California Invasion of Privacy Act (CIPA)

Kronenberger Rosenfeld is at the forefront of CIPA litigation defense, helping businesses across the country. If you have received a CIPA violation or demand letter, contact our team for a free consultation today.

What is CIPA?

The California Invasion of Privacy Act (CIPA), Cal. Penal Code §631 et seq., passed in 1967, was meant to criminalize eavesdropping on telephone calls. However, recent cases revolve around alleged wiretapping via illegal "trap and trace", often based on a defendant's use of a third-party marketing pixels, cookies, or web beacons.

What is "trap and trace"?

Under California’s Invasion of Privacy Act (CIPA), a “trap and trace device” is any device or process that captures incoming electronic signals to identify the source of a communication without recording the content itself. Trap and Trace has been repurposed to include tracking tools that log device identifiers, IP addresses, URLs, and similar metadata. The tools most commonly named in CIPA tracking pixel complaints include:

• Meta Pixel (Facebook or Instagram Pixel) - Sends IP address, device information, URL paths, and event data to Meta, sometimes tied to user identifiers or emails via Advanced Matching functions.
• Google Analytics - Logs IP address, device/browser details, page paths, and referrers that can identify the source and path of a communication.
• Microsoft Bing Ads / UET and Microsoft Clarity - Tracks session behavior, clicks, page flows, and replay sessions, which plaintiffs characterize as capturing routing and signaling information about user interactions.
• LinkedIn Insight Tag (LinkedIn Pixel) - Sends visitor and page-level metadata to LinkedIn for retargeting and audience building.

Does CIPA apply to my business?

CIPA pixel lawsuits can impact any business that interacts with California residents. If California users use your website, app, or phone lines, you can face CIPA claims. California State privacy laws can apply to out-of-state businesses because they focus on protecting California residents regardless of the business’s location.

CIPA Violations

CIPA is a powerful statute for plaintiffs because it provides for statutory damages of $5,000 per violation, which can create massive financial risks for defendants. Generally, a business will first be notified of a CIPA violation when they receive a demand letter or notice of litigation from a plaintiff's firm, outlining the claims and demands.

CIPA lawsuits and arbitration complaints generally focus on a few main arguments. Specifically, plaintiffs argue that website tracking technologies are analogized to unlawful "pen registers" or "trap-and-trace" devices. Technologies used on websites (cookies or tracking pixels) capture information, like IP addresses, when users visit the site. That information can be sent to third-party platforms, like LinkedIn, TikTok, and Google. Plaintiffs argue that this collection and sending of information without consent to third parties is similar to the use of a pen register or trap-and-trace device, and which would be a violation of CIPA.

Respond to a CIPA Demand Letter

Our firm vigorously defends CIPA claims on behalf of our defendant clients, in both courts and in arbitration. Specifically, we have significant experience responding to demand letters from Tauler Smith and Swigart Law Firm. If you have been named in a lawsuit or arbitration, or if you have received a demand letter alleging California Privacy violations, we would be happy to discuss how we could help.

Rise in CIPA Litigation

The California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA") does not allow for individual consumers to sue for damages. This has led plaintiff's attorneys to repurpose the decades old CIPA law to address privacy violations, in response to rampant use of marketing pixels and cookies that pass private information of website users to third parties such as Google or Meta (i.e. Facebook).

While some courts have been skeptical about the merits of these arguments, other courts have refused to quickly dismiss cases. As these cases work their way through state and federal courts, there are strong arguments that defendants can assert at any stage. Contact us today for a free consultation.

RELATED CONTENT

How to Respond to a CIPA Tracking Pixel Demand Letter (May 2026 - Blog)

Download The Essential Guide to California Invasion of Privacy Act (CIPA) (Spring 2026 - Guide)

Does California Invasion of Privacy Act Apply to My Business? (November 2025 - Blog)

California Invasion of Privacy Act Litigation Updates (October 2025 - Blog)

Webinar: CIPA Litigation Trends after Javier vs. Assurance IQ, featuring Jim Carlson (September 2025 - Blog)

Firm Elevates Jim Carlson as Senior Associate (January 2025 - Blog)