What is the California Invasion of Privacy Act (CIPA)?

CIPA is a broad 1967 California chapter (Penal Code Section 630 and following) covering wiretapping, eavesdropping, and other privacy invasions well beyond websites. Since 2022, plaintiffs have applied its wiretapping and eavesdropping sections to website chat tools, analytics, and ad pixels that share visitor activity with a third party before consent.

Is CIPA the same as the Children's Internet Protection Act?

No. The Children's Internet Protection Act is a federal law about web filtering in schools and libraries and has nothing to do with website tracking. The California Invasion of Privacy Act is the state wiretapping and eavesdropping chapter behind the current wave of website lawsuits; look for "California" or "Penal Code 631" to confirm which one you mean.

Does using a chat widget or ad pixel automatically violate CIPA?

No. Courts are split on whether a vendor that only receives data after it reaches your own server was intercepting it "in transit," a requirement of the main provision plaintiffs use (Section 631). At least one California federal court has ruled that server-side processing does not meet that requirement. The strongest claims involve a script sending visitor data straight to a third party in real time.

What are the penalties for a CIPA violation?

Penal Code Section 637.2 allows statutory damages of $5,000 per violation or three times actual damages, whichever is greater, recoverable by any person who sues. There is no regulator and no cure period, so a lawsuit can be filed without warning.

Does a cookie banner make my site CIPA compliant?

Gating chat, session-replay, and pixel tools behind opt-in, with reject that actually stops them, addresses the Section 631 in-transit theory for client-side scripts and reduces exposure. No vendor can promise CIPA compliance outright, since courts are still split on how far both the wiretapping and pen-register theories reach. ConsentStack's scanner shows what currently fires before consent so you can see and fix the gap.

Is a CIPA demand letter serious?

Serious enough to act on, though it is not a lawsuit. A CIPA demand letter is a pre-litigation notice, usually from a plaintiff's firm or a self-represented litigant, claiming that a chat widget, session-replay tool, analytics tag or ad pixel on your site intercepted a California visitor's activity without consent. Many are templates sent to thousands of sites off an automated scan, and the tight settlement deadline is the sender's, not a court's. What makes them serious is the statute behind them: section 637.2 allows $5,000 per violation or three times actual damages, no actual damages need be shown, there is no cure period, and the sender can file. The right first move is to preserve a record of what your site sends before consent and to talk to a lawyer, not to change your tags or pay.

Can I ignore a CIPA demand letter?

The letter itself has no legal force, so ignoring it does not create liability, but it does not make the claim go away either: the sender can file suit with no further notice, and the underlying exposure exists whether or not you answer. Most guidance for recipients lands in the same place. Do not pay by the deadline out of fear, do not go silent, and do not change your website before you have recorded what it currently does, because that record is your evidence. Then have counsel review the technical facts and respond. Whether a particular letter deserves a reply is a question for your lawyer, not for a web page.

What are CIPA violations?

On a website, three sections of the California Invasion of Privacy Act are alleged. Section 631 (wiretapping) is the strongest: the claim is that your site aided a third-party vendor in reading a visitor's communications while they were in transit, which is what a chat, analytics or session-replay script does when it sends activity to the vendor in real time. Section 632 (eavesdropping) requires a confidential communication, which courts have often found ordinary browsing is not. Section 638.51 (pen register) is the newest theory, aimed at pixels and SDKs that capture IP addresses or routing data, and it is the one SB 690, signed in September 2026, moves to the Attorney General from January 1, 2027, for claims arising from websites and apps. Each carries a private right to $5,000 per violation under section 637.2 and misdemeanor exposure. All three turn on the same fact: what a third party received before the visitor consented.

CIPA - California Wiretapping Law & Website Compliance

Back to Regulations Guide

Key Facts

Effective Date

January 1, 1967

Enacted

January 1, 1967

Enforcing Authority

No dedicated regulator. Enforced entirely through private civil lawsuits under the Penal Code Section 637.2 private right of action, with limited misdemeanor prosecution by California district attorneys.

Consent Model

Opt-in

Applies To

Any website using a chat widget, analytics tool, session-replay tool, or ad pixel that sends a California visitor's activity to a third-party vendor. Exposure depends on architecture (real-time client-side capture faces the strongest claims) more than on any specific tool category. No revenue or visitor-count threshold; a single visitor can bring a claim.

Does this apply to your site?

CIPA claims center on what a chat widget, session-replay tool, or ad pixel actually does before a visitor consents. Scan your site to see which of those tools fire first, free and instant.

