California Invasion of Privacy Act (CIPA) & Website Tracking Litigation
What This Statute Says (Plain Language)
CIPA is California's electronic interception statute. Section 631 addresses wiretapping and reading or attempting to read the contents of a communication in transit without the consent of all parties; § 632.7 has been raised regarding communications involving cellular devices; and § 638.51 restricts the use of 'pen registers' and 'trap and trace' devices that capture routing and addressing information. CIPA provides a private right of action with statutory damages of $5,000 per violation, which materially shapes the economics of class litigation.
Why It Appears in Website Tracking Litigation
CIPA is the most heavily litigated statute in website tracking cases. Plaintiffs have advanced § 631 'aiding and abetting' theories against website operators whose third-party scripts allegedly read communications in transit, and more recently § 638.51 'pen register' theories aimed at trackers that capture IP addresses and device information. Courts have split on many of these theories, including whether a third-party service provider is an eavesdropper or merely an 'extension' of the website operator. The volume of filings and demand letters citing CIPA remains high.
Practical Implications for Website Operators
CIPA is the single most frequently cited statute in the website tracking matters we track. A large share of activity never reaches a courtroom: plaintiff-side firms run automated scans that detect session replay scripts, chat widgets, and advertising pixels, then send pre-suit demand letters citing sections 631, 632.7, or 638.51. Because the theories focus on where the website visitor is located, businesses with no California offices, employees, or registrations receive these letters routinely — an online store in Ohio serving California visitors is squarely inside the pattern.
The economics explain the volume. Section 637.2 provides $5,000 in statutory damages per violation without requiring proof of actual harm, and plaintiffs' theories multiply violations across visitors and page views. Even where a legal theory is untested, the arithmetic of a potential class action creates settlement pressure that is largely independent of the merits.
The technology mix has shifted over time. Earlier waves focused on session replay and chat transcripts under section 631; the more recent wave asserts section 638.51 'pen register' theories against ordinary trackers that capture IP addresses and device information on page load — a lower factual bar than capturing message contents, which is precisely why plaintiffs adopted it. Courts have divided on whether those theories state a claim, and the split itself sustains filing activity.
Litigation Risk in Plain Language
Four structural features combine to make CIPA the center of gravity in this area: an all-party consent standard, a private right of action, per-violation statutory damages, and California's class action infrastructure. Public decisions are genuinely mixed — some courts have dismissed claims because routine browsing data was held not to be the 'contents' of a communication, or because the third-party service was treated as an extension of the website operator rather than an eavesdropper; others have allowed materially similar claims past the pleading stage. That unresolved landscape, not any single ruling, is what drives risk.
For operators, the practical exposure question is factual rather than legal: what do the third-party tools on the site actually transmit, and when does the transmission occur relative to any consent choice? Matters that survive early motions tend to involve transmission of typed input, chat content, or identifying information before the visitor has interacted with a consent tool. Detection of a tracker is an informational risk indicator that warrants configuration review — it is not a finding that any law was violated.
What Operators Commonly Review
These are the configuration reviews we most often see performed by operators of websites serving visitors in this jurisdiction — informational starting points, not legal requirements and not legal advice:
- Test whether chat widgets transmit transcripts — or keystroke-level 'typing previews' — to the vendor before the visitor presses send.
- Verify session replay masking covers every input field, including custom form components where default masking rules often fail.
- Confirm the consent banner actually blocks tracker network requests for California visitors before opt-in, rather than merely hiding the banner UI.
- Inventory which tags capture IP address and device parameters on page load — the exact behavior section 638.51 pen-register theories target.
- Check whether advertising pixels have 'advanced matching' enabled, transmitting hashed emails or phone numbers captured from forms.
- Re-run the review after every tag manager change; CIPA demand letters are frequently triggered by newly added or misconfigured tags.
How This Statute Compares
Consent standard, private right of action, and statutory damages are the structural features that most shape where website tracking claims are filed. Here is how the other electronic interception statutes we track compare:
| Statute | Consent Standard | Private Right of Action | Statutory Damages |
|---|---|---|---|
| Federal Wiretap Act (ECPA Title I) | One-party | Yes | The greater of actual damages, $100 per day of violation, or $10,000 (18 U.S.C. § 2520) |
| Florida Security of Communications Act (FSCA) | All-party | Yes | The greater of actual damages, $100 per day of violation, or $1,000 (Fla. Stat. § 934.10) |
| Illinois Eavesdropping Act | All-party | Yes | Actual and punitive damages; injunctive relief (720 ILCS 5/14-6) |
| Maryland Wiretapping and Electronic Surveillance Act | All-party | Yes | The greater of actual damages, $100 per day of violation, or $1,000, plus punitive damages and fees (§ 10-410) |
| Massachusetts Wiretap Act | All-party | Yes | Actual damages, not less than $100 per day of violation or $1,000, plus punitive damages and fees |
| Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA) | All-party | Yes | The greater of actual damages, $100 per day of violation, or $1,000, plus punitive damages and fees (18 Pa. C.S. § 5725) |
| Washington Privacy Act | All-party | Yes | Actual damages including mental pain and suffering, or liquidated damages of $100 per day up to $1,000 (RCW 9.73.060) |
Jurisdiction Context
See the full California website tracking litigation page for the current risk guideline (Very High), tracked matter counts, and trend data.
