Responding To CIPA Demand Letters

Data analytics software has become an essential tool in the online marketplace. Businesses rely heavily on technologies such as chat boxes, session replay and embedded tracking pixels to develop critical insights about their customers and guide their decision-making. Business owners should beware, however, of recent challenges to the use of such technologies under an expansive reading of the 1967 California Invasion of Privacy Act (CIPA). This law prohibits any party from using electronic means to learn the contents or meaning of any communication without consent, providing a statutory penalty of up to $5,000 per violation. Cal. Pen. Code §§ 631(a), 637.2.

Based on 2006 and 2020 cases interpreting the law, CIPA actions have been allowed against out-of-state businesses so long as they have customers within California and against businesses using website tracking and analytics technologies. Together, these decisions significantly expanded the geographic reach