Website Privacy Lawsuits Under CIPA: Current State of the Law

If you operate a business website, there is a good chance it runs Google Analytics, Meta or TikTok pixels, a live chat widget, or some combination of tools your web developer installed years ago and nobody has looked at since. Over the past three years, that ordinary setup has become the basis for thousands of lawsuits, arbitration demands, and demand letters in California alleging the use of illegal “spyware.”

The statute behind them is the California Invasion of Privacy Act, or CIPA. It was enacted in 1967 to stop people from tapping telephone lines. Plaintiffs’ firms have spent the last few years arguing that it also covers cookies and tracking pixels. Some of the firms and plaintiffs pursuing these cases include Pacific Trial Attorneys, Tauler Smith LLP, Manning Law, Potter Handy LLP, and Vivek Shah.

Whether they are right has never been answered by a California appellate court. That may be about to change. This month the California Court of Appeal issued a tentative ruling in the first case squarely presenting the question, and the Legislature progressed a bill that could change the legal landscape for good.

The Statute and the Two Theories

CIPA is a criminal statute with a private right of action attached. Two of its provisions do nearly all the work in website litigation.

Penal Code § 631(a) — the wiretap theory. This prohibits reading or attempting to read the contents of a communication in transit without the consent of all parties. California is an all-party consent state, which is why the statute reaches further than its federal counterparts. Plaintiffs argue that what a visitor types into a search bar, a chat window, or a web form is protected “content,” and that a third-party script capturing it is an unlawful interception by that third party.

Penal Code § 638.51 — the pen register theory. This prohibits using a “pen register” or “trap and trace device” without a court order or the user’s consent. Historically, a pen register was a device that recorded the numbers dialed from a telephone line—the metadata of a call, not the conversation itself. The statute defines it as a device or process that records “dialing, routing, addressing, or signaling information.” Plaintiffs argue that an analytics tag or advertising pixel is the digital equivalent, because it captures the visitor’s IP address and device details.

The pen register theory is easier to plead, because the plaintiff does not need to allege that anyone read the contents of anything. It has become the growth engine. Senator Anna Caballero told the Assembly Privacy and Consumer Protection Committee on July 1, 2026, that filings under § 638.51 grew from roughly 600 when she introduced her reform bill to more than 4,000, many of them traced to four law firms using repeat plaintiffs.

Why the numbers get large. Under Penal Code § 637.2, a plaintiff recovers the greater of $5,000 per violation or three times actual damages, plus injunctive relief. No actual damages are required since there is the alternative statutory damage amount ($5,000 per violation). Plaintiffs typically argue that each visit, and sometimes each individual data transmission, is a separate violation. (Whether “per violation” really means that, rather than $5,000 per lawsuit, is itself contested; the phrase took effect January 1, 2017, and courts have not agreed on it.) The practical effect is that a demand letter can credibly threaten exposure far exceeding the cost of settling.

One more thing worth knowing early: CIPA exposure follows the California visitor, not the business. So if a consumer visits your site from California, it could form the basis for a lawsuit even if the business is based outside of California, and disclaiming California in a privacy policy or terms of service is not a defense.

The Case Law Is Not Just Unsettled—It Is Openly Contradictory

Ordinarily when I tell a client the law is unsettled, I mean there is a majority rule and some disagreement within the courts about particulars. But with CIPA, judges applying the same statute to the same technology have reached opposite conclusions, sometimes in the same courthouse, in the same month.

California state courts have trended against plaintiffs. A series of Los Angeles Superior Court judges concluded that the pen register provisions were never written for websites. In Rodriguez v. Ink America International Group (No. 25STCV15350, Dec. 10, 2025), the court threw out the § 638.51 claims without leave to amend, reasoning that the plaintiff’s reading would criminalize the very data collection the California Consumer Privacy Act expressly permits, and that a website operator can in any event qualify for the statute’s service-provider exception. Heiting v. Wildflower Brands (No. 25STCV18507, Apr. 2026) dismissed an entire CIPA complaint with prejudice, noting that the internet was already in widespread use when the Legislature enacted these provisions in 2015. Blaker v. NetScout Systems (No. 25STCV31283, May 27, 2026) did the same, pointing to the neighboring statute’s court-order procedure—which makes sense for a phone line and none at all for a website.

