What Is CIPA, and Why Is Your Website Getting Sued?

CIPA, the California Invasion of Privacy Act, is a 1967 law against wiretapping and eavesdropping. A CIPA lawsuit claims your website's cookies, pixels, chat widget, or session replay tool let a third party read or record visitors' activity without their consent. Plaintiffs can seek $5,000 per violation, with no proof of harm required.

Here's what that looks like when it lands in your inbox.

A law firm just audited your website. There wasn’t any advance notice, you didn’t know there was anything to audit. Nevertheless, now there's a demand letter in your inbox.

It accuses your organization of illegal wiretapping—not because you’ve been tapping anybody’s phone, but because your website fires a tracking pixel before visitors consent to it.

California plaintiffs are winning these suits under the California Invasion of Privacy Act (CIPA), a 1967 statute built to stop telephone eavesdroppers that enterprising lawyers have retooled for the digital ad stack. If your site runs tracking technologies—analytics, advertising pixels, session replay, live chat—without first getting explicit user consent, you're a target. The letter names your specific tools, cites the exact moment your code intercepted visitor data, and demands a settlement payout to stay out of court.

SaaS, e-commerce, media, and essentially any business with a website visited by Californians is fair play for CIPA lawsuits. And if you refuse to pay the law firm’s demands, you could get taken to court, where judges have been siding with plaintiffs and defendants alike. That’s why preventative action is so essential when it comes to CIPA lawsuits.

CIPA at a Glance

Why CIPA, and Why Now?

To understand how a law from the Civil Rights era applies to modern websites, look at how the regulatory environment has changed. For years, privacy teams focused almost exclusively on frameworks such as the European Union’s GDPR and California’s CCPA. These laws focus on data workflows, transparency, and consumer deletion rights.

CIPA operates differently. It’s a criminal and civil anti-wiretapping statute. Section 631 of the act penalizes anyone who intentionally taps a telegraph or telephone line. It also punishes anyone who reads a message while it is in transit without the consent of all parties.

Plaintiff attorneys realized this statutory language applies to digital data. They argue that when a website visitor fills out a form, clicks a link, or browses a page, a communication takes place between their browser and the website’s backend technology. If a third-party software company intercepts that communication to track the user, they’ve essentially run a wiretap.

Three drivers accelerated this legal trend:

• A Lucrative Private Right of Action: Unlike the CCPA/CPRA, which is mostly enforced by state regulators (consumers can sue only after certain data breaches), CIPA lets private individuals sue businesses directly. Statutory damages are $5,000 per violation. A single high-traffic website becomes a prime target for automated class actions.
• A Shift in Judicial Interpretation: Several California courts have interpreted these decades-old wiretapping definitions broadly enough to encompass claims against websites that trigger tracking pixels. This change allowed plaintiff firms to move forward with demand letters and litigation.
• Transparent Evidence: Website tracking operates in plain view. A paralegal can open any public website and use browser developer tools to document exactly what tracking scripts fire when a page loads. They can gather everything they need to draft a CIPA notice.

If CIPA wiretapping claims collapse because a business proves that tracked data never leaves the organization, firms turn to CIPA Sections 638.50 and 638.51 pen-trap provisions. Because these sections penalize the unconsented use of technologies that function as pen registers or trap-and-trace devices rather than the mere interception of messages, plaintiffs use them to neutralize previous defense arguments. Though some judges are dismissing the new claims, others are allowing them to move forward. The battle isn’t necessarily over even if you can prove you never shared a consumer’s personal data.

The Latest on CIPA

As of October 2026, two developments change the picture for website owners. Neither one makes the risk go away.

SB 690 Moves Pen-Trap Claims to the Attorney General

Governor Newsom signed SB 690 on September 30, 2026. Starting January 1, 2027, only the Attorney General can bring the Section 638.51 pen-trap claims described above over website and app tracking, and the change also reaches pending claims filed on or after January 1, 2025. What it doesn't touch matters just as much: wiretapping claims under Section 631 stay fully open to private plaintiffs at $5,000 per violation. The tracking itself stays illegal without consent; only who can sue for it changes.

Courts are narrowing pen-trap claims too. In August 2026, a California Court of Appeal tentatively ruled in Variety Media v. Superior Court that collecting a visitor's IP address alone isn't pen register activity, while still reading the law to cover online technology. That ruling isn't final. On October 1, the court asked both sides whether SB 690 makes the case moot, so a final opinion may never issue.

