Last updated: May 2026
Businesses across the United States are being sued under California’s CIPA law for using common website tracking tools like Meta Pixel, Google Analytics, session replay software, chat widgets, and heatmaps. Even businesses outside California may face lawsuits if California residents visit their websites.
Here’s what website owners need to know about CIPA, CIPA demand letters, the technologies being targeted, and how to reduce risk.
Rather listen to a podcast than read a blog? Jason Kelly (Attorney with tons of CIPA experience) join us on Privacy Lawls to discuss. You can listen to Episode 16 here.
Table of Contents
What is CIPA?
The California Invasion of Privacy Act (CIPA) is a privacy law that went into effect in 1994 to protect residents of California from the harms that come when a third party eavesdrops on private communications. The law was originally passed to prevent the eavesdropping of phone calls over landline phones. As technology improved, CIPA was used to protect residents of California from the recording of calls without consent through cell phones and even the Internet (e.g. recording of calls through Zoom or CRM platforms such as Hubspot).
CIPA applies to any communications with a resident of California, even if your business is not located in California. While “communications” was originally intended to cover phone calls, it has been reinterpreted to cover any communication, including the communication of an individual with a website.
What makes CIPA risky for businesses is that it allows consumers to sue businesses directly for violations and obtain damages of $5,000 per violation. In fact, a very recent trend has emerged where consumers are suing businesses directly arguing that the use of cookies, web beacons, pixels, script or software code that track a user’s location, search terms, browsing history or purchase history act as a “pen register.” The lawsuits argue that the use of such technologies is in violation of CIPA as the technologies eavesdrop communications between an individual and a website.
Why are so many lawsuits being filed under CIPA?
Many modern websites use tracking tools like pixels, cookies, session replay, analytics, chatbots, and heat maps. These tools help businesses improve their websites, reach a broader audience, and run advertising campaigns. But under CIPA, plaintiffs are alleging these technologies amount to illegal “wiretaps” or “pen registers.”
Since CIPA predates the Internet, its language has been reinterpreted by courts to apply to website interactions—creating fertile ground for lawsuits against businesses of all sizes.
Also, CIPA allows for private right of action, meaning anyone can sue if their privacy rights are being violated. Not having to go through the attorney general of California makes it easier for more lawsuits to be sent out.
How have CIPA lawsuits evolved over time?
CIPA lawsuits have shifted in focus over the last few years:
- Session Replay: Early lawsuits argued that session replay software was an unlawful wiretap because it intercepted keystrokes and mouse movements.
- Chatbots: Next, lawsuits claimed that chat features or chatbots unlawfully intercepted user communications.
- Pixels and Web Beacons: Today, lawsuits often allege that pixels (such as Meta or TikTok pixels) and web beacons act as “pen registers” or “trap and trace devices” by recording users’ IP addresses, search queries, or browsing behavior without consent.
The latest claims focus on search queries – arguing that when a user searches a website, those queries are shared with third parties via pixels in violation of CIPA.
What do CIPA lawsuits generally look like?
The process often begins with a demand letter alleging CIPA violations and threatening litigation unless the business settles. This demand letter usually looks something like this:
If no settlement is reached, the law firm usually files a lawsuit using nearly identical boilerplate complaints across multiple defendants. Once a lawsuit is filed, businesses face strict deadlines to respond, and cases may proceed to dismissal, settlement, or trial.
What types of businesses are being targeted?
Businesses of all sizes, industries, and locations have been targeted. Examples include:
- Small e-commerce shops
- Large cosmetics companies
- Solo digital marketing consultants
- Healthcare providers
Importantly, you do not need to be based in California to be sued under CIPA if you interact with California residents online. Website owners across the United States and even Canada have been targeted.
What types of tools are being targeted under CIPA?
