CIPA & Legal Risk: The Website Wiretapping Wave

In August 2026, a federal court let a wiretapping case proceed against an AI notetaker that sat in on Zoom calls. The statute it was decided under? A California law written in 1967 for telephone eavesdropping. That’s not a stretch — it’s the pattern. The same consent theory has marched from phone taps, to website pixels, to AI tools, and each jump makes the last one look settled.

It’s one of the most common — and most expensive — misunderstandings in website privacy: the belief that because your privacy policy discloses the trackers you run, visitors have somehow consented to them. They’re two different legal things. A privacy policy is a one-way notice of what you do. Consent is the visitor actively agreeing to it.

Last cycle was about verdicts. This one is about division. A California federal court let some tracking claims against Wayfair proceed while tossing others in the same order; a $3.85M settlement won final approval — then drew an appeal; and the pen-register theory keeps winning for defendants in one courtroom while §631 wiretapping claims survive in the next.

Of every privacy mistake a healthcare organisation can make online, one has produced more lawsuits, more settlements, and more patient-notification letters than any other: a small snippet of Meta’s advertising code, quietly running on the website — sometimes inside the patient portal itself. It was never installed maliciously. It was added to measure ad campaigns, the way it is on millions of ordinary sites. But on a hospital site, what it transmits is different, and the law treats it differently. Here’s exactly how the Meta Pixel became healthcare’s most expensive line of JavaScript — and what the 2026 picture really looks like.

For three years, the tracking-pixel story was a lawsuit story — plaintiff firms in California scanning websites, sending demand letters, collecting settlements. In June 2026, Australia’s privacy regulator did something different: it ran the scan itself, and formally found two health providers had breached the Privacy Act by loading tracking pixels without consent. A cookie banner, it held, was not enough. Here is exactly what the OAIC decided, and why it turns the pixel problem from a private-litigation risk into a regulatory one — worldwide.

You accept them on every website, but where does the name even come from — and what are they actually doing? Here’s where “cookie” comes from, what a cookie really is, where it’s stored, and exactly how to view, allow, or block cookies in any browser.

Everyone talks about data and privacy, but the words get used loosely — privacy, security, compliance, consent all blur together. This guide draws the lines clearly: what data privacy actually is, how it differs from security, the rights you have, the rules that apply in 2026, and what really happens when privacy is violated.

Everyone warns you about getting sued for website tracking. Almost no one asks the more expensive question: will your insurance actually pay for it? A new case involving session-replay vendor FullStory suggests the answer is increasingly “not without a fight” — and it reveals a whole layer of the tracking-litigation economy that most compliance guides ignore.

A cookie banner makes a promise. When a visitor clicks “Decline,” tracking is supposed to stop. Two 2026 lawsuits — against Toyota and the NFL — allege it didn’t, and a wave of CCPA enforcement now punishes the same gap. Here’s why a decline button that doesn’t actually stop trackers has become one of the clearest privacy risks a website can carry, and how to close it.

In July 2026, a federal court declared one of the most prolific individual CIPA filers a vexatious litigant and restricted his future lawsuits. Headlines framed it as a turning point. It is meaningful — but its practical effect is narrow, and reading it as “the CIPA demand-letter wave is over” would be a costly mistake. Here’s exactly what the designation does, what it doesn’t, and what it changes for a business that receives a demand letter.

SB 690 was supposed to be the bill that ended the CIPA lawsuit wave. Then, in July 2026, it was gutted and rewritten — and what’s left is far narrower than the headlines suggest. If you’ve heard “California is fixing CIPA” and assumed your exposure is about to disappear, this is the reality check: here’s what the amended bill actually does, what it pointedly leaves untouched, and why it changes much less than you’d hope.

Last cycle, the story was a spreading defense against the pen register theory. This cycle, the ground shifted the other way — hard. A jury handed down the first major CIPA verdict in the statute’s history, a $59.5M settlement landed alongside it, patient-portal settlements kept stacking up, and a brand-new theory emerged: suing companies for tracking people after they opted out. Meanwhile the “reform” headlines — SB 690 and a serial filer restricted — sound like relief but change little. Here’s the Good, the Bad, and the Ugly.

These terms get used interchangeably, and they’re not interchangeable. There are actually four things hiding in this question — a privacy policy, a cookie policy, a cookie declaration, and cookie consent — and they do genuinely different jobs. Here’s each one in plain language, whether you need all of them, and how they connect.

Short answer: if your site collects any personal data, almost certainly yes. The longer answer is more useful — because knowing you need one is easy, and knowing what a privacy policy actually protects you from (and what it doesn’t) is where most site owners go wrong.

When a demand letter lands on your client’s desk, they forward it to you — because it’s about the website you built and the tags you manage. Here’s how to steer them through it, what to actually do on the site and the CMP, how the “just ignore it” path really plays out, and how to protect your client and your agency at the same time.

Most GDPR compliant solutions solve about a third of the problem — and the marketing language makes it almost impossible to tell which third. This guide breaks the market into the four categories that actually exist, what each one cannot do, and the one exposure none of them will mention.

A working reference to invasion of privacy in California: what each section of the California Invasion of Privacy Act actually says, how the $5,000-per-violation math works, the one-year clock that governs every claim, and how the same conduct is treated in Texas, Indiana, Louisiana, New Jersey, and Michigan.

You built the cookie banner. You added the “Do Not Sell or Share” link. You’re CCPA compliant — so how did a CIPA demand letter still land on your desk? The uncomfortable answer: CCPA compliance and CIPA compliance are two different things, and the gap between them is exactly where the 2026 wave of website lawsuits lives. Here’s the gap, in plain English, and how to close it.

How did a California wiretapping statute written in 1967 — decades before the web existed — become the engine behind thousands of website tracking lawsuits? This is the story of the California Invasion of Privacy Act: the two court rulings that opened the floodgates, the “pen register” theory driving today’s demand letters, and why, in 2026, your everyday analytics and ad pixels put your site in the crosshairs.

If you run websites for both European and American audiences, you’ve probably wondered whether you need two different consent setups — one for GDPR, one for California’s CIPA. The reassuring answer: a single, correctly built prior-consent configuration can satisfy both. Here’s how the two laws actually differ, where they converge, and the one setup that covers you on both sides of the Atlantic.

Something changed this cycle. For two years, the CIPA §638.51 “pen register” theory was the plaintiff bar’s most reliable weapon against websites. Now a line of defense rulings — led by Rodriguez v. Ink America — is spreading, holding that CIPA can’t criminalise what the CCPA already regulates. But federal courts still disagree. Here’s the shift, the split, and what both mean for your site.

A CIPA claim alleges that your website’s trackers “wiretapped” a visitor without consent. Here’s exactly what a plaintiff has to prove, what one is worth, how the claim moves through court — and the one change that makes your site un-claimable.

California Penal Code Section 631 is a 1967 anti-wiretapping statute that became, in 2022, the most-litigated digital privacy law in the United States. This article explains precisely how it works — the four operative clauses, the aiding-and-abetting theory that reaches website operators, the defenses that have succeeded and failed, and what the 2026 case law means for agencies managing multiple client sites and for CIPA-practicing counsel.

Hotjar, Microsoft Clarity, and FullStory are all named in active CIPA lawsuits. They’re not illegal. But the way most websites deploy them is. Here’s what each tool actually captures, what the 2026 case law says, and the configuration changes that close the gap.