California Invasion of Privacy Act Litigation Risk

CIPA is a California law originally designed to prohibit wiretapping and eavesdropping. Plaintiffs now argue that website tracking technologies (e.g., Google Analytics, Meta Pixel, chat tools) may “intercept” communications between a website and its users.  

• Lawsuits and demand letters are increasingly targeting cookie-based tracking and third-party integrations
• Businesses nationwide—not just those in California—are being targeted if their sites are accessible by California users 
• Statutory damages can be $5,000 per violation  

The most frequently targeted technologies include: 

• Google Analytics and similar analytics tools
• Advertising pixels (Meta, LinkedIn, etc.)
• Session replay or keystroke tracking tools
• Chatbots and contact forms
• Embedded third-party services 

These are commonly alleged to transmit user activity to third parties without consent.

No. A privacy policy alone is not sufficient. 

Best practices require: 

• Transparent disclosure of tracking technologies
• Clear explanation of data sharing with third parties
• Alignment with actual technical behavior of the site 

Courts and regulators focus on what the website actually does, not just what it says. 

Yes—if your website uses non-essential cookies or tracking technologies. 

A compliant banner should do the following: 

• Offer Accept All / Reject All / Customize options
• Use clear, plain-language disclosures
• Provide equal prominence for acceptance and rejection
• Block any cookies or tracking technologies that are not strictly necessary for core website functionality (e.g., analytics, advertising, or third-party tools) unless and until the user provides affirmative (opt-in) consent. 

Contact your website vendor to discuss compliance. 

Yes—but only with safeguards: 

• Do not allow analytics tools to run before user consent 
• Configure tools to minimize data collection
• Disclose their use clearly in your privacy policy 

Even when configured, analytics tools may still present risk if data is shared with third parties before consent is obtained. Choosing to remove these tools entirely will eliminate risk. 

HIPAA adds a critical additional layer of risk. If tracking tools collect or transmit protected health information (PHI), then HIPAA applies, and disclosure of PHI to vendors (e.g., Google, Meta) without authorization may violate HIPAA. See the HHS guidance on online tracking technologies for more information. 

Minimum recommended actions: 

• Contact your website vendor to discuss compliance
• Audit your website for all tracking technologies
• Implement a true opt-in cookie banner
• Prevent analytics/pixels from firing before consent
• Update your privacy policy
• Evaluate whether you actually need high-risk tools

Vendor agreements are a critical risk control. 

A. Data Use and Purpose Limitation

• Vendor may use data only to provide contracted services
• No independent use, monetization, or resale of data
• Vendor must not deploy tracking technologies without prior written approval 
• Vendor must ensure tools comply with consent requirements
• Example principle: data must be used “solely to fulfill obligations”  

B. Compliance with Privacy Laws 

• Require vendor to:
  • Comply with CIPA, CCPA/CPRA, HIPAA (if applicable)
  • Maintain written privacy and security policies
  • Certify compliance upon request
• Vendors should warrant compliance with applicable data protection laws 

C. Indemnification  

• Include indemnity for:
  • Privacy violations
  • Unauthorized data disclosures
  • Failure to obtain required consent
• Sample concept: vendor indemnifies for claims arising from failure to comply with data protection obligations  

D. Data Security Requirements 

• Require vendor to provide:
  • Encryption, access controls, and audits
  • Written security program 
  • Prompt breach notification
• Agreements should define required safeguards and incident response protocols  

E. Data Ownership 

• Practice retains full ownership of all patient and website data
• Vendor receives only limited rights to process data 

F. Data Retention and Deletion 

• Vendor must delete or return data at termination
• No indefinite retention
• Contracts should include clear deletion/return requirements 

G. Subprocessors / Third Parties 

• Vendor must disclose all downstream vendors
• Obtain approval before sharing data
• Ensure downstream vendors comply with all privacy and security requirements 

H. Audit and Cooperation Rights 

• Right to audit vendor compliance
• Cooperation with regulatory inquiries or litigation 

Practices may also wish to review cyber liability insurance policies, as some policies exclude coverage for privacy or tracking-related claims. 

• Do not ignore it
• Preserve website configurations and logs
• Consult your website vendor, legal counsel, and insurance coverage promptly
• Evaluate: 
  • Whether tracking occurred before consent
  • Whether third-party data sharing occurred 

No—courts are divided. 

• Some decisions favor plaintiffs; others dismiss claims
• Judges have described the law as unclear and evolving
• Litigation is expected to continue
• The uncertainty itself drives settlements and enforcement pressure. 

Jacqueline Wade Cooney, Damon D. Eisenbrey & Chesley S. McLeod, California’s Invasion of Privacy Act: A New Frontier for Website Tracking Litigation, American Bar Association – Business Law Today (Aug. 5, 2024)

Varnum LLP, The Rise of CIPA Website Tracking Claims (Feb. 17, 2026)

Burr & Forman LLP, What Are CIPA Claims, and How Can Businesses Defend Against Them? (Apr. 9, 2026)

Alexis S. Anderson, Best Practices for Apps & Websites to Avoid Claims Under the California Invasion of Privacy Act (CIPA), Greenberg Glusker LLP Client Alert (Apr. 29, 2024)

U.S. Department of Health & Human Services, Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (updated June 20, 2024)

FasterCapital, Privacy Policies: Addressing Data Protection in Vendor Agreements (updated Apr. 9, 2025)

Captain Compliance, Cookie Consent Best Practices: Ultimate Guide (Feb. 26, 2025)