What California Consumers and Business Owners Should Know About Website Tracking, Recording, and CIPA

California's decades-old wiretapping law, CIPA, has been applied to website tracking tools like pixels and chat widgets. In our blog, we discuss what it protects and how pending legislation could change things in ways that business owners and consumers in the state should know.

Social Media Blurb:
CIPA started as a 1967 wiretapping law. It has recently been applied to website tracking. Here's what California consumers and business owners should know:

Blog:

A customer visits a website, looks at a couple of products, and by that evening the same items are following them around in ads on every other site they open. Or a customer types a question into a "chat with us" bubble on a company's website, then wonders afterward who else might have seen or recorded what they typed. Moments like these raise questions about consumer online privacy, and California laws dating back to 1967 designed to stop illegal telephone wiretapping could be the answer.

An Old Law Applied to New Technology

The California Invasion of Privacy Act (CIPA) became law in 1967. Its original purpose was to criminalize the wiretapping and eavesdropping of telephone calls. Nearly six decades later, California courts have started applying CIPA's core principle, protecting people's private communications from being intercepted without consent, to the tools websites and apps use to track and record what visitors do online.

Three parts of CIPA have become the basis for most privacy claims we see today:

1. Reading communications in transit: One provision prohibits a third party from reading or attempting to read the contents of a communication while it is being sent, without consent. Courts have found this applies to certain internet communications.
2. Recording confidential communications: Another provision addresses the recording of confidential communications without consent. Once limited to phone calls, this now extends to some online chat and voice systems.
3. Pen registers and trap-and-trace devices: A third provision restricts the use of devices that capture the routing, addressing, or signaling information of a communication, without capturing its content, without a court order. Software that quietly tracks a website visitor's device and browsing information can fall under this category.

Technology Behind These Claims

Modern privacy claims under CIPA usually center on a small number of common web technologies, including:

• Session replay software, which records a visitor's activity on a website much like a screen recording, capturing mouse movements, keystrokes, and information entered into online forms.
• Website chat widgets, which can transmit the contents of a live chat conversation to a third-party company for analysis, sometimes without a clear disclosure that this is happening.
• Tracking pixels and embedded code, which can log what a visitor views or types on a page and send details like their IP address, device information, and browsing activity to advertisers or other third parties.

Signs That Consumer Online Activity May Have Been Tracked Without Their Knowledge

Because tracking stemming from online shopping or searches usually happens behind the scenes, it can be hard for consumers to know when it happens.

Consumers should keep an eye out for situations or interactions that often reveal, lead to, or involve online activity tracking. For instance, a consumer may have:

• Used a website or app, then later saw their exact words or actions reflected back to them in targeted ads or emails from a company they never gave such information to directly;
• Used a live chat feature and shared sensitive information, like a medical or financial detail, without being shown a disclosure explaining who might see it;
• Filled out a form with personal information and later received calls, emails, or ads that seemed to reference details from that form; and
• Not been notified or made aware that a company's privacy policy was buried in small print or a footer link, rather than presented in a way that asked for their clear, affirmative consent.

What Does California Law Allow Regarding Online Tracking?

CIPA gives consumers a way to hold companies accountable when their private communications are intercepted or recorded without consent. The law allows for statutory damages of $5,000 per violation, along with other remedies like requiring a company to stop a challenged practice or delete data that was collected improperly. Because these damages apply per violation, cases involving many affected website visitors can carry significant consequences for a company found to have violated the law.

For an example of how this law can be applied, in a lawsuit against Adidas, a court found that the company's use of tracking pixels could qualify as an illegal pen register and rejected the company's argument that a footer link to its privacy policy amounted to valid consent. In a case against Prudential Financial, a court certified a class action after finding that the company's privacy notice would not have put a reasonable website visitor on notice that a third-party tool was recording their every keystroke while filling out an insurance quote form.

Concerns About Lawsuit Abuse and Senate Bill 690

At the same time, consumer privacy protections under CIPA have expanded, so have concerns about the law being used in ways its authors likely never intended. Businesses, including many small and mid-sized companies, have reported receiving demand letters and facing lawsuits over what have been considered as routine website tools.

In response, California lawmakers introduced Senate Bill 690 to narrow the scope of CIPA claims. The bill's path has been far from simple, though. An earlier version would have broadly shielded companies from CIPA lawsuits any time their data practices already complied with the California Consumer Privacy Act, but that language did not survive the legislative process. The version that passed the Legislature on August 28, 2026, takes a narrower approach, removing the ability of individual consumers to sue over the pen register and trap-and-trace provision of CIPA, while leaving provisions such as the wiretapping and eavesdropping provisions, in place.

Governor Newsom signed SB 690 on September 30, 2026. The new rules will take effect on January 1, 2027.

A Responsible Approach for Consumer Protection Attorneys

At Kershaw Talley Barlow, we believe California consumers deserve legal protection when their private information is collected and shared without their knowledge or consent. We also recognize that reasonable limits on abuses of any law serve the interests of a fair legal system. Protecting consumer privacy and preventing misuse of the legal process are not opposing goals, and we believe California can accomplish both.

For more information about this nuanced topic, check out the article that Attorney Ian Barlow recently wrote about this topic in more legal detail for The Litigator (Fall 2026 issue), a publication of the Capitol City Trial Lawyers Association: https://cctla.com/the-litigator/.

If you believe your personal information was collected, recorded, or shared through a website or app without your knowledge or proper consent, call us at (916) 520-6639 for a free consultation about what legal options might be available to you.