Fregosa v. Mashable Inc.

Published by Crandall Consulting · Informational litigation intelligence · Last substantive update: August 26, 2026

Docket / citation: 3:2025cv01094 · Filed: 2025-10-09

Summary

A federal district court in the Northern District of California denied Mashable’s motion to dismiss a Second Amended Complaint alleging that third-party web trackers installed on Mashable’s site recorded IP addresses and device identifiers in violation of CIPA’s pen-register provisions. The court concluded the statute’s text and precedent permit treating software processes that record addressing information as pen registers at the pleading stage, and the case remains pending.

Litigation Status

Status, direction, and weight describe how tracked public sources characterize this matter as of our last review — they are informational classifications, not legal assessments.

Procedural Posture

Plaintiff filed a Second Amended Complaint alleging that Mashable installed third-party trackers (Microsoft, Wunderkind, PubMatic) that recorded IP addresses and device identifiers in violation of CIPA’s pen-register provisions; Defendant moved to dismiss under Rule 12(b)(6) (Dkt. 34); the court considered requests for judicial notice and briefs and denied the motion to dismiss by order signed October 9, 2025.

Reported Holding

The court denied Defendant Mashable’s Rule 12(b)(6) motion to dismiss the Second Amended Complaint, concluding that (1) CIPA’s pen register prohibition can extend to software processes (including web trackers) that record addressing information such as IP addresses and device identifiers; (2) the SAC plausibly alleged installation and use of such trackers and transmission of addressing information to third parties; and (3) the rule of lenity did not require dismissal for ambiguity.

What the Court Decided

The court held that the statutory text, structure, purpose, and controlling district-court precedent support treating software-based web trackers that record addressing information as a "pen register" under CIPA for pleading-stage purposes; the SAC sufficiently alleges Mashable installed and used third-party trackers that captured addressing information; and Mashable’s ambiguity/lenity argument fails. Accordingly, the court denied the motion to dismiss.

What the Court Did Not Decide

The court did not resolve the merits of liability or damages, did not enter final judgment, and did not determine factual disputes about whether particular tracking code actually transmitted the alleged data (it only found the pleadings sufficient to survive a 12(b)(6) motion). The court also did not resolve any potential defenses that may be litigated later (e.g., consent, factual predicates), and it did not treat judicially noticed materials as proof of disputed facts.

Significance

Generally viewed as plaintiff-favorable. Characterizations of significance describe how the matter has generally been discussed in tracked public sources; individual holdings are often narrow, procedural, or fact-specific, and this page does not state or imply broader holdings than the sources support.

What This Page Does and Does Not Say

This page reports what our tracked public sources say about this matter — including, where identified, the procedural posture (for example, a ruling on a motion to dismiss is not a final merits decision). It does not report legal conclusions beyond those sources, does not predict outcomes, and does not constitute legal advice.

Technologies at Issue

• web trackers
• device fingerprinting
• IP address collection
• HTTP request addressing information
• website trackers
• third-party trackers
• web tracking / third-party trackers
• device fingerprinting / device identifiers
• third-party web trackers
• HTTP requests/requests to third-party domains

Third parties named or identified in tracked sources: Microsoft, Wunderkind, PubMatic, Mashable.

Statutes Invoked

• Cal. Penal Code §§ 638.50–638.55 (CIPA pen register provisions); Cal. Penal Code § 637.2 (private right of action) — all-party consent · private right of action
• California Invasion of Privacy Act (CIPA) pen register/trap-and-trace provision — all-party consent · private right of action
• Cal. Penal Code § 638.51 (California Invasion of Privacy Act - Pen Register Act)
• Cal. Penal Code §§ 630; 637.2; 638.50–638.55 (CIPA Pen Register Act, esp. § 638.51) — all-party consent · private right of action

Claims Asserted

Claims identified in tracked public sources; pleadings may include additional or amended claims.

• California Invasion of Privacy Act – pen register claim (Cal. Penal Code § 638.50 et seq.)
• Statutory damages/relief claim under Cal. Penal Code § 637.2
• California Invasion of Privacy Act - pen register/trap-and-trace claim (as applied to website trackers)
• California Invasion of Privacy Act - Pen register/trap-and-trace prohibition (Cal. Penal Code §§ 638.50–638.55; § 638.51)
• Statutory private right of action and damages under Cal. Penal Code § 637.2 (pleaded)
• California Invasion of Privacy Act (CIPA) — Pen Register Act (Cal. Penal Code § 638.51)
• CIPA private right of action and statutory damages (Cal. Penal Code § 637.2)

What This Matter May Mean for Website Operators

California Invasion of Privacy Act (CIPA) is an all-party consent statute with a private right of action. Consent standard and private enforceability are the structural features that most shape where website tracking claims are filed and how they are valued.

Because this matter is pending, anything reported here is procedural — allegations and interim rulings, not final determinations.

Detection of a similar technology on a website is an informational risk indicator, not a legal conclusion, and nothing in this section is legal advice.

Related Intelligence

Sources

• Fregosa v. Mashable Inc., No. 3:2025cv01094 - Document 53 (N.D. Cal. 2025) — Justia (U.S. District Court docket/document) · Tier A (Primary authority) · 2025-10-09
• Fregosa v. Mashable Inc., No. 3:2025cv01094 - Document 53 (N.D. Cal. 2025) — Justia · Tier A (Primary authority) · 2025-10-09
• Interlocutory Review Denied Following Ruling On Website Tracker As Pen Register — Law360 / Mealey's Data Privacy · Tier B (Authoritative secondary) · 2026-01-28
• ORDER denying Motion to Dismiss Second Amended Complaint (Fregosa v. Mashable Inc.) — Justia Dockets & Filings · Tier B (Authoritative secondary) · 2025-10-09

About This Page

Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.

How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.

Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.

Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.