Who's Really Suing — CIPA Website-Wiretap Filers

The California Invasion of Privacy Act (CIPA) was written in 1967 to stop phone wiretapping. A wave of plaintiffs' firms has spent three years arguing it also covers the analytics and ad pixels on ordinary business websites — because those tools send data to third parties before consent.

The theory

CIPA bans wiretapping and "pen register / trap and trace" devices. Filers argue a tracking pixel (Meta, TikTok, Google, Bing) that captures a visitor's activity and reports it to a third party is a pen register, triggering a $5,000-per-violation penalty under Penal Code §637.2. Each third-party recipient can be counted as a separate violation — that's how one homepage visit becomes a big number on a demand letter.

How it arrives

Usually not as a lawsuit first — as a demand letter. A serial filer runs an automated (often HeadlessChrome) scan of your site, captures a pre-consent request to, say, Google Analytics, and proposes a per-visitor settlement. In one documented case the entire evidence was a single GA4 /g/collect request firing before any consent.

How courts are actually ruling (2025–2026)

Genuinely split.

• Several federal judges narrowed the theory, requiring that a defendant actually read the contents of a communication in transit — dismissing pixel claims. One court called the statute a "total mess" and urged the legislature to fix it.
• Other judges let claims survive, including a Southern District of California ruling that TikTok- and Bing-pixel tracking may violate the wiretap law.
• A 2025 reform bill (SB 690) that would have exempted routine commercial tracking failed to pass, so the uncertainty continues.
• Courts have also begun reining in the worst serial filers: in July 2026 one of the most prolific, Vivek Shah, was declared a vexatious litigant in the Central District of California after 29 suits and a file-then-abandon pattern. Note the limits — the order is narrow (that filer, that district, CIPA-type claims only) and punished his conduct, not the CIPA theory itself. (See ‘When the Court Reins One In.’)

What actually neutralizes it

That single change is the highest-leverage fix in this category, and it's exactly what Law-o-matic's #1 finding checks.

Sources

• Fisher Phillips
• Holland & Knight
• Mayer Brown
• Privacy World
• Jeffer Mangels (Vivek Shah demand letters)
• Varnum LLP
• National Law Review (Shah vexatious-litigant ruling, 2026)