Huffington Post accused of privacy violations under Cold War-era law

The trend of using a Cold War era law to litigate modern privacy disputes continues as a putative class action has been filed against online news publisher Huffington Post, claiming it uses trackers to collect user information for targeted advertising and data monetization without consent.

L. Timothy Fisher and Emily A. Horne, of Walnut Creek firm Bursor & Fisher PA, wrote in the complaint that the tracker "crosschecks the internet protocol (IP) addresses and device fingerprints against any profiles in its possession to identify website users. Those data profiles are then provided to advertisers for more targeted and tailored advertising based on a broad universe of information."

They did not reply to requests for further comment.

The complaint filed in San Francisco Superior Court on Tuesday claims the use of these trackers violates the California Invasion of Privacy Act (CIPA), passed by the Legislature in 1967 to prevent the unauthorized interception, monitoring and recording of private conversations. Barton Golub v. Thehuffingtonpost.com, Inc., CGC-25-622955 9 (S.F. Super. Ct. filed March 4, 2025).

Recently, the act has been used to litigate whether any device that tracks online activity - including IP addresses - is a pen register, a device that can record phone numbers. The complaint against Huffington Post claims the website uses trackers that function as pen registers and trap and trace devices that violate the CIPA.

Jeremy S. Goldman, partner with Frankfurt Kurnit Klein & Selz PC's Litigation Group and co-chair of the Emerging Technology Group, called the growing trend of litigating over this issue "absurdist."

Goldman, who has defended dozens of cases around the CIPA, said the trackers named in the complaint were "garden variety" and used by most websites, but a handful of firms were pursuing most cases looking for a "quick settlement."

"I think [these firms] are much more interested in volume and getting quick settlements with people shaking down everything from mom-and-pop websites all the way to global multinational corporations," said Goldman.

"The way things unfold is you now have a split between the state courts and the federal courts, and it seems like it needs to be resolved eventually by the California Supreme Court because ultimately the federal court is really trying to interpret California law. And yet you have these lower-level state court judges that are saying these claims are bogus and then you have these federal judges that are trying to be protective of consumer privacy that are upholding the claims."

The Huffington Post complaint was originally filed in the Northern District of California court before a voluntary dismissal without prejudice by the plaintiff on Tuesday. It was then filed in state court.

Goldman added that the complaints skirt around the California Consumer Privacy Act (CCPA) which was designed to allow technology -- such as the trackers listed in the complaint - to be used by websites. According to the CIPA, a trap and trace device is deemed "a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication."

Goldman said, "The theory of these claims, if you take them to their logical conclusion is that just capturing a user's IP address, even if you don't send it to a third party, under the construction of the statute by these plaintiffs is that you're engaging in a trap and trace device.

"Given the broad definition and the inartful language in the statute, and if you look at it in its broadest, dopiest kind of light, it would capture almost any technology where you're tracking, incoming calls like caller ID on your phone. It would track every website that tracks an IP address, which is literally every website because that's how the internet works," he said.

"It results in an absolute absurdity, and you can't protect against that. The only protection is don't have a website."

Fisher and Horne also brought a putative class action against tech and consumer publisher CNET in June 2024, alleging similar tracker practices that violated the CIPA. The plaintiffs filed a motion to dismiss without prejudice in that case which was granted in August 2024. It was not refiled in another court. Skaff et al. v CNET Networks, Inc., CGC-24-615227 (S.F. Super. Ct. filed June 4, 2024)

Huffington Post was approached for comment but did not respond.