Privacy Suits Under California Wiretap Law Stand on Shaky Ground

Judges are all over the map on whether the California Invasion of Privacy Act is an appropriate vehicle for consumers to bring certain online privacy claims, leaving defendants unsure about their compliance obligations and attorneys struggling to advise clients.

Consumers allege that tracking pixels from ad-tech giants like Meta Platforms Inc. and Google LLC violate the wiretapping and pen-register provisions of the 1967 law, but defendants argue that the measure instead was intended to combat telephone surveillance and shouldn’t apply to routine commercial practices on the internet.

Resolving the open legal issues will likely require legislative action or a definitive appellate court ruling, and could determine whether CIPA litigation dies out or becomes a permanent feature of the legal landscape for website operators.

“It’s true we’ve gotten some decisions that are favorable for the defense side, but there’s also a number of courts that have ruled in the other direction,” said John Jackson, chair of the cybersecurity litigation group at Jackson Walker LLP. “It’s still such a minefield, and it makes it difficult for companies that are targeted to make decisions about whether to fight the claims.”

The pressure on defendants to reach settlements in lower-value cases because of the lack of judicial consensus—particularly on those without deep pockets—is enormous, he said.

Turning Tide?

The lawsuits take aim at the use of online tracking tools to collect and use consumer data for targeted advertising, arguing it constitutes illegal wiretapping under CIPA and violates other provisions of the statute.

Recent decisions dismissing CIPA lawsuits are signs the “tide is beginning to turn” against consumers who sue over the tracking tools, said Sophia Mancall-Bitel, a partner with Mayer Brown LLP who focuses on data privacy.

The initial wave of online CIPA lawsuits “pretty much just sailed through” the motion-to-dismiss stage, but are now facing closer scrutiny, she said. “I’ve seen a few cases now where judges say, ‘Hey, wait a second, is this statute really about a type of technology that didn’t exist when it was passed and has become so commonly used on the internet?” she said.

Judge Vince Chhabria of the US District Court for the Northern District of California sounded skeptical in an October 2025 ruling tossing a CIPA lawsuit targeting a health-care provider’s use of Meta’s tracking pixel.

Chhabria took aim at the statutory text, saying it was a “mess from the get-go, but the mess gets bigger and bigger as courts are called on to apply CIPA’s already-obtuse language to new technologies.”

Judge Teresa Beaudet of the Los Angeles Superior Court was equally direct in a December ruling dismissing a lawsuit against Ink America International Group over tracking tools on its website, ruling that the particular CIPA provisions at issue in the lawsuit were “aimed at telephonic-style surveillance, not at the routine operation of commercial websites or analytical software.”

But plaintiffs’ attorney Robert Tauler sees the judicial balance tipping in favor of plaintiffs despite some recent defense wins.

“I think if you just stacked up all the opinions on the scale to see whether CIPA applies to these internet technologies, you’d see that most judges view it favorably to plaintiffs,” he said.

For example, a September 2025 ruling by Los Angeles Superior Court Judge David S. Cunningham III denied Variety Media LLC’s bid to toss a lawsuit under CIPA’s pen-register provisions. He rejected Variety’s argument that those provisions applied only to telephone-based technologies.

Tauler, a founding partner of Tauler Smith LLP, says judges have become more receptive to CIPA lawsuits as they’ve become better informed about web-tracking technology and the privacy harms arising from internet surveillance.

“I think people have had enough, and we’re seeing that in judicial opinions,” he said. “In some cases the fact patterns are so egregious that judges will say, ‘This is totally out of control,’ which creates a willingness among judges to allow cases to proceed.”

Definitive Resolution

A legislative clarification appeared possible during the 2025 session when a bill (SB 690) containing business-friendly CIPA amendments sailed through the state Senate before stalling in the Assembly.

SB 690 would have created a “commercial business purpose” exception to CIPA, allowing website operators to engage in routine online data collection for operational or analytic purposes without risk of liability.

Chhabria didn’t weigh in on the policy issue in his ruling, but implored the legislature to “bring CIPA into the modern age and to speak clearly about how the kinds of activities at issue in this case should be treated.”

Another fix could come from the California Court of Appeals, which so far has been silent on the application of CIPA to online technologies, said Daniel Taylor, a partner with Musick, Peeler & Garrett LLP with a data-privacy focus.

That court is set to hear Variety’s appeal later this spring.

“This is an area that’s ripe for appellate review,” Taylor said. “At this point, every trial-court judge has been starting from square one without the guidance of a higher court, so without further clarification from the legislature, an appellate ruling would be very significant.”

Matthew D. Pearson, a partner at Frankfurt Kurnit Klein & Selz PC, also called for greater clarity.

“Right now I’m hamstrung because of the number of cases that have gone the other way,” said Pearson, whose focus is online privacy. “But if the California Court of Appeals comes back and says these technologies don’t apply to the internet, it’s suddenly a lot easier to make that argument in the cases to come.”

Tauler says he remains confident that the courthouse doors aren’t about to shut on CIPA claimants.

“It would be strange if they basically left this one to history and said the law applied only to technologies that no longer exist,” he said. “And I don’t think people who are paying attention are going to be happy if they curtail the ability to police this kind of surveillance.”