CIPA Wiretapping Claims Are Surging: Why and What to Fix First

Wiretapping seems a pretty niche topic in 2026. It isn’t top of mind to anyone not regularly thinking about undercover informants or the Nixon administration.FN1 This is the kind of attention drift plaintiff attorneys seize on and are now exploiting through a surge of litigation invoking legacy wiretapping statutes, particularly the 1967 California Invasion of Privacy Act ("CIPA") .

Under federal and most state laws wiretapping (i.e., interception of oral or electronic communications using a device) is generally legal if at least one party to the conversation consents (this is even without a judicial warrant). In California, however - along with a few other states - the law follows a stricter “all-party” standard whereby it is illegal for a private person to record a "confidential communication" unless every participant gives their permission.

Until recently there was little practical consideration of how those standards applied to commercial websites and particularly with commonplace website tools like pixels, session replay, and chat widgets. These technologies automatically collect information about user activities (e.g., page navigation, clicks, inputs) and often transmit that data in real time to third-party vendors (e.g., Meta, Google, Hotjar, Intercom).

CIPA litigants, with the vigor of Henry V’s soldiers straining upon the start, have stepped into that gap, advancing the theory that these routine website interactions constitute “communications,” and that the transmission of those interactions to third parties constitute unlawful interception without lawful consent —effectively treating standard website tooling as the modern equivalent of a Watergate wiretap.

These claims (which often begin with a demand letter) do not require proof of harm. CIPA provides for statutory damages of up to $5,000 per violation, which creates immediate settlement pressure. Filings have surged over the past several years (following a pretty predictable playbook) and are not limited to large consumer platforms - startups (very early startups indeed) and mid-market companies are frequent targets, including in B2B contexts.

CIPA claims reflect a tension with broader U.S. privacy frameworks, which generally operate on an opt-out basis. The basic premise of these regimes (in contrast to say the GDPR) is that companies do not need prior consent to collect and use non-sensitive personal information so long as disclosures are made at point of disclosure and data subjects are granted various statutory rights with respect to information collected.

CIPA litigation risk pushes in a different direction - incentivizing prior consent. That dynamic is one reason cookie banners have become increasingly common in the U.S., even where not strictly required by privacy statutes.

The good news is that companies do not need to rebuild their entire website stack to meaningfully reduce risk. Two steps tend to drive most of the impact:

-Implement a consent-based cookie banner (at least for California users): A GDPR-style banner requiring users to accept or reject non-essential tracking technologies is increasingly the baseline. A number of third-party vendors can assist with implementation (the substantiv e work is not presenting the banner itself but honoring any opt-out choices selected by the user).

-Audit what actually fires on page load: Identify which tracking technologies load immediately and whether they transmit data to third parties. If non-essential scripts fire before consent, that is the highest-risk configuration.

If a company implements a consent-based banner and configures its tracking technologies so that (a) it is honoring opt-out signals (via banner select or Global Privacy Control) and (b) non-essential scripts (and any capture of user inputs) are delayed until after user consent, that will address the core issue driving most CIPA claims.

FN1. There was a forty year run before the popularization of texting, email, reality TV, live-streaming and communicating all our secrets to Amazon via product purchasing decisions when “wearing a wire" was viewed as an extraordinary, scandalous intrusion and high stakes drama, capable of, among other things, propping up the principal plot points of classic American movies and television series. The architecture of modern technology and our engagement with it has made this view harder to sustain.

This alert was prepared by Jake Molland, a Principal at Bound Legal Strategy P.C. The content of this alert is informational only and does not constitute legal or professional advice. Please note that the law changes frequently and further that the generalized information reflected in this alert may not address the specifics of a given factual situation. Please contact Jake at jake.molland@boundlegal.com if you have specific questions or concerns relating to any of the topics covered in here.