Cal. Penal Code § 630 et seq.
CIPA: a 1967 wiretapping statute, $5,000 a violation, and a bill that may narrow it
A claim in California superior courts · Last verified August 26, 2026
A note on timing before anything else. This page describes an area moving faster than any other in California civil litigation. Legislation narrowing one of its main theories was pending before the Legislature as of August 2026, with a deadline of August 31, 2026 to pass. Verify the current state of the statute before relying on anything here.
The California Invasion of Privacy Act is a criminal statute from 1967 with a private right of action attached. It was written for telephone wiretapping, and for fifty years it did approximately that.
What changed is not the statute. It is the reading of it. Plaintiffs began applying its eavesdropping and pen register provisions to ordinary website technology — session recording, chat widgets, analytics scripts, advertising pixels — and the volume followed, because CIPA supplies $5,000 per violation with no proof of harm required.
What it is
CIPA is a mechanism, not a claim in the ordinary sense. It is a set of criminal prohibitions on intercepting communications, with Penal Code § 637.2 creating a civil action for anyone injured by a violation.
The two provisions doing nearly all the work in modern litigation:
Section 631 — wiretapping. Prohibits reading or attempting to read the contents of a communication in transit without consent, and prohibits aiding another to do so. The "aiding" clause is what reaches third-party analytics and advertising vendors embedded in a website.
Section 638.51 — pen registers and trap and trace devices. Prohibits installing or using, without a court order, a device or process that records dialing, routing, addressing, or signaling information. This provision does not require capturing the contents of anything — only routing data — which is why it became the preferred theory when contents-based claims ran into trouble.
Section 632 prohibits recording a confidential communication without the consent of all parties, and it is the provision behind California's two-party consent rule for call recording.
What a plaintiff has to prove
There is no CACI instruction, because the claim tracks the criminal statute.
For a § 631 claim: the defendant, without the consent of all parties, read or attempted to read the contents of a communication while in transit, or aided another in doing so.
For a § 638.51 claim: the defendant installed or used a pen register or trap and trace device without a court order.
For a § 632 claim: the defendant intentionally recorded a confidential communication — one where a party had an objectively reasonable expectation it was not being overheard or recorded — without the consent of all parties.
Injury is not required in the ordinary sense. Section 637.2 expressly provides that it is not a prerequisite to an action that the plaintiff suffered or was threatened with actual damages, which is what makes the statutory damages available on a bare violation.
How long you have to file
One year, under CCP § 340(a), as an action on a statutory penalty — the majority position, and the one defendants argue for.
Some authority applies the three-year period at CCP § 338(a) for a liability created by statute, on the reasoning that § 637.2's damages are remedial rather than penal.
This is contested. Do not assume three years. Plead within one where the facts allow.
What has to happen before you file
Nothing. No notice, no demand, no agency.
Character: no pre-suit prerequisite.
Who can be sued — and who cannot
The website operator, on a direct theory or for aiding the interception.
The third-party vendor whose script or pixel did the collecting — analytics providers, session replay companies, advertising networks, chat services.
The party exception is the central defense. A party to a communication cannot wiretap it, so a website operator recording its own interaction with a visitor is generally not liable under § 631 as a direct interceptor. The claims are therefore built on the third party — the vendor is the eavesdropper, and the operator aided them.
Whether a vendor is a genuine third party or an "extension" of the operator is the question these cases turn on. A vendor that merely provides a tool to the operator and does nothing with the data for its own purposes is increasingly treated as the operator's extension, and not a third party at all.
Common defenses — and defendants have been winning more of them
Consent. Disclosed in a privacy policy, a cookie banner, or terms of service. The fight is over whether the disclosure was sufficient and whether the plaintiff was on notice of it, and clear, conspicuous consent flows have been increasingly effective.
The party exception, above.
The vendor is an extension of the operator, not a third party.
No contents were captured, defeating a § 631 claim — which is precisely what drove plaintiffs to the pen register theory, since § 638.51 requires no contents.
The communication was not confidential, defeating a § 632 claim. Browsing a commercial website is a poor fit for an expectation that no one is observing.
The technology is not a "pen register." The statutory definition was written for telephone equipment, and whether software collecting IP addresses and device identifiers fits it is the core dispute in the pen register cases. Courts are divided.
Article III standing in federal court, where a bare statutory violation without concrete harm may not suffice — which pushes these cases into state court.
Arbitration, under the website's terms.
The one-year period.
