CIPA is the California Invasion of Privacy Act, a 1967 wiretapping law (Penal Code Sections 630-638) that plaintiff attorneys now use to sue businesses over website chat widgets, tracking pixels, and analytics tools. It carries statutory damages of $5,000 per violation, and it applies to any website with California visitors.
If that sounds like a stretch of a 59-year-old phone-tapping law, most business owners agree. Courts are still divided on parts of it. But thousands of demand letters and lawsuits are going out anyway, and businesses of every size are paying settlements over tools as ordinary as Google Analytics. Here is what the law actually says, how it reached your website, and what to do about it. For the complete compliance walkthrough, see our full CIPA Compliance Guide.
What does CIPA actually say?
CIPA was written to stop secret phone recordings. California requires all-party consent: everyone on a call must agree before it can be recorded. The law sat mostly untouched for decades until attorneys noticed its language could describe how modern websites handle visitor data.
Three sections matter for websites:
- Section 631 prohibits intercepting a communication in transit without consent. Plaintiffs apply this to live chat widgets and session replay tools, arguing that when a third-party vendor receives your visitors’ chats or keystrokes, an unauthorized “wiretap” occurred.
- Section 632 prohibits recording confidential communications without everyone’s consent.
- Section 638.51 prohibits pen registers, devices that capture routing data like phone numbers. Plaintiffs argue tracking pixels that capture IP addresses and device identifiers are the modern equivalent.
The teeth are in the damages: $5,000 per violation or three times actual damages, plus attorney fees, and a private right of action, which means individuals can sue directly without a regulator involved. No proof of actual harm is required to send a demand letter.
Why is a phone law being applied to websites?
Because the economics work. An attorney can scan thousands of websites with automated tools, detect which trackers fire on page load, and mail boilerplate demand letters at scale. Settlements typically run $5,000 to $50,000, cheap enough that many businesses pay rather than litigate. Public filings have climbed from a few dozen in 2022 to a projected 3,500+ in 2026, and demand letters that never become lawsuits are estimated in the tens of thousands.
A legislative fix called SB 690 would have exempted routine commercial tracking, but it stalled in Sacramento. Until the law changes or higher courts settle the theory, the letters keep coming.
Which tools put your website at risk?
The pattern in every claim: your website sent visitor data to an outside company without the visitor agreeing first.
| If your site uses… | The claim will say… |
|---|---|
| Meta, Google, TikTok, or LinkedIn pixels | Visitor behavior was transmitted to ad platforms without consent |
| Google Analytics or similar | Identifiers and browsing data were captured on page load |
| A live chat or chatbot widget | Conversations were routed through a third-party vendor |
| Session replay or heatmaps | Every click and keystroke was recorded |
| Forms connected to a CRM | Typed content was sent to an outside platform |
Notice something? That table describes nearly every business website built in the last decade, probably including yours. The tools are not illegal. Running them before consent, on California visitors, is what creates the exposure.
Want to know exactly what your site is sending, and to whom?
Our Website Security Reinforcement Package includes a complete third-party script audit and lockdown, so you know your exposure before a plaintiff firm does.
Does CIPA apply if my business is not in California?
Yes, and this catches more businesses than anything else. CIPA claims follow the visitor, not the business. A contractor in Arizona, a law firm in Texas, or a shop in Florida can receive a demand letter if California residents load their site and trackers fire without consent. Given that California is roughly one in eight Americans, almost every U.S. website has California traffic.
How is this different from GDPR or CCPA?
GDPR and CCPA are regulatory privacy frameworks: government agencies enforce them, and penalties usually follow investigations. CIPA is a criminal wiretap statute with a private right of action, which means any individual plaintiff, backed by a law firm, can demand statutory damages directly. That is why CIPA moved faster than any regulator ever has. If you have already done GDPR work, you have a head start, because consent-first tracking satisfies both.
What should a business owner do right now?
Three moves, in order. First, inventory every third-party script on your site, including the ones a past marketer installed and forgot. Second, put a consent management platform in place that actually blocks tracking until a visitor agrees, with equal accept and decline options. Third, make your privacy policy match what your site really does. We break each step down in our CIPA Compliance Checklist for Business Websites.
And then keep it maintained. Sites drift out of compliance every time a plugin updates or a campaign adds a new pixel, which is why ongoing website management includes script monitoring as a standing task.
Find out where your site stands in ten minutes
Get a free CIPA Exposure Scan: we check your website the same way plaintiff firms do and send you a plain-English report.
Frequently Asked Questions
What does CIPA stand for?
CIPA stands for the California Invasion of Privacy Act, codified at California Penal Code Sections 630-638. It was enacted in 1967 to prohibit unauthorized wiretapping and recording of confidential communications.
Is CIPA the same as CCPA?
No. CCPA is a consumer privacy regulation enforced primarily by the state, focused on data rights like access and deletion. CIPA is a wiretap statute with a private right of action and $5,000 statutory damages per violation, which is why individual plaintiffs use it to sue businesses directly.
Can I be sued under CIPA for using Facebook ads?
Running Facebook ads is not itself a violation, but the Meta Pixel that measures those ads transmits visitor data to Meta. If the pixel fires on California visitors before they consent, that configuration is the basis of many current CIPA claims.
Do CIPA lawsuits only target big companies?
No. Large companies attract class actions, but the demand letter wave is aimed heavily at small and mid-sized businesses, which are more likely to settle quickly. Automated scans do not discriminate by company size.
What happens if I ignore a CIPA demand letter?
Ignoring a demand letter can lead to an actual lawsuit in California state or federal court, where statutory damages and attorney fees apply. The better path is to respond through a qualified attorney and remediate the website exposure immediately.
This article is for general informational purposes only and does not constitute legal advice. If you have received a CIPA demand letter or face potential litigation, consult a qualified privacy attorney.
