Have You Received a CIPA Demand Letter or Been Sued Over Your Website?

Businesses across the country continue to face a surge of claims under the California Invasion of Privacy Act (“CIPA”), many arising from the routine use of common website technologies such as analytics tools, chat features, advertising pixels, session replay software, and similar technologies. These claims frequently begin with a demand letter but often escalate into lawsuits, arbitrations, or putative class actions seeking significant statutory damages.

If your business has received one of these claims, you are not alone.

Our firm has seen a substantial increase in these matters and regularly advises businesses on defending CIPA claims, evaluating potential exposure, implementing practical compliance measures, and resolving disputes efficiently. We represent businesses across a wide range of industries in responding to these evolving privacy claims and work with clients to develop practical, cost-effective strategies that align with their business objectives.

Proposed Legislation Reflects Growing Concern Over CIPA Litigation

The California Legislature is again considering Senate Bill 690, legislation intended to narrow the scope of CIPA and curb the growing wave of lawsuits challenging ordinary website functionality. The bill recognizes what many businesses have experienced firsthand: a decades-old criminal wiretapping statute is increasingly being used to challenge commonplace online business practices that were never contemplated when the law was enacted.

Although the bill’s future remains uncertain, its introduction reflects growing concern among lawmakers, businesses, and courts regarding the rapid expansion of CIPA litigation.

Courts have likewise acknowledged the uncertainty surrounding the statute. One federal judge described CIPA’s language as “a total mess” and suggested that the Legislature should substantially rewrite the statute to address modern technology. Despite this uncertainty, plaintiffs continue filing lawsuits seeking statutory damages of $5,000 per alleged violation, often attempting to leverage the significant cost of defending class actions or mass arbitrations to obtain early settlements.

Businesses Should Not Assume They Have No Defenses

Many CIPA claims challenge technologies that are widely used throughout the internet, including by retailers, manufacturers, service providers, financial institutions, healthcare organizations, law firms, and even government entities. Yet plaintiffs frequently characterize these commonplace technologies as unlawful “wiretaps,” “pen registers,” or “trap and trace” devices despite significant disagreement among courts regarding whether CIPA applies at all.

The law continues to evolve, and appellate courts are expected to provide additional guidance. In the meantime, businesses should not assume that receiving a demand letter means they violated the law—or that immediate settlement is their only option.

Every case is different. A thorough legal analysis may reveal significant defenses based on:

• Whether CIPA applies to the challenged technology;
• Whether California law governs the dispute;
• The nature and operation of the website technology at issue;
• The website’s privacy disclosures, consent mechanisms, and terms of use;
• Standing, jurisdictional, and procedural defenses; and
• Recent developments in California and federal case law.

An early evaluation can often place a business in a stronger position to defend the claim, negotiate a favorable resolution, or position the case for dismissal.

Experienced Counsel Can Make a Difference

CIPA litigation has become one of the fastest-growing areas of privacy litigation in California. Many businesses receiving these claims have never heard of CIPA until a demand letter arrives alleging that their website unlawfully intercepted visitor communications.

Our attorneys regularly defend businesses facing CIPA demand letters, individual lawsuits, putative class actions, and arbitration proceedings involving website tracking technologies. We also advise companies on proactive website privacy compliance to reduce future litigation risk.

Whether your business is headquartered in California or simply operates a website accessible to California residents, it is important to evaluate these claims promptly and strategically. Early involvement often allows counsel to preserve defenses, assess exposure, identify compliance issues, and pursue the most efficient path toward resolution.

Have You Received a CIPA Demand Letter or Lawsuit?

If your business has been served with a CIPA demand letter, arbitration demand, or lawsuit relating to website tracking technologies, cookies, pixels, chat features, session replay software, or similar tools, we invite you to contact our office for a confidential evaluation.

Our attorneys can help you:

• Evaluate the merits of the claim and available defenses;
• Assess potential exposure and litigation risk;
• Develop an efficient strategy for responding to the demand or lawsuit;
• Review your website for privacy compliance and risk mitigation; and
• Position your business to minimize future claims.

These matters are evolving rapidly, and the decisions made during the early stages of a claim often have a significant impact on the outcome. If your company has been targeted by a CIPA claim, we would be pleased to discuss how we may be able to assist. To learn more contact:

Phil Zvonicek

pzvonicek@gibbsgiden.com

310-734-3380

Mr. Zvonicek is a partner in Gibbs Giden’s Irvine, California office. He represents businesses in California Invasion of Privacy Act (CIPA) litigation, including claims arising from website tracking technologies, session replay software, chat features, and alleged pen register violations.

The content contained herein is published online by Gibbs Giden Locher Turner Senet & Wittbrodt LLP (“Gibbs Giden”) for informational purposes only, may not reflect the most current legal developments, verdicts or settlements, and does not constitute legal advice. Do not act on the information contained herein without seeking the advice of licensed counsel. The content contained herein may contain attorney advertising.

For specific questions about any of the content discussed herein or any of the content posted to the Gibbs Giden website please contact the article attorney author or send an email to info@gibbsgiden.com. The transmission of information by email, over the Gibbs Giden website, or any transmission or exchange of information over the Internet, or by any of the included links is not intended to create and does not constitute an attorney-client relationship. For a complete description of the terms of use of this information and the Gibbs Giden website please see the Website Terms section at https://www.gibbsgiden.com/website-terms/. This publication may not be reproduced or used in whole or in part without written consent of the firm. Copyright 2026 Gibbs Giden Locher Turner Senet & Wittbrodt LLP ©