California’s CIPA Problem: How a 1967 Wiretap Law Became a Website-Tracking Litigation Machine—and What SB 690 Would Change

California enacted the California Invasion of Privacy Act (CIPA) in 1967 to address technologies that made it possible to secretly intercept and record private communications. Nearly sixty years later, that wiretap statute has become one of the most important sources of website privacy litigation in California.

Plaintiffs have argued that technologies now routinely embedded in websites—including session-replay software, chat tools, pixels, cookies, analytics technologies, and device-fingerprinting tools—can violate CIPA when they collect or transmit information without sufficient consent.

The stakes are unusually high because CIPA provides a private right of action allowing statutory damages of $5,000 per violation without requiring proof of actual damages. When alleged violations occur automatically across thousands of website visits, the potential exposure can become enormous.

California lawmakers are now attempting to narrow one important part of that litigation. SB 690, passed by the Legislature on August 28, 2026, would eliminate private claims under CIPA’s pen-register and trap-and-trace provision when the alleged conduct occurs on a website, online application, or mobile application. It would also apply retroactively to certain pending cases. But it would leave CIPA’s important Section 631 wiretapping provision intact.

As of September 2, 2026, the bill has been enrolled and awaits action by Governor Gavin Newsom.

What Is CIPA?

CIPA is codified principally at California Penal Code Sections 630 through 638. Although originally directed at telephone surveillance and secret recording, the statute has been amended over time to address new communications technologies.

Three parts are particularly relevant to modern privacy litigation:

• Section 631 — Wiretapping. Prohibits specified forms of unauthorized interception or reading of communications and can also reach those who aid or conspire in the interception. Website plaintiffs have relied on this provision when third-party technologies allegedly receive communications between a visitor and a website.
• Section 632 — Confidential communications. Prohibits using an electronic device to eavesdrop upon or record a confidential communication without the consent of all parties.
• Section 635 — Eavesdropping devices. Prohibits manufacturing, selling, possessing, furnishing, or otherwise dealing in a device “primarily or exclusively designed or intended for eavesdropping” on another’s communications. Although written with traditional surveillance equipment in mind, plaintiffs have begun invoking Section 635 against providers of website-tracking technologies alleged to function as eavesdropping devices.
• Sections 638.50–638.51 — Pen registers and trap-and-trace devices. Regulate technologies that capture dialing, routing, addressing, or signaling information rather than communication content. These provisions have generated the newest wave of website-tracking claims.

The litigation incentive comes from Section 637.2, which permits civil plaintiffs to seek the greater of $5,000 per violation or three times actual damages. Actual damages are not required.

How CIPA Became a Website-Tracking Law

Modern websites communicate with numerous third-party technologies as users browse, click, type, or interact with a page. Depending on their configuration, these tools can receive IP addresses, URLs, browser and device information, clicks, keystrokes, chat communications, or other information.

Plaintiffs have used CIPA to challenge those practices primarily through two theories.

Third-Party Wiretapping

Under Section 631, plaintiffs argue that a website permits a third-party vendor to intercept communications between the visitor and the site.

The theory has been applied to session-replay tools, which can reconstruct user interactions with a webpage, and chat technologies, where an outside provider processes communications between the visitor and the website.

A recurring question is whether the vendor is actually an eavesdropping third party or merely a tool used by one of the parties to the communication.

Website Trackers as Pen Registers

More recently, plaintiffs have argued that website technologies collecting IP addresses, device identifiers, and similar information qualify as pen registers because they obtain “dialing, routing, addressing, or signaling information” associated with electronic communications.

That theory received important support from Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024 (S.D. Cal. 2023). The court allowed a Section 638.51 claim to survive dismissal where software allegedly identified consumers, collected information, and correlated that information through digital fingerprinting.

But Greenley did not resolve whether ordinary website analytics technologies are pen registers, and subsequent courts have disagreed.

Why the Courts Have Struggled

Two Los Angeles Superior Court cases illustrate the uncertainty.

• In Licea v. Hickory Farms, the court sustained a demurrer, distinguishing Greenley and concluding that the allegations did not sufficiently establish use of a pen register. The court also expressed concern that an expansive interpretation could effectively turn ordinary websites into CIPA violators.
• In Levings v. Choice Hotels, by contrast, the court permitted a similar claim to proceed where software allegedly recorded information transmitted by the plaintiff’s device and then installed tracking code. The court also rejected the proposition that simply visiting a website necessarily constituted consent to the collection.

The disagreement reflects a fundamental problem: concepts developed for twentieth-century telephone surveillance do not map neatly onto internet architecture. Courts have had to decide whether software is a statutory “device,” whether IP addresses constitute addressing information, and whether ordinary interactions with a website amount to consent.

• The issue has also reached the appellate courts. As of July 2026, Variety Media LLC v. Superior Court was pending before California’s Second District Court of Appeal and presented the question whether CIPA’s trap-and-trace provisions apply to website software.

Why CIPA Litigation Exploded

The growth of CIPA litigation also reflects the structure of California privacy law.

The California Consumer Privacy Act (CCPA) provides broad privacy rights but does not give consumers a general private right of action for ordinary violations. Its damages remedy is principally limited to specified data-security breaches.

CIPA, by contrast, combines a private right of action with substantial statutory damages. Plaintiffs therefore began using the older wiretap statute to pursue alleged website privacy violations that consumers generally could not sue over directly under the CCPA.

