Online businesses used to worry about slow checkout pages, abandoned carts, and whether their “Subscribe now!” pop-up was annoying enough to be legally classified as furniture. Today, another concern has muscled its way onto the risk dashboard: CIPA litigation.
The California Invasion of Privacy Act, better known as CIPA, was born in 1967 to fight secret wiretapping and eavesdropping. That means it arrived before online shopping carts, behavioral advertising, chatbots, session replay tools, Meta Pixel, Google Analytics, TikTok Pixel, and the delightful modern ritual of rejecting cookies six times before reading a recipe. Yet this decades-old privacy law has become one of the sharpest tools used against online businesses that operate websites visited by California consumers.
The issue is not just theoretical. Plaintiffs have brought lawsuits and arbitration demands against companies that use common website technologies such as pixels, cookies, tags, analytics tools, search bars, chat widgets, and session replay software. The central accusation is simple but powerful: these tools may intercept, record, or transmit user communications without proper consent. In many cases, the business may have viewed the tools as ordinary marketing plumbing. Plaintiffs, however, describe the same plumbing as unlawful surveillance. Same pipe, very different invoice.
Meanwhile, California Senate Bill 690, the reform proposal that could narrow CIPA exposure for certain routine commercial uses of personal information, remains in the legislative process. For online businesses, that means one thing: do not wait for Sacramento to save your cookie banner. The lawsuits are still coming, courts remain divided, and compliance programs need to grow up quickly.
What Is CIPA, and Why Are Online Businesses Suddenly Nervous?
CIPA is a California privacy statute that generally prohibits certain forms of wiretapping, eavesdropping, recording, and the use of pen register or trap-and-trace devices without proper authorization or consent. The statute was designed for a world of telephone lines and confidential conversations, but its language is broad enough that plaintiffs have attempted to apply it to the modern web.
The most common online-business CIPA theories focus on three areas. First, plaintiffs allege that website tracking tools intercept user communications while the user interacts with a website. Second, they argue that session replay tools and chat widgets can capture the contents of communications or user behavior in a way that resembles eavesdropping. Third, they claim that pixels and similar technologies function like pen registers or trap-and-trace devices because they collect routing, addressing, signaling, device, or browsing information.
What makes CIPA especially attractive to plaintiffs is its private right of action. A plaintiff may seek statutory damages of $5,000 per violation or three times actual damages, whichever is greater. In a single-user case, that number is already unpleasant. In a class action involving thousands or millions of website visitors, the math starts looking like a horror movie for general counsel.
Why Website Tracking Became the New Battleground
Most modern websites are not single, quiet pages sitting politely on a server. They are crowded little airports full of third-party scripts taking off and landing. A retail site may use analytics software to measure traffic, an advertising pixel to retarget shoppers, a heat-mapping tool to study clicks, a session replay tool to diagnose checkout bugs, a chatbot to answer questions, and a customer data platform to organize everything. From a marketing perspective, this is normal. From a privacy-litigation perspective, it can look like a buffet with no sneeze guard.
Pixels and Advertising Tags
Tracking pixels are tiny pieces of code that can collect information about a user’s visit and send it to a third party. Businesses use them to measure ad performance, retarget users, improve campaigns, and understand conversions. Plaintiffs argue that when pixels collect IP addresses, identifiers, timestamps, page visits, search terms, or other browsing events before valid consent, they may operate as unlawful tracking devices under CIPA.
Session Replay Tools
Session replay software records or reconstructs how users interact with a website. It can help companies detect broken forms, confusing navigation, or checkout problems. The business sees a tool for improving user experience. Plaintiffs may see a tool that captures keystrokes, clicks, page movements, and form interactions without clear disclosure. The legal problem gets worse when replay tools capture sensitive information or send data to vendors that can use it for their own purposes.
Chatbots and Customer Support Widgets
Chat tools create another risk zone. A user might type questions about an order, a refund, a medical product, an insurance issue, an employment application, or a financial concern. If a third-party chatbot vendor receives those communications without adequate consent, plaintiffs may argue that the vendor is secretly listening in. That is not the brand experience most companies were aiming for.
Search Bars and Form Fields
Search tools can also create exposure. A search query may reveal private intent: symptoms, financial worries, job interests, legal questions, or personal preferences. If those terms are transmitted to outside vendors for analytics or advertising, plaintiffs may argue that the company crossed the line from measurement into interception.
The Reform Bill: What SB 690 Tries to Do
California Senate Bill 690 was introduced to address the growing wave of CIPA lawsuits aimed at routine website technologies. The bill would amend several provisions of the California Penal Code and create a carve-out for certain processing of personal information performed for a “commercial business purpose.” In practical terms, supporters argue that SB 690 would help protect businesses using ordinary digital tools for analytics, operations, advertising, security, and customer service when those practices are already governed by modern privacy laws such as the CCPA and CPRA.
