signal that courts may no longer entertain CIPA claims if they involve the use of pixel tracking technology.
What Are the Allegations at Issue in a Typical TikTok Pixel Lawsuit?
The TikTok pixel is a tool developed and utilized by TikTok to gather information regarding visitors to third-party websites. Typically, third-party website operators agree to install the tracking software on their websites in exchange for some form of compensation.
In CIPA lawsuits involving the use of TikTok pixels, plaintiffs usually allege that TikTok obtained access to some of the following consumer information: 1) names; 2) device and browser information; 3) dates of birth; and 4) street addresses. Without providing adequate notice and obtaining prior consent for allowing TikTok to access this information, plaintiffs assert that defendants violate CIPA’s statutory provisions prohibiting:
1) wiretapping, or the interception and recording of user communications without the consent of all parties to the communications; and/or
2) the installation of a pen register without a court order.
Why Have Courts Recently Decided to Dismiss TikTok Pixel CIPA Claims?
Over the past months, several key TikTok pixel decisions have been handed down. Although the underlying reasoning has varied, all three trap and trace device-related matters were decided for the CIPA defendant:
- Price v. Headspace, Inc., decided by the California Supreme Court on April 1, 2025: the court held that a TikTok pixel, or similar technology such as a Meta pixel, is “definitionally not a trap & trace device” under CIPA because plaintiff’s complaint suggests the capture of content (i.e. name, date of birth, address) which removes it from the statute’s coverage because it is concerned with devices that capture metadata and routing information, but not content;
- Kishnani v. Royal Caribbean Cruises Ltd., decided by the Northern District of California on June 24, 2025: in addition to the above “content-based” analysis, the court decided that plaintiff lacked Article III standing because the complaint failed to allege when/how many times the plaintiff visited the subject website, what data was collected and decrypted, and what harm Plaintiff suffered;
- Mitchener v. CuriosityStream, Inc., decided by the Northern District of California on August 6, 2025: the court integrated both of the above rationales in its decision, dismissing the complaint with prejudice because: i) plaintiff’s allegations were too generalized to establish Article III; and ii) the software did not meet the statutory definition of a trap and trace device because it merely collected content.
How Do These Recent Decisions Impact Your Business?
The recent trend in TikTok pixel litigation definitely favors defendants. However, because California courts are not deciding CIPA matters in a uniform matter, the tide could turn at any moment. As such, it is imperative that businesses evaluate their data collection, use, and sharing procedures, ensuring that best practices are always followed.
[View source.]
