What CIPA means for your website in 2026
Guest Contributor
Matthew Pearson,
Partner, Womble Bond Dickinson LLP
Matthew is one of the country’s leading CIPA and privacy class-action litigators, working closely with companies to proactively protect them against the next privacy-litigation trends.
Check out his LinkedIn to learn more.
A 1967 wiretapping statute. $5,000 per violation. Statutory damages that don't require proving actual harm. And a California legislative framework that one federal judge recently described as impossible to apply to the internet.
That's CIPA. If you're running tracking technologies on your website, understanding this law has become operationally essential.
What CIPA Actually Regulates
CIPA covers three distinct categories of activity, each under different code sections.
Section 631 addresses wiretapping and focuses on how information is collected, specifically when a third party intercepts content as it's transmitted.
Section 632 covers confidential communications and unlawful recording.
Section 638.51 deals with pen register and trap and trace devices.
The pen register provision has become a significant focus of current litigation.
The argument: an IP address is basically a phone number, so if there's a third party on the website collecting incoming IP addresses, it operates as a pen register trap and trace device. Many courts have agreed with this interpretation, which is why the volume of CIPA demand letters has increased.
If you've ever called a customer service line and heard "this call may be monitored or recorded for quality assurance purposes," that's CIPA compliance for telephone communications. The challenge is that applying that same framework to website tracking creates significant conceptual problems that courts are still working through.
Why the Lawsuit Volume Has Increased
The math is straightforward. CIPA provides $5,000 in statutory damages per violation. Plaintiffs don't need to prove they were actually harmed, just that the statute was violated.
Run the calculation: 100 California visitors per day, multiplied by $5,000, multiplied by however many tracking technologies are firing, multiplied by 365 days. Those numbers add up real quick.
A modest traffic website can generate theoretical exposure in the millions.
Plaintiff's counsel have recognized this dynamic. The technology exists to scan websites, identify tracking technologies, and generate demand letters at scale. The arbitration provisions that companies included to protect themselves have become leverage points in the other direction. Filing fees for arbitration make it cheaper for companies to settle than to actually arbitrate low-value claims.
The CCPA created an interesting acceleration effect. Organizations invested in privacy compliance infrastructure. Privacy policies became more detailed. But CCPA is an opt-out regime while CIPA requires prior consent. A company can be fully CCPA compliant and still face significant CIPA exposure.
The Information Being Collected
The claims have evolved. Early CIPA litigation focused on IP address collection, which defendants could often defeat. Current claims aggregate multiple data points: screen height, screen width, browser version, operating system, referring URL, current page URL. Individually, these are benign metadata. Collectively, plaintiff's counsel argue they enable identification of individuals.
Session replay technology faces particular scrutiny because it visually resembles surveillance. If opposing counsel can demonstrate to a judge what session replay looks like, showing a near-real-time recreation of user behavior, the wiretap framing becomes more persuasive than abstract discussions of cookie identifiers.
Chatbots triggered similar litigation earlier. The "chat may be monitored or recorded" disclosure has become standard practice. Now the AI dimension adds complexity. If an AI system is processing conversation content for training or analysis, does that AI constitute a third party? The answer depends on what the AI does with the information and whether it uses data for purposes beyond the immediate conversation.
Mitigation Strategies That Actually Work
Complete elimination of tracking technology removes CIPA risk entirely. This is a non-starter for most organizations. The marketing value of analytics and targeting outweighs the litigation exposure.
GDPR-style affirmative opt-in would provide defensible consent. The marketing impact is substantial: data collection drops to 10 to 40 percent of current rates. Few organizations find this acceptable.
What remains is risk reduction. Don't be the slowest gazelle in the pack.
Protect yourself:
1. Transparent disclosures
Be painfully transparent about what technologies are running and what data they collect. "We use cookies to enhance your experience" won't work; you need to tell users what's actually going on.
2. Terms of use enforcement
Ensure your terms are enforceable against users and bolster provisions for additional protection. Differentiate between visitors and customers in how you structure terms.
3. Visitor vs. customer differentiation
Exclude visitors from arbitration provisions since they're most likely to sue. Visitors who pop on your website and do nothing are most likely to take advantage of arbitration provisions; customers who engage with you are not.
4. Server-side tracking
Going server-to-server largely removes the CIPA risk because CIPA focuses on how information is collected. However, you must remove client-side tags entirely; otherwise you still have the issue.
5. Asynchronous tracking
Put more time between transmission to your website and transmission to third parties. CIPA focuses on simultaneous transmission, so adding delay can help.
The visitor vs. customer distinction deserves particular attention. Someone who pops on your website and does literally nothing, scrolls around and leaves, is a visitor. A customer is anybody who engages with you, signs up for a newsletter, creates an account, makes a purchase. The visitors are the ones most likely to sue you. Your customers are not. So differentiate between those two so you can tailor your terms to the group in which they fall.
If your arbitration provision only applies to customers, you are far less likely to get those demand letters, because the people going on your website and sending you demand letters aren't interested in your business. They're interested in the fact that you have an arbitration provision and you're running tracking technology. Cut them out. Get rid of that leverage they have over you.
The Legislative Outlook
Senate Bill 690 attempted to create a CCPA safe harbor for CIPA. The logic: if you comply with CCPA, you're not exposed to CIPA penalties or anything like that. The bill got through the Senate but got hung up in the Assembly.
Judge Chhabria's opinion out of the Northern District gave the effort some motivation and made the pitch to the California legislature a little bit easier. He did call it a mess, and tell them that it was imperative that they revisit this. Whether reform comes through SB 690 or different legislation, the current framework is increasingly recognized as unworkable.
Until reform arrives, organizations face uncertainty. The risk profile isn't binary. The question is how to position your organization on the defensibility spectrum while maintaining necessary business functionality.
Need to evaluate your CIPA exposure? Our team at FLLR Consulting can assess your tracking technology landscape and recommend practical mitigation strategies.
Reach out to us today for a quick discussion to learn more.