A call can end in a second, but its outer trail can remain. The voice is gone. The message is closed. Still, the numbers, routing marks and timing can remain like footprints in wet sand. California trap and trace law deals with those footprints.
This law is not about fishing traps, animal traps, or car trackers. It is about communication tracing. A pen register records or decodes outgoing dialing, routing, addressing, or signaling data. A trap and trace device captures incoming data that can identify where a wire or electronic communication came from. In plain English, a pen register looks at what goes out. A trap and trace device looks at what comes in. Neither is meant to capture the words, pictures, sounds, or message body.
High-End Privacy Picks For California Homes And Small Offices
A serious privacy setup can pass $2,000 once you add better network gear, secure storage, and basic office protection. Start with a business-grade firewall appliance, a high-end Wi-Fi 7 mesh router system, a hardware-encrypted external SSD, a micro-cut paper shredder, and a privacy screen filter set. These items support lawful privacy habits. They are not for spying, stalking, hiding crimes, or getting around a court order.
Good gear cannot fix bad conduct. A strong firewall will not make illegal monitoring lawful. An encrypted drive will not erase a valid order. Privacy gear is like a sturdy lock on a front door. It protects your space, but it does not give you a right to enter someone else’s.
The Main California Law
California trap and trace rules live mainly in Penal Code Sections 638.50 through 638.55. Those sections define pen registers and trap and trace devices, set the court-order path, allow narrow emergency approval, require notice after use, and give people a way to challenge unlawful orders or data collection.
California’s rule is stricter than the casual phrase “metadata only” might suggest. The state does not let peace officers use these tools on a mere hunch. A peace officer must apply to a magistrate. The application must be written under oath or equivalent affirmation. It must identify the officer, the law enforcement agency, the investigation, and the offense tied to the data sought.
The law also has a health-care shield. A magistrate may not issue an ex parte order for a pen register or trap and trace device for the purpose of investigating or collecting proof of a prohibited violation. That term is tied to protected health care activity under California law, including acts that are lawful in California even when another state tries to punish them.
What A Pen Register Is
A pen register is a device or process that records or decodes dialing, routing, addressing, or signaling data sent from a phone, account, computer, app, or other communication facility. It is pointed outward. It can show what number or address was reached, when a signal was sent, and how the communication moved through a service.
It is not supposed to collect the actual message. It should not record the spoken call, read the text, save the email body, or capture the substance of a chat. It is like seeing the outside of an envelope without opening it.
That said, the outside of an envelope can still say a lot. A stack of call logs can reveal habits, friends, business ties, timing, and repeated contact. Metadata is quiet, but it can still point a bright light at a person’s life.
What A Trap And Trace Device Is
A trap and trace device works from the other direction. It captures incoming electronic or other impulses that identify the originating number or other routing, addressing, or signaling data that is reasonably likely to identify the source of a wire or electronic communication.
For a phone line, the older image is simple. The device helps show where incoming calls came from. For digital accounts, the idea can reach routing and addressing data around incoming communications. It is still meant to stay outside the message itself.
A trap and trace device can be very useful in a stalking, threat, fraud, extortion, or missing-person case. It can also be very invasive when misused. That is why California places it behind a court-order gate, with narrow exceptions for providers and emergencies.
The Court Order Requirement
California Penal Code Section 638.51 says a person may not install or use a pen register or trap and trace device without first getting a court order under Section 638.52 or emergency approval under Section 638.53, unless a provider exception applies.
This rule applies to more than police. A private person cannot attach a tracing tool to another person’s phone, account, or service just because they are suspicious. A landlord cannot use it on a tenant. A boss cannot use it on a personal phone without lawful authority. A private investigator cannot create authority by being hired.
The legal gate matters because the tool can map relationships. It can show who contacts whom, how often, and at what times. That map can be revealing even without a single recorded word.
What The Application Must Say
A peace officer seeking a pen register or trap and trace order must submit a written application under oath or equivalent affirmation. The application must give the officer’s identity and the law enforcement agency running the investigation. It must certify that the data likely to be obtained is relevant to an ongoing criminal investigation. It must also state the offense tied to the data.
The magistrate may ask more questions under oath before granting the order. The judge may take written affidavits from the officer or witnesses. This gives the court a chance to check the request before the tool is used.
The order must also list certain details when known. It should name the person who leases or owns the line, the person under investigation, the number and physical location of the line, and the offense tied to the data. For a trap and trace device, the order must also state the geographic limits.
The Probable Cause Finding
California does not use the same low bar found in some older federal pen register practice. A California magistrate must find that the data is relevant to an ongoing investigation and that there is probable cause to believe the device will lead to one of the listed categories in the statute.
