- with Inhouse Counsel
- in United States
- with readers working within the Advertising & Public Relations industries
The California Invasion of Privacy Act (CIPA) The California Invasion of Privacy Act (CIPA) is rapidly becoming one of the most significant—and misunderstood—privacy laws affecting digital businesses today. While often overshadowed by the CCPA/CPRA, CIPA, a law traditionally used against illegal wiretapping, has become a common tool for class action litigation targeting companies that use […]
The California Invasion of Privacy Act (CIPA)
The California Invasion of Privacy Act (CIPA) is rapidly becoming one of the most significant—and misunderstood—privacy laws affecting digital businesses today. While often overshadowed by the CCPA/CPRA, CIPA, a law traditionally used against illegal wiretapping, has become a common tool for class action litigation targeting companies that use third-party tracking technologies without adequate disclosure or consent.
And unlike CCPA and CPRA, CIPA applies far more broadly — covering any company with a California-facing website or communication channel, even if the business is not located in California. CCPA and CPRA, by contrast, apply only to businesses that meet specific revenue or data‑volume thresholds.
What Is the California Invasion of Privacy Act (CIPA)? CIPA is a two-party consent wiretapping statute, originally enacted to protect Californians from secret monitoring or recording of communications.
CIPA makes it unlawful to intercept, record, or eavesdrop on communications without the consent of all parties involved using any electronic or mechanical device. Unlike federal wiretapping laws which require one party consent, California requires ALL party consent – raising compliance stakes for online businesses and any business that relies on analytics tools, session-replay software, chat widgets, pixels, or advertising trackers. So basically, all online businesses.
Why CIPA Matters in the Digital Advertising & Tracking Context. CIPA has been in place since December of 2000, long before cookies, pixels, or session-replay tools existed. Now however, courts are starting to apply this law to modern web tracking technologies. Plaintiff's lawyers argue that website visitors are engaged in confidential communications with a company, that third party tracking tools are “intercepting” those communications and that users didn't consent to that interception.
Who does CIPA target? In short, CIPA applies to any company regardless of location or size who interacts with California consumers and who uses third party tracking tools, including analytics, tracking, or other behavioral tools (e.g.: pixels or other journey trackers) without clear disclosures to consumers. Third party tracking can include session replay, advertising pixels, or tag managers – among others. And intent doesn't matter – if a tracking tool is only used for site optimization, there still might be liability.
Some Key Risk Factors.
- Lack of Clear Disclosure – A privacy policy must explicitly describe third-party interception of communications.
- Affirmative Consent – Passive use of a website without a clear consent mechanism may not satisfy CIPA's all-party consent requirement.
- Third Parties – Vendors may not just be “service providers” if they collect data for their own purposes or process communications in real time.
Note that CIPA is a statutory damages statute, which makes it especially dangerous in class actions. Damages can include up to $5,000 per violation or three times actual damages, whichever is greater – and these are per interaction, not per user. Further, private plaintiffs can sue directly, making CIPA a popular statute for litigation.
How Can You Mitigate Liability? Companies can mitigate their CIPA risk by auditing tracking technologies, implementing specific and clear disclosures, and using affirmative consent mechanisms, among others. Companies should tighten up third party and vendor agreements to ensure that data isn't used for independent purposes.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]