The trend was never uniform. In Balabbo v. Wildflower Brands, decided against the same defendant 10 days before Heiting, a different judge knocked out the CIPA counts but let a common law invasion of privacy claim proceed, because the complaint alleged capture of credit card and medical information. Other judges in the same building have allowed pen register claims to survive. Killing the CIPA count does not always end the case.

Federal courts have been more receptive—but not consistently. Much of the federal fight has been about Article III standing, the constitutional requirement that a plaintiff show a real injury rather than a bare statutory violation. In In re USA Today Co. Internet Tracking Litigation (N.D. Cal. Apr. 2026), a Northern District of California judge dismissed for lack of standing—with leave to amend—holding that under the Ninth Circuit’s decision in Popa v. Microsoft, IP address, device type, and browser type are not information whose disclosure would be highly offensive to a reasonable person. Three days later, on nearly indistinguishable facts, a Southern District of New York judge denied CNN’s motion to dismiss in D’Antonio v. Cable News Network, finding that the aggregation of tracking data into de-anonymized advertising profiles came close enough to the traditional privacy torts.

Outcomes diverge as sharply as reasoning. The Central District of California dismissed a prolific pro se plaintiff’s claim in Vivek Shah v. Talentbridge, Inc. (May 28, 2026) for lack of Article III standing, holding that typing generic search terms into a public website implicates no protectable privacy interest, and denying leave to amend as futile. Yet on June 26, 2026, the Northern District of California granted final approval to a $3.85 million class settlement in Mirmalek v. Los Angeles Times Communications LLC, built on the same pen register theory and targeting three trackers on the paper’s site and app (TripleLift, GumGum, and Audiencerate)—a settlement the class representative defended by arguing her own theory was novel and risky. An objector appealed in August 2026, and distribution of settlement payments is on hold pending that appeal.

The Ninth Circuit has been picking at the wiretap theory around the edges. In Thomas v. Papa John’s International (June 18, 2025), it affirmed dismissal because a party to a conversation cannot “eavesdrop” on its own conversation. Two days later, Mikulsky v. Bloomingdale’s revived a § 631(a) claim, holding that the plaintiff had adequately alleged that a session replay vendor captured the contents of her communications rather than mere record data. In Gutierrez v. Converse (July 9, 2025), it affirmed summary judgment for the retailer on the evidentiary record, with Judge Bybee writing separately to say the provision’s first clause does not apply to the internet at all. All three dispositions were unpublished, meaning they bind no one.

Why the split has persisted. Nearly every decision above is a trial court ruling or an unpublished appellate memorandum. California trial court rulings do not bind other California trial courts, and federal judges do not treat them as controlling statements of California law. With no published California appellate decision, each new judge has started from scratch—which is why outcomes have depended less on what your website does than on which courthouse the complaint landed in.

Variety Media: The Case That Could Fix That

Variety Media, LLC v. Superior Court (No. B350578) arises from a putative class action Sean Rose filed in Los Angeles Superior Court in January 2025 (No. 25STCV01865). He alleges that third-party trackers on Variety’s website collected his IP address and device information and transmitted it to third parties—including Microsoft—that used the data to identify visitors and build targeted advertising profiles. Variety filed a demurrer, the California equivalent of a motion to dismiss, arguing the pen register provisions reach only telephonic surveillance. The trial court disagreed and let the case proceed.

Variety then did something that rarely works: it asked the Court of Appeal to review that ruling immediately, rather than waiting for a final judgment, filing a petition for writ of mandate on November 21, 2025. In early January 2026, Division Three of the Second Appellate District issued an order to show cause and stayed all proceedings in the superior court—a strong signal it considered the question both unsettled and important enough to resolve now. Orders to show cause issue in fewer than two percent of writ proceedings.

