CIPA & Legal Risk

When a demand letter lands on your client’s desk, they forward it to you — because it’s about the website you built and the tags you manage. Here’s how to steer them through it, what to actually do on the site and the CMP, how the “just ignore it” path really plays out, and how to protect your client and your agency at the same time.

Most GDPR compliant solutions solve about a third of the problem — and the marketing language makes it almost impossible to tell which third. This guide breaks the market into the four categories that actually exist, what each one cannot do, and the one exposure none of them will mention.

A working reference to invasion of privacy in California: what each section of the California Invasion of Privacy Act actually says, how the $5,000-per-violation math works, the one-year clock that governs every claim, and how the same conduct is treated in Texas, Indiana, Louisiana, New Jersey, and Michigan.

You built the cookie banner. You added the “Do Not Sell or Share” link. You’re CCPA compliant — so how did a CIPA demand letter still land on your desk? The uncomfortable answer: CCPA compliance and CIPA compliance are two different things, and the gap between them is exactly where the 2026 wave of website lawsuits lives. Here’s the gap, in plain English, and how to close it.

How did a California wiretapping statute written in 1967 — decades before the web existed — become the engine behind thousands of website tracking lawsuits? This is the story of the California Invasion of Privacy Act: the two court rulings that opened the floodgates, the “pen register” theory driving today’s demand letters, and why, in 2026, your everyday analytics and ad pixels put your site in the crosshairs.

If you run websites for both European and American audiences, you’ve probably wondered whether you need two different consent setups — one for GDPR, one for California’s CIPA. The reassuring answer: a single, correctly built prior-consent configuration can satisfy both. Here’s how the two laws actually differ, where they converge, and the one setup that covers you on both sides of the Atlantic.

Something changed this cycle. For two years, the CIPA §638.51 “pen register” theory was the plaintiff bar’s most reliable weapon against websites. Now a line of defense rulings — led by Rodriguez v. Ink America — is spreading, holding that CIPA can’t criminalise what the CCPA already regulates. But federal courts still disagree. Here’s the shift, the split, and what both mean for your site.

A CIPA claim alleges that your website’s trackers “wiretapped” a visitor without consent. Here’s exactly what a plaintiff has to prove, what one is worth, how the claim moves through court — and the one change that makes your site un-claimable.

California Penal Code Section 631 is a 1967 anti-wiretapping statute that became, in 2022, the most-litigated digital privacy law in the United States. This article explains precisely how it works — the four operative clauses, the aiding-and-abetting theory that reaches website operators, the defenses that have succeeded and failed, and what the 2026 case law means for agencies managing multiple client sites and for CIPA-practicing counsel.

Hotjar, Microsoft Clarity, and FullStory are all named in active CIPA lawsuits. They’re not illegal. But the way most websites deploy them is. Here’s what each tool actually captures, what the 2026 case law says, and the configuration changes that close the gap.

Most “consent management platforms” were built for GDPR cookie compliance, with CIPA bolted on as a checklist line. But in 2026, CIPA cases don’t turn on whether you have a banner — they turn on whether trackers fired before consent and whether your site’s behavior matched what the banner promised. Here’s how the leading tools actually stack up on that test.

The Meta Pixel is on millions of websites — and it’s the single most-named technology in CIPA tracking lawsuits. With courts split down the middle in 2026 and settlements running into eight figures, here’s the honest answer to whether yours is a liability, and how to keep using it safely.