A Federal Court Labeled a Serial CIPA Plaintiff "Vexatious"

On July 20, 2026, the US District Court for the Central District of California barred a prolific CIPA demand-letter sender from filing new privacy claims there without the court's permission. The court counted at least 29 proceedings since 2021, nearly all resolved at the pleading stage, including seven near-identical complaints in the prior seven months. That gives you more room to push back on letters from that sender. But the order covers one person in one federal district. It doesn't cover state court, other plaintiffs, or the open question of whether analytics tools violate CIPA.

So what do you do with this? The same thing as before: make sure tracking tools don't fire until a visitor consents. Plaintiffs' firms are already shifting to Section 631 claims about trackers that fire before consent, which SB 690 doesn't touch. The Interactive Advertising Bureau, which counts more than 4,000 CIPA lawsuits filed so far, put it plainly the day after the signing: SB 690 isn't a safe harbor. Every one of these claims turns on data captured without consent, so that's the step that cuts your exposure most. A consent management platform won't make you compliant with every provision of CIPA, but blocking trackers until consent addresses the conduct most of these claims are built on.

Anatomy of a CIPA Privacy Demand Letter

CIPA notices follow a standardized format designed to maximize pressure.

A CIPA demand letter references CIPA Section 631 (wiretapping) or Sections 638.50 and 638.51 (unauthorized pen registers and trap-and-trace devices). It states that your organization uses website code that allows third parties to record browsing behavior of Californians like:

• Keystrokes
• Mouse movements, clicks, and scrolls
• Form inputs
• Search queries
• Page navigation sequences
• IP addresses
• Device identifiers
• Browsing histories

The document identifies your specific web integrations by name. It lists the exact tracking technologies running on your back end:

• Ad-tech scripts, especially the Meta Pixel
• Analytics tools, like Google Analytics and HubSpot Tracking
• Session replay tools like Hotjar and FullStory
• Live chat widgets, like those from Salesforce and Zendesk

The letter claims you committed civil privacy violations because you let these platforms intercept or log IP addresses, device locations, and browsing histories without permission. Under the newest pen-trap allegations, plaintiff firms argue a violation occurs the moment the tracking code logs this data, meaning they can assert a claim even if the tracked information stays entirely in-house and is never shared with a third party.

And while courts don’t always side with plaintiffs, they do often enough that your organization could be on the hook for an eye-watering penalty. Individual demand letters typically ask for $15,000 to $40,000, an amount set just below what it would cost to fight. Class actions cost far more: the Los Angeles Times settled one for $3.85 million, and Kaiser Permanente agreed to pay up to $47.5 million to settle a web-tracking class action that included CIPA claims. Worse, CIPA demand letters often bundle related laws together. This increases the plaintiff law firm's chance of a higher payout.

Who Is Being Targeted?

Because practically every business has a website, and nearly every one of those websites uses the commonplace tracking technologies named in CIPA suits, no industry is immune. But certain industries and practices are associated with greater risk.

Digital Publishers and Media Entities

Publishers, news sites, and media networks maintain complex, multi-layered ad-tech configurations. Their business models rely heavily on programmatic advertising and audience retargeting. That means a dense volume of tracking pixels and a large target footprint for automated scanners.

High-Traffic E-Commerce Properties

When a consumer enters a credit card number, they transmit sensitive data. The same risk applies when they enter a billing address or search for a product. If an analytics tracker or a session-replay script records those specific keystrokes before the user gives explicit consent, the plaintiff firm claims you intercepted confidential communications.

Websites Using Internal Search Bars

Any business hosting an internal search bar on its platform is at risk. Terms entered into these fields qualify as the contents of a communication. If a third-party pixel or an unconfigured backend database automatically records or logs those specific search queries when a user types them in, plaintiff firms claim it's an illegal data capture. This applies even if the data remains internal; the lack of a proactive consent gatekeeper means your native site infrastructure is treated as an active trap-and-trace mechanism.

Any Enterprise Adhering to Notice-Only or Opt-Out Consent (or Lacking Front-End Consent Technology Entirely)

Any business marketing products or services to California residents without an opt-in consent banner is a target. Anything besides an opt-in consent banner signals to plaintiffs’ firms that you’re a viable target: opt-out consent banners, notice-only banners, or no banner whatsoever. Keep reading to learn the difference between these two consent regimes and how opt-in consent banners defend against CIPA risk.