Overview

The California Invasion of Privacy Act (CIPA) is not a website law. It is a roughly 30-section 1967 chapter of the Penal Code covering phone wiretapping, eavesdropping, cellular and cordless phone interception, disclosure of telephone messages, voice prints, cable TV monitoring, GPS tracking devices, and more. Since 2022, plaintiffs' firms have applied two of those sections, wiretapping and eavesdropping, to website chat tools, analytics, and ad pixels, arguing a vendor that receives visitor data "intercepts" it the way a phone tap intercepts a call. That extension is contested and only partly settled, but it has not slowed the lawsuits, and the volume of demand letters is now among the largest sources of US privacy litigation.

What This Means for Your Website

The strongest claims are under Penal Code Section 631 (wiretapping), on an aiding-and-abetting theory: a site cannot wiretap its own traffic, but is alleged to have helped a third-party vendor (chat, analytics, session-replay, ad pixels) intercept it
Architecture matters more than tool category. Courts are actively split on whether data captured "in transit," meaning a script sends it to a third party in real time before your server sees it, differs from data a vendor only receives after it reaches your own server. At least one California federal court granted summary judgment for a defendant on exactly this basis
A second, weaker claim runs through Section 632 (eavesdropping), which requires a "confidential communication." Courts have generally found ordinary web browsing is not confidential, so these claims are dismissed more often than Section 631 claims
A newer, contested theory applies the pen-register statute (Section 638.51) to pixels and SDKs that capture IP addresses or routing data; courts disagree on whether this reaches ordinary web telemetry at all
There is no size cutoff. A solo-operator site with one visitor from California faces the same exposure as an enterprise

Key Requirements

CIPA has no dedicated regulator and no notice-and-cure period. Penal Code Section 637.2 lets any person sue directly for statutory damages of $5,000 per violation or three times actual damages, whichever is greater, and misdemeanor exposure also attaches to Sections 631 and 632. The Ninth Circuit has recently split on how far the theory reaches: it affirmed dismissal in Thomas v. Papa John's (June 2025) where the plaintiff did not adequately allege the site aided a vendor's interception, but reversed dismissal in Mikulsky v. Bloomingdale's (June 2025) where it did. Because enforcement runs through private lawsuits instead of an agency, a single visitor complaint can become a filed case with no warning first.

How ConsentStack Handles This

By default ConsentStack treats California visitors under the CCPA's opt-out model: trackers can load until a visitor opts out, and on the current install snippet an opt-out (Reject in the banner, or a Global Privacy Control signal) actually stops them rather than just hiding the banner. A CIPA claim asks a different question, whether a third party received a visitor's activity before any choice was made, and the opt-out model does not hold trackers back before a choice. Run a free scan at ConsentStack to see which of these tools your site fires before a choice is made.

SB 690 and the demand-letter wave

Senate Bill 690 is the Legislature's answer to the wave of website claims. It became law on September 30, 2026, and it is far narrower than the bill introduced: it amends section 637.2 only, and it leaves the wiretapping and eavesdropping claims in sections 631 and 632 exactly as they are. Dates below are from the bill's official history.

February 21, 2025 · Introduced
SB 690 is introduced in the Senate as a broad exemption for ordinary commercial website tracking from CIPA's private lawsuits.
June 3, 2025 · Passes the Senate
The Senate passes the bill 35 to 0 and sends it to the Assembly.
July 2, 2026 · Amended in the Assembly
The bill is amended on the Assembly floor. The text that goes on to pass amends section 637.2 alone: a private lawsuit for a pen register or trap and trace violation under section 638.51 arising from a website, online application or mobile application may be brought only by the Attorney General. Sections 631 and 632 are not touched.
August 28, 2026 · Passes the Assembly, Senate concurs
The Assembly passes the amended bill and the Senate concurs in the amendments 39 to 0 the same day.
September 4, 2026 · Presented to the Governor
The enrolled bill is presented to the Governor at 2 p.m. Its retroactivity clause reaches pending section 638.51 claims in actions filed within two years before the law takes effect.
September 30, 2026 · Signed into law
Governor Newsom approves the bill, and the Secretary of State chapters it the same day as Chapter 976, Statutes of 2026.
January 1, 2027 · Takes effect
The amendment takes effect on January 1, 2027, like any statute enacted at a regular session without an urgency clause. From that date a section 638.51 claim arising from a website or app can be brought only by the Attorney General; the section 631 and 632 theories, which carry most demand letters, keep their private right of action, so the question of what your site sent before consent does not go away.

CIPA vs CCPA and CPRA

Most sites treat California as one opt-out jurisdiction because the CCPA, as amended by the CPRA, is the law they built their banner for. A CIPA letter arrives under a different statute with different rules: it is a criminal wiretapping chapter with a private right to sue, and none of the CCPA's thresholds, cure periods or opt-out mechanics apply to it.

