It’s been alleged by plaintiffs in digital wiretapping and tracking lawsuits that web technologies like chat widgets, tracking pixels, and session replay tools violate specific parts of the California Invasion of Privacy Act (CIPA).
- Penal Code Section 631(a): Wiretapping/Interception
- 632: Eavesdropping/Recording
- 638.51: Pen Registers and Trap/Trace Devices
Below is a quick summary of these and other important sections of the law.
What are the main requirements of CIPA?
CIPA is a wiretapping law that protects residents of the state of California. It’s main requirements include:
- Prohibits unauthorized wiretapping: In penal code section 631, this law makes it illegal to tap, make unauthorized connections to, or read/intercept telephone lines, telegraphs, or electronic/internet communications without consent.
- Requires all party consent: Outlined in penal code section 632, it requires you to get consent of all parties involved before recording, listening in on, or monitoring any confidential phone calls, conversations, or electronic communications.
- Protects cordless and cellular communications: Penal code section 632.7 explicitly forbids intentionally recording or intercepting communications involving cellular or cordless telephones without all-party consent.
- Requires court order for pen registers and trap-and-trace: In penal code section 638.51, the law explains that the use of devices or software that capture incoming or outdoing dialing, routing, addressing, or signaling info requires a court order or explicit user consent.
What modern digital tools is CIPA being applied to?
Recently, lawsuits have been filed by plaintiffs and courts referencing the following digital tools that transmit real-time user keystrokes and analytics to third-party vendors:
- Cookies
- Pixels
- Session replay software
- Live chat widgets
Who needs to follow the CIPA?
Technically, businesses and website owners across the nation must follow CIPA, regardless of the size of you or your company or where you’re located.
It applies broadly to all private individuals, businesses, employers, tech providers, and government entities interacting with or recording confidential communications involving individuals in California.
How can I align my website with CIPA requirements?
To align your website with CIPA requirements, you should request and obtain explicit consent from your website’s users before deploying any cookies, pixels, or trackers used for purposes like analytics or advertising.
If they do not opt into agreement for this tracking, respect and honor their choice and do not deploy any of those cookies or share their data with the third-party vendors.
Using consent management solutions like Termly’s can help you easily set up a cookie consent banner, scan your website for cookies and trackers and create a cookie policy, manage and log your user’s consent choices, and more.
Features like script auto blocking and regional consent settings, including specifically for California, make it seamless to meet obligations outlines by laws like the CIPA and the CCPA/CPRA.
Who enforces CIPA and what are the penalties?
Individuals have a private right of action for $5,000 per violation or three times the actual damage, whichever is higher.
Entities that violate this law could also face court-ordered attorney fees for plaintiffs, criminal misdemeanor or felony penalties, and fines of up to $10,000, depending on which section was violated.
Senate Bill 690, signed September 2026 and effective January 1, 2027, eliminates private-citizen lawsuits for website/app pen-register and trap-and-trace claims, and enforcement becomes the responsibility of the California Attorney General.
Traditional wiretapping and eavesdropping suits remain open.
Written by Amanda Lee, CIPP/US
Amanda is a Documentation Specialist and Certified Privacy Professional (US). She converts product documentation into easily understood product for Termly's customers. She also has strong understanding of US privacy laws and regulations, helping to keep customer policies up to date at a time when US states are enacting more and more privacy laws.
Read all posts by Amanda Lee, CIPP/US
FREE Cookie Consent Manager for Websites
