Accessibility Watch › CIPA Watch

Is Your Website a CIPA 'Wiretapping' Lawsuit Target?

By Accessibility Watch · June 27, 2026

If you run analytics, a Meta or TikTok pixel, a session-replay tool, or a chat widget on your site — and most business sites run at least one — a decades-old California wiretapping law has been repurposed to put you in the crosshairs. Here’s the plain-English version, including the parts the demand-letter firms would rather you not know.

What is a CIPA wiretapping lawsuit?

The California Invasion of Privacy Act (CIPA) is a 1960s anti-wiretapping law written for telephone calls. Since a 2022 wave of rulings, plaintiffs’ firms have argued that when a website loads a third-party tracker — a Meta Pixel, Google Analytics, a session-replay recorder like Hotjar — before the visitor agrees, the third party is “intercepting” the visitor’s communications with the site in real time, like an unauthorized wiretap.

It doesn’t matter that you didn’t write the tracking code or read anyone’s data yourself. The theory targets the site owner for enabling the third-party “interception.” The result is a flood of near-identical demand letters and class actions: more than 4,300 filed since 2022, about three-quarters of them in California.

Is my website a CIPA target?

You’re a plausible target if, on a cold page load with no consent given, your site sends data to a third party. The patterns these suits cite most:

• Advertising pixels — Meta Pixel, TikTok Pixel, Google Ads — firing on page load.
• Session replay — Hotjar, FullStory, Microsoft Clarity — which record the visitor’s actual mouse movement, clicks, and form input. This is treated as the strongest “recording” exposure.
• Chat and search widgets that can transmit what a visitor types before they agree.

The uncomfortable part: a great many sites that have a cookie banner are still exposed, because the banner loads alongside the trackers instead of gating them. A banner that doesn’t actually block anything is no defense — see Does a cookie consent banner actually protect you?

How much are CIPA wiretapping damages?

CIPA allows $5,000 per violation, plus attorneys’ fees. Plaintiffs argue each affected visitor is a separate violation, so the theoretical exposure across a site’s traffic is enormous. As with ADA accessibility suits, the business model doesn’t depend on winning at trial — it depends on a settlement being cheaper than mounting a defense. That asymmetry is the entire engine behind mass demand letters.

Is this risk overstated? An honest look.

It would be dishonest to tell you every CIPA suit succeeds. They don’t, and the legal ground is genuinely shifting. Courts have increasingly scrutinized standing — in Popa v. Microsoft, the Ninth Circuit signaled that generic browsing metadata may not be enough, and some courts have held that session replay isn’t “real-time interception.” Reform efforts, including California’s SB 690, aim to curb the wave.

So why fix it? Two reasons. First, demand-letter economics don’t require a winning case — only a credible-enough claim that settling beats defending. Second, and more durable: the EU treats firing non-essential trackers before consent as a straightforward GDPR/ePrivacy violation, with regulators issuing nine-figure fines for exactly this. The US litigation may ebb and flow; the underlying “don’t track before consent” rule is not going away.

How do I stop firing trackers before consent?

The fix is mechanical and the same one that satisfies EU law:

1. Add a real consent gate that records the visitor’s choice before any non-essential tag loads.
2. Fix it at the source if you use Google Tag Manager — enable Google Consent Mode v2 with ad_storage and analytics_storage defaulting to denied, and fire your tags on a consent-granted trigger. One change covers GA4, Google Ads, and any GTM-managed pixels.
3. Defer session replay and chat until after consent — they’re never essential.
4. Verify — load your site fresh with no prior consent and confirm nothing fires to a third party until you accept.

The free ForensicConsent browser extension does that last step for you: it loads your page cold, shows exactly which trackers fire before consent, and gives you the fix recipe for each — at no cost. If you’ve been named in one of our consent reports, it’s the fastest way to get the report taken down by actually fixing the problem.