What Is
What Is CIPA (California Invasion of Privacy Act)
The California Invasion of Privacy Act (CIPA), Penal Code §630 and following, was enacted in 1967 to address wiretapping and eavesdropping. It is now the basis for many lawsuits and demand letters over website chat, session replay, pixels, and other tracking tools.
Three provisions do most of the work:
- Wiretapping (§631(a)). It is unlawful to read or learn the contents of a communication in transit without the consent of all parties, or to aid, agree with, or employ another to do so. Plaintiffs use this provision against website owners whose third-party tools capture what visitors type or click.
- Recording confidential communications (§632(a)). Eavesdropping on or recording a confidential communication requires the consent of all parties.
- Pen registers and trap-and-trace devices (§638.51). Section 638.51 generally requires a court order to install or use a pen register or trap-and-trace device, subject to specified exceptions, including qualifying service-provider use with the user's consent. Plaintiffs have argued that tracking pixels and similar tools are such devices.
These are the theories plaintiffs invoke against website tracking; whether website conduct satisfies each provision's statutory tests is litigated, and courts are divided on the pen-register theory in particular.
The statute's appeal to plaintiffs is its private right of action: a person injured by a violation may recover the greater of $5,000 per violation or three times actual damages, and actual damages need not be proved (§637.2). Standing turns on injury from the violation, a question distinct from proving damages.
On September 30, 2026, the Governor approved SB 690 (Chapter 976, Statutes of 2026), which is operative January 1, 2027 and therefore enacted but not yet operative. New Penal Code §637.2(d) provides that an action against a private actor for a violation of §638.51, alleged to arise from conduct on an internet website, online application, or mobile application, may be brought only by the Attorney General. The limitation is section-specific: it does not change the wiretapping or eavesdropping provisions (§§631, 632), which still carry the $5,000 private remedy, and it does not make the underlying conduct lawful. The limitation applies to pending claims in actions commenced within two years before the operative date, that is, actions commenced on or after January 1, 2025 (§637.2(d)(2)).
Why it matters in Texas. Texas is a one-party consent state for recording (Penal Code §16.02(c)(4)), but a Texas business whose website reaches California users can still face CIPA claims. On September 17, 2026, the Texas Attorney General warned Texas businesses about CIPA website-tracking demand letters and urged recipients to consult a lawyer before responding or paying. The same tracking tools can also raise questions under the Texas Data Privacy and Security Act's targeted-advertising rules and the DTPA.
Pinpoint: Cal. Penal Code §§630 to 638.55.