California's Court of Appeal Closes the Door on Web Surveillance, Applies CIPA to the Pixel
Doe v. Adventist Health System/West, No. B344951 (Cal. Ct. App. Aug. 24, 2026)
The California Court of Appeal for the Second District has held that the state's wiretapping statute reaches the tracking pixels that hospitals and other businesses embed in their websites. In Doe v. Adventist Health System/West, certified for publication on August 24, 2026, the Second District applied Penal Code section 631 to the Google and Meta tracking technologies installed on a health system's public site and its patient portal, and it reversed the denial of class certification on the claims that survived.[1] It is the first published California appellate decision to apply section 631 to internet communications, and it lands in the middle of a fight in the federal courts over whether a statute written in 1967 for telephone wiretapping can govern the web at all.[2] The decision matters for two reasons. It answers, with the authority of a state appellate court, a question the federal courts had said only California could answer. And it draws the line that pixel litigation has been working toward, the line between a URL that merely identifies a page and one that reveals the contents of a patient's communication with her provider.
The decision
The plaintiffs were patients of Adventist Health who alleged that Adventist installed the Meta Pixel and Google Analytics on its websites, including a password-protected patient portal, and that those tools transmitted their identifiers and the contents of their communications to Meta and Google for use in advertising.[3] They brought claims under section 631, the Confidentiality of Medical Information Act, and related law, and moved to certify a class. The trial court denied certification. The Court of Appeal reversed in part, and in doing so it treated section 631 as applying to the tracking technologies without hesitation, resting the claim on the statute's aiding-and-abetting clause and its clause reaching the “contents” of a communication “in transit.”[4]
How the internet question fractured the federal courts
Section 631(a) was enacted in 1967. Its first clause speaks of tapping a “telegraph or telephone wire, line, cable, or instrument.” Its later clauses reach anyone who “reads, or attempts to read … the contents or meaning of any message, report, or communication while the same is in transit,” and anyone who aids a violation.[5] For a time the application to the internet seemed settled. In Javier v. Assurance IQ, LLC, the Ninth Circuit stated in a memorandum disposition that, “[t]hough written in terms of wiretapping, Section 631(a) applies to Internet communications.”[6] Then the district courts came apart, and the pressure point was the first clause. In Mastel v. Miniclip SA, the Eastern District read the term “telephone … instrument” narrowly and declined to apply it to a smartphone's computing functions.[7] In Gutierrez v. Converse Inc., a non-precedential memorandum, Judge Bybee concurred to argue that a 1967 Legislature that had never heard of the internet did not write section 631 to reach it, and that a court should refuse to apply the first clause to the internet “until and unless the California appellate courts tell us otherwise.”[8] Judge Chhabria of the Northern District of California pressed the point to the second clause. In Doe v. Eating Recovery Center LLC he called the language of CIPA “a total mess,” invoked the rule of lenity because CIPA is a criminal statute, and urged that “the California Legislature needs to step up.”[9]
A split the district courts could not resolve
By 2026 the disagreement was open. As one court put it, there was “no binding authority on this issue,” and “district courts have come out both ways on whether … § 631(a) applies to the internet.”[10] Some sustained pixel claims without deciding the question, and others held that the first clause could not reach the internet even as the aiding clause could.[11] California trial courts added confusion from the other direction, declining to stretch CIPA's analog pen-register and trap-and-trace provisions to website tools on the reasoning that the Legislature knew how to name the internet when it wished to.[12] Through all of it ran one refrain from the federal bench. A court sitting in diversity does not decide California law. It predicts it, and the prediction should wait on California's own appellate courts.[13] That refrain reached its most consequential form three weeks before Adventist came down. In Merical v. The Joint Corp., a magistrate judge in the Eastern District recommended dismissing a pixel suit and, in the alternative, concluded that section 631 does not apply to the internet, resting on Bybee's first-clause reasoning and Chhabria's rule of lenity, and expressly giving “the final words to the California Superior Courts.”[14]
What Adventist settles
Adventist is the state appellate voice those decisions deferred to, and it cuts against the federal retreat on the ground that matters. The Court of Appeal applied section 631 to web tracking through the aiding clause and the “contents in transit” clause, the very clauses Merical, following Eating Recovery Center, tried to read out of internet cases.[15] The premise that carried the federal hesitation, that no California appellate court had spoken, is now spent. On the question the federal judges said they were waiting for California to answer, California has answered.
