CIPA and Website Tracking: How a 1967 Wiretap Law Reached Chat Widgets and Pixels

A great deal of what you do on a website is captured as you do it. Chat messages, clicks, scrolling, and form entries can all be recorded by software running on the page, and much of it is sent in real time to companies whose names never appear on the screen. A California statute written in 1967 to address telephone wiretapping has become one of the main legal tools for challenging those practices.

The statute

The California Invasion of Privacy Act, Cal. Penal Code § 630 and following, contains several provisions that plaintiffs have applied to online tracking. Section 631(a) prohibits, among other things, reading or attempting to learn the contents of a communication in transit without the consent of all parties, and aiding anyone who does. Section 632 prohibits recording a confidential communication without everyone's consent, and § 632.7 covers intercepting or recording communications involving cellular or cordless phones. Section 638.51 prohibits installing or using a pen register or trap and trace device, which capture routing and addressing information, without a court order.

California requires the consent of all parties. Federal wiretap law, and the law in many states, requires only one.

What made CIPA a litigation tool is its civil remedy. Under Penal Code § 637.2, a person injured by a violation can recover $5,000 per violation or three times actual damages, whichever is greater. The statute states that a plaintiff doesn't need to have suffered actual damages to sue.

How it has been applied online

Website chat features were among the first targets. Many sites use outside vendors to run their customer service chat, and plaintiffs have alleged that those vendors read and record visitors' conversations in real time without consent, with the website operator's help, in violation of § 631(a).

Session replay software came next. These tools record mouse movements, clicks, scrolling, and keystrokes so a visit can be played back like a video. Plaintiffs have argued this amounts to wiretapping the exchange between a visitor and the site.

More recently, cases have focused on tracking pixels, small pieces of code that send information about a visitor's activity to advertising platforms. Plaintiffs have alleged both that transmitting this data to a third party violates § 631(a) and that the pixels operate as pen registers or trap and trace devices under § 638.51.

SB 690 and pen register claims

The pen register theory produced so many filings and demand letters that the Legislature stepped in. In August 2026 it unanimously passed Senate Bill 690. As passed, the bill would allow only the California Attorney General, not private plaintiffs, to bring § 638.51 claims based on conduct on a website, online application, or mobile application. It doesn't change § 631 or § 632. The bill was sent to the Governor, and if it becomes law it's expected to take effect January 1, 2027, with provisions written to reach certain pending cases. Anyone evaluating a pen register claim should confirm the bill's final status.

Earlier versions of SB 690 would have created a broad exemption for "commercial business purposes" across CIPA. That language was removed before passage.

Where the courts disagree

The law in this area is unsettled, and anyone who tells you otherwise is overselling. The federal district courts in California, where most of these cases are filed, have reached different conclusions on several basic questions. Is a website's vendor a third party that can intercept a communication, or is it just a tool the website uses, like a tape recorder? Is the information captured the "contents" of a communication? Can a chat with a website be "confidential"? Did the visitor consent by using a site whose privacy policy disclosed the tracking? Does software that captures data as it's transmitted satisfy the in-transit requirement? Can a pixel be a pen register?

Some courts have let claims proceed past the pleading stage and others have dismissed them. The result often depends on the specific technology, how the complaint describes it, and what the website disclosed. There has been limited appellate guidance, and the picture could look different a year from now.

What this means for you

If you used a site's chat feature, filled out a form, or browsed a site using these tools, and the site didn't clearly tell you before you engaged that a third party would be recording or receiving your activity, your communications may have been captured. Whether that supports a claim depends on facts that take investigation: which vendor was involved, what it did with the data, what the site's disclosures said, and which court would hear the case.

If you shared something sensitive through a website chat, such as health or financial details, make a note of the site, the date, and what you communicated. Browser extensions that show third-party scripts can also give you a sense of what a site is loading.