Businesses nationwide with California website visitors face significant legal exposure under the California Invasion of Privacy Act (CIPA). Originally a 1967 criminal wiretapping statute, CIPA is now being weaponized by plaintiffs’ attorneys against modern website technologies like tracking pixels, session replays, and chatbots. Because CIPA carries statutory damages of $5,000 per violation, which plaintiffs argue can be multiplied across every website visitor, theoretical exposure can translate to millions. Between early 2025 and August 2026, §638.51 pen register lawsuits specifically surged from roughly 600 to nearly 4,000. While recent legislation targets those specific claims, hundreds of §631 and §632 wiretapping matters remain unaffected.
The California Legislature passed Senate Bill 690 (SB 690) unanimously on 28 August 2026 and sent it to the Governor. If enacted, it takes effect January 1st, 2027, and applies retroactively to actions filed on or after January 1st, 2025. While the bill provides some relief by eliminating private right of action for “pen register” claims, it leaves CIPA’s Section 631 wiretapping provision fully intact.
As a result, the litigation threat remains real and active as plaintiffs pivot their claims to wiretapping violations. In Javier v. Assurance IQ (an unpublished 2022 Ninth Circuit decision), the court held that consent under Section 631 must be obtained before recording begins, not after. High-profile brands like Smith & Wesson have also faced proposed class actions alleging that tracking cookies fired after users rejected them.
The core vulnerability is that standard privacy tools, like cookie banners and basic tag managers, are necessary but not sufficient. They are designed to record user preferences rather than actively police the browser and stop unauthorized data transmission. To get ahead of the next wave of CIPA lawsuits, organizations must move from passive consent logging to active, real-time privacy enforcement.
Here are five actionable steps to help preempt CIPA litigation and reduce the chances of a demand letter landing on your desk.
Step 1: Put Someone in Charge Before You Need To
Most CIPA exposure traces back to a script that legal never reviewed—or an approved tool that was implemented incorrectly. Marketing added a new pixel to hit a campaign deadline. An agency embedded a chat widget without looping in the privacy team. Or, legal signed off on an analytics platform, but a simple misconfiguration during deployment caused the pixel to fire before consent was granted or capture unintended form data. None of this is malicious. It’s simply what happens when no one owns the end-to-end process.
Fix this by naming a single accountable owner for the privacy risk of what runs on the website, typically someone in legal or privacy, and giving that person real authority to block a launch. The group that needs a seat at the table includes privacy counsel, marketing or growth operations, IT and security, and procurement. This cross-functional alignment is crucial because exposure often happens during handoffs—whether a script arrives through a vendor agreement nobody flagged for privacy review, or it gets misconfigured as it moves from procurement to engineering. Document who approves what and how it is supposed to behave. If nobody in the organization can answer “who signed off on this pixel” in under a minute, that’s the gap to close first.
Step 2: Find Out What Your Website Actually Does
Most teams audit their Consent Management Platform (CMP) configuration and call it done. That tells you what’s supposed to happen, not what’s actually happening in a visitor’s browser. Plaintiffs’ firms use forensic testing to find exactly this gap, and it consistently surfaces the same issues: trackers loading before any consent choice is made, third-party tags that quietly load their own nested sub-tags nobody approved, session replay tools capturing form fields or keystrokes, and fingerprinting scripts running in the background.
Run that same kind of audit on yourself before opposing counsel does. Capture network traffic and page activity on a fresh, unauthenticated browser session and compare what fires against what the CMP claims is blocked. Do this across major page types, not just the homepage, since checkout flows, contact forms, and account pages tend to carry the highest-risk scripts. The output of this step should be a real inventory of live behavior, not the vendor list marketing keeps in a spreadsheet.
Step 3: Rebuild Consent as a Gate, Not a Log
A consent banner that records a preference without enforcing it is closer to a liability than a defense. Many organizations assume they are secure because they have a standard CCPA banner in place. However, CCPA generally operates on an opt-out model, allowing data collection by default until a user objects. CIPA Section 631 wiretap claims turn on whether a third party captures the content of user communications in real time without prior consent. The fix is architectural. Scripts in non-essential categories should be blocked by default and load only after affirmative opt-in, rather than being logged as declined while still running in the background.
