If you want the short version before the detail: the single most effective way to reduce your CIPA lawsuit risk is to make sure that nothing which tracks a visitor, no session replay script, no advertising pixel, no analytics tag, no chat widget, fires until that visitor has actively agreed to it. Almost every CIPA website claim we have seen traces back to one avoidable fact: a tracker sent data before the person clicked anything. Fix the timing of when your trackers load, prove you fixed it, and you remove the factual basis most of these lawsuits are built on. Everything below is the practical version of how to actually do that, drawn from watching this play out on real sites, and none of it is legal advice, a point worth making early and one we will come back to.
We scan sites for exactly this kind of problem, and the pattern behind the current wave of lawsuits is remarkably consistent. A business installs the usual marketing stack, Meta Pixel, Google Analytics, a session replay tool like Hotjar or Microsoft Clarity, a live chat box, and every one of them starts working the instant the page loads, which is the default. Then a law firm's automated scanner visits the site, records which trackers fired before the cookie banner was answered, and mails a demand letter. The whole case rests on a network capture of your own homepage doing something you probably did not know it was doing. Understanding that mechanism is what lets you shut it down.
What is CIPA, and why is a 1967 law about your website?
CIPA is the California Invasion of Privacy Act, a wiretapping statute the state legislature passed in 1967. It was written for a world of telephone taps, tape recorders, and parabolic microphones, and its core rule is simple: you may not intercept or record a confidential communication unless every party has consented. The language, though, is broad, the consent requirement is strict, and crucially the damages do not require any proof that the plaintiff was actually harmed.
That combination is why a law older than the internet has become the engine of a litigation wave against ordinary website technology. Plaintiffs' lawyers argue that when a tracking pixel or a session replay script captures what a visitor types, clicks, and views and transmits it to a third party without consent, that is an unlawful interception of a communication, the modern equivalent of tapping a phone line. Two sections do most of the work. Section 631 is the wiretapping provision aimed at interception. Section 638.51 targets "pen registers," originally devices that recorded the numbers a phone dialed, which some plaintiffs now argue covers trackers that capture routing and identifying data like IP addresses.
The turning point was a 2022 federal appeals court decision, Javier v. Assurance IQ, in which the Ninth Circuit treated session replay software that recorded a user's activity before they were shown a privacy policy as a potential CIPA violation. That decision established the theory that tracking before consent can be unlawful interception, and a flood of filings and demand letters followed. It is worth being clear that the law here is genuinely unsettled: courts have split on whether CIPA even applies to website software, there is no statutory safe harbor yet, and some 2026 rulings have gone in defendants' favor while others let cases proceed into discovery. That uncertainty is not comforting, because it means the demand letters keep coming while everyone waits for clarity.
How big is the CIPA risk, really?
Big enough to take seriously, and structured in a way that makes it a numbers game rather than a matter of whether your site is a household name. The financial mechanism is what makes these cases attractive to file. CIPA sets statutory damages at up to $5,000 per violation, and courts have not settled what a single "violation" even is: per visitor, per session, or per page load. Multiply any of those interpretations by a site's California traffic and the theoretical exposure becomes enormous, which is precisely what gives a demand letter its leverage even when the underlying legal theory is shaky.
The public settlement figures make the point. In June 2026 the Los Angeles Times settled claims over three advertising trackers on its site for $3.85 million, covering visitors across a three-year window, without admitting wrongdoing. One tracker cited a complaint alleging a major site ran well over a hundred third-party trackers before any consent was collected at all. Across the cases that have been tracked publicly, disclosed settlements run into the hundreds of millions, and once you count pre-suit demand letters rather than just filed cases, total CIPA activity since 2022 runs into the tens of thousands of claims.
The uncomfortable structural detail is that this is not really targeted. Defense lawyers describe most filings as the output of automated scanning: firms run tools that visit large numbers of websites, watch which scripts fire before the consent banner is answered, and send letters to the ones that fail the test. Your business does not need to be famous or large to land on that list. It needs to have a common marketing stack firing on page load, which describes an enormous share of the web. And CIPA follows the California resident, not your office, so being based outside California does not put you out of reach, and being compliant with CCPA does not protect you either, because these are different obligations.
The two patterns that trigger CIPA claims
From what we see, nearly all of these claims come down to one of two failures in the timing and honesty of tracking, and both are worth understanding because the fix differs slightly.
The first and most common is pre-consent tracking. The trackers simply fire the moment the page loads, before the visitor has made any choice, so data reaches Meta, Google, or a session replay vendor in the first few hundred milliseconds of the visit. This is the "millisecond problem," and it is the factual heart of most cases, because it is trivially easy for a plaintiff to prove with a network capture and it is extremely common, since firing tags on page load is the default in most tag managers.
The second pattern is subtler and, in some ways, more dangerous: honored-in-name-only consent. Here the site shows a proper-looking banner, the visitor declines tracking or turns off a category, the banner confirms their choice was saved, and then the tracking continues anyway because the technical implementation never actually blocked the scripts. A 2026 federal court described one such site as having set an expectation that data would not be collected and then collecting it regardless. Courts treat this not as a harmless bug but as a representational failure, which can pull in additional consumer-protection and unfair-competition claims on top of the core wiretapping allegation. In other words, a broken banner can be worse than no banner, because it adds a broken-promise claim to the pile.
How do I reduce CIPA risk on my website?
Here is the practical core, the part you can actually action. Reducing CIPA risk is mostly about controlling three things: what fires, when it fires, and whether you can prove what happened. None of the following is legal advice, and your specific obligations should be confirmed with a qualified privacy attorney, but these are the operational steps that address the factual basis of the claims.