Those categories include recovery of stolen or embezzled property, evidence of a felony, evidence that a certain person committed or is committing a felony, the location of a person unlawfully restrained, the location of a person reasonably believed to be a witness, or the location of a person for whom there is probable cause to arrest. The statute also reaches certain child sexual exploitation offenses, a workers’ compensation insurance offense under the Labor Code, and certain Fish and Game Code or Public Resources Code violations.
That probable-cause layer is one of the main things that makes California’s rule stand out. The state asks the judge to do more than rubber-stamp a claim that the data may be useful.
Location Data Limits
California’s pen register and trap and trace order has a strong location limit. Data gathered solely under this authority may not include data that reveals the physical location of the subscriber, except to the extent that location may be determined from the telephone number.
This matters because modern phones and apps can create location clues far beyond a number on a bill. Cell-site data, GPS data, Wi-Fi location, and app-based location trails can show where a person sleeps, works, shops, seeks care, or meets others. A basic pen register or trap and trace order is not supposed to become a location warrant.
If officers want location data, a different legal path may be needed. The exact path depends on the data, the service, the facts, and the current law. The pen register chapter draws a bright line: do not use this tool alone to pull physical location data.
How Long The Order Lasts
A California order authorizing a pen register or trap and trace device may last no more than 60 days. The officer can ask for an extension, but the request needs a new application. The officer must show continued probable cause that the data or items sought are likely to be obtained during the extension.
Each extension may also last no more than 60 days. That time limit keeps the order from becoming an endless watch. If law enforcement wants the tool to stay active, it must return to the court.
The order and any extension are sealed until the order expires. The person owning or leasing the line is also barred from disclosing the device or the investigation while the order is sealed.
Provider Help And Compensation
A court order may direct a wire or electronic communication service provider, landlord, custodian, or other person to give the officer the technical help needed to install and use the device. For a pen register, the law calls for help that lets installation happen with minimal service disruption. For a trap and trace device, the provider may be ordered to install it and provide operation help.
The provider or other person who gives that help must be reasonably paid by the requesting law enforcement agency for reasonable expenses. This keeps the cost of the investigation from landing silently on the provider.
Unless the magistrate orders something else, the data from the pen register or trap and trace device is given to the officer at reasonable intervals during regular business hours for the life of the order.
Provider Exceptions
California lets providers use pen register or trap and trace functions for limited service-related reasons without first getting a court order. A provider may use them to operate, maintain, and test a wire or electronic communication service. A provider may also use them to protect its rights or property, protect users from abuse or unlawful use, record that a communication was initiated or completed to guard against fraud or abuse, or act with user consent.
These exceptions are narrow. They are built around running and protecting the service. They do not let a provider, employee, contractor, or outsider conduct private spying for curiosity, revenge, or pressure.
A provider exception is a shield for service work, fraud control, and user protection. It is not a back door into another person’s private life.
Emergency Oral Approval
California has an emergency path in Penal Code Section 638.53. A peace officer may make an oral application to a magistrate. The magistrate may grant oral approval for immediate use without a written order if several conditions are met.
The magistrate must find that grounds exist for an order under Section 638.52. The magistrate must also find probable cause that an emergency exists in a criminal investigation and probable cause that a substantial danger to life or limb justifies immediate use before a written order can be submitted and decided.
This is a narrow bridge, not a shortcut for routine cases. By midnight of the second full court day after the device is installed, the officer must submit a written application to the magistrate who gave oral approval. If a written order is granted, it is retroactive to the time of oral approval. If no order is granted, use must stop when the desired data is obtained, when the application is denied, or by the midnight deadline, whichever comes first.
Notice After The Order Ends
California requires notice after the use of a pen register or trap and trace device. A government entity that obtains data under a written order or emergency oral approval must give notice to identified targets. The notice must say that data about the recipient was compelled or requested and must describe the nature of the government investigation with reasonable detail.
The notice must include a copy of the order or a written statement of the facts that gave rise to the emergency. The notice must be provided no later than 30 days after the order, extensions, or emergency request ends.
That notice rule gives people a later window into secret collection. It does not stop every sealed order from being used. It does require the government to return to the daylight after the hidden stage ends, unless the court delays notice.
Delayed Notice
The government may ask the court to delay notice. The request must be supported by a sworn affidavit. The court may delay notice if it finds reason to believe that notice may cause an adverse result. The delay can last only as long as that reason remains, and no single delay may exceed 90 days.
The court may grant more 90-day extensions on the same grounds. When the delay ends, the government must give notice within three days. The notice must include the data required by the statute and either a copy of the data obtained or a summary of it. The summary must include the number and type of records disclosed and the earliest and latest dates and times covered.
If there is no identified target when the order or emergency request ends, the government must send the required report to the Department of Justice. The department must publish those reports on its website within the time set by the statute, with personal identifying details redacted when needed.
How This Differs From A Wiretap
A pen register or trap and trace device is not the same as a wiretap. A wiretap is aimed at the words, sounds, or message body. It captures what people say or write. A pen register or trap and trace device is aimed at the data around the communication.