Plaintiffs characterize chatbots and session replay tools as wiretapping under Section 631. While courts have rejected these claims where data is not readable in transit, scripts reading actual form content represent a core exposure. This architectural fix must also include client-side masking and fencing. Work with engineering to ensure sensitive inputs, like passwords and payment information, are masked and gated at the source, preventing third-party tools from ever capturing sensitive data or specific keystrokes regardless of consent. Additionally, a business cannot wiretap itself, and vendor contracts that classify the tool as a service provider with no independent use rights can act as a strong legal defense (party exception).
You must also build a process for every future change. Any new tag, pixel, or script should go through a lightweight privacy review before it ships, the same way a code change goes through review before it merges. Set a quarterly re-certification schedule rather than an annual one, since marketing stacks change faster than most compliance calendars assume. And document the legal basis and consent flow for each tracking category, because if a demand letter arrives, the ability to show exactly when consent was captured and what was blocked beforehand is often the difference between a quick dismissal and a costly settlement.
Step 4: Close the Runtime Gap
This is the step most companies skip. A CMP configures intent. It tells the browser what should happen. It doesn’t continuously verify what happens after a script loads, after a vendor pushes an update, or after someone with access modifies a tag manager container. A script that was compliant last month can start behaving differently without anyone on the internal team touching a line of code, simply because a vendor changed something on their end.
The technology gap here is runtime enforcement on the client side: monitoring and control that watches what scripts actually do in the browser, in real time, and can flag or stop unauthorized behavior, whether that’s the injection of an unapproved fourth-party script, a trusted script drifting from its original scope, or data transfers to unauthorized domains. This layer is different from, and complementary to, a CMP. The CMP sets the policy. Runtime enforcement helps ensure the policy is actually being followed on every page load, not just the ones covered by the last manual audit. Without it, an organization is relying on trust that vendors and internal teams won’t change anything unexpectedly, which is precisely the assumption the current wave of litigation is built to test.
Step 5: Monitor, Document, and Stay Ready
This work isn’t a project with an end date. New tags get added, vendors update their scripts, and the legal landscape keeps evolving. Build ongoing monitoring that alerts the team when new scripts appear or existing ones change behavior, rather than waiting for the next scheduled audit to catch it.
Keep a clean record proving the consent gate was active before data collection started, alongside a continuous audit log of script behavior. You must be able to demonstrate exactly what data each script accessed and where it initiated data transfers to during a user session. This granular audit trail is what legal will need if a demand letter shows up, and its absence is often what turns a defensible position into a settlement. Train marketing and development staff on why the review process exists, since the ownership structure from step one erodes quickly if the people making day-to-day changes don’t understand what’s at stake. And assign someone to track legal developments, including the final fate of SB 690 and how courts continue to handle Section 631 claims, since the rules here are still being written in real time.
Moving from a Reactive to a Proactive Compliance Posture
Waiting for a CIPA demand letter to hit your desk forces your organization into a costly reactive posture, scrambling to address technical violations that have already occurred while facing potential statutory damages of $5,000 per violation. Plaintiffs’ attorneys increasingly use automated tools to scan websites at scale, meaning that if your site relies on passive consent logs rather than active blocking, you could be at risk of being targeted.
To prevent this litigation, businesses must shift to a proactive security model by conducting comprehensive audits, optimizing consent architecture, and deploying client-side runtime enforcement. This active defense stops unauthorized network requests before data leaves the user’s browser, reducing the technical gaps plaintiffs rely on for their claims and producing the evidence your counsel needs.
Ready to Uncover Your Website’s Privacy Blind Spots?
Don’t wait for a demand letter to find out if your website is vulnerable to CIPA litigation. Request a Browser Privacy Risk Assessment today to audit your active scripts, identify tracking pixels operating outside of their intended scope, and uncover the client-side vulnerabilities your standard CMP misses. Gain full visibility into your digital properties and get an actionable roadmap to protect your business before claims arise.
*Disclaimer: This article is for general information and is not legal advice.*