What the claim pays
Statutory damages of $5,000 per violation, or three times actual damages, whichever is greater, under Penal Code § 637.2.
The per-violation multiplication is the entire economics of this litigation. Whether "violation" means per plaintiff, per session, per communication, or per intercepted transmission is contested and unresolved — and the difference between those readings is the difference between a modest case and an existential one for the defendant.
Injunctive relief, expressly available under § 637.2.
No attorney's fee provision in CIPA itself, though CCP § 1021.5 may supply fees, and a companion Unfair Competition Law claim can extend the reach to four years.
Punitive damages are unnecessary given the statutory multiplier and are not separately provided.
Jury trial: yes on damages.
Where it stands — as of August 2026
This section will date faster than anything else on this site.
The volume is real and large. Tracked wiretapping and pen register filings ran into the thousands between 2022 and 2026, overwhelmingly in California, with pen register filings in particular rising sharply after the contents-based theories met resistance.
And the theory is under pressure from two directions.
Legislatively: a bill to remove the private right of action for website-based pen register claims — leaving enforcement to the Attorney General — was narrowed in July 2026 to target that branch specifically, after a broader version stalled. As of late August 2026 it had not passed, and it faced an August 31 deadline to clear the Legislature. If enacted this session it would operate from January 1, 2027, absent an urgency clause.
Judicially: courts have divided on whether ordinary web tracking software is a pen register at all, and defendants have been prevailing more often on consent, the party exception, and the vendor-as-extension argument.
What this means practically. The underlying statute is durable — § 632's two-party consent rule for call recording is settled and long-standing, and § 631 has decades of application to actual interception. The website tracking wave riding on top of it is not. Treat the two differently, and check the current state of both the statute and the case law before filing or advising.
What people get wrong
"CIPA is a new privacy law." It was enacted in 1967. What is new is its application to website technology.
"I need to show I was harmed." You do not. Section 637.2 expressly makes actual damages unnecessary.
"The website recorded me, so they wiretapped me." A party to a communication cannot wiretap it. The claim depends on a third party doing the collecting, and on whether that party was a third party in fact.
"I have three years." Contested. The majority view is one year as a statutory penalty.
"The privacy policy doesn't matter." Consent is the leading defense, and a clear, conspicuous disclosure is increasingly effective.
"$5,000 per violation means per website visit." Unresolved. What counts as a violation is one of the most consequential open questions in this litigation.
"This is settled law." It is the least settled area in California civil practice, and legislation narrowing it was pending as this page was written.
Where it came from
CIPA was enacted in 1967, and its findings are worth knowing because they explain why the statute stretches so far: the Legislature declared that advances in electronic technology had created a serious threat to the free exercise of personal liberties, and that it intended to protect the right of privacy against them.
That language was written about telephone technology, but it is written broadly, and the courts applying CIPA to internet technology have leaned on it — the Legislature said it was legislating against advances in technology, not against particular devices.
The two-party consent rule at § 632 is the provision most Californians encounter, and it has been stable for decades. It is why calls are announced as recorded.
The modern wave began around 2021, when plaintiffs' firms applied § 631's aiding clause to third-party analytics scripts. When defendants pushed back on whether website interactions had "contents" capable of interception, the litigation shifted to § 638.51's pen register provision, which requires only routing and addressing information — a theory that fit web technology far better and produced a sharp increase in filings.
The Legislature is now considering whether that was ever intended, which is the question a 1967 statute applied to 2026 technology was always going to raise.
Common questions
Do I have to prove I was harmed?
No. Penal Code § 637.2 expressly provides that suffering actual damages is not a prerequisite, which is why statutory damages are available on a bare violation.
How much is a CIPA claim worth?
$5,000 per violation, or three times actual damages, whichever is greater. What counts as a "violation" — per plaintiff, per session, per transmission — is unresolved and is the central question in these cases.
How long do I have to sue?
Contested. The majority view is one year, as an action on a statutory penalty. Some authority applies three years. Do not assume the longer period.
Can I sue a website for recording my visit?
The claim generally depends on a third party doing the collecting, because a party to a communication cannot wiretap it. Whether an embedded vendor is a genuine third party or an extension of the website operator is the question these cases turn on.
Does a privacy policy defeat the claim?
Consent is the leading defense, and clear, conspicuous disclosure has been increasingly effective. A buried policy is weaker than a conspicuous consent flow.
Is this area stable?
No. Legislation narrowing the pen register theory was pending as of August 2026, courts are divided on core questions, and defendants have been winning a growing share. Check current law before relying on anything.