Tracked Cases Invoking This Statute
Variety Media LLC v. Superior Court
Jones Walker reports that SB 690 was signed September 30, 2026, and will limit private civil remedies for covered Section 638.51 website and application claims beginning January 1, 2027. In Variety Media, LLC v. Superior Court, the California Court of Appeal withdrew submission and requested briefing on mootness and possible exceptions; no final merits or mootness decision is reported.
Ortega, et al., v. Emanate Health Medical Center
The FAQ describes a proposed $777,000 settlement in Ortega, et al., v. Emanate Health Medical Center concerning an alleged “Pixel Disclosure” and California privacy claims. Emanate denies the allegations, and the notice describes final court approval as still pending rather than reporting a merits determination.
Popa v. Microsoft Corp.
The article reports that California enacted SB 690 to narrow private CIPA pen-register litigation involving websites and applications while preserving wiretapping and eavesdropping claims. It also describes developing standing standards, including a Ninth Circuit ruling in Popa v. Microsoft Corp. that generalized web-tracking injury allegations are insufficient for constitutional standing.
In Re: BPS Direct, LLC; Cabela’s, LLC Wiretapping Litigation
The excerpt identifies a Third Circuit opinion in the BPS Direct and Cabela's wiretapping litigation, decided May 11, 2026. Its opening describes the retailers' use of JavaScript Session Replay Code to capture and store website interactions, but the bounded excerpt does not reveal the holding or disposition.
Smith v. Rack Room Shoes, Inc.
The law firm blog reports a Northern District of California decision in Smith v. Rack Room Shoes, Inc., concerning allegations that third-party pixel tracking intercepted private communications containing personally identifiable information. The court found the plaintiffs lacked Article III standing, rejected actual and attempted interception theories, dismissed the claims without prejudice, and denied class certification.
Allison v. PHH Mortgage
Ethan Allison brought a putative class action alleging that PHH Mortgage used website tracking devices to disclose users’ personal and financial information to third parties without their knowledge or consent. The amended order granted PHH’s motion to dismiss in part and denied it in part, with leave to amend; the excerpt does not identify the affected claims or provide claim-specific holdings.
D'Antonio et al v. Smith & Wesson Inc.
A law firm analysis reports that the Northern District of California denied a motion to dismiss CIPA website-tracking claims in D’Antonio v. Smith Wesson Inc. The court found the amended complaint sufficiently detailed at the pleading stage and left technical questions about tracking and interception for factual development, rather than deciding liability.
Crano v. Sojern, Inc.
Suellen Crano filed a putative class action alleging Sojern collected identifying information and hotel-booking data without her consent through Hilton and Marriott websites. The court dismissed the action with leave to amend because she had not alleged a concrete injury for Article III standing.
D’Antonio v. Tripadvisor, LLC
D’Antonio filed this Massachusetts lawsuit alleging unauthorized third-party tracking on Tripadvisor’s website under CIPA and unjust enrichment, after a California court dismissed his earlier action without prejudice based on a forum-selection clause. Tripadvisor sought dismissal based in part on a Massachusetts choice-of-law provision; the court states that the motion will be allowed, although the excerpt does not include the complete dismissal analysis.
In re Adobe Data Tracking Litigation
The law firm article reports that a federal court dismissed all nine claims in a putative privacy class action alleging that Adobe used persistent ECIDs to track users across websites and build advertising profiles. The court found the nonconsent allegations insufficient and identified additional pleading defects, while granting leave to amend and staying discovery. It did not reach several substantive CIPA questions concerning parties, confidential communications, and pen registers.
Common Questions
Why do so many website tracking demand letters cite CIPA?
CIPA combines an all-party consent standard, a private right of action, and $5,000-per-violation statutory damages with California's active privacy plaintiff bar. Demand letters are inexpensive to generate — many are based on automated scans of a website's third-party scripts — so detection of a common tracker is often all it takes to receive one. Receiving a letter is not a finding of liability; it is a signal to review what your site transmits and to consult qualified counsel.
Our business is not in California. Can CIPA still be asserted against us?
Plaintiffs' theories generally focus on the location of the website visitor, not the business. A website operated from any state that serves California visitors can — and in tracked matters regularly does — face CIPA demands. Whether the statute actually applies to a given operator is a fact- and law-specific question for qualified counsel.
What is a CIPA 'pen register' claim?
Section 638.51 restricts devices that capture routing and addressing information — historically, dialed phone numbers. Beginning around 2023, plaintiffs began arguing that website trackers which capture IP addresses and device data function as unauthorized 'pen registers.' Courts have split on the theory, and the question remains unsettled. This description is informational, not legal advice.
Related Intelligence
Further Reading
- Your website may be sharing more than you think — our plain-language overview of hidden tracking, wiretap exposure, and Global Privacy Control.
- Website wiretap lawsuits by state — risk guidelines and tracked matter counts for all 50 states.
Sources
Statutory text and public commentary are the basis for this page; tracked litigation sources will be listed as the intelligence engine links them to this statute.
About This Page
Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.
How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.
Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.
Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website