The proposal would also clarify that a pen register or trap-and-trace device does not include a device or process used in a manner consistent with a commercial business purpose. That language matters because many recent CIPA lawsuits depend on the claim that common web-tracking technologies are pen registers or trap-and-trace devices. If SB 690 becomes law in a meaningful form, it could reduce the leverage of certain claims against routine business tracking.
But the bill has not delivered relief yet. It advanced through the Senate in 2025, moved into the Assembly, and remained in committee. As of the current legislative posture, online businesses should treat SB 690 as a possible future development, not as a shield they can hold up today. A reform bill sitting in committee is not a compliance program. It is, at best, a weather forecast.
Why the Reform Effort Is Controversial
Supporters of CIPA reform argue that the law is being stretched far beyond its original purpose. They say small and mid-sized businesses are being hit with costly demand letters and lawsuits over common technologies that are not sinister, secret spy gadgets, but ordinary website infrastructure. A local retailer using analytics to understand why customers abandon carts may not see itself as a digital wiretapper. It probably sees itself as a business trying to sell socks without going bankrupt.
Opponents of broad reform see the issue differently. Privacy advocates worry that a sweeping commercial-purpose exemption could weaken protections for sensitive data, especially where tracking occurs on health, employment, immigration, financial, education, or children’s websites. Their concern is that labeling data collection as “commercial” should not automatically excuse invasive tracking or third-party sharing. After all, almost every business practice has some commercial purpose. That is why businesses do it, and also why privacy advocates reach for the big red marker.
This tension explains why the bill has moved slowly. Lawmakers are trying to balance two real concerns: preventing abusive litigation over ordinary technology and preserving meaningful privacy rights in a web economy where personal data moves quickly, quietly, and often invisibly.
Recent Cases Show Why Businesses Cannot Relax
CIPA litigation is unsettled because courts have not reached one clean, universal answer. Some courts have dismissed claims involving website tracking, especially where plaintiffs could not allege the collection of sensitive information or failed to show concrete harm. Other courts have allowed claims to proceed, particularly where third-party pixels, device identifiers, search terms, or user inputs were allegedly collected before valid consent.
One notable recent example involved allegations that tracking pixels on a major brand’s website collected IP addresses, browser information, unique identifiers, and other data without consent. The court allowed the CIPA pen-register theory to move forward at the pleading stage, rejecting arguments that the statute should be limited to old-fashioned telephone technology. The decision did not mean every pixel automatically violates CIPA, but it gave plaintiffs a useful roadmap and gave businesses another reason to audit their tags before breakfast.
Other decisions have gone the opposite way, especially when the alleged data involved only routine browsing activity or when the complaint failed to identify what was actually collected. This split is exactly why the litigation continues. Plaintiffs file because some judges are receptive. Defendants fight because other judges are skeptical. The uncertainty itself becomes fuel.
Which Online Businesses Face the Highest Risk?
Any company with a website accessible to California users should pay attention, even if the business is not headquartered in California. A small e-commerce store in Ohio, a SaaS company in Texas, a hotel group in Florida, or a digital publisher in New York can still attract claims if its website interacts with California visitors and deploys tracking tools in a risky way.
Health and Wellness Websites
Health-related websites face especially serious exposure. Pages involving symptoms, appointments, patient portals, treatment information, insurance questions, or provider searches can reveal sensitive information. If advertising pixels or analytics tools transmit that information to third parties, a CIPA claim may be only one part of the problem. HIPAA, the FTC Act, state health privacy laws, and consumer-protection rules may also enter the chat, and none of them are bringing snacks.
Employment and Careers Pages
Careers pages are another danger zone. Applicants may upload resumes, disclose disability accommodation needs, reveal veteran status, or provide demographic information. A marketing pixel on a job application flow may look harmless to a recruiting team trying to measure campaign success, but it may look very different in a lawsuit.
Financial, Insurance, and Legal Websites
Financial services, insurance, debt relief, tax, and legal intake websites often collect information that users reasonably expect to be private. Search terms, form entries, quote requests, and chat messages may contain highly personal details. These websites should be especially cautious with third-party scripts that activate before consent.
Retail and Subscription Businesses
Retailers remain frequent targets because they commonly use advertising pixels, analytics tags, personalization tools, and session replay software. Even ordinary browsing can become risky when linked to a user profile, loyalty account, email address, or advertising identifier.
Consent Is the Center of the Storm
The most important practical issue in many CIPA cases is consent. A privacy policy buried in a footer may not be enough. A cookie banner that says “we value your privacy” while tracking tools fire before the user makes a choice may not be enough. A banner that lets users reject tracking but continues to load nonessential scripts anyway is especially risky. That is the privacy equivalent of asking someone if they want dessert, hearing “no,” and then throwing cake at them.
Businesses should focus on affirmative, informed, and timely consent. The user should see a clear notice before nonessential tracking begins. The notice should describe the categories of tools used, the purposes of collection, and the role of third parties. The user should have a real choice. Most importantly, the technical setup should match the promise. If the banner says tracking is disabled, tracking should actually be disabled.
