What is CIPA (California Invasion of Privacy Act)?

CIPA was written to stop telephone wiretapping and eavesdropping. Its key provisions are section 631 (wiretapping — intercepting the contents of a communication in transit), section 632 (eavesdropping on confidential communications), and sections 638.50-638.51 (installing a pen register or trap and trace device without a court order). California is an all-party consent state: everyone on the line must agree to the recording or interception.

What makes CIPA the center of a modern litigation wave is its remedy. Under Penal Code section 637.2, any person injured by a violation can bring a civil action for $5,000 per violation or three times actual damages, whichever is greater — and the statute says plaintiffs do not need to have suffered any actual damages at all. That combination of statutory damages and a private right of action makes CIPA claims cheap to file and expensive to defend.

Since roughly 2022, plaintiff firms have recast ordinary website technologies as CIPA violations: session replay software as wiretapping, live-chat vendors as third-party eavesdroppers, and analytics or advertising trackers as illegal pen registers or trap and trace devices. Most cases begin as pre-litigation demand letters seeking a quick settlement, sent in bulk to eCommerce brands whose sites fire trackers before the visitor consents.

The defense picture is unsettled. Some California courts have dismissed pen-register theories as a stretch of a telephone-era statute; others have allowed them past the pleading stage. Because outcomes vary by courtroom, the practical mitigation is technical: do not let third-party trackers capture visitor data before consent.