Forbes Media Tracking Pixel Litigation: The $10M Pen-Register Settlement

The Forbes Media tracking pixel lawsuit is one of the most instructive cases in the entire CIPA wave, and not because of anything exotic. Forbes didn't suffer a breach. It ran three advertising trackers that millions of ordinary websites also run — a LinkedIn tag, a Microsoft Bing tag, and an ad-tech tracker — and those trackers sent visitors' IP addresses and identifiers to third parties. A California plaintiff argued that this everyday setup made the trackers function as illegal "pen registers" under a decades-old wiretap statute. Forbes agreed to pay $10 million to settle. If a tool as mainstream as the LinkedIn Insight Tag can anchor a $10M claim, the exposure isn't about being Forbes — it's about running trackers before consent, which describes a very large share of the web.

What the case is about

Filed in December 2024 in the Northern District of California, Berman v. Forbes Media LLC alleges that Forbes embedded third-party tracking tags on its websites that quietly transmitted visitors' IP addresses and unique identifiers to outside companies — without visitors' consent — so those companies could target advertising. The three tags named are the LinkedIn Insight Tag, the Microsoft Bing Universal Event Tracking (UET) tag, and Xandr's "Adnx" tracker.

None of these is unusual. The LinkedIn and Bing tags are standard conversion-tracking tools that marketing teams install to measure ad campaigns; Xandr is a widely used advertising exchange. That ordinariness is the point. The complaint didn't need to prove Forbes did anything a typical marketing stack doesn't do — it only needed to argue that the routine transmission of identifiers to third parties, before consent, fit a specific statutory definition. In June 2026 the court granted preliminary approval to a $10 million settlement covering roughly 3.9 million California visitors.

The detail that makes it matter

Most of the healthcare and e-commerce CIPA cases involve clearly sensitive data — medical conditions, patient portals, purchase histories. Forbes is a publisher. The data at issue was mostly IP addresses and advertising identifiers tied to reading news articles. That's what makes the case so consequential: it pushes the theory into the most generic possible fact pattern. If visiting a news site and having your IP shared with an ad vendor can support a claim, there is almost no category of commercial website that sits comfortably outside the theory.

The second detail is the trackers themselves. A business owner reading this list — LinkedIn Insight, Bing UET, Xandr — is very likely running at least one of them right now. These aren't shadowy data-brokers; they're the default tags in LinkedIn Campaign Manager and Microsoft Advertising. The case effectively says: the tool being mainstream and marketing-approved is not a defense. What matters is whether it transmitted identifiers before the visitor consented.

The pen-register theory, explained

The claim rests on California Penal Code §638.51(a), part of CIPA, which prohibits installing or using a pen register or trap-and-trace device without a court order or consent. Those terms come from an era of telephone surveillance: a pen register records the outgoing numbers dialed from a phone; a trap-and-trace records the incoming numbers. Neither captures the content of a call — just the routing information, the metadata of who contacted whom.

Plaintiffs in the 2023–2026 wave repurposed that language for the web. The argument: when a tracker on a website captures a visitor's IP address and the identifiers that route their data to a third party, it is doing the modern equivalent of a pen register — recording the "dialing, routing, addressing, or signaling information" of an internet communication. Because §638.51 doesn't require intercepting message content, it's an easier theory to plead than the older §631 wiretapping claim, which is why it drove a surge of filings.

Courts haven't been unanimous about this stretch. Some judges accepted that IP addresses and routing identifiers fit the statutory language closely enough to let claims proceed past a motion to dismiss; others pushed back, questioning whether a cookie or an advertising tag is really a "device" in the sense the statute contemplated, or whether a website operator receiving data about its own visitors is the kind of third-party interception the law was written to stop. That uncertainty is precisely why so many of these cases settle rather than get decided: a defendant facing even a modest chance of a multi-million-dollar statutory-damages verdict often finds a settlement cheaper than the risk of a ruling. Forbes's $10M resolution is a textbook example of that calculus — it resolves the exposure without a court ever deciding whether the theory would ultimately win.

Why the timing is pivotal (SB 690)

Here's what makes Forbes a bookmark in the CIPA story rather than just another settlement. The §638.51 pen-register theory is exactly the theory California's SB 690 reform targets. Signed September 30, 2026 and operative January 1, 2027, SB 690 removes the private right of action for §638.51 website claims, leaving enforcement to the Attorney General. In plain terms: the kind of private class action that produced the Forbes settlement is being switched off for this specific theory.

So Forbes sits right on the hinge: likely among the last big private §638.51 website settlements, filed and resolved just before the door closed on that avenue. The underlying conduct it punished — trackers firing before consent — remains fully actionable under the theories SB 690 left standing.

How it fits the 2026 landscape

Place Forbes next to the other cases in the CIPA tracker and a clear spectrum appears. Healthcare systems settled over patient-portal pixels (Penn Medicine, Cone Health, Atrium). E-commerce sites face claims over checkout trackers (Posh Peanut). And now a publisher has settled over ad tags on news pages. The through-line is identical across all of them: a third-party tracker transmitted data before the visitor consented.

Forbes is the data point that removes the comfort of "we're not healthcare, we don't handle sensitive data." The theory reached a news site over advertising identifiers. The common denominator isn't the industry or the sensitivity of the data — it's the pre-consent firing.

There's a publisher-specific wrinkle worth naming, too. Media sites live on advertising revenue, which means they tend to run more third-party tags than the average business — ad exchanges, measurement vendors, audience-segmentation tools, each one a potential transmission before consent. The very commercial model that keeps the lights on at a free news site is the model that stacks up pen-register exposure. For a small business the lesson scales down cleanly: every additional marketing or analytics tag you bolt on is another thing that may fire before a visitor agrees, and each one widens the surface a plaintiff can point at. Fewer tags, properly gated, is both cleaner marketing hygiene and lower legal risk.

What this means for your site

You don't need to be a publisher, a hospital, or a retailer to be in the same position Forbes was. You need to be running a third-party tracker that transmits before consent — which, if you've installed a LinkedIn, Bing, Meta, or Google tag the standard way, you very likely are. The practical takeaways:

Frequently asked questions