The clarity runs deeper than the yes or no. Adventist's lasting contribution is where it drew the contents line. On a public website, the court explained, a transmitted URL conveys the “contents” of a communication mainly when it carries a search term, the query string that shows what a person typed.[16] Inside a password-protected patient portal, the analysis changes, because everything a logged-in patient does relates to her care. There, even a generic path term like “radiology,” “health record,” or “messages” can convey the “purport” of her communication with her provider, and because the portal sends no query strings, no URL-by-URL inquiry into search terms is required.[17] The court stopped short of declaring these URLs to be contents. It held only that whether they are is a merits question capable of common proof, which is what a class action needs.[18] That places Adventist at the head of a line of federal decisions that had been working toward the same distinction, from Zynga through the healthcare pixel cases, and it is the first published state appellate authority to carry that distinction into the authenticated portal.[19]
The door, and what is left of the argument
Two honest limits keep this short of a total rout, and both cut in the plaintiffs' favor over time. Adventist did not engage the first-clause textual argument, the claim that “telegraph or telephone wire” cannot stretch to the internet, because it ran on the second and fourth clauses instead.[20] So Merical's clause-one point is not formally overruled. Its force, though, depended on the absence of state appellate authority treating CIPA as an internet statute, and that absence is gone. Adventist also left untouched the rule-of-lenity concern and the argument that a pixel does not read a communication while it is “in transit,” questions a later court will have to reach.[21] And Merical itself is a magistrate judge's findings and recommendations, not yet a judgment, so its status should be confirmed before anyone treats it as the Eastern District's last word.[22]
None of that changes the direction of the law. For two years the businesses defending these suits have argued that a 1967 statute cannot reach a 2026 pixel, and they have won often enough in the federal district courts to make the argument look respectable. A published California appellate decision now holds otherwise, on the clauses that matter, in the setting that matters most, a patient's private portal. The federal courts said they would follow California once California spoke. California has spoken, and the door surveillance advocates were trying to hold open is closing.
[1]Doe v. Adventist Health Sys./W., No. B344951, slip op. at 28-29, 67 (Cal. Ct. App. filed July 24, 2026, certified for publ'n Aug. 24, 2026) (applying Penal Code section 631 to the defendant's tracking technologies and reversing the denial of class certification as to the surviving claims). The decision is certified for publication and therefore citable under California Rules of Court 8.1105 and 8.1115.
[2]See Merical v. The Joint Corp., No. 1:26-cv-00974-KES-SAB, slip op. at 26 (E.D. Cal. Aug. 3, 2026) (observing there is “no binding authority on this issue” and that “district courts have come out both ways on whether … § 631(a) applies to the internet”).
[3]Adventist, slip op. at 28-29, 35-36 (describing the plaintiffs' section 631 theory and the expert testimony that Adventist installed Google and Meta tracking pixels on its websites and patient portal, sharing URLs and identifiers with the third parties).
[4]Id., slip op. at 28-29, 67 (resting the section 631 claim on the aiding-and-abetting clause and the “contents … in transit” clause, treating the statute as applying to the tracking technologies, and reversing in part).
[5]Cal. Penal Code § 631(a) (reaching, among others, one who “reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit,” and one who “aids, agrees with, employs, or conspires with any person” to do so).
[6]Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at 1 (9th Cir. May 31, 2022) (mem.) (stating that “[t]hough written in terms of wiretapping, Section 631(a) applies to Internet communications”), criticized in Merical, slip op. at 27 (describing the statement as an unreasoned overstatement in a non-precedential memorandum).
[7]Mastel v. Miniclip SA, 549 F. Supp. 3d 1129 (E.D. Cal. 2021) (reading the statutory term “telephone … instrument” narrowly and declining to extend the first clause to a smartphone's computing functions).