A Practical CIPA Risk-Reduction Checklist
Online businesses do not need to panic, unplug the website, and conduct commerce by carrier pigeon. But they do need a disciplined approach. The following steps can reduce CIPA exposure while improving general privacy compliance.
1. Audit Every Tracking Tool
Create an inventory of cookies, pixels, tags, beacons, analytics scripts, session replay tools, chat widgets, search tools, customer data platforms, and advertising integrations. Identify what each tool collects, when it fires, where the data goes, and whether the vendor can use the data for its own purposes.
2. Map Sensitive Pages
Not all pages carry the same risk. Careers pages, patient portals, appointment forms, quote forms, login areas, checkout pages, search pages, and customer support flows deserve special review. Remove unnecessary third-party trackers from sensitive pages whenever possible.
3. Fix Consent Timing
Nonessential tracking should not fire before the user has had a meaningful chance to consent. This is a technical issue, not just a legal-writing issue. A beautiful privacy policy cannot rescue a broken tag manager.
4. Update Privacy Disclosures
Privacy policies should accurately describe the technologies in use. Avoid vague statements that sound comforting but say little. Users, regulators, and courts increasingly expect specificity about categories of data, third-party recipients, tracking purposes, and opt-out rights.
5. Review Vendor Contracts
Contracts with analytics, advertising, chatbot, and session replay vendors should address data use, retention, security, confidentiality, service-provider restrictions, indemnity, and cooperation in litigation. If a vendor can use collected data for its own advertising network, the risk profile changes.
6. Test the Cookie Banner
Do not assume the banner works. Test it. Reject cookies and inspect whether nonessential tags still fire. Accept only necessary cookies and verify the result. Run tests across browsers, devices, and geographies. Consent tools are not decorative website ornaments; they are controls.
7. Train Marketing and Web Teams
Many CIPA problems begin when a marketing vendor or developer installs a pixel without legal review. Create a rule: no new tracking technology goes live without privacy approval. It is less exciting than launching a campaign immediately, but so is not being sued.
Experience-Based Insights: What Businesses Learn the Hard Way
In practice, the companies that handle CIPA risk best are not always the largest companies. They are the companies that know what is actually happening on their websites. That sounds simple, but many businesses are surprised when they discover how many tags are firing behind the scenes. A marketing team may install a pixel for one campaign, a web agency may add a session replay tool for debugging, a chatbot vendor may update its script, and an old analytics tag may remain active years after anyone remembers why it was installed. Over time, the website becomes a junk drawer with JavaScript.
One useful experience from privacy audits is that the riskiest tools are often not the most obvious ones. A company may focus on its homepage banner while ignoring the search bar, the careers page, or the checkout confirmation page. Yet those pages can be more sensitive because they reveal intent. A user searching for “debt relief,” “anxiety medication,” “divorce consultation,” or “disability accommodation” is not simply browsing. That search communicates something meaningful. If the term is sent to an advertising platform or analytics vendor without consent, the business may have a much harder story to tell.
Another lesson is that consent must be operational, not theatrical. Some companies have cookie banners that look impressive but do not actually control the scripts. Users click “reject,” and the tags keep firing like nothing happened. From a legal perspective, that can be worse than having no banner at all because the company has made a promise and broken it in the same breath. A working consent-management platform should block nonessential technologies until consent is obtained and should maintain records showing what the user selected.
Businesses also learn that vendor management is not optional. A third-party tool may be described as analytics, personalization, chat, or fraud prevention, but labels do not decide legal risk. What matters is what data the tool collects, whether it receives user communications, whether it can combine the data with other profiles, and whether it uses the data for independent purposes. A vendor that acts strictly as a service provider creates a different risk profile from a vendor that feeds data into a broader advertising ecosystem.
Finally, the best defense is not one magic sentence in a privacy policy. It is a consistent privacy governance process. Before launching a new campaign, adding a new chatbot, redesigning the checkout, or changing the careers platform, teams should ask basic questions: What data will this collect? Does it collect before consent? Is it necessary? Is it active on sensitive pages? Does the privacy policy disclose it? Can the vendor use the data for itself? Are users given a real choice? These questions are not glamorous, but neither is a demand letter with a spreadsheet attached.
Conclusion: Reform May Come, But Risk Is Already Here
CIPA litigation persists because the modern web runs on data collection, and California’s old privacy statute contains language plaintiffs can use creatively. SB 690 may eventually bring more clarity, especially for routine commercial processing governed by modern privacy rules. But until reform becomes law, businesses must manage today’s risk under today’s uncertainty.
The smart move is not panic. It is visibility, consent, minimization, and governance. Know what your website tools do. Block nonessential tracking until users make a choice. Remove unnecessary pixels from sensitive pages. Align disclosures with reality. Review vendor contracts. Train the teams that control the website. In other words, treat privacy compliance like part of running an online business, not like a legal side quest unlocked after the first lawsuit.
CIPA may have started in the age of phone lines, but its modern impact is landing squarely on websites, apps, and digital marketing teams. For online businesses, the message is clear: the reform bill may be moving slowly, but litigation is not.