Immediate Action Steps If You Receive a Letter

If your company received a CIPA demand notice, taking the right steps minimizes your exposure.

Don’t Panic and Don’t Ignore It

Ignoring a demand letter won’t make it go away. Panicking and paying the initial settlement demand out of fear can also be dangerous. Opportunistic firms send these letters hoping for a quick payout without ever intending to step into a courtroom. Treat the notice as serious.

Engage Experienced Representation

Your standard corporate counsel or general practice attorney may not know how 1960s wiretapping laws and modern tracking relate to each other. Retain outside counsel who specializes in California privacy regulations and class-action defense. They can evaluate the letter, determine the plaintiff’s legal standing, and negotiate from a position of strength. If you have a data privacy solution in place, your vendor may also be able to help you reconfigure your software to address the alleged violation or help you gather data that can bolster your defense.

Document the Current State of Your Website Technology

Before altering your website or deleting software scripts, your marketing operations or engineering team should document and identify the scripts that fire on your site and when: instantly upon page load versus after a user interaction. Document what type of user data they capture and what kind of consent messaging is on the site.

Deploy a Technical Intercept

The moment you identify an exposure, you can stop further liability. If you have tracking pixels firing automatically without user consent, you can pause or remove those scripts until you’ve set up an opt-in cookie consent system.

Why Your Existing Cookie Banner May Not Be Enough

Most companies with a cookie banner assume they're covered. Often, they aren’t. There are two fundamentally different types of consent, and CIPA only accepts one.

Opt-out consent (what the CCPA generally requires) means your tracking scripts fire immediately when a visitor lands on your site. The user receives notice—a banner, a disclosure, a link—and can choose to opt out later. This is legal under California's privacy law. It is not sufficient under CIPA.

Opt-in consent means your tracking scripts stay dormant until a visitor affirmatively clicks Accept. This is the standard CIPA defense requires, because under CIPA's wiretapping provisions, interception without prior consent is a violation the moment it occurs—not something that can be undone retroactively by offering an opt-out.

A company can be fully CCPA-compliant with an opt-out banner while simultaneously being exposed to CIPA wiretapping claims. These are separate laws with different standards, and a banner that satisfies one does not automatically satisfy the other.

How Cookie Consent Defeats CIPA Claims

To defend against a CIPA wiretapping claim, look directly at the legal core of the accusation: unauthorized interception or the use of prohibited technology. If a visitor gives you permission to use an analytics tool or an advertising pixel before that tool records data, the interception and/or use of the tool is authorized. The wiretapping claim loses its strength.

An automated consent management platform (CMP) enables you to secure and act on a visitor’s consent. A properly deployed CMP addresses CIPA risk by re-engineering how your website communicates with your visitors’ browsers.

Different CMPs take different approaches to managing consent for data trackers, but here’s how Osano does it: Osano injects a single line of JavaScript that acts as a gatekeeper. Assuming you’ve configured Osano to accept opt-in consent only, it will force all other scripts, including the Meta Pixel, Google Analytics, and HubSpot trackers, to remain dormant.

If the user ignores the banner, closes it, or navigates away, those tracking tools never execute. Zero data goes back to the third-party platforms. The trackers only unblock and fire if the user explicitly clicks Accept.

An enterprise-grade CMP provides a verifiable record of consent. It logs exactly when a user gave consent and what specific categories of data tracking they agreed to. If a plaintiff law firm targets your organization with a CIPA demand letter, your legal team can counter by pulling the historical consent log for that visitor’s IP address or session ID, proving that the tracking was authorized. Without a verifiable log of when and how each visitor consented to data collection, you lack the documentation needed to get a wiretapping claim dismissed.

The Real Cost of Non-Compliance

Looking at privacy compliance as a software cost versus a one-time settlement is a shortcut that misses the bigger picture. It overlooks the hidden costs of a data privacy dispute:

• Escalating Defense Overhead—Even if your legal counsel manages to get an opportunistic demand letter dropped before a formal complaint hits a docket, mounting a response burns substantial resources. Inside counsel must audit your website's historical tracking behavior and draft formal denial letters. The effort creates an immediate and unavoidable budget drain before a lawsuit is filed.
• The Risk of Repeat Exposure—Settling a CIPA claim with one plaintiff firm does nothing to protect you from being targeted by a different law firm next month. If you settle a claim but leave your website trackers configured to fire automatically, your site remains a public target for the next automated scanner that crawls your website.
• Operational Disruption—Managing active threats pulls your marketing and engineering teams away from revenue-generating projects to conduct emergency technical audits and coordinate legal matters.

