Javier v. Assurance IQ
Summary
This guide explains the distinction between CIPA (California Penal Code Section 631) and the CCPA/CPRA opt-out regime, discusses an unpublished Ninth Circuit decision (Javier v. Assurance IQ) that suggested Section 631 applies to internet communications and may require consent before recording, and summarizes pending California legislation (SB 690) that would limit private pen-register claims but not Section 631 claims. It advises operational steps for CMPs to block high-risk third-party capture and to properly honor Global Privacy Control and Do Not Sell/Share controls.
Litigation Status
Procedural Posture
Described as an unpublished Ninth Circuit decision that was influential but left certain issues unresolved; the guide treats it as a key precedent-like discussion point for website-tracking risk under CIPA.
Reported Holding
The guide reports that in the influential but unpublished Javier v. Assurance IQ decision, the Ninth Circuit concluded that California Penal Code Section 631 applies to internet communications and indicated that California law requires consent before a communication is recorded; the court did not resolve every issue, including whether the vendor was a third party.
What the Court Decided
That Section 631 can apply to internet communications and that consent is required before the communication is recorded (as described in the unpublished Javier decision).
What the Court Did Not Decide
Whether the vendor in that case was legally a third party and several other factual/legal issues related to vendor status and downstream uses of data.
Significance
Generally viewed as plaintiff-favorable. Characterizations of significance describe how the matter has generally been discussed in tracked public sources; individual holdings are often narrow, procedural, or fact-specific, and this page does not state or imply broader holdings than the sources support.
What This Page Does and Does Not Say
This page reports what our tracked public sources say about this matter — including, where identified, the procedural posture (for example, a ruling on a motion to dismiss is not a final merits decision). It does not report legal conclusions beyond those sources, does not predict outcomes, and does not constitute legal advice.
Technologies at Issue
- session replay tools
- tracking pixels
- fingerprinting scripts
- chat widgets
- analytics tools
- chatbots
- website tracking
- third-party trackers
- tag managers
- analytics scripts
- advertising scripts
- cookie consent management platforms (CMPs)
Third parties named or identified in tracked sources: Assurance IQ, Cookiebot, Usercentrics, downstream analytics and advertising vendors (generic).
Statutes Invoked
- California Invasion of Privacy Act (CIPA) (1967)
- California Penal Code Section 631; California Penal Code Section 638.51; California Civil Code Section 1798.100 et seq. (CCPA/CPRA)
Claims Asserted
- California Invasion of Privacy Act (CIPA)
- Electronic Communications Privacy Act (ECPA)
- California Consumer Privacy Act (CCPA)
- Video Privacy Protection Act (VPPA)
- Pennsylvania Wiretap Act
- Massachusetts Wiretap Act
- Florida Security of Communications Act (FSCA)
- California Penal Code Section 631 (CIPA interception/recording)
- California Penal Code Section 638.51 (pen-register provision)
- CCPA/CPRA sale/sharing opt-out and Global Privacy Control (Civil Code Section 1798.100 et seq.)
What This Matter May Mean for Website Operators
California Invasion of Privacy Act (CIPA) is an all-party consent statute with a private right of action. Consent standard and private enforceability are the structural features that most shape where website tracking claims are filed and how they are valued.
For operators using similar technologies, the recurring factual questions in matters like this one are when session recording begins relative to consent and whether input masking covers every field; whether chat transcripts or typing previews transit a vendor's servers before the visitor presses send; whether advertising pixels transmit page URLs or hashed form data before a consent choice; what page URLs and query strings analytics tools share with third parties. Our scanner tests these behaviors empirically.
The reported outcome direction at the statutory interpretation stage reflects how tracked sources characterize the ruling; such rulings are often narrow, posture-specific, and fact-bound rather than broad statements of law.
Detection of a similar technology on a website is an informational risk indicator, not a legal conclusion, and nothing in this section is legal advice.
Related Intelligence
Sources
- The CIPA Playbook: Consent, Tracking, and What to Do If You Get a Demand Letter
- California CIPA and Website Tracking in 2026: Consent, GPC, and the “Do Not Sell or Share” Rule
About This Page
Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.
How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.
Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.
Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website