In a significant ruling for digital privacy law, a federal court has denied Smith & Wesson’s motion to dismiss a California Invasion of Privacy Act lawsuit over website tracking.
The case, D’Antonio v. Smith & Wesson Inc., was filed in the Northern District of California and concerns allegations that the firearms company unlawfully tracked users on its website.
Plaintiffs alleged that Smith & Wesson violated CIPA by placing cookies on users’ devices even after those users had explicitly rejected them.
The complaint further alleged that the company unlawfully used a pen register and engaged in broader tracking of visitors across its website.
Smith & Wesson moved to dismiss the claims, arguing that the CIPA privacy allegations lacked sufficient detail to proceed in court.
The court rejected that argument, finding that the amended complaint was sufficiently detailed to give notice of the claims and defenses.
The judge noted that any challenge to whether the tracking technology fell outside the statutory definition of a pen register could be addressed on a fuller record.
The ruling signals that plaintiffs asserting CIPA claims do not need to plead the precise technical mechanisms underlying website tracking at the motion-to-dismiss stage.
Where plaintiffs identify specific communications with a website and plausibly allege that cookies or other tracking technologies captured or transmitted associated information, claims may survive despite uncertainty over technical specifics.
The decision recognises that questions around particular cookies, third parties, processing platforms, or technical means of interception often require factual development and discovery rather than early dismissal.
For businesses operating websites with tracking technologies, the ruling underscores the legal risk of deploying cookies without robust and enforceable user consent mechanisms in place.
CIPA has increasingly become a vehicle for privacy litigation in California, with plaintiffs targeting a wide range of companies over digital data collection practices.
The D’Antonio decision, handed down in September 2026, adds to a growing body of case law clarifying how traditional wiretapping and pen register statutes apply to modern web technologies.