The difference is like reading the address on a package versus opening the box. Both can reveal private facts, but opening the box is a deeper intrusion. California treats those tools through different statutes and different court showings.
People often mix these terms in casual talk. The distinction can matter in court. A defense lawyer may ask whether officers used the right legal tool, whether the data collected stayed within the order, and whether any later warrant grew from a bad seed.
How This Differs From Stored Records
A pen register or trap and trace order collects future or ongoing dialing, routing, addressing, or signaling data during the life of the order. Stored records are different. They are records a provider already has, like subscriber details, older logs, billing data, or stored messages.
California’s electronic data privacy rules may require a warrant, order, subpoena, or other legal process depending on the kind of stored data sought. A pen register order should not be treated as a magic key for every account record.
The time line helps. A pen register is watching data as it forms. A stored-record request reaches into data already held. The law treats those moves differently.
Penalties For Unlawful Use
A person who violates California’s pen register and trap and trace restriction can face a fine up to $2,500, county jail up to one year, imprisonment under California’s felony sentencing rule, or both fine and imprisonment. The facts decide how a case is charged and handled.
The statute also says good faith reliance on a valid order or emergency authorization is a complete defense to a civil or criminal action under that chapter. That protection matters for officers and providers acting under a court order or lawful emergency approval.
For private people, the warning is plain. Do not install or use tracing tools on another person’s communications without lawful authority. Curiosity, suspicion, jealousy, and workplace tension do not create a court order.
Suppression And Challenges
California gives people tools to challenge unlawful collection. A person in a trial, hearing, or proceeding may move to suppress wire or electronic data obtained or kept in violation of the Fourth Amendment or the California pen register chapter. The motion follows the procedures used for search and seizure suppression motions.
The Attorney General may bring a civil action to force a government entity to comply with the chapter. A targeted person, service provider, or recipient of legal process may also ask the issuing court to void or modify a warrant, order, or process that does not comply with the chapter, the California Constitution, or the United States Constitution.
The court may also order destruction of data obtained in violation of those rules. That remedy matters because data can spread quickly once collected. Destruction is the legal broom that may sweep up what should not have been gathered.
What California Residents Should Know
For ordinary California residents, the main point is simple. Trap and trace law is about communication metadata, not the message itself. That data can still be revealing. It can show contact patterns, timing, repeated calls, and digital routes.
If you believe someone is unlawfully monitoring your phone, accounts, or communications, save evidence without confronting the person alone. Account alerts, strange forwarding rules, unknown devices, call logs, bills, screenshots, and provider notices may help. For immediate danger, call emergency services. For legal advice, talk to a California lawyer.
If you are charged in a case involving pen register or trap and trace data, the questions can be detailed. Did the officer apply under the right statute? Did the magistrate make the required finding? Did the data include physical location that the order could not cover? Was notice given or lawfully delayed? Did later evidence come from the tracing data? Those questions turn on the record.
What Businesses Should Know
California businesses should be careful with real-time communication tracing. Network logs, fraud alerts, billing data, and service records are common business tools. A pen register or trap and trace device is different when it records or captures dialing, routing, addressing, or signaling data in a way covered by the statute.
A provider may have legal room to monitor for service operation, testing, fraud, abuse, and user protection. A non-provider business has less room and should not assume ownership of a device or account gives unlimited monitoring rights. Employee notice, consent, privacy policies, device ownership, account ownership, and the type of data all matter.
When a company receives a court order, it should read the scope before responding. The order may require technical help, but only within the legal boundaries. When the order is unclear, legal review can prevent an overbroad data handoff.
Common Misunderstandings
One common mistake is thinking metadata has no privacy value. It does. Metadata can show who called, when, how often, and from where the path appears to begin. A person’s relationships can show up in patterns long before the words are known.
Another mistake is thinking a pen register order lets officers hear calls or read messages. It does not. That requires a different order. The pen register or trap and trace tool is meant for the outside marks around the communication.
A third mistake is thinking emergency approval wipes out court review. It does not. The oral approval path is short, tied to danger to life or limb, and followed by a written application deadline.
Final Word On California Trap And Trace Law
California trap and trace law lives mainly in Penal Code Sections 638.50 through 638.55. A pen register looks at outgoing dialing, routing, addressing, or signaling data. A trap and trace device looks at incoming data that can identify the source of a communication. Both are meant to stay outside the message itself.
California generally requires a court order before these tools are installed or used. The order must be tied to an ongoing criminal investigation, and the magistrate must find relevance and probable cause under the statute. The order can last up to 60 days, with 60-day extensions only after a new showing. Emergency oral approval is available only when danger to life or limb justifies immediate action and a written application follows quickly.
For residents, businesses, officers, and providers, the rule is clear enough to remember: trace data may look small, but it can tell a large story. California law treats that story with care. Anyone handling it should do the same.