CIPA and website tracking: why we do not fire before consent

The exposure, in one sentence

The website tracking litigation wave is not really about what data was collected. It is about when — specifically, about trackers that ran before the visitor was ever asked.

The prior-consent holding

In Javier v. Assurance IQ (9th Cir. 2022), the court held that California Penal Code § 631(a) requires prior consent, and that consent obtained after the fact does not cure a prior interception. Retroactive consent is not consent.

This is the holding that makes architecture matter more than policy. A privacy policy that discloses tracking, on a page whose trackers already fired before the visitor read anything, does not fit the requirement the court described.

The pen-register theory

A second and more recent line of cases advances a “pen register” theory under CIPA § 638.51: that scripts collecting IP addresses and similar routing information can function as pen registers or trap-and-trace devices, and that the service-provider exception is a question of fact rather than an automatic defense.

On dates, we are deliberately imprecise. The D’Antonio v. CNN pen-register rulings span 2025–2026 and are easy to conflate with the companion Lesh v. CNN ruling; the docket dates are genuinely confusing. Rather than publish a specific date we would have to correct later, we describe the holdings and point you at the dockets. If a vendor’s marketing page gives you a confident single date for this line of cases, check it.

What consent-before-fire means architecturally

It means the identification logic cannot run — not “does not report,” cannot run — until the consent state reads granted.

1. An inline script in the document head sets all consent signals to denied before any tag loads.
2. The Ballot Signal loader reads the consent state from your consent management platform, or from our own banner.
3. If the required categories are not granted, the loader stops. No identifier is generated, no request is made, no record is created.
4. Only on an affirmative update to granted does anything else happen.
5. A withdrawal stops it again immediately, and writes a consent-revoked event.

You can verify all of this yourself in about ninety seconds: open a private window, decline consent, and watch the network tab. If you see a request, that is a bug and we want the report.

What this costs you

Fewer identified visitors than a vendor who fires first and asks later. That is the honest trade, and we would rather state it than let you discover it in a comparison. What you get instead is a data set whose provenance survives a subpoena.

This is not legal advice

A summary of litigation trends written by a software company is not legal advice, and this area is moving fast. Have counsel review your website’s tracking posture — including the tags you have that are not ours.

Related

• Consent-first — the mechanism in detail
• Consent & privacy integrations — the CMP signals we consume
• Platform — where the consent gate sits in the pipeline