CIPA lawsuit: what courts decided about pixels, chat and session replay

A CIPA lawsuit is a claim under California’s Invasion of Privacy Act that a tool on your website let someone else listen in on your visitors without their consent. The tools named are ordinary ones: an ad pixel, an analytics script, a chat widget, a session replay recorder, a script that collects visitors’ IP addresses. Where things stand now: SB 690, signed on 30 September 2026, takes private suits on the “pen register” theory away from websites and apps from 1 January 2027. The wiretapping and eavesdropping sections stay as they are.

Below: what these suits claim, which tools they point at, and what the courts have actually decided, at which stage. Then SB 690, what it leaves standing, and a check of your own site. If a letter is why you’re here, the last two sections are the practical part.

What a CIPA lawsuit claims

The California Invasion of Privacy Act is the state’s wiretapping law. It dates from 1967, when the worry was someone tapping a phone line, and it sits in the Penal Code: a criminal law with a civil remedy attached. Three of its sections show up in website suits.

Section	What it covers	How website suits use it
631(a), wiretapping	Reading the contents of a communication in transit without everyone’s consent, or helping someone do it	A vendor’s script read what visitors typed, and the site helped
632, eavesdropping	Recording a confidential communication without everyone’s consent	A third party recorded something private, like health details
638.51, pen register	Recording dialing, routing, addressing or signaling information without a court order	A script collected the visitor’s IP address for an ad company

The first row is what people mean by “cipa 631”.

What makes these claims worth bringing is section 637.2. Someone injured by a violation can sue for the greater of $5,000 per violation or three times their actual damages, and the statute adds: It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages. Multiply that by every visitor in a class. A claim can also arrive as a letter asking for a settlement before any suit is filed, and the governor’s signing message for SB 690 names lawsuits and demand letters together.

Being outside California doesn’t settle it. Section 631(a) covers a message while it is being sent from, or received at any place within this state, as the federal court quoted it in the Meta Pixel healthcare case.

The tools on an ordinary site that drew the suits

Pixels and analytics

An ad pixel loads with the page and sends the page address, and often what you clicked or filled in, to the ad platform’s servers. People search for this as a “cookie lawsuit”, though the claim is about what the script sends.

In the Meta Pixel healthcare litigation, the plaintiffs say hospitals put the Meta Pixel on their patient portals and that logging in sent information to Meta. On 7 September 2023 the federal court in San Francisco denied Meta’s motion to dismiss the CIPA claim under sections 631(a) and 632. That only lets the claim go forward.

Chat widgets

The chat box in the corner of many sites is run by a vendor, and every message passes through the vendor’s servers. The claim: the vendor is a third party listening in on you and your customer, and you helped.

In Gutierrez v. Converse, the plaintiff said Converse aided Salesforce, which ran its chat. On 9 July 2025 the Ninth Circuit upheld summary judgment for Converse: At best, this evidence shows that Salesforce could read messages sent through the Converse chat feature. The claim needed proof that it did.

Session replay

A replay script records mouse movements, clicks, keystrokes and pages visited, so the vendor can recreate the visit as a video for the site owner. The theory is wiretapping: the vendor learns what you do on the page as you do it.

Javier v. Assurance IQ and Popa v. Microsoft, both below, are replay cases.

IP lookups and “pen register” scripts

Some scripts read nothing you type. They collect your IP address and device details for an ad or data company that tries to work out who you are. The “cipa pen register” claim says that script is a pen register used without a court order.

The theory traces back to Greenley v. Kochava, a ruling about a software kit inside phone apps, not a website. On 27 July 2023 the federal court in San Diego read “process” in the definition broadly: Surely among them is software that identifies consumers, gathers data, and correlates that data through unique “fingerprinting.” The order let the claim go forward, and plaintiffs carried the idea over to website scripts.

What the courts decided

All of these are private lawsuits. A ruling on a motion to dismiss only says whether a claim can go forward on what the complaint alleges. A jury verdict is a finding, and there’s one below.

