CIPA & Legal Risk

Home › Blog › CIPA › Insurance & CIPA Coverage CIPA · Litigation Economy · August 2026 Will Insurance Cover […]

A cookie banner makes a promise. When a visitor clicks “Decline,” tracking is supposed to stop. Two 2026 lawsuits — against Toyota and the NFL — allege it didn’t, and a wave of CCPA enforcement now punishes the same gap. Here’s why a decline button that doesn’t actually stop trackers has become one of the clearest privacy risks a website can carry, and how to close it.

In July 2026, a federal court declared one of the most prolific individual CIPA filers a vexatious litigant and restricted his future lawsuits. Headlines framed it as a turning point. It is meaningful — but its practical effect is narrow, and reading it as “the CIPA demand-letter wave is over” would be a costly mistake. Here’s exactly what the designation does, what it doesn’t, and what it changes for a business that receives a demand letter.

SB 690 was supposed to be the bill that ended the CIPA lawsuit wave. Then, in July 2026, it was gutted and rewritten — and what’s left is far narrower than the headlines suggest. If you’ve heard “California is fixing CIPA” and assumed your exposure is about to disappear, this is the reality check: here’s what the amended bill actually does, what it pointedly leaves untouched, and why it changes much less than you’d hope.

Last cycle, the story was a spreading defense against the pen register theory. This cycle, the ground shifted the other way — hard. A jury handed down the first major CIPA verdict in the statute’s history, a $59.5M settlement landed alongside it, patient-portal settlements kept stacking up, and a brand-new theory emerged: suing companies for tracking people after they opted out. Meanwhile the “reform” headlines — SB 690 and a serial filer restricted — sound like relief but change little. Here’s the Good, the Bad, and the Ugly.

These terms get used interchangeably, and they’re not interchangeable. There are actually four things hiding in this question — a privacy policy, a cookie policy, a cookie declaration, and cookie consent — and they do genuinely different jobs. Here’s each one in plain language, whether you need all of them, and how they connect.

Short answer: if your site collects any personal data, almost certainly yes. The longer answer is more useful — because knowing you need one is easy, and knowing what a privacy policy actually protects you from (and what it doesn’t) is where most site owners go wrong.

When a demand letter lands on your client’s desk, they forward it to you — because it’s about the website you built and the tags you manage. Here’s how to steer them through it, what to actually do on the site and the CMP, how the “just ignore it” path really plays out, and how to protect your client and your agency at the same time.

Most GDPR compliant solutions solve about a third of the problem — and the marketing language makes it almost impossible to tell which third. This guide breaks the market into the four categories that actually exist, what each one cannot do, and the one exposure none of them will mention.

A working reference to invasion of privacy in California: what each section of the California Invasion of Privacy Act actually says, how the $5,000-per-violation math works, the one-year clock that governs every claim, and how the same conduct is treated in Texas, Indiana, Louisiana, New Jersey, and Michigan.

You built the cookie banner. You added the “Do Not Sell or Share” link. You’re CCPA compliant — so how did a CIPA demand letter still land on your desk? The uncomfortable answer: CCPA compliance and CIPA compliance are two different things, and the gap between them is exactly where the 2026 wave of website lawsuits lives. Here’s the gap, in plain English, and how to close it.

How did a California wiretapping statute written in 1967 — decades before the web existed — become the engine behind thousands of website tracking lawsuits? This is the story of the California Invasion of Privacy Act: the two court rulings that opened the floodgates, the “pen register” theory driving today’s demand letters, and why, in 2026, your everyday analytics and ad pixels put your site in the crosshairs.