How Many CIPA Lawsuits Are Filed? The Counts, Compared (2026)

The short answer: nobody keeps an official count of CIPA lawsuits. We found no court system, regulator or legislature that publishes one, and every number in circulation counts something different.

The largest public tally we found is a law firm's. Fisher Phillips' Digital Wiretapping Litigation Map counts 5,846 privacy suits over tracking technology filed nationwide from February 5, 2022 to September 25, 2026, under CIPA and similar laws, 4,235 of them in California. For 2025 it counts 1,556 California suits. The firm publishes no method.

Our own search of federal court records found at least 1,247 matching dockets in California's four federal districts from 2022 to September 2026, 402 of them in 2025. Federal court is the smaller part: in Fisher Phillips' map, about four in five California suits are in state court, which our search cannot reach.

Why the counts disagree

Five differences explain most of the spread:

• Which courts. State court, federal court or both.
• Which laws. Some counts take CIPA only. Others add other states' wiretap-style laws, such as Florida's and Pennsylvania's.
• Which conduct. Website tracking only, or every CIPA claim, including recorded phone calls.
• Which unit. Lawsuits, claims, businesses sued or demand letters. Docket counts miss demand letters and private arbitrations. SB 690's sponsor told the Assembly committee "tens of thousands more have received demand letters"; we found no count of them.
• When it was read. Case trackers keep adding late-found cases to past months. Fisher Phillips published "over 1,560" in January 2025; its September 2026 data for the same cut-off reads 1,643.

The published counts, side by side

These are the counts we could trace to a dated publication.

Fisher Phillips' map is interactive; the year and court splits come from its own data, read on October 1, 2026, and can differ from its totals by a few cases. The sponsor's figures are in the Assembly Privacy Committee analysis, the State Bar's in its 2023 report. We left vendor blogs' counts out of the table.

How the numbers fit together:

• The big California figures agree once dates line up. The sponsor's 4,000 (July 2026), Fisher Phillips' "over 4,000" and Troutman's 3,291 (to March 2026) all fit the map's California curve: 3,302 by March 31, 3,891 by July 1, 4,235 by September 25.
• The sponsor's "about 600" for early 2025 is the outlier. The map had about 1,300 California suits by mid-January 2025. The two agree only if 600 means pen-register suits alone, as Akin Gump read it.
• The often-repeated 54 (2022), 289 (2023) and 675 (2024) line up with the map's California state-court counts (54, 289 and 669). With federal court added, its California totals are 112, 396 and 760.
• EcomBack's count of 206 California state-court suits for January to June 2026 is about a quarter of the map's 847 California state-court suits for those months.
• Nothing else we found comes near Stinson's 4,000 for 2024. The map has 907 nationwide.

Our count: California federal dockets, quarter by quarter

Free Law Project's RECAP Archive, searchable on CourtListener, holds federal court dockets, with the full text of documents that someone bought from PACER or a court posted free.

On October 1, 2026 we searched it for dockets in California's four federal districts whose text matches ("Invasion of Privacy Act" OR CIPA) AND (website OR pixel OR "session replay" OR chat OR "pen register" OR "trap and trace" OR cookies), counting each docket once by its federal filing date.

Two rulings came before the jumps. Dockets went from 8 in the second quarter of 2022 to 49 in the third, after the Ninth Circuit's Assurance IQ ruling of May 31, 2022, an unpublished memorandum: "Though written in terms of wiretapping, Section 631(a) applies to Internet communications." The 2025 rise followed the pen-register theory, and an early marker of it is the Kochava ruling (S.D. Cal., July 27, 2023). The court rejected the argument that software embedded in phone apps cannot be a "pen register" under section 638.51. It was ruling on a motion to dismiss, so it took the complaint's allegations as true.

How precise it is

A text match can pick up the wrong cases, so we read 100 of the 117 matching dockets for April to June 2025, at least one court document each:

• 87 were website or app tracking claims under CIPA (95% interval: 79% to 92%). 76 were about websites alone.
• 13 were not: 4 suits over AI on call-center calls, texts or chatbots, 1 smart-TV suit, 2 tracking suits with no CIPA count, and 6 cases where CIPA appears only in a brief or an order.
• The 100 dockets belong to 77 matters: 23 are extra dockets in five consolidated or refiled matters. 18 were removed from state court. Each docket is a separate filing, but they are not 100 separate disputes.

This checks one quarter, classified by one reader. Precision for earlier years is unmeasured.

How it compares with Fisher Phillips' federal count

For 2025 and 2026 the federal counts are close. For 2022 to 2024 ours runs 2 to 2.5 times higher, and we have not settled why: the map may cover early federal cases thinly, or our search may catch more non-tracking cases in those years.

