December 5, 2025

Over the past year, we have observed a significant increase in demand letters issued to our clients by several California plaintiff’s firms. These letters allege violations of the California Invasion of Privacy Act (CIPA) related to the use of website tracking technologies.

Background on CIPA and Emerging Litigation

Enacted in 1967 primarily to address illegal wiretapping, the scope of CIPA has recently been expanded by certain interpretations to potentially cover modern tracking technologies such as cookies, pixels, tags, and beacons. These tools are routinely used by websites and platforms to collect and process visitor data.

CIPA authorizes civil lawsuits, allowing affected individuals to sue for statutory damages of up to $5,000 per violation. While courts are still actively adjudicating whether the use of standard tracking technologies constitutes a CIPA violation, we strongly advise taking proactive measures to mitigate risk.

Recommended Proactive Steps

To help safeguard your organization against potential litigation, we recommend implementing the following two steps immediately:

1. Review and Update Your Privacy Policy: Ensure your public-facing privacy policy accurately and clearly describes how your company collects, uses, and shares personal information from website visitors.
2. Implement an Opt-In Mechanism: We recommend utilizing a cookie consent banner that requires website visitors to provide explicit “opt-in” consent before tracking technologies are activated. Obtaining explicit consent may provide a affirmative defense against CIPA allegations.

We encourage you to prioritize these compliance efforts. Please contact our team if you have any questions or require assistance updating your privacy policies and website configurations.

For questions, please contact C. Lucas Beal