A growing number of US-based website owners, including businesses located far outside California, are receiving demand letters alleging violations of the California Invasion of Privacy Act (CIPA). If your website uses third-party tracking technologies, this trend is worth understanding now, before a demand letter lands in your inbox.
What Is the California Invasion of Privacy Act?
CIPA was written more than 30 years ago to address landline wiretapping and eavesdropping. It was never designed with websites, cookies, or online advertising in mind.
In recent years, plaintiffs’ attorneys have reinterpreted CIPA to apply to modern website tracking technologies. Their argument is that tools like third-party analytics scripts, advertising pixels, and session recording software amount to a form of wiretapping when they collect visitor data without prior consent. Courts have not settled this question uniformly, but that has not slowed the volume of demand letters going out.
Why Are Businesses Outside California at Risk?
Location does not provide protection. Any website that receives traffic from California visitors is a potential target, regardless of where the business is incorporated, headquartered, or physically operating.
Because CIPA claims are tied to where the website visitor is located rather than where the business sits, a business based in Washington, Oregon, or anywhere else can still face a demand letter if California residents visit its site and encounter tracking tools that load before consent is obtained.
What Do These Demand Letters Typically Allege?
Most CIPA demand letters follow a similar pattern. They allege that a website loaded third-party tracking technology, such as advertising or analytics tools, without first obtaining the visitor’s consent. The letters often seek statutory damages that can reach into the thousands of dollars per violation, and they are frequently sent in batches to multiple businesses at once.
Is This a Change in the Law?
No. CIPA itself has not changed. What has changed is how the statute is being applied and enforced. This is an emerging litigation trend built on an aggressive reading of an old law, not a new legal requirement. That said, the practical risk is real, and it is growing.
How Can Website Owners Reduce CIPA Risk?
Reducing exposure starts with understanding exactly what is running on your website. A few practical steps can meaningfully lower your risk:
- Inventory every third-party tracking technology on your site. You cannot manage a risk you cannot see. Identify every analytics tool, advertising pixel, chat widget, and session recording tool currently in use.
- Remove any trackers you are not actually using. Unused trackers add legal risk without providing any business benefit. If a tool is not actively supporting a business decision, it should be removed.
- Add a consent solution so visitors can opt in before trackers load. Trackers should not load automatically. Visitors should have the opportunity to accept or decline tracking before it begins.
- Test to confirm no tracking cookies load before consent is given. Configuration errors are common. Regularly verify, through actual testing, that trackers are not firing early, and troubleshoot immediately if they are.
Take a Proactive Approach
CIPA demand letters are unlikely to disappear soon, and the businesses best positioned to respond are the ones that have already reviewed their website tracking practices. A short internal audit today can prevent a costly demand letter tomorrow.
If you would like to discuss whether your website’s tracking configuration may present potential exposure, Equinox Business Law is happy to help.
Contact our team to schedule a review of your website’s tracking practices and privacy compliance.
