CIPA Explained: The Law Behind the Lawsuits

What the California Invasion of Privacy Act actually is

The California Invasion of Privacy Act (CIPA) is a state wiretapping statute, codified at California Penal Code §§630–638. When California lawmakers passed it in 1967, they were worried about a specific, physical threat: hidden microphones, telephone wiretaps, and tape recorders being used to secretly capture private conversations. The law makes it a crime to intercept, record, or eavesdrop on a "confidential communication" without the consent of all parties — California is an "all-party consent" state.

For a full breakdown of the statute's sections and how they map to website technology, see our complete CIPA regulation guide. This article tells a different story: not what the law says, but how it became a litigation phenomenon — and why that matters for anyone running a website today.

Fifty-five quiet years — then everything changed

Here's the surprising part: for most of its life, CIPA was a sleepy statute. From 1967 through roughly 2022, the cases it generated were mostly mundane disputes about recording phone calls without permission. It had almost nothing to do with the internet, and website operators had never heard of it.

What woke it up wasn't a new law. It was a pair of court rulings that reinterpreted this decades-old language to reach modern web-tracking technology — and a plaintiffs' bar that realised a 1967 statute contained something extraordinarily valuable: a private right of action with fixed statutory damages, meaning any individual can sue directly, without waiting for a regulator and without proving they lost a dollar.

The two rulings that opened the floodgates

If you understand two cases, you understand why CIPA lawsuits exist. Almost every demand letter sent to a website in 2026 traces back to one or both of them.

1. Javier v. Assurance IQ (2022) — consent has to come first

In May 2022, the Ninth Circuit Court of Appeals decided Javier v. Assurance IQ. The ruling's key holding sounds simple but was seismic: under CIPA §631, consent must be obtained before tracking begins, not after. A privacy policy that a visitor "agrees" to after their data has already been captured doesn't count as valid consent. Practically every modern CIPA demand letter now cites Javier in its opening lines, because it turns a timing detail — when your trackers fire relative to the consent banner — into the whole ballgame.

2. Greenley v. Kochava (2023) — trackers as "pen registers"

The more aggressive theory arrived in July 2023, when a federal judge in the Southern District of California decided Greenley v. Kochava. The court held that software which identifies consumers through "unique fingerprinting" and correlates their data can plausibly qualify as a "pen register" under CIPA §638.51. That's the precedent the plaintiffs' bar cites most aggressively today when targeting analytics, ad tech, and identity-resolution vendors — because it reframes an ordinary tracking pixel as an illegal surveillance device.

The pen-register theory, in plain English

The phrase "pen register" trips people up, so here's the plain version. Historically, a pen register was a device law enforcement used to record the phone numbers someone dialled — the routing information about a call, not the words spoken in it. CIPA §638.51 makes it illegal to install or use one without a court order.

Plaintiffs' lawyers took that concept and mapped it onto the web. Their argument: when a tracking pixel or beacon captures a visitor's IP address, device identifiers, URL parameters, or search queries, it's doing the internet equivalent of recording "routing and addressing information" — so it's a digital pen register, used without the court order the statute requires. The latest wave of claims focuses specifically on search queries: when you type into a site's search box and that term gets shared with a third party via a pixel, plaintiffs argue that's an unlawful interception.

This is the theory behind most 2026 filings. It's powerful precisely because it doesn't require the plaintiff to show a data breach, identity theft, or any financial loss — only that the tracker captured the data.

Where the fight stands in 2026: courts deeply divided

Here's the honest, current picture — and it's the part generic explainers get wrong by pretending the law is settled. It isn't. Courts are producing conflicting decisions on nearly identical facts, sometimes within days of each other.

On the plaintiff-friendly side: in Camplisson v. Adidas (Nov 2025), a federal court noted that "most cases in this and other districts have also recognised that website-based trackers can plausibly constitute a pen register." In D'Antonio v. CNN (April 2026), a New York federal judge refused to limit CIPA to telephone systems, ruling it can reach technologies that didn't exist when it was enacted.

On the defense-friendly side: in Heiting v. Wildflower Brands (2026), a Los Angeles judge dismissed a case with prejudice, holding CIPA's pen-register provisions were designed "exclusively for telephone surveillance, not commercial websites." Courts in the USA Today and Rounds matters reached similar defense-side conclusions. And the Ninth Circuit's Popa v. Microsoft (2025) gave defendants a standing argument: generic metadata alone may not be a concrete enough injury to sue over.

We track every publicly known ruling as it lands in our CIPA Lawsuit Tracker, and break down the most important decisions each month in CIPA Case Watch.

Why your website is a target — even if you're small

A common misconception is that this is a big-company problem. It isn't. The litigation model is built for volume: a small number of plaintiff firms (and prolific serial claimants) use the same automated scanning tools to crawl thousands of sites, detect common trackers, and fire off template demand letters. One serial claimant alone reportedly sent enough demand packets in 2026 to file 21 lawsuits from a single batch.

What draws their scanner to you is mundane: the everyday tools most sites install without a second thought. The usual triggers are the Meta Pixel, Google Analytics, Google Ads, TikTok pixel, session-replay tools (Hotjar, FullStory, Clarity), and chat widgets — anything that loads a third party and sends it visitor data. If those fire before a visitor consents, you match the exact pattern the Javier and Greenley precedents were built to attack.

And because most CIPA matters are resolved privately — through demand letters, arbitration, or confidential settlement — the publicly filed lawsuits are just the visible tip. Estimates put total claims since 2022 in the range of 50,000 to 100,000+. Your site doesn't need to be famous to get scanned.

How to protect your site: prevention beats defense

The reassuring news is that the fix is largely technical, not legal — and it directly neutralises the theory behind the lawsuits. Because Javier made timing the vulnerability, the single most protective step is to ensure non-essential third-party trackers do not fire until a visitor has affirmatively consented. If nothing loads before consent, the core "captured my data without permission" allegation loses its footing.

Concretely, a defensible posture looks like this:

• Block first, fire later. No analytics, ad pixel, session-replay, or chat tool runs on page load — everything waits behind the consent choice.
• Make "Reject" real. A banner that displays a reject option but keeps tracking anyway is worse than none — it becomes evidence you knew and ignored the choice.
• Disclose the trackers clearly, so a visitor knows what's running before they consent.
• Keep an auditable consent record — timestamped proof of what fired, what was blocked, and when. That log is your best answer to a demand letter.

This is exactly the posture ConsentPixel is built around: a single pixel that blocks third-party trackers until a visitor opts in, and logs every consent decision — so your compliance doesn't depend on how a given court happens to rule. The first step is simply knowing what runs on your pages today.