Protecting Your Business: The Long-Term Playbook

Mitigating your exposure to digital privacy risk means using a proactive playbook. Take three core steps:

1. Conduct a Comprehensive Tech-Stack Audit

Your marketing and product teams must have a single source of truth regarding what software runs on your digital properties. You can’t manage consent for scripts you don’t know exist. Automated domain scanning identifies hidden tracking pixels so you can categorize and control them (and often, CMPs provide this functionality in addition to their consent management capabilities).

2. Determine your Risk Appetite

Your organization can balance risk and reward. While your marketing team may lose access to some data when implementing opt-in consent, it protects against CIPA and similar wiretap lawsuits. You may choose to adopt an opt-in standard across the US to safeguard against all state wiretap laws. You could decide on an opt-in implementation to cover California and opt-out everywhere else. You could also adhere to an opt-in standard in California and specific states like Florida, where there is also some wiretap risk.

3. Implement a Centralized Consent Management Platform

Deploying a solution like the Osano Consent Management Platform lets you automate compliance across jurisdictions and evolving state rules without adding headcount. Using a single line of JavaScript, the platform localizes cookie banners, detects user locations, blocks unconsented scripts, manages consent for privacy laws in more than 50 countries, and keeps detailed consent logs.

Frequently Asked Questions

Is CIPA the same thing as the CCPA?

No. While both are California statutes that protect consumer privacy, they are separate laws with different mechanisms. The CCPA is a comprehensive regulation that the California Privacy Protection Agency (CalPrivacy) and the Attorney General enforce, dictating how businesses handle data transparency, consumer data deletion, and opt-out preferences. CIPA is a decades-old civil and criminal anti-wiretapping law that lets private individuals sue businesses directly for unauthorized data interception, bypassing state regulators.

Can I just remove all tracking pixels to avoid this risk entirely?

Technically, yes. If you strip your website backend of all advertising pixels, analytics tools, and third-party scripts, you remove the tracking code that plaintiff law firms target. But this blinds your marketing team, leaving you unable to measure campaign performance, optimize user experiences, and drive digital revenue. Implementing a CMP lets you keep using these tools safely.

Does CIPA only affect businesses located within the state of California?

No. CIPA protects California residents. If your business is in Ohio, New York, or anywhere else, you can still face CIPA suits in California courts, especially if your website knowingly collects data from visitors you know are in California.

What if my website already has an active cookie banner?

This is the single most common point of vulnerability. Many organizations believe they are protected because they display a standard cookie notice. Misconfigured banner settings can lead to a false sense of security.

Standard compliance under the CCPA operates on an opt-out framework, meaning it’s legal to fire marketing scripts immediately upon page load, provided you give the user notice and a clear link to stop it later. CIPA wiretapping claims reverse this logic. Because a wiretap happens the instant that data is intercepted without permission, defeating a CIPA claim requires an opt-in setup. If your current banner displays a disclosure message but allows your Meta Pixel or Google Analytics scripts to launch in the background before the user explicitly clicks Accept, your website remains exposed to a wiretapping claim.

What are CIPA statutory damages?

Under Section 637.2, a plaintiff can recover $5,000 per violation or three times their actual damages, whichever is greater. They don't need to prove they were harmed. Because each visit can be framed as a separate violation, exposure adds up quickly on a high-traffic site.

Is CIPA strict liability?

Not quite, though it can feel that way. Plaintiffs don't have to show they were harmed. But courts still ask whether the visitor consented and whether the tool actually read or recorded a communication, and those questions are where most CIPA defenses start.

What is a CIPA demand letter?

It's a letter from a plaintiff's firm saying your website violated CIPA and offering to settle before a lawsuit is filed. Most name the specific tools on your site and ask for a payment, often with a short deadline. Don't ignore one, and don't pay without talking to a lawyer. The steps above under "Immediate Action Steps If You Receive a Letter" walk through what to do.

Does SB 690 end CIPA lawsuits?

No. Starting January 1, 2027, it moves pen-trap claims under Section 638.51 to the Attorney General. Wiretapping claims under Section 631 stay open to private plaintiffs.

Want a step-by-step guide to reduce your risk of a CIPA lawsuit? Download our checklist to reduce your CIPA risk today.