Matched case by case for April 10 to June 30, 2025, our 85 tracking dockets and the map's 83 California federal cases had 57 in common. 28 were only on ours and 25 only on the map; the map's other case is on our list as a tracking suit with no CIPA count. Neither list is complete, and the map includes none of our non-tracking dockets. Some suits removed to federal court also appear in it under their state case number, so adding a state count to a federal count can count a suit twice.

What our count cannot see

• State court, where most California suits are filed: 3,328 of the map's 4,235.
• Federal cases with no matching text in the archive yet. For April to June 2025, a matching document appeared within 90 days for 79% of tracking dockets; the slowest took 464 days. The 43 for July to September 2026 is likely to rise. We do not project how far.

What the complaints cite, and what they name

We took one complaint for each tracking matter among the 100 dockets we read that had one in the archive: 58 in all, none hand-picked. It covers federal complaints from one quarter and leaves out state court, where most suits are filed. Of the 58, 49 are proposed class actions and 9 are individual suits, 8 of them each against one website operator, with section 638.51 as their only CIPA claim.

The Assembly committee wrote that section 631 has featured "to a lesser extent" than the pen-register statute, and that section 632 "has not been used in these cases nearly as often."

Counting a technology only when a complaint names it at least twice:

• 44 of 58 name at least one of Google, Meta or TikTok: a Google tag in 34 (Google Analytics in 27), the Meta Pixel in 24 and a TikTok tracker in 15.
• 19 name ad-exchange or identity scripts, such as The Trade Desk (12). Each of the 8 individual complaints alleges that one ad-tech or identity script works as a "trap and trace" device.
• LinkedIn's Insight Tag appears in 7, and Microsoft's Bing or Clarity tags in 5.
• Session replay and chat are nearly absent: a named session-replay vendor in 2 complaints, a chat widget in 1.

16 of the 58 allege a consent failure. Counted once each, 8 allege that tracking began before any banner or choice, 6 that a Reject, decline or opt-out choice was ignored, and 2 that there was no banner or no way to reject. These are allegations.

What SB 690 changes, and what it does not

Governor Newsom signed SB 690 on September 30, 2026 (Chapter 976, Statutes of 2026; bill history). It sets no date of its own, so under the California Constitution it takes effect January 1, 2027.

It amends one section, 637.2, CIPA's remedy. From January 1, 2027, an action against a private actor for a section 638.51 violation "alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General" (text). It does not change section 631 or 632, or the remedy for them: the greater of $5,000 per violation or three times actual damages.

The new subdivision (d)(2) reads: "The amendments to this section by Senate Bill No. 690 of the 2025-26 Regular Session apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation." The committee added a severability clause "in view of possible constitutional challenges to the retroactivity provisions." We do not estimate which pending suits it reaches.

Many 2025 articles describe an earlier, broader version that the Assembly narrowed in July 2026. The Governor's signing message says "additional work in this area is needed."

In our federal sample, 18 of 58 complaints cite section 638.51 as their only CIPA section, 13 cite it alongside another CIPA section, and 27 do not cite it. Fisher Phillips says that of over 4,000 CIPA website suits, about a third allege only a pen-register or trap-and-trace claim and about a third allege one plus another CIPA violation.

California filings in the map fell from 211 in June 2026 to 131 in August, but recent months fill in late, so we do not read that as an effect of the bill. Our CIPA guide covers the law itself.

How often our scanner sees the technologies the complaints name

Our free compliance scanner loads a website in a real browser and records its network requests. Two of our censuses report individual trackers under a strict standard: any request to the tracker observed before a consent choice counts, including Google Consent Mode "denied" pings without cookies. It applies no court's test.

The consent-tool census is 912 sites running one of four widely used consent tools, from our sales-lead lists (not a random sample), scanned July 19 to 20, 2026. The state census is 229 sites whose owners ran our free scanner, June 21 to July 14, 2026. Methods are in the per-consent-tool census and the state of cookie compliance study.

How to read these numbers:

• Every per-tracker figure in our studies comes from the scanner's EU test: a fresh browser in Frankfurt, Germany, visiting each site for the first time. Our scanner also loads each site from San Francisco, California, but none of our per-tracker figures comes from that US visit, so we have no US rate for any tracker. CIPA is a California law, so read these as how common the technologies are.
• The scanner cannot see data a website's own servers send to another company, such as events sent through Meta's Conversions API, and it does not count requests to the website's own domain, so tracking relayed through the site's own server is not in these figures.
• It records where each request went and when, not what the request contained or why it was made. It does not send a Global Privacy Control signal, so GPC honoring and US opt-out flows are not measured.

The complaints and the census describe different sites. None of this says that any site broke a law or could be sued. It says what a browser observed.

Check your own site