Date	Case	Court and stage	What was decided
31 May 2022	Javier v. Assurance IQ	Ninth Circuit, unpublished	Consent under 631(a) has to come before the recording
5 Jan 2023	Javier v. Assurance IQ	N.D. Cal., motion to dismiss	One-year limit; claim out of time
27 Jul 2023	Greenley v. Kochava	S.D. Cal., motion to dismiss	App software can be a “pen register”
7 Sep 2023	Meta Pixel healthcare litigation	N.D. Cal., motion to dismiss	CIPA claim goes on
9 Jul 2025	Gutierrez v. Converse	Ninth Circuit, unpublished	Chat claim fails on the evidence
1 Aug 2025	Frasco v. Flo Health	N.D. Cal., jury trial	Meta liable under 632
26 Aug 2025	Popa v. Microsoft	Ninth Circuit, published	Replay plaintiff lacks standing
27 May 2026	Blaker v. NetScout	LA Superior Court	Reported: 638.51 is for telephones
21 Aug 2026	Variety Media v. Superior Court	Court of Appeal, tentative	Reported: covers the internet, but an IP address alone falls short

Javier v. Assurance IQ: consent after the fact

The district court had accepted that the visitor consented when he clicked past the privacy policy at the end of the form. The visitor had filled in a life insurance quote form, medical history included, while a replay tool recorded it. The Ninth Circuit predicted that the California Supreme Court would interpret Section 631(a) to require the prior consent of all parties to a communication, and sent the case back. The memorandum is unpublished, so it isn’t binding precedent.

The case then ended on time. On remand the judge held that CIPA has a one-year statute of limitations, and that the privacy policy’s line about third-party vendors monitoring site activity had put the visitor on notice. The claim was dismissed for good in June 2023.

Frasco v. Flo Health: the jury verdict

Flo is a period tracking app. The class said software kits from Meta and Google inside it collected users’ menstruation and pregnancy details. Google and Flurry settled before trial, Flo during it, and Meta went to verdict. The jury found that Meta had violated section 632, and in September 2025 Judge Donato denied Meta’s motions to overturn it: Nothing in the evidence adduced at trial or the record as a whole justifies disturbing the California class or the jury’s unanimous verdict.

Meta’s latest quarterly report says the plaintiffs seek $5,000 per class member, claim up to about 1.25 million class members, and that the amount is uncertain. The plaintiffs’ motion for final judgment against Meta, which Meta opposes, and the motion to approve the settlements with Google, Flo and Flurry are both set for a hearing on 29 October 2026.

Popa v. Microsoft: session replay and standing

This one ran under Pennsylvania’s wiretap law, but it’s a published Ninth Circuit opinion about the same tool, and federal courts in California follow it on standing. The shopper had no concrete injury, so no standing to sue in federal court: Popa identifies no embarrassing, invasive, or otherwise private information collected by Clarity. The court left a door open for sensitive medical or financial information. The shopper here was browsing a pet supplies site.

NetScout and Variety Media: the pen register theory in state court

On 27 May 2026 a Los Angeles Superior Court judge in Blaker v. NetScout Systems dismissed a pen register claim without leave to amend, holding, as reported, that section 638.51 covers telephone communications and not software on a commercial website. A trial court ruling binds no other court.

A Court of Appeal ruling would. In Variety Media v. Superior Court, it issued a tentative ruling on 21 August 2026. As reported, the tentative said the pen register definition isn’t limited to telephones, but that an IP address identifies where a request comes from, not where it’s going, so the claim as pleaded failed. Then SB 690 was signed. On 1 October the court set aside the submission and asked whether the new law makes the case moot, since it was filed in January 2025 on a single pen register claim. No opinion had been filed when I checked. If the court calls it moot, nobody may get an appellate answer on whether a website script can be a pen register at all.

SB 690 closes the pen register door

SB 690 is Chapter 976 of 2026. It amends section 637.2 so that an action against a private actor under 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General. Private plaintiffs lose that claim for websites and apps. The Attorney General keeps it.

The change takes effect on 1 January 2027, as the Court of Appeal noted in its 1 October letter. It also applies to any pending claim in an action filed within two years before that date, which reaches back to suits filed from 1 January 2025.

The governor’s signing message explains why: This measure addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses. The SB 690 post covers the bill in full.

After SB 690: which CIPA lawsuit claims are left

Most of them. SB 690 leaves sections 631 and 632 alone, along with their $5,000 figure. The governor said as much in the same message: CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants. He asked the Legislature to take that on next year. Until then, CIPA claims about pixels, chat and session replay carry on under 631 and 632.