Start by blocking every non-essential tracker until you have affirmative consent. This is the single highest-impact change. Essential cookies, the ones strictly needed to make the site function, can load without consent, but everything else, analytics, advertising pixels, session replay, and chat widgets, should wait behind an explicit opt-in. If nothing that tracks fires before the click, the pre-consent theory that drives most cases has no facts to stand on.
To do that reliably you have to control the firing order at the technical layer, not just visually. Many sites add a banner that looks correct but sits on top of scripts that have already loaded, which is exactly the honored-in-name-only trap. The scripts themselves, in your tag manager, your theme, and your hardcoded snippets, must be genuinely prevented from executing until consent is recorded. That usually means loading trackers through a consent mechanism that gates execution, rather than dropping the raw vendor snippets directly into your page and hoping the banner covers them.
Then make your banner honest and symmetrical. Declining should be as easy as accepting, and when a visitor declines or turns off a category, that choice has to actually stop the corresponding scripts, not just record a preference while the tracking continues. The gap between what the banner promises and what the site does is the exact thing the second theory targets.
Finally, log every consent decision. Keep a durable record of who was shown what, what they chose, and when, because the entire dispute in these cases is about timing and consent, and a defensible log is how you answer "what actually happened for this visitor" months later. Since CIPA claims often turn on a point-in-time network capture and carry a short statute of limitations, being able to show your own contemporaneous evidence of what fired and what was consented to is genuinely valuable.
How do I know which trackers fire before consent on my site?
You check what your live pages actually do, rather than trusting your configuration. This is the same method the plaintiff's firms use, turned to your advantage: load your pages in a way that records every third-party request made before the consent banner is answered, and see which trackers appear. The trackers that recur in these cases are predictable, session replay tools such as Hotjar, Microsoft Clarity, and FullStory, advertising and analytics pixels like Meta Pixel, TikTok Pixel, and Google Analytics, and live chat widgets, so those are what to look for first.
The catch is that this is not a one-time check. A marketing team adds a new pixel for a campaign, a vendor updates a snippet, a new landing page ships without the consent gating, and pre-consent tracking quietly reappears on part of your site while the rest stays clean. This is why seeing what fires before consent, across every page and on a schedule, matters more than auditing the homepage once. Our own region-by-region guide to what your website legally needs for cookie consent covers the consent rules that sit underneath all of this, and because the direction of travel is toward browser-level signals, our look at where consent is heading with GPC and the future of cookie banners is worth reading alongside it. If you want to see exactly what loads before consent on your own pages right now, you can scan your site with Sitejar for free, up to five pages, no signup, and it shows the third-party trackers that fire before a visitor has agreed, which is the precise thing a plaintiff's scanner is looking for.
Common questions about CIPA and website tracking
Because this topic moves fast and the rules are genuinely unsettled, a few questions come up again and again. These are general explanations, not legal advice for your situation.
Does having a cookie banner protect me from CIPA claims?
Not on its own. A banner only helps if it actually gates the trackers, meaning nothing non-essential fires until consent and declining truly stops the scripts. A banner that displays while trackers have already loaded underneath it provides no protection and can make things worse by adding a broken-promise claim. The protection comes from the technical enforcement, not the visual presence of a banner.
I'm not based in California. Am I still exposed?
Possibly. CIPA attaches to the California resident who visits your site, not to where your business is located. If people in California can reach your website and your trackers fire on them before consent, the theory can apply regardless of where you operate. This is why so many businesses outside California have received these letters.
Does being CCPA compliant mean I'm CIPA compliant?
No. They are different laws with different mechanics. CCPA is California's consumer privacy statute with its own notice and opt-out framework; CIPA is a wiretapping statute with a consent-before-interception theory. Satisfying one does not automatically satisfy the other, and a number of businesses have been surprised to find that their CCPA program did nothing to address the CIPA timing question.
If I get a demand letter, what does it usually look like?
These claims typically start as a pre-litigation demand letter from a plaintiff's firm, alleging that specific trackers on your site violated CIPA and inviting a settlement before a suit is filed. A large share of all CIPA activity begins and ends at this stage, resolved confidentially. Because so much rides on point-in-time evidence of what your site did, this is a moment to involve a qualified attorney quickly rather than to respond on your own.
A necessary word on legal advice
Everything in this article is drawn from experience and from publicly reported developments, and it is written to help you understand the operational side of the problem: what fires, when, and how to prove it. It is not legal advice, and it cannot be, because CIPA is an area where the case law is actively split, where new rulings land in both directions, and where your specific exposure depends on facts we cannot see. Please treat the steps here as a way to reduce the technical risk that underlies these claims, and talk to a qualified privacy attorney about your actual obligations and any letter you receive. The engineering and the legal strategy are two different jobs, and you want both.
The bottom line
The CIPA wave is real, it is largely automated, and it targets a specific, fixable fact: trackers firing before a visitor consents. You reduce your risk most by making that fact untrue on your site. Block every non-essential tracker, session replay, advertising and analytics pixels, and chat widgets, until you have affirmative consent; enforce that at the script level so your banner's promise matches your site's behavior; make declining as easy as accepting; and log every consent decision so you can prove what happened. Then keep checking what your live pages actually load before consent, because this problem reappears every time a new pixel or page slips through. Do that, and you take away the network capture that these cases are built on. And because the law here is genuinely unsettled, pair that technical work with advice from a qualified attorney, so your engineering and your legal position are both covered.
Sources
Loeb & Loeb, The Millisecond Problem: How Pre-Consent Tracking Is Driving CIPA Lawsuits in 2026
Fisher Phillips, Digital Wiretapping Litigation Map
This article is educational and reflects Sitejar's point of view. It is not legal advice. For your specific situation, consult a qualified attorney.