Meta loses bid to toss 'pen register' claim from tax information harvesting suit

(CN) — A federal judge on Wednesday denied Meta’s bid to dismiss a claim that its “pixel” code installed on tax-preparers’ websites functions as a so-called pen register in collecting metadata about users interactions with those websites.

U.S. District Judge P. Casey Pitts in San Jose, California, rejected Meta’s arguments that it doesn’t use the pixel and that the plaintiffs’ separate wiretapping claim precluded their new claim under the California Invasion of Privacy Act that the pixel functions as a pen register that records “dialing, routing, addressing or signaling information" from the third-party sites.

Pitts, a Joe Biden appointee, wasn’t persuaded by Meta’s line of reasoning that it is the tax websites who both install and use the pixel while Meta, by contrast, merely uses the data that it receives from the pixel without using the pixel itself.

“Whether or not Meta’s mere use of the data generated from the pixel violates Section 638.51 [of the California Invasion of Privacy Act], the complaint adequately alleges that Meta is using the pixel to record and transmit that data to its servers in order to enable the pixel’s core value proposition,” the judge said.

Meta developed its pixel to be installed on third-party website so that it can track users online behavior in order to sell targeted advertising based on that behavior. The pixel has also been installed on the websites of H&R Block, TaxAct and TaxSlayer, and the plaintiffs claim that Meta collected their private financial information to be used in its advertising algorithms.

H&R Block prepares more than 20 million tax returns annually, and per the Internal Revenue Code, may not disclose any information it collects for any purpose other than to prepare a tax return.

In a second amended class action complaint filed in May, the plaintiffs added a claim that Meta’s pixel violates the provision of California Invasion of Privacy Act that prohibits installing a pen register without a court order.

A pen register traditionally was a device that could record all the numbers that were dialed from a particular phone line, and a 1986 federal statute put restrictions on the use of such devices by private parties and by law enforcement. The concept is nowadays also applied to recordings of metadata in communications over the internet.

Meta had also argued that, if the plaintiffs wanted to claim that the pixel functions as a wiretap that transmits the contents of their online interaction with the tax preparers’ websites, they cannot also claim under the California Invasion of Privacy Act that the pixel functions as a pen register.

The statute, according to Meta, defines a pen register as a “device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.”

The judge, however, while acknowledging that the language of the statute is somewhat ambiguous, rejected this either-or interpretation because it didn’t fit with the legislators’ intent behind the California law.

“Given CIPA’s purpose to protect Californians’ privacy, it is highly unlikely that the Legislature intended to permit the installation and use of pen registers so long as those devices also record the contents of a third party’s communications,” Pitts said. “Under Meta’s interpretation of the statute, an entity could escape liability under CIPA’s pen register provisions by combining the functionality of a wiretap with that of a pen register.”

Representatives of Meta didn’t immediately respond to a request for comment on the ruling.

Follow @edpettersson