[8]Gutierrez v. Converse Inc., No. 24-4797, 2025 WL 1895315, at 2 (9th Cir. July 9, 2025) (mem.) (Bybee, J., concurring) (declining to apply the first clause of section 631(a) to the internet and deferring to the California appellate courts). Memorandum dispositions are not precedential. See9th Cir. R. 36-3.
[9]Doe v. Eating Recovery Ctr. LLC, 806 F. Supp. 3d 1109, 1112, 1118 (N.D. Cal. 2025) (describing CIPA's language as “a total mess,” applying the rule of lenity because CIPA is a criminal statute, and urging legislative action), as quoted in Merical, slip op. at 27-28.
[10]Merical, slip op. at 26 (quoting the absence of binding authority and the division among district courts).
[11]Compare Garcia v. Truist Fin. Corp., 825 F. Supp. 3d 1149, 1167-68 (C.D. Cal. 2026) (sustaining a section 631(a) claim in an internet case without deciding whether the statute reaches the internet), with Casillas v. Six Flags Ent. Corp., 812 F. Supp. 3d 1016, 1031 (C.D. Cal. 2025) (holding the first clause does not apply to the internet but the aiding-and-abetting clause does).
[12]See Rodriguez v. Ink Am. Int'l Grp., LLC, No. 25STCV15350, 2025 Cal. Super. LEXIS 84257, at 8 (Cal. Super. Ct. Dec. 10, 2025) (declining to apply Penal Code section 638.52 to website tracking tools); Blaker v. NetScout Sys., Inc., No. 25STCV31283, 2026 WL 1709143, at 3-4 (Cal. Super. Ct. May 26, 2026) (declining to apply section 638.51 to internet communications). These are CIPA's pen-register and trap-and-trace provisions rather than section 631, but they reflect the same reluctance to stretch analog statutory language to the web.
[13]See Gutierrez, 2025 WL 1895315, at 2 (Bybee, J., concurring) (deferring to the California appellate courts).
[14]Merical, slip op. at 26-29 (recommending dismissal and, in the alternative, concluding section 631 does not apply to the internet, and observing that the court, “sitting in diversity, gives the final words to the California Superior Courts”).
[15]Adventist, slip op. at 28-29 (applying the aiding-and-abetting clause and the “contents … in transit” clause of section 631(a) to the tracking technologies).
[16]See In re Zynga Privacy Litig., 750 F.3d 1098, 1106-08 (9th Cir. 2014) (distinguishing record information in a URL from “contents,” and explaining that a URL containing “a search term or similar communication made by the user” may constitute “contents”).
[17]Adventist, slip op. at 51-53 (reasoning that within an authenticated patient portal the descriptive URL path conveys the “purport” of the patient's communication, and that the absence of query strings removes the individualized search-term inquiry required for the public website).
[18]Id., slip op. at 52, 55 (holding that whether the portal URLs satisfy the “contents” element “is a merits question, and it is a common one”).
[19]See Cousin v. Sharp Healthcare, 702 F. Supp. 3d 967, 975-76 (S.D. Cal. 2023) (holding that URLs reproducing a person's search queries may constitute “contents”); In re Google RTB Consumer Privacy Litig., 606 F. Supp. 3d 935, 949 (N.D. Cal. 2022) (treating content-category and page identifiers as “content”); In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 795-96 (N.D. Cal. 2022) (construing patient-portal “log-in buttons” and descriptive URLs as “contents”).
[20]Adventist, slip op. at 28-29 (grounding the claim in the aiding and contents-in-transit clauses without addressing the first-clause “telephone wire” limitation).
[21]See Eating Recovery Ctr., 806 F. Supp. 3d at 1118-19 (raising the rule of lenity and concerns about applying the “in transit” language to internet communications).
[22]Merical, slip op. at 32-33 (findings and recommendations recommending dismissal with leave to amend, subject to written objections within fourteen days and review by the district judge under 28 U.S.C. § 636(b)(1)).