Requirement	CIPA	CCPA as amended by the CPRA
What the law is	A 1967 chapter of the Penal Code (sections 630 to 638.55) on wiretapping, eavesdropping and pen registers. Nothing in it mentions websites; since 2022 plaintiffs have applied it to chat widgets, session replay, analytics and ad pixels.	A consumer privacy statute (Civil Code section 1798.100 and following) passed in 2018, amended by voters in 2020 and in force in its current form since January 1, 2023. Written for online data collection.
Who can sue you	Any person injured by a violation (section 637.2). The plaintiff does not need to show actual damages (section 637.2(c)).	Consumers only over a data breach of unencrypted, unredacted information (section 1798.150), for $100 to $750 per consumer per incident, after a 30-day cure notice. There is no private lawsuit over tracking or cookies.
Who enforces it	No agency. Enforcement is private lawsuits and the demand letters that precede them; district attorneys can also prosecute the misdemeanor.	The California Privacy Protection Agency, through administrative actions, and the Attorney General.
Does it apply to a small site	Yes. There is no revenue, visitor or headcount threshold. One visitor from California is enough.	Only to businesses over one of three thresholds: more than $25 million in annual revenue (as printed in section 1798.140, adjusted for inflation by the agency), 100,000 or more consumers or households a year, or half of revenue from selling or sharing personal information.
Consent rule for trackers	The claims turn on interception or recording without the consent of all parties. The defensible position is opt-in: no third-party tool receives a California visitor's activity until that visitor has agreed.	Opt-out. Selling or sharing for cross-context behavioral advertising may run until the visitor objects, through a Do Not Sell or Share My Personal Information link or an opt-out preference signal such as Global Privacy Control (section 1798.135).
What it costs	$5,000 per violation or three times actual damages, whichever is greater, plus an injunction (section 637.2). Letters multiply the figure by visitors.	Administrative penalties up to $2,500 per violation, or $7,500 for an intentional violation or one involving a consumer known to be under 16 (section 1798.155). Breach damages of $100 to $750 per consumer per incident.
Cure period	None. A lawsuit can be filed without any notice; the demand letter's deadline is the sender's, not the court's.	None for agency enforcement since 2023. The private breach claim still requires 30 days' written notice and a chance to cure (section 1798.150).
Criminal exposure	Yes. Sections 631, 632 and 638.51 are misdemeanors carrying a fine of up to $2,500 (up to $10,000 for a repeat section 631 offense) and up to a year in county jail.	None.
What a demand letter cites	Section 631 (aiding a vendor's wiretap), section 632 (eavesdropping on a confidential communication) and section 638.51 (an unauthorized pen register). From January 1, 2027, under SB 690, the last of these can be brought only by the Attorney General when it arises from a website or app.	Rarely anything. The statute gives consumers no claim over tracking, so letters lean on CIPA even when the site is CCPA-compliant.
What removes the exposure	Holding chat, session replay, analytics and ad tools until a California visitor consents, and making Reject actually stop them. Then a dated record showing that is what your site does.	A working opt-out link, honoring Global Privacy Control, and a privacy policy that discloses what is collected and shared.

Statute text read on October 2, 2026 from leginfo.legislature.ca.gov. CIPA figures come from Penal Code sections 631, 632, 637.2 and 638.51; CCPA figures from Civil Code sections 1798.135, 1798.140, 1798.150 and 1798.155. This page is a compliance explainer, not legal advice.

Penalties

$5,000 per violation or three times actual damages, whichever is greater (Penal Code 637.2); Sections 631 and 632 violations can also carry misdemeanor criminal exposure.

Maximum Fine

$5,000 per violation

Key Requirements

Section 631 (wiretapping, the strongest theory): a site is alleged to have aided a third-party vendor in intercepting visitor data "in transit"
Architecture matters: courts are split on whether server-side data processing counts as "in transit" the way a real-time client-side script does
Section 632 (eavesdropping) is weaker: it requires a "confidential communication," and courts often find ordinary web browsing is not one
No revenue or visitor-count threshold; private right of action lets any visitor sue directly with no regulator or cure period first
Statutory damages of $5,000 per violation or three times actual damages, whichever is greater (Penal Code 637.2)

Notable Provisions

CIPA is a roughly 30-section chapter (Penal Code 630-638.55) covering phone wiretapping, eavesdropping, cellular interception, voice prints, cable TV monitoring, GPS tracking, and pen registers, not a website-specific law
Section 631 (wiretapping) carries the strongest website claims via an aiding-and-abetting theory against the site; Section 632 (eavesdropping) is weaker since it requires a "confidential communication"
A newer, contested theory applies the pen-register statute (Section 638.51) to pixels and SDKs that capture IP addresses or routing data; courts are inconsistent
Ninth Circuit split in June 2025: dismissal affirmed in *Thomas v. Papa John's*, dismissal reversed in *Mikulsky v. Bloomingdale's*, both turning on whether the site adequately aided a vendor's interception