What makes the case consequential is the range of open questions squarely before the court:

• Does § 638.51 reach internet communications at all, or only telephonic surveillance?
• Does the CCPA—California’s actual online privacy statute, with its own regulations and enforcement agency—displace CIPA for routine website data collection?
• Is simply loading a webpage a “communication” with “contents” in the statutory sense?
• Where is the line between a “pen register,” which captures destination information, and a “trap and trace device,” which captures source information?
• Does the federal Pen Register Act independently prohibit the same conduct, and should CIPA be read to avoid conflict with it?

Briefing drew broad amicus participation on both sides, with companies and organizations submitting their various opinions to the court.

The tentative ruling, issued ahead of oral argument, would grant Variety’s petition in part and send the case back with instructions to sustain the demurrer with leave to amend. Businesses should resist reading that as a clean win. The panel would reject Variety’s threshold arguments and hold that § 638.51 does reach internet communications, that the CCPA does not displace it, and that the rule of lenity does not require a telephone-specific construction—eliminating the precise reasoning behind the Rodriguez, Heiting, and Blaker dismissals above. Variety would still prevail, but on a much narrower ground: that a pen register captures only metadata identifying the destination of an outgoing communication, while a visitor’s IP address identifies its source. That leaves room to replead, including under CIPA’s separate trap and trace definition, which the tentative does not resolve.

Two caveats: a tentative ruling is not a decision, and the resulting opinion may or may not be published. Under the California Constitution, the court must decide within 90 days after submission, pointing to a final ruling by roughly late November.

SB 690: The Legislative Track

Senator Caballero introduced SB 690 on February 21, 2025, as a broad “commercial business purpose” exemption across CIPA, reaching the wiretapping, eavesdropping, and pen register and trap and trace provisions. It passed the Senate 35-0 on June 3, 2025, and then stalled in the Assembly, becoming what California calls a two-year bill. It came back this summer looking very different.

The July amendments dropped the exemption entirely. The bill now amends a single statute, Penal Code § 637.2, the civil remedies provision, as it applies to §§ 638.50 and 638.51, to state that an action against a private actor for a § 638.51 violation “alleged to arise from conduct occurring on an internet website, online application, or mobile application” may be brought only by the Attorney General. This would prevent private plaintiffs from bringing this specific type of claim via litigation. The limitation applies retroactively to any pending claim in an action commenced within two years before the bill’s operative date.

Three things to keep straight:

1. Sections 631 and 632 are untouched. The wiretap theory, which is harder to plead, but very much alive, survives completely. Committee members have floated further amendments aimed at § 631(a) claims before the August 31 deadline, but none has been adopted.
2. It is not yet law. The bill cleared Assembly Appropriations and was ordered to a third reading in the Assembly on August 21, 2026. It must clear the Assembly floor and Senate concurrence by August 31, then survive the Governor’s pen. If enacted without an urgency clause, it becomes operative January 1, 2027.
3. It removes the claim, not just the courthouse. Private plaintiffs could not sue or settle on a website pen register theory. Only the Attorney General could act.

Where This Leaves Businesses

For the first time in three years, there is real hope for a change in the law as to CIPA liability. Between a tentative ruling that undercuts the standard complaint and a bill with a two-year retroactivity clause, the legal landscape could look very different in 90 days.

What does not change is the compliance baseline: know every third-party tag running on your site, make sure nothing fires before consent is recorded, confirm that declining tracking actually stops it, and preserve your site’s configuration as of the date of any alleged visit. Note that the tentative ruling’s rejection of the CCPA-displacement argument means CCPA compliance alone will not answer a CIPA claim.

Lastly, do not ignore a filed lawsuit or demand letter against your business—and do not reflexively pay to settle. On July 20, 2026, the Central District of California declared one of the most prolific pro se CIPA claimants, Vivek Shah, a vexatious litigant, requiring him to obtain court permission before filing any new CIPA or related digital privacy case in that district. The order is narrow: it does not reach his pending cases, his demand letters, arbitration demands, or filings in state court or other districts.

This area of law is moving quickly; the status of the litigation and legislation described above is current as of August 27, 2026. Stay tuned for more.

For help with CIPA demand letters, website privacy compliance, or ADA website accessibility, contact Stuart K. Tubis, Esq at stubis@jeffer.com or 415-984-9622.