The result has been a wave of demand letters, arbitration threats, and class actions against businesses using common website technologies. The ABA reported this trend as early as 2024, noting that both large and small businesses were receiving CIPA demands.

That litigation has produced a policy divide. Business groups argue that uncertain legal theories combined with $5,000 statutory damages make settlement economically attractive even for questionable claims. Privacy advocates respond that private litigation fills an enforcement gap and creates incentives to limit undisclosed tracking. That disagreement has shaped the debate over SB 690.

What SB 690 Would Change

SB 690 was introduced in 2025 in response to this litigation wave. Earlier versions would have gone much further, generally seeking to harmonize CIPA with the CCPA by protecting certain processing undertaken for a “commercial business purpose.” The proposal stalled amid concerns that the exemption would weaken consumer privacy protections.

The version passed by the Legislature in 2026 takes a narrower approach.

Instead of deciding whether ordinary website tracking violates Section 638.51, SB 690 changes who can sue.

The enrolled bill provides:

“An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”

In practical terms, private plaintiffs would no longer be able to seek CIPA’s $5,000 statutory damages for website- or app-based pen-register claims under Section 638.51. The Attorney General could still enforce the provision.

That distinction is important. SB 690 does not declare the underlying tracking lawful. It removes the private damages action for this particular category of CIPA claims.

What About Pending Cases?

SB 690 could have an immediate effect on existing litigation because the bill expressly applies its amendment retroactively “to any pending claim in an action commenced within two years before the operative date.”

If enacted, defendants facing qualifying Section 638.51 claims within that window would therefore have a strong basis to seek dismissal on the ground that the private plaintiff can no longer maintain the claim.

That could substantially reduce both the viability and settlement value of pending cases built principally around the pen-register theory.

The precise application of the retroactivity provision to individual pending cases may itself generate litigation.

What SB 690 Would Not Change

SB 690 would not end CIPA website litigation.

Most importantly, it does not amend Section 631. Plaintiffs can therefore continue bringing wiretapping claims involving technologies alleged to intercept communications, including pixels, session-replay tools, chat technologies, and other third-party integrations.

Nor does the bill affect obligations arising under the CCPA or other federal and state privacy laws. Businesses will still need to understand what tracking technologies collect, when they activate, where information goes, and whether disclosures and consent mechanisms accurately reflect those practices.

Practice Point: If SB 690 becomes law, businesses should distinguish between Section 638.51 pen-register exposure, which the legislation would substantially reduce, and Section 631 interception exposure, which remains. That means the appropriate response is not simply to turn trackers back on. Businesses should continue auditing website technologies, verifying consent-management configurations, understanding third-party data flows, and ensuring that privacy disclosures match actual practices.

The Bigger Picture

CIPA illustrates a recurring problem in technology law: statutes written for one generation of technology can contain language broad enough to reach another.

That flexibility can preserve privacy protections as technology changes. But it can also create substantial uncertainty when concepts developed for telephone surveillance are applied to the ordinary technical exchanges underlying modern websites.

SB 690 represents a relatively targeted legislative response. It does not decide that website tracking is categorically lawful and does not dismantle CIPA. Instead, it would remove private enforcement of Section 638.51 for website and app conduct while leaving Section 631 and California’s broader privacy regime intact.

If signed, the bill could eliminate a significant category of pending and future pen-register litigation. But the broader fight over website tracking will continue—under Section 631, the CCPA, and other privacy laws.

SB 690 will not end the CIPA litigation era, but it will substantially narrow one of its most aggressive chapters.

Sources and Additional Resources

• California Legislature, Senate Bill 690 (2025–2026 Regular Session), enrolled August 31, 2026. Primary source for the legislation, including the limitation on private Section 638.51 actions and its retroactivity provision. Read the bill.
• California Penal Code §§ 630–638.55, Chapter 1.5, Invasion of Privacy (California Invasion of Privacy Act). The statute declares California’s policy of protecting privacy against technological eavesdropping and includes the provisions central to modern website-tracking litigation: Section 631 (wiretapping), Section 637.2 (private civil remedies), and Sections 638.50–638.51 (pen registers and trap-and-trace devices). Read the Code.
• Privacy Rights Clearinghouse, “California Invasion of Privacy Act (CIPA).” Background on CIPA’s history, principal provisions, consent requirements, and remedies. Read the article.
• Jacqueline Wade Cooney, Damon D. Eisenbrey & Chesley S. McLeod, “California’s Invasion of Privacy Act: A New Frontier for Website Tracking Litigation,” ABA Business Law Today (Aug. 5, 2024). Discussion of the emergence of CIPA website-tracking litigation, Greenley, Licea, and Levings. Read the article
• Anokhy Desai, “SB 690: A Potential Pause in CIPA Litigation,” California Lawyers Association (Nov. 10, 2025). Legislative history and discussion of the competing business and consumer perspectives surrounding the original proposal. Read the article.
• Rachel Lowe, Daniel J. Felz, Jonathan J. Kim & Tracy Yao, “California SB 690 Reform Advances as CIPA Claims Persist,” Alston & Bird (July 27, 2026). Analysis of the narrowed 2026 proposal, continuing Section 631 exposure, and developing CIPA case law. Read the article. Read the article.
• Simone McCormick & Paul Schmeltzer, “California Legislature Passes Bill Curtailing CIPA Website-Tracking Lawsuits,” Clark Hill PLC (Sept. 2, 2026). Analysis of the legislation passed by the Legislature and its potential effect on pending litigation. Read the article