On August 13, 2026, a federal judge in the Central District of California handed Wayfair a split decision in the expanding field of website tracking litigation under the California Invasion of Privacy Act. In Limas v. Wayfair LLC, No. CV 25-11185-DMG (Ex), 2026 WL 2351592 (C.D. Cal. Aug. 13, 2026), the court dismissed the plaintiff’s Section 638.51 pen register claim without leave to amend, but allowed the plaintiff’s Section 631(a) wiretapping claims and Section 638.51 trap-and-trace theory to move forward. The Wayfair tracking case is significant because it illustrates how narrowly courts are reading CIPA’s requirements when third-party trackers capture user data in real time.
Why the Wayfair Tracking Case Survived CIPA Motion to Dismiss in Part
Wayfair moved to dismiss the entire putative class action, arguing that the tracking tools installed on its website collected only basic metadata, that no communication was intercepted “in transit,” that Wayfair lacked the required willfulness, and that the plaintiff consented to the alleged tracking. The court rejected nearly all of those arguments with respect to Section 631(a), and it also rejected Wayfair’s interpretation of CIPA’s trap-and-trace provisions. Only the pen register claim was dismissed, and only because the plaintiff failed to respond to Wayfair’s argument that a recent California appellate decision foreclosed that theory.
The decision is not a final ruling on the merits. It simply means that the plaintiff’s allegations are legally sufficient to proceed to discovery. That is an important threshold in privacy litigation, where the practical ability to test what tracking technology actually does often depends on evidence that only the website operator and its tracking partners possess.
The Six Trackers and the Matching Allegation That Carried the Complaint
The plaintiff in Limas alleged that Wayfair installed tracking tools associated with six major social media and advertising platforms on its website:
- TikTok
- Facebook/Meta
- Snapchat
- Twitter/X
According to the First Amended Complaint, those tools collected information about users’ interactions with Wayfair’s website, including products viewed and purchased, search terms, and other website activity. The plaintiff did not stop at generic descriptions of cookies and pixels. He alleged that cookies and other identifiers could be used to match a website visitor with an existing social media account, allowing the tracking entities to connect a user’s Wayfair activity with an identifiable person.
That matching allegation became central to both of the plaintiff’s CIPA theories. It distinguished the case from earlier efforts to sue over anonymous IP addresses or persistent cookies alone. The alleged ability to link a visitor to a known social media profile gave the court a concrete basis to treat the captured information as something more than meaningless routing data.
Section 631(a) Wiretapping: Four Wayfair Arguments That Failed
Section 631(a) of CIPA prohibits unauthorized interception of communications while they are being transmitted over a wire, line, or cable. Website tracking cases routinely invoke this provision, but defendants frequently argue that the data collected by analytics and advertising pixels does not qualify as the “contents” of a communication, was not intercepted “in transit,” and was received with consent. Wayfair raised each of those arguments. The court rejected them all.
What did the court decide about the “contents” of communications?
The court found that the plaintiff’s allegations went far beyond basic metadata. The complaint described each tracking tool in detail, included sample webpages and code from the website, and alleged that the tools collected information about products viewed or purchased, search queries, and other interactions across multiple devices. That was enough at the pleading stage to state a plausible claim that the tracking tools intercepted the contents of communications, not merely addressing or routing information.
Wayfair tried to require the plaintiff to identify the precise search terms he personally entered. The court refused to impose that burden, explaining that the complaint already walked through each tracking tool and provided visual examples of the tool and its code on the website. A plaintiff does not need to plead self-incriminating search history to make out a plausible CIPA claim when the underlying technology is described with enough specificity.
Why “in transit” did not require Wayfair to receive the data first
Wayfair also argued that the alleged communications were not intercepted “in transit.” The court called that a novel reading of Section 631 and declined to adopt it. The key, the court said, is whether duplicates of communications or information are sent contemporaneously with a user’s browser interaction. That is sufficient to allege an interception “in transit.”
The complaint met that standard by alleging that each tracking tool intercepted information before it reached Wayfair and that the information was neither stored nor encrypted at the moment of interception. The timing and technical configuration of the tracking tools therefore allowed the court to draw a reasonable inference that data moved to third parties as the user was actively interacting with the website.
Willfulness and consent
Wayfair’s attack on willfulness was also unpersuasive. The court found that the plaintiff adequately pleaded willfulness by alleging that Wayfair used the tracking tools to collect data for the purpose of improving its advertising. The idea that a company intentionally deploys tracking technology to boost ad performance and expects it to capture user activity is enough to move a CIPA claim past the pleading stage.
The consent argument fared no better. Wayfair argued that the plaintiff had to allege that Wayfair knew he had not consented to the tracking. The court found no such knowledge requirement in Section 631 or in binding authority. Consent in CIPA litigation is an affirmative defense, and at the motion to dismiss stage the burden is not on the plaintiff to plead the absence of consent in the specific way Wayfair demanded.
The fourth-clause claim and the role of third-party trackers
Wayfair also argued that it was a party to the communications between users and its website, and therefore could not be liable for intercepting communications to which it was already a participant. The court rejected that argument as to the plaintiff’s fourth-clause Section 631(a) claim. The third-party tracking tools were not parties to the communications, and the plaintiff alleged that Wayfair intentionally installed them knowing they would intercept user information.
That distinction is important. Even if Wayfair could lawfully receive its own users’ communications, the alleged interception by TikTok, Meta, Pinterest, Snapchat, Twitter/X, and Reddit involved separate actors whose access was not necessarily part of the communication itself. The court saw enough factual support to let the claim proceed.
