CIPA (California Invasion of Privacy Act)

The California Invasion of Privacy Act, or CIPA, is a 1967 law found in California Penal Code section 630 and following sections. It was written for telephone wiretapping, but it is now one of the most heavily used statutes in online privacy class actions.

Key sections include Penal Code 631, which prohibits reading or learning the contents of a communication in transit without the consent of all parties, and 632, which prohibits recording confidential communications without consent. Another provision, 638.51, restricts "pen register" and "trap and trace" devices that capture routing and addressing information. Penal Code 637.2 lets a person harmed by a CIPA violation sue for the greater of $5,000 per violation or three times their actual damages. Because no proof of financial loss is required, the potential damages in a class case can be very large.

Plaintiffs have used CIPA to challenge website chat tools that record conversations, session replay software that captures keystrokes, and tracking pixels that send browsing data to advertisers such as Meta or Google. Companies argue that website visitors consented through privacy policies, that the vendor is merely a tool of the website, or that CIPA does not apply to modern web technology. Courts have split on these questions, and many cases are dismissed early, so outcomes vary widely.

If you are a California resident and a website or app shared what you did or typed there, you may be part of a proposed class. See our pages on Yahoo tracking and health app data sharing, and the California settlements guide.