A Demand Letter Says Your Website Analytics Is an Illegal Pen Register: Is the Claim Real?

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

The statute is real, and the theory has survived early motions in several federal trial courts, but the California Supreme Court has not settled it. Penal Code section 638.51 bars installing or using a pen register or trap and trace device without a court order, and section 637.2 lets an injured person sue for $5,000 per violation. Plaintiffs argue that analytics and advertising scripts fit those definitions because they record visitors' IP addresses. Kolmogorov Law, P.C. defends California businesses in the civil cases.

Call (909) 235-6116 or contact us online to discuss a pen register or trap and trace demand.

What the letter is claiming

The theory runs like this. Your site loads third-party scripts for analytics, advertising, or social media. When a visitor arrives, those scripts cause the visitor's browser to send an IP address and device details to the vendor. The letter calls each script a pen register or a trap and trace device, installed without a court order. It then asks for $5,000 per visitor, or announces a class action.

This is a separate theory from the wiretap claims aimed at chat widgets and session recording, which our California Invasion of Privacy Act page covers. It also differs from the video claims on our Video Privacy Protection Act page.

What the statute says

A pen register is a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted. It does not record the contents of a communication. A trap and trace device captures incoming impulses that identify the originating number, or other dialing, routing, addressing, or signaling information reasonably likely to identify the source. It, too, excludes contents. (Pen. Code, § 638.50, subds. (b), (c).)

A person may not install or use either one without first obtaining a court order. (Pen. Code, § 638.51, subd. (a).) The order the section has in mind is one a peace officer requests from a magistrate for a criminal investigation. (Pen. Code, § 638.52, subd. (a).)

Section 638.51 also carries a criminal penalty. Our work is the civil claim.

Where the $5,000 comes from

The chapter has one civil remedy for all of its sections. Any person who has been injured by a violation may sue for the greater of $5,000 per violation or three times actual damages. Actual damages are not a prerequisite, and an injunction is available. (Pen. Code, § 637.2, subds. (a), (b), (c).) The same remedy backs the call recording claims described on our page about recording phone calls.

How courts have ruled so far

The law is unsettled. In November 2025 a federal district court in San Diego refused to dismiss a complaint of this kind. It held that trackers alleged to collect visitors' IP addresses could plausibly be pen registers, and it rejected the argument that the statute is limited to telephones. The court said most cases in its own and other federal districts had reached the same result, and it cited one contrary decision. (Camplisson v. Adidas America, Inc. (S.D. Cal. 2025) 809 F.Supp.3d 1095, 1105, 1107.)

Three cautions apply. A ruling on a motion to dismiss decides only that a complaint may proceed, not that the business violated the statute. "Most" is not all, so the outcome can depend on the judge. And the California Supreme Court has not decided the question.

Federal standing is a second front. The Ninth Circuit held in 2025, in a case under a Pennsylvania wiretap statute, that a website visitor suing over tracking software must show a concrete harm resembling one the common law recognized. A statutory violation alone was not enough, and the collection of shopping preferences and a street name did not qualify. (Popa v. Microsoft Corp. (9th Cir. 2025) 153 F.4th 784, 791-795.) The San Diego court, ruling after that decision, still found standing adequately alleged on its facts. A dismissal for lack of federal standing is also not a decision on the merits.

The defenses a business raises

The definition. Does the script record "addressing" information of a communication, or does it do what every web request does?
Consent. A provider of an electronic communication service may use such a device with the consent of the user. (Pen. Code, § 638.51, subd. (b)(5).) In Camplisson the court looked to the visitor's consent, and a link to terms in the page footer, with nothing to click, was not enough at the pleading stage. Our clickwrap and browsewrap page explains how assent is shown.
Injury. Section 637.2 gives the claim to a person who has been "injured," and federal courts add the standing test above.
The ordinary-course exclusion. The definition of a pen register excludes a device or process used by a provider or customer of a wire communication service for cost accounting or similar purposes in the ordinary course of its business. (Pen. Code, § 638.50, subd. (b).) How far that reaches for a website is untested in the decisions read for this page.

What to do, and what not to do

Document before you change anything. Record which tags load on which pages, what each one transmits, who the vendor is, and when each was installed. Save every version of the consent banner. Then decide with counsel whether to remove or reconfigure a script.

Do not write back with an explanation of how your tracking works. Send the letter to your insurance broker, because some policies respond to privacy claims. The general steps are on our page about receiving a demand letter, and class exposure is covered on our page about a business named in a class action.

What to bring to the first meeting

The demand letter or complaint.
A list of the analytics, advertising, and social media tags on the site, with install dates.
The contracts and data terms for each vendor.
Screenshots and version history of the cookie banner and privacy policy.
Your business insurance policies.

Frequently asked questions

A law firm says the analytics on our website is an illegal pen register and wants $5,000 per visitor. Is that real?

The statutes are real. California Penal Code section 638.51 prohibits using a pen register or trap and trace device without a court order, and section 637.2 allows $5,000 per violation. Whether ordinary website analytics fits those definitions is unsettled. Several federal trial courts have let the claims proceed past early motions, and the California Supreme Court has not ruled. Evaluate the demand before answering it.

What is a pen register under California law?

Penal Code section 638.50 defines a pen register as a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted. It does not capture the contents of the communication. The California definition excludes certain billing and cost accounting uses by a communication service's provider or customer.

Is collecting IP addresses on a website illegal in California?

Not in those words. Plaintiffs argue that third-party scripts which record visitors' IP addresses are pen registers under California Penal Code section 638.50. A federal court in San Diego accepted that argument at the pleading stage in 2025 and said most cases in its own and other federal districts had done the same. That is not a final ruling that any business is liable.

Does a cookie banner protect a website from a Penal Code 638.51 claim?

It can help, depending on how it works. California Penal Code section 638.51 allows a provider of an electronic communication service to use such a device with the user's consent. One federal court asked whether visitors received conspicuous notice and took an affirmative step to agree. A link to terms in the page footer, with nothing to click, was held insufficient at the pleading stage.

We already received a wiretapping demand about our chat widget last year. Is this pen register letter a different claim?

Yes. The wiretapping section of the California Invasion of Privacy Act, Penal Code section 631, concerns reading or learning the contents of a communication in transit. A pen register claim under section 638.51 concerns addressing and routing information, and expressly not contents. Both rely on the $5,000 remedy in section 637.2, and one website can draw both.

Talk to a California business litigation attorney

If your business has received a pen register or trap and trace demand, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is located in Irvine, California, and represents companies and their owners in the state and federal courts in California.

This page provides general information about California and federal law and is not legal advice. Outcomes depend on the website, the facts, and the court.