The Pen Register Claim Was Dismissed: What Smith v. LoanDepot.com Did
Wayfair had better luck with one portion of the plaintiff’s Section 638.51 claim. The plaintiff alleged that the tracking tools qualified as both pen registers and trap-and-trace devices. A pen register claim typically targets technology that records dialing, routing, addressing, or signaling information without capturing the content of a communication. The court dismissed the pen register theory without leave to amend after the plaintiff failed to respond to Wayfair’s argument that Smith v. LoanDepot.com, LLC, 2026 WL 1061119 (Cal. Ct. App. Apr. 8, 2026), foreclosed the claim.
Losing a claim for failure to respond is a procedural lesson as much as a legal one. A plaintiff cannot ignore a defendant’s citation to a recent controlling or persuasive decision and expect the court to do the work of distinguishing it. The pen register theory is now gone from the case for good.
The Trap-and-Trace Theory Survived: A Key Distinction About “Incoming” Data
What is a trap-and-trace device under CIPA?
Under CIPA’s trap-and-trace provision, the relevant question is whether a device captures incoming electronic or other impulses that identify the source of a communication. In the website context, this does not necessarily mean incoming to the website operator. In Limas, the court held that because the tracking tools allegedly received users’ outgoing communications before those communications reached Wayfair, the “incoming” requirement was plausibly alleged as to each tracking tool.
Wayfair had argued that a trap-and-trace device captures incoming impulses, while the trackers reportedly captured communications outgoing from users visiting Wayfair’s website. The court said Wayfair was looking at the wrong recipient. The question was not whether the communication was incoming to Wayfair; it was whether the communication was incoming to the alleged trap-and-trace device itself. Since the complaint alleged that the tracking tools received users’ outgoing communications before the data reached Wayfair, the “incoming” requirement was satisfied at the pleading stage.
The identification requirement was also satisfied. Wayfair argued that the information collected by the trackers was not “reasonably likely” to identify the source of a communication. The court acknowledged that an IP address or digital cookie alone might not be enough. But the plaintiff alleged something more: the trackers could use identifiers to match website visitors with existing social media accounts. That alleged matching capability supported a plausible inference that the information was reasonably likely to identify the user.
This is one of the most consequential parts of the decision. It shows that a trap-and-trace claim under CIPA is not limited to old-fashioned telephone equipment. Modern tracking tools that receive user communications before the intended recipient processes them can fit the same statutory pattern, especially when they can tie data back to a specific person.
Why Wayfair’s Safe Harbor Defense Failed
Wayfair also invoked Section 638.51(b), which provides a safe harbor for certain uses of pen registers and trap-and-trace devices by providers of electronic or wire communication services. Even assuming Wayfair qualified as such a provider, the court found a separate problem: purpose.
The First Amended Complaint alleged that the tracking tools were used to improve advertising. The court concluded that this alleged purpose did not come within the statutory exemptions Wayfair identified. In other words, even if Wayfair was a provider of an electronic communication service, the alleged use of the tracking tools for advertising analytics was not the kind of purpose the safe harbor was designed to protect.
The safe harbor ruling is another reminder that CIPA’s statutory exceptions are narrow. A defendant cannot simply show that it is a communications provider. It must also show that the challenged use fits a specific exempt purpose, and advertising enhancement is unlikely to qualify.
Rule of Lenity and First Amendment: No Escape Hatch
Wayfair raised two additional arguments rooted in statutory interpretation and constitutional law. The rule of lenity, which requires ambiguous criminal statutes to be construed in favor of defendants, did not help Wayfair because the court found no sufficiently specific ambiguity in the relevant CIPA provisions. The First Amendment argument also failed. Wayfair argued that it had a protected interest in holding or duplicating the transmissions at issue, but the court concluded that Wayfair had not identified a legally protected First Amendment interest in the challenged tracking activity.
These arguments are common in tracking litigation, but they rarely succeed at the motion to dismiss stage. Courts are more likely to engage with the factual allegations and the statutory text than to overturn a privacy claim on broad constitutional or canons-of-construction grounds.
What Companies Should Watch in the Wayfair Tracking Case
The Limas decision offers practical guidance for companies that use third-party tracking tools on their websites. The outcome turned on the specific details of the plaintiff’s allegations, and those details point directly to the technical decisions that website operators make every day.
- When data is captured matters. The court accepted the allegation that tracking occurred before information reached Wayfair and before users were presented with a privacy policy or cookie banner. That timing was critical to both the “in transit” analysis and the trap-and-trace theory.
- What data is collected matters. Anonymous IP addresses and cookies may not be enough to support a CIPA claim, but identifiers that can be matched to existing social media accounts can push a case past the pleading stage.
- Who receives the data matters. The court treated third-party tracking tools as separate actors, not as extensions of Wayfair. Even if a website operator is a party to a communication, the operator’s business partners may not be.
- Why the data is collected matters. Advertising purposes undermined both the safe harbor defense and the willfulness analysis. A company cannot argue that tracking for ad optimization is exempt while simultaneously claiming it lacked any intent to collect user data.
The decision is not a blanket ruling that all social media tracking violates CIPA. It is a ruling that well-pleaded facts about the mechanics of tracking—what is collected, when it is captured, where it is sent, and what the recipient can do with it—can survive a motion to dismiss.
With the pen register claim dismissed but the Section 631(a) claims and trap-and-trace theory still active, the case now moves toward discovery. That discovery could reveal whether the tracking tools actually operated as the plaintiff alleged, whether the matching capability was real, and whether Wayfair’s configuration of those tools created the kind of transmission paths that CIPA was designed to regulate. For companies, the broader lesson is already clear: the technical details of a website tracking system are not just engineering decisions. They are now central to the legal viability of consumer privacy litigation, and they will continue to shape how courts apply a decades-old wiretapping statute to modern internet technology.
