CIPA Demand Letter or Class Action Over Your Website's Pixel? Defense for Website Operators
Plaintiff's firms are suing website operators under the California Invasion of Privacy Act, a 1967 wiretapping law, over standard tools like Meta Pixel, Google Analytics, and TikTok Pixel. The law is unsettled, the damages provision is large, and many claims have real weaknesses. Jonathan Phillips defends browser privacy and website wiretapping claims in federal and state courts nationwide.
At a glance
Frequent plaintiff's firms — Pacific Trial Attorneys (Scott J. Ferrell); Tauler Smith LLP; Kevin Lemieux; Swigart Law Group
Main theories — Wiretapping (Cal. Penal Code § 631); "pen register" tracking (§ 638.51)
Damages — $5,000 per violation or three times actual damages (§ 637.2)
Related claims — Video Privacy Protection Act; state wiretap acts in Pennsylvania, Illinois, Florida, and Maryland
What are they claiming?
Wiretapping (§ 631). Embedding a pixel lets a third party such as Meta or Google intercept communications between your site and its visitors without consent.
Pen register (§ 638.51). Software that records a visitor's IP address, device data, and browsing path is a "pen register" that needs consent or a court order. In 2025 a federal court in the Northern District of California denied Meta's motion to dismiss a pen register claim in the tax-filing cases [verify citation].
Video tracking (VPPA). Sites that host video alongside trackers are accused of sharing viewing data with Meta or Google.
What defenses work?
Consent. A clear banner that names the tools you use and records the visitor's choice changes these cases. A footer privacy-policy link usually does not.
Standing. Several federal courts have dismissed these claims because sharing an IP address with an analytics vendor is not a concrete injury. Results vary by circuit.
Party to the communication. A vendor acting only as your service provider may be an extension of you, not an outside wiretapper.
Statutory purpose. Some courts hold that a 1967 telephone statute was never meant to reach routine analytics. Courts are split.
What to do if you get a letter
Do not respond directly to the sending firm, especially to a short FedEx deadline.
Do not delete records or pull tracking code in a way that destroys evidence; preserve first.
List every pixel, tag, chat tool, and session-replay tool on the site.
Pull your current cookie banner and privacy policy, with dates of past versions.
Talk to counsel about exposure in your jurisdiction and class-certification risk.
Frequently asked questions
We are not in California. Can they sue us? Yes, if California visitors use your site, and similar claims are filed under other states' wiretap laws.
Does a cookie banner protect us? A well-built one that discloses your tools and records consent is the strongest defense; a decorative one is not.
Has the law changed recently? It is moving. See Jonathan's latest CIPA update.
Recent writing
Another CIPA update: SB 690 passed, an appellate court finally spoke; neither one settles CIPA yet
CIPA and website tracking litigation: a working resource for ecommerce businesses
Jonathan L.A. Phillips, Brown, Hay & Stephens, LLP. Part of the Serial Plaintiff Tracker. Last reviewed October 2026.