A federal judge in San Francisco just handed website operators a meaningful win and, in the process, called the California Invasion of Privacy Act what it has long been in the digital-tracking context: a statutory relic. The decision cuts directly against the wave of CIPA-based “digital wiretapping” suits that plaintiffs’ firms have been filing nationwide. But it also confirms what every business with a website already knows: this area of law is unstable, inconsistent, and capable of producing liability even when a company follows standard industry practice.

The Statute Has Outgrown Its Own Language

The California Invasion of Privacy Act (CIPA) was enacted in 1967 to deal with one problem: telephone wiretaps. That’s it. It was a Cold War statute built for analog communications, drafted long before the internet, cookies, pixels, ad tech, or anything resembling modern data flows. As technology advanced and privacy rhetoric intensified, plaintiffs’ firms began repurposing old wiretap statutes to manufacture new digital-privacy claims. And because CIPA carries criminal exposure and punitive civil penalties, it became the tool of choice.

Enter CIPA—not as intended, but as reinvented for an entirely different era. But the CIPA was never written for cookies, pixels, session replay tools, SDKs, or anything else that now gets dragged into these lawsuits. Plaintiffs’ firms have been trying to retrofit a telephone-era wiretap law onto ordinary website-analytics tools. Courts have been split on whether a web visit is a “communication” and whether metadata collected through analytics tools is “content.”

In a recent case, Doe v. Eating Recovery Center LLC, granting summary judgment for the defendant, Judge Vince Chhabria called the whole CIPA interpretive exercise what it is: untenable. 

The Facts of the Case Don’t Support Wiretapping

The plaintiff visited a healthcare website, took a self-assessment, and later saw related ads. She sued under CIPA, arguing the website “wiretapped” her by using a third-party analytics provider.

Key evidence:

• The analytics vendor logged URLs, time-on-page, visitor paths, button clicks, and form inputs.

• The vendor filtered out privacy-sensitive information before storing data.

• There was no evidence the vendor “read,” “attempted to read,” or “learned” the contents of any communication while it was in transit.

Judge Vince Chhabria: using a third-party analytics provider is “worlds different” from wiretapping. Full stop. Summary judgment granted.

Real Problem: CIPA’s Language Is Not Equipped for the Internet

The judge did not mince words:

“The language of CIPA is a total mess… courts are issuing conflicting rulings, and companies have no way of telling whether their online business activities will subject them to liability.”

That statement will get quoted for years. It captures the core instability: businesses are trying to comply with a statute that was never meant for them.

Legislative Fix

The court openly asked the California Legislature to fix CIPA, noting that:

• CIPA carries criminal liability and punitive civil penalties.

• Ambiguous statutes with criminal exposure require narrow construction.
  Until the Legislature acts, courts should default to narrower interpretations.

• SB 690 would modernize CIPA by exempting routine commercial website activity, limiting trap-and-trace theories, and shutting down many private CIPA lawsuits. But session ended without action. The earliest lifeline is 2026.

Until then, companies remain exposed to the same scattershot litigation that has already produced contradictory rulings on:

• standing

• jurisdiction over out-of-state companies

• whether anonymous metadata counts as “content”

• whether analytics tools are pen registers or trap-and-trace devices

• whether standard tracking scripts constitute “interception”

• Some judges dismiss these cases at the threshold. Others allow them to proceed. Same courthouse, different results.

Practical Steps (For Now)

These recommendations are not theoretical. Courts have repeatedly rejected “but we complied with the CCPA” as a defense. CIPA claims are independent and can survive even when privacy disclosures are compliant.

• Do not rely on CCPA compliance: CIPA’s litigation risk is unrelated to CCPA’s consent framework.

• Audit all tracking tools: Identify every pixel, cookie, chatbot, session replay script, or SDK firing on your site. Many companies don’t actually know what’s running.

• Fix disclosures: Privacy policies and in-page notices must accurately describe data collection and third-party analytics. It is not enough to rely on broad boilerplate.

• Re-evaluate consent: Decide whether opt-in consent is necessary for high-risk tools. This is a risk-tolerance question, not a statutory requirement.

• Coordinate with counsel: Emerging CIPA rulings shift monthly. Defense strategy requires real-time monitoring and tailored disclosures.