Sanchez v. Cars.com; Aviles v. LiveRamp

Published by Crandall Consulting · Informational litigation intelligence · Last substantive update: October 7, 2026

Summary

A Chamberlain Hrdlicka blog post explains how plaintiffs have used California's 1967 Invasion of Privacy Act (CIPA) pen register provisions to sue websites over routine trackers and describes inconsistent trial-court rulings on that theory. The post reports a pending amendment to SB 690 that would remove the private right of action for § 638.51 pen register claims tied to websites/apps, shifting enforcement to the Attorney General, while leaving wiretap/eavesdrop provisions (§§ 631–632) intact.

Litigation Status

Status, direction, and weight describe how tracked public sources characterize this matter as of our last review — they are informational classifications, not legal assessments.

Procedural Posture

The piece describes a wave of litigation: more than 4,300 digital wiretapping suits filed under CIPA since 2022 (about 3,300 in California), inconsistent trial-court rulings on the pen register theory, and pending legislative action (SB 690) that would narrow the private right of action for pen register claims arising from websites/apps/mobile conduct.

Reported Holding

The article reports that on January 27–28, 2025 two California Superior Court judges (in Sanchez v. Cars.com and Aviles v. LiveRamp) reached opposite conclusions about whether California's pen register / trap-and-trace statute reaches a website's collection of IP addresses and device identifiers; some courts have rejected the pen register theory while other courts have allowed similar claims to proceed.

What the Court Decided

According to the article, two California Superior Court judges ruled that the pen register provision of CIPA does not reach a website's collection of IP addresses and device identifiers (Sanchez and Aviles).

What the Court Did Not Decide

The article notes that the wiretapping and eavesdropping provisions (Penal Code §§ 631 and 632), which generate most website-tracking suits, were not resolved by the narrow pen register rulings and remain a live issue.

Significance

Neutral / mixed significance. Characterizations of significance describe how the matter has generally been discussed in tracked public sources; individual holdings are often narrow, procedural, or fact-specific, and this page does not state or imply broader holdings than the sources support.

What This Page Does and Does Not Say

This page reports what our tracked public sources say about this matter — including, where identified, the procedural posture (for example, a ruling on a motion to dismiss is not a final merits decision). It does not report legal conclusions beyond those sources, does not predict outcomes, and does not constitute legal advice.

Technologies at Issue

• Google Analytics
• Meta Pixel
• Microsoft Clarity
• session-replay scripts
• ad tags
• chat widgets

Third parties named or identified in tracked sources: Google, Meta, Microsoft, LiveRamp, Cars.com.

Statutes Invoked

• California Invasion of Privacy Act (Penal Code §§ 630–638), including §§ 638.50(b), 638.51(a), 637.2(a)(1), and references to §§ 631 and 632

Claims Asserted

Claims identified in tracked public sources; pleadings may include additional or amended claims.

• Pen register / trap-and-trace claims under Penal Code § 638.50/638.51
• Private right of action and statutory damages under Penal Code § 637.2(a)(1)
• Wiretapping / eavesdropping claims under Penal Code §§ 631 and 632

What This Matter May Mean for Website Operators

For operators using similar technologies, the recurring factual questions in matters like this one are when session recording begins relative to consent and whether input masking covers every field; whether chat transcripts or typing previews transit a vendor's servers before the visitor presses send; whether advertising pixels transmit page URLs or hashed form data before a consent choice; what page URLs and query strings analytics tools share with third parties. Our scanner tests these behaviors empirically.

Detection of a similar technology on a website is an informational risk indicator, not a legal conclusion, and nothing in this section is legal advice.

Related Intelligence

Sources

• The Wiretap Law That Ate California's Websites — Chamberlain Hrdlicka · Tier C (Professional analysis) · 2026-07-28

About This Page

Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.

How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.

Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.

Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.