CIPA “Wiretapping” Demands Are Surging — Is Your Website A Target?

What businesses with California website visitors need to know — and the steps that meaningfully reduce your exposure.

Donahue Fitzgerald is seeing a sharp rise in demand letters and class-action threats under the California Invasion of Privacy Act (“CIPA”), a 1967 anti-wiretapping statute now being aimed at ordinary website technology. A small group of repeat “tester” plaintiffs — most prominently Vivek Shah, along with firms such as Tauler Smith and the Swigart Law Group — visit business websites, capture the data those sites transmit, and demand payment.

The theory: when your site loads cookies, tracking pixels, analytics scripts, session-replay tools, or chat widgets that send a visitor’s information to third parties (Google, Meta, HubSpot, and the like) before the visitor consents, plaintiffs argue that you have unlawfully “intercepted” a communication — treating the tracker like a wiretap or “pen register” under Penal Code §§ 631 and 638.51.