It’s very common for modern websites to use tools that are targeted by CIPA lawsuits. Some of the more popular tools include:
- Google Analytics
- Meta Pixel
- TikTok Pixel
- Chatbots
- Heatmaps
- Microsoft Clarity
- Hotjar
- Google Maps
- YouTube embeds
By having tracking tools like these on your website, you are at risk of CIPA lawsuits.
Recent, high-profile CIPA Lawsuits
California courts have allowed the California Invasion of Privacy Act (CIPA) to be applied to website tracking, leading to a wave of lawsuits with mixed results.
- Licea v. Old Navy – Court ruled for Old Navy, finding they couldn’t “eavesdrop” on their own chat communications.
- Byars v. Hot Topic – Chat tool was deemed an extension of the business, so the lawsuit was dismissed.
- Greenley v. Kochava – Court allowed claims that fingerprinting and data correlation could violate CIPA.
- Lesh v. CNN – Lawsuit filed over multiple tracking tools on CNN’s website.
These are simply CIPA lawsuits that are getting a lot of attention due to impacting large corporations, however, small businesses are also being targeted.
What types of law firms are filing CIPA lawsuits?
Originally, a small number of firms accounted for the majority of these lawsuits, often using copy-and-paste templates. However, as the lawsuits have grown, more law firms (including those without prior privacy law experience) are joining in.
What are the conflicts between CIPA and CPRA?
California now has two major privacy laws that affect websites:
- CIPA: Requires an opt-in cookie consent model (no tracking unless a user affirmatively consents).
- CPRA (California Privacy Rights Act): Allows tracking by default but requires an opt-out option for California residents.
This creates a compliance conflict:
- If you comply with CIPA, you may not be compliant with CPRA.
- If you comply with CPRA, you may not be compliant with CIPA.
So far, regulators have provided no guidance on resolving this contradiction – leaving businesses and website owners in a difficult position.
What can businesses do to minimize their risk?
Steps businesses can take include:
- Audit Website Tracking Tools
- Identify what data is being collected, how it is being collected, and why it is being collected.
- Remove unnecessary tracking tools (e.g., unused chat widgets, analytics tools, or pixels).
- Update Privacy Disclosures
- Ensure your Privacy Policy and Cookie Policy accurately describe your tracking practices.
- Make sure your practices match your policies.
- Use a Proper Cookie Consent Banner
- Must block tracking until consent is given.
- Must provide clear “accept” and “decline” options of equal prominence.
- Must allow users to withdraw consent later.
- Must provide enough information for users to make informed choices.
These features mirror GDPR requirements and are critical for complying with CIPA.
What are lawmakers doing about this?
In April of 2025, a bill (SB690) was introduced to prevent attorneys from preying on small business website owners for non-compliance with the California Invasion of Privacy Act (CIPA).
Unfortunately, the bill’s sponsor said SB690 has stalled, implying these demand letters will continue for the foreseeable future. However, the fact that a bill was introduced to begin with is a good start.
What happens if you receive a CIPA demand letter or lawsuit?
- Don’t ignore it. A non-response may escalate the matter or cause you to miss deadlines.
- Consult experienced counsel. They can help assess whether the allegations are frivolous or require corrective action.
- Respond quickly. Delay increases the risk of a lawsuit being filed or losing procedural rights.
How Termageddon helps businesses defend against CIPA claims
At Termageddon, we:
- Became the first Privacy Policy & Cookie Consent Solution Generator to identify and comply with CIPA requirements.
- Provide a cookie consent banner solution (in partnership with Usercentrics) that combines CIPA and CPRA requirements into one layout – blocking tracking until consent is given while also allowing users to exercise CPRA opt-out rights.
- Auto-update our customers’ policies and consent banners as laws like CIPA change or are re-interpreted again in the future.
As of 2026, no Termageddon customer has received a CIPA demand letter. You can help protect your website from CIPA lawsuits by signing up with Termageddon.
Want more? Listen to our podcast episode: Ep.16 | CIPA: The 30-year-old privacy law getting businesses sued today (Guest: Jason Kelly)
