What is cipa (california invasion of privacy act)?

CIPA is a California statute, originally enacted in 1967, that prohibits recording or intercepting communications without the consent of all parties. Plaintiffs' firms have applied it since roughly 2022 to website tools like chat widgets, session-replay software, and tracking pixels, arguing that capturing a visitor's on-site activity without consent amounts to illegal wiretapping, with statutory damages of $5,000 per violation.

This area of law is changing. The description below reflects the position as of 2026-08-22. Check the sources before relying on it.

As of August 2026, California's Section 631 wiretapping theory — the basis for most website-tracking suits — remains fully available to individual plaintiffs. A narrower related theory, based on CIPA's 'pen register/trap and trace' provisions, was cut back by SB 690, which as amended in mid-2026 eliminates the private right of action for that specific theory and leaves enforcement to the state Attorney General; the wiretapping theory under Section 631 was left untouched. Other states, including Pennsylvania and Florida, have similar all-party-consent statutes generating comparable website-tracking suits.

Last reviewed 2026-08-22.