Is That Website Recording You? California's Wiretap Law and Online Tracking

Most of what you do on a website is recorded. Every click, scroll, and keystroke can be captured by software running invisibly on the page, and much of that data is transmitted in real time to companies you have never heard of. A statute California enacted in 1967 to stop telephone wiretapping has become one of the primary legal tools for challenging that practice.

The California Invasion of Privacy Act

The California Invasion of Privacy Act, or CIPA, is codified at Cal. Penal Code § 630 and following. Its provisions most relevant to online tracking are:

• Section 631(a), which prohibits, among other things, intentionally tapping or making any unauthorized connection with a communication line, and reading or attempting to learn the contents of any communication while it is in transit without the consent of all parties. It also prohibits aiding or conspiring with anyone who does.
• Section 632, which prohibits intentionally recording a confidential communication without the consent of all parties.
• Section 632.7, which prohibits intercepting or recording communications involving a cellular or cordless telephone without the consent of all parties.
• Section 638.51, which prohibits installing or using a "pen register" or "trap and trace device" — devices that capture routing and addressing information — without a court order.

California is an all-party consent state. Unlike the federal Wiretap Act and the laws of many states, which require only one party's consent to record a conversation, CIPA generally requires everyone involved to agree.

The Civil Remedy

What makes CIPA significant in civil litigation is Cal. Penal Code § 637.2. It provides that any person injured by a violation may bring a civil action against the violator for the greater of $5,000 per violation or three times the amount of actual damages, and it expressly states that a plaintiff need not have suffered actual damages to sue. Injunctive relief is also available.

A statutory penalty that does not require proof of loss, multiplied across every visitor to a website, creates substantial exposure. That combination is why CIPA has generated so much litigation.

How the Statute Has Been Applied Online

Plaintiffs have brought CIPA claims against a wide range of online tracking practices. The most common theories:

Chat features

Many websites use third-party vendors to power their customer service chat windows. Plaintiffs have alleged that when a visitor types into the chat, the vendor is reading and recording the conversation in real time without the visitor's knowledge or consent, and that the website operator aided the interception, in violation of § 631(a). Some complaints add § 632.7 claims when the visitor was using a smartphone.

Session replay software

Session replay tools record a visitor's mouse movements, clicks, scrolling, and keystrokes, allowing the website operator or a vendor to replay the visit like a video. Plaintiffs have alleged this constitutes wiretapping of the communication between the visitor and the website.

Tracking pixels and analytics

Tracking pixels embedded on websites send information about the visitor's activity to advertising platforms. Plaintiffs have alleged that transmitting this data to a third party without consent violates § 631(a), and that the pixels themselves function as pen registers or trap-and-trace devices under § 638.51 by capturing identifying information.

Where the Courts Stand

This is an area of active and unsettled litigation, and it would be misleading to suggest the law is clear. Courts — particularly the federal district courts in California where most of these cases are filed — have reached different conclusions on several core questions:

• Whether a website's own vendor is a "third party" that can "intercept" a communication, or whether it is merely a tool the website uses, like a tape recorder
• Whether the information captured constitutes "contents" of a communication, which § 631 protects, or merely routing and addressing information
• Whether a communication with a website's chat box is "confidential" under § 632 when the visitor has no reasonable expectation of privacy in it
• Whether the visitor consented by continuing to use a site whose privacy policy disclosed the tracking
• Whether the "in transit" requirement of § 631 is satisfied when the tracking software captures data simultaneously with its transmission
• Whether a tracking pixel can qualify as a pen register or trap-and-trace device

Some courts have allowed claims to proceed past the pleading stage; others have dismissed them. The outcome often turns on the specific technology involved, what the complaint alleges about how it works, and what the website's disclosures said. Appellate guidance has been limited, and the legal landscape may look different a year from now.

What This Means for You

If you have used a website's chat feature, filled out forms, or browsed pages on a site that uses these tools — and the site did not clearly disclose that a third party was recording or receiving your interactions before you engaged — you may be among the people whose communications were captured. Whether that gives rise to a viable claim depends on facts that require investigation: which vendor was involved, what the vendor did with the data, what the site's disclosures actually said, and which court would hear the case.

Practically speaking, if you want to know what a site is doing, look at its privacy policy for references to chat vendors, session replay, or analytics providers, and consider using browser extensions that reveal third-party scripts. If you communicated something sensitive through a website chat and later learned it was being shared, keep a record of the site, the date, and what you communicated.

The Bottom Line

CIPA is a decades-old law with a substantial per-violation penalty, and it is being tested against modern web tracking with mixed but significant results. The claims are complex, fact-specific, and unsettled — which is exactly why they warrant careful evaluation by counsel rather than a quick judgment either way.