Other laws are in play. Popa shows plaintiffs using Pennsylvania’s wiretap act against session replay. The federal Wiretap Act lets one party to a communication consent, unless the interception is for a criminal or tortious purpose. Video pages bring in the Video Privacy Protection Act, which has its own case file.

On the CIPA statute of limitations, the courts so far say one year, under Code of Civil Procedure section 340(a). When the year starts is what gets argued. In Javier, a line in the privacy policy about third-party vendors started it.

How smaller and larger companies are treated

The statute doesn’t scale. Section 637.2 sets the same figure per violation for any defendant, whatever its headcount or revenue. SB 690 draws no size line either: it covers every private actor running a website or an app.

The governor’s message is about small businesses that unwittingly install software on their websites that at times have tracked and shared the information of visitors. Yet a small shop running a chat widget or a replay script faces section 631 exactly as it did before 30 September.

What it means for your site

None of this is legal advice, and a demand letter goes to a lawyer, not to a blog. But the cases show where alleged CIPA violations tend to sit, and that points at a few things you can look at today.

1. List what loads before anyone clicks: pixels, analytics, chat, replay, anything that sends data to another company. In Javier the tool was recording before the visitor saw a word about it.
2. Open the chat and replay vendor settings. See whether replay masks what people type, and what the chat vendor may do with conversations.
3. Where a tool records what people type, ask first. Consent collected afterwards is what the Ninth Circuit turned down in Javier.
4. Keep ad tools off health and money pages. Flo and the Meta Pixel healthcare case are about health details, and Popa left the door open for exactly that.
5. Say in your privacy policy which kinds of vendors receive what.

Check your own site from your phone

Use a phone in a private tab, and a laptop for step 3.

1. Open your home page in a private tab and don’t touch the banner. Note anything that appears on its own: a chat bubble, a pop-up, a video.
2. Open the chat. Look at the small print in the chat window. If it names a company other than yours, that company handles the conversation.
3. On a laptop, open the browser’s developer tools, pick the Network panel and reload. Before clicking anything, read the list of domains. Ad, analytics, chat and replay services usually have names you’ll know.
4. Go to a page with a form: contact, quote, sign-up. Is there a short notice next to the form that says what’s collected and why, or a link to one?
5. On any page about health, symptoms or appointments, repeat step 3.
6. Open your privacy policy at the part about sharing. Does it name the kinds of tools you just saw?

Peeky reads your public pages too, and writes down what he saw. For the notice next to your forms, the check is US-05. For whether your privacy policy owns up to the advertising tools on your pages, it’s US-04. And for ad and analytics tools on pages about health, treatment or appointments, it’s US-12.

Questions people ask

What is CIPA in California?

It's the California Invasion of Privacy Act, a 1967 law in the Penal Code. It covers wiretapping (section 631), recording a confidential conversation without everyone's consent (section 632) and pen registers used without a court order (section 638.51). Section 637.2 lets an injured person sue for $5,000 per violation or three times their actual damages. Most suits today are about tracking tools on websites.

What is the statute of limitations under CIPA?

Courts have applied one year. In Javier v. Assurance IQ, the federal court in San Francisco held that CIPA has a one-year statute of limitations under Code of Civil Procedure section 340(a). It threw the claim out because the site's privacy policy had put the visitor on notice. That's one district court's ruling, so other judges can see the start of the clock differently.

Does SB 690 stop every CIPA lawsuit?

No. It ends private suits under section 638.51, the pen register section, when the conduct happens on a website or an app. From then on, only the Attorney General can bring those. Wiretapping claims under section 631 and eavesdropping claims under section 632 are untouched, and the damages stay the same. The SB 690 post goes through the bill in detail.

Can a cookie banner or a chat widget lead to a CIPA claim?

A chat widget can be the subject of one: the claim is that the chat vendor reads messages as they're sent and the site helped. In Gutierrez v. Converse that claim failed on the evidence. A banner doesn't cause a claim. But the Ninth Circuit in Javier said consent has to come before the recording starts, so tools that run before the banner is answered aren't covered by it.

What should I do if I get a CIPA demand letter?

Take it to a lawyer who handles privacy litigation before you answer it. When he signed SB 690, the governor described the use of CIPA lawsuits and demand letters to pull settlements from businesses, so you're not the first to get one. Bring a list of the tools your site loads, and since when each one has been there.