D'Antonio v. Cable News Network, Inc.

What the case is about

Plaintiff Anthony D'Antonio sued Cable News Network over the tracking technology running on CNN.com. According to the operative complaint, when he visited the site, CNN had embedded third-party adtech code — from Microsoft, PubMatic, and OpenX — that prompted his browser to transmit identifying information to those companies without his consent. The trackers, the complaint alleges, collected his IP address and device metadata, then worked to match that data against existing profiles to deanonymize him and serve targeted advertising.^[1]

The detail that makes the complaint concrete — and that most coverage seizes on — is an advertisement. D'Antonio alleges he was shown a banner for Jaguar Land Rover, and that the third-party tracker PubMatic had received a real-time bid response for that ad slot based on metadata harvested from him, without his knowledge or consent, while he was simply reading the news.^[2] That is the ordinary machinery of programmatic advertising — real-time bidding, or RTB — described in the language of a wiretap statute.

This was CNN's second time defending the same theory

D'Antonio did not arrive out of nowhere. The same court, the same judge — Judge Victor Marrero — had already denied CNN's motion to dismiss an earlier version of essentially the same lawsuit roughly 14 months before, in a predecessor action (Lesh v. Cable News Network). A CIPA plaintiff targeted the same defendant, drew the same judge, and got the same answer: the claim can go forward.^[3] When the D'Antonio ruling built directly on the reasoning from that earlier decision, it turned a one-off into a pattern.

The legal theory — the pen-register revival

D'Antonio's claim runs on California Penal Code § 638.51, the "pen register and trap and trace" provision of CIPA. Historically, a pen register was a device law enforcement attached to a phone line to record the numbers dialed — the routing and addressing information of a call, but not the words spoken. Modern plaintiffs argue that website trackers do the digital equivalent: they capture the "dialing, routing, addressing, or signaling information" that a browser emits, which is exactly what § 638.51 restricts.^[4]

Marrero's ruling accepted, at the pleading stage, that the tracking code on CNN.com could fit CIPA's broad definition of a pen register, and that a visitor's IP address qualifies as "addressing information" within the meaning of the statute. Critically, the court read the definition as technology-neutral — not confined to legacy telephone equipment simply because that is what existed when the statute was written.^[4]

Content vs. record: the line CNN tried to draw

CNN's cleverest argument targeted the seam in the statute. A pen register, by definition, captures routing and addressing information but not the contents of a communication. So CNN argued that D'Antonio had actually alleged the interception of content — which would place the conduct outside the pen-register definition and sink that theory.^[5]

D'Antonio's answer was precise: the "fingerprint" data at issue — device and browser identifiers, IP address, technical metadata — is not the content of a communication. It is exactly the routing and addressing layer the statute covers. He cited decisions holding that trackers collecting digital fingerprint information do not thereby collect content.^[5] Marrero was persuaded that dismissal was not warranted on that basis.

The hurdle most CIPA cases die on — and how D'Antonio cleared it

Many pen-register cases never reach the merits because the plaintiff cannot show Article III standing — a concrete injury, not a bare statutory violation. Collecting an IP address, several courts have held, is not "remotely similar" to a traditional privacy harm, and a "free-roaming privacy right" is not enough to get into federal court.^[6]

D'Antonio cleared the bar by pleading harm in a specific shape. He argued his information was not merely collected but collected and sold in the online-advertising marketplace, and that aggregating his metadata into a comprehensive, identifiable profile was "highly offensive." Marrero held that this bore a close enough relationship to the common-law tort of intrusion upon seclusion to confer standing — echoing the reasoning from the earlier Lesh ruling.^[6]

CNN's fallback: the service-provider exception

CNN had one more argument, and it is the one publishers everywhere were watching. Section 638.51(b) contains an exception: a provider of an electronic or wire communication service may use a pen register to operate or maintain its service. CNN argued it was exactly that — "a provider of wire communication service" — and that the device and browser metadata it collected "were required to properly operate and load the website," meeting the operation requirement in the statute.^[7]

Marrero declined to resolve it. Relying on Garon v. Keleops USA, he held that whether the service-provider exception applied was a question of fact not suitable for resolution on a motion to dismiss — precisely because of the breadth of data alleged to have been tracked. Loading a webpage may need some metadata; harvesting IP addresses and device fingerprints to build sellable advertising profiles is a different thing, and telling the two apart requires a factual record.^[7]

Where it stands (as of July 2026)

On April 9, 2026, Judge Marrero denied CNN's motion to dismiss the Second Amended Complaint (docket entry 86, denying the motion at docket 73).^[8] The practical meaning:

• The case is alive and moving into discovery. A denial of a motion to dismiss is not a finding that CNN did anything wrong — it means D'Antonio's allegations, taken as true, state a claim the law recognises.
• Three theories survived: the pen-register claim under § 638.51, Article III standing grounded in intrusion upon seclusion, and the rejection — for now — of the service-provider exception.
• The service-provider question is deferred, not decided. CNN can raise it again on a full factual record at summary judgment.
• This is the second denial. Combined with the predecessor Lesh ruling, the same judge has now twice held that CNN's adtech configuration can support a CIPA claim.

D'Antonio is represented by Bursor & Fisher PA, one of the most active plaintiff-side privacy firms in the country; CNN by Weil, Gotshal & Manges LLP.^[2] With statutory damages of up to $5,000 per violation and a proposed class measured in the site's California visitors across millions of page views, the exposure math is what makes these cases settle.

How D'Antonio fits the 2026 landscape

The single most important thing to understand about CIPA pen-register litigation in 2026 is that the courts are split, and D'Antonio sits firmly on the plaintiff-friendly side of that split. Reading it next to the cases going the other way is the only honest way to gauge your risk.