CIPA lawsuits have gone from a few hundred filings to roughly 4,000 in about two years, and most of the businesses caught up in them never made a decision they thought was risky. They added a chat widget. They installed analytics. They ran a remarketing pixel because their ad platform told them to.
Two things changed recently, and they point in opposite directions. California is running out of time on a bill that would shut down a large share of these claims. Florida has quietly become the new place to file them. If you are watching only California, you are watching the wrong state.
What CIPA Lawsuits Are Really About
The California Invasion of Privacy Act was written in 1967 to stop people from wiretapping telephones. Nothing about it was designed for websites. But plaintiffs’ firms have spent the last few years arguing that a tracking script is a modern wiretap, and enough courts have let those claims past the motion to dismiss stage to make the theory worth pursuing at scale.
The tools that draw claims are ordinary ones: website chat widgets, third party analytics, session replay software, and advertising pixels that report what a visitor did on your site.
Two different sections of the law get used, and the difference matters far more now than it used to. Section 631 is the wiretapping provision, covering the alleged interception of the contents of a communication, meaning what someone typed into your chat box or your form. Section 638.51 is the pen register provision, covering routing and signaling data, which is closer to metadata. Most of the recent filing volume has come through 638.51, because it does not require anyone to show that sensitive content was captured.
Intent is not part of the claim. Harm usually is not either. That combination is what makes these cheap to file and expensive to fight.
How CIPA Lawsuits Differ From CCPA
These two get confused constantly, since both are California and both involve personal data. They are not the same kind of law.
CCPA is a regulatory framework built around consumer rights: access, deletion, opt outs, and disclosure about how you use personal information. Enforcement mostly runs through the state, with a narrow private right of action limited to certain data breaches.
CIPA is a criminal statute with a private right of action attached, and that attachment is the whole story. It lets an individual sue directly, and it carries statutory damages that do not require proving anyone was hurt. One is a compliance regime. The other is a litigation engine. Your obligations under each are different, and so is your exposure.
Why These Lawsuits Are Surging
Websites run on other people’s code. A typical site loads a dozen scripts that phone home to somebody: chat, CRM, analytics, A/B testing, remarketing. Each one becomes an exhibit if consent was not obtained first.
The economics also work for plaintiffs. Statutory damages mean a filing does not need a sympathetic injury to carry settlement value. A handful of firms and a small number of repeat plaintiffs generate most of the volume, and the demand letters that settle quietly never appear in any case count. One prolific individual litigant was declared a vexatious litigant in July 2026, which tells you something about the pace.
And consumers genuinely care now in a way they did not a decade ago. A site that feels evasive about data collection makes both an easier target and a less sympathetic defendant.
California Is Running Out of Time to Close One Door
Here is the part most coverage has not caught up with. California SB 690 would remove the private right of action for pen register claims under Section 638.51, leaving enforcement to the Attorney General. Since 638.51 drives much of the current filing volume, that would take a real bite out of it.
It has already failed once. The bill cleared the Senate unanimously in 2025, then stalled in an Assembly committee and became a two year bill. It came back on July 1, 2026, when the Assembly Committee on Privacy and Consumer Protection advanced a narrowed version aimed squarely at the pen register claims.
Now the calendar matters more than the politics. The legislature reconvened on August 3 and adjourns on August 31. SB 690 has to clear the Assembly floor and win Senate concurrence inside that window, then survive the Governor. Miss it and the bill is dead for another year. If it does pass, it would become operative January 1, 2027, and the current version carries a retroactivity provision reaching back at claims filed within two years before enactment.
What it would not do is touch Section 631. Wiretapping claims over intercepted content, along with Section 632 recording claims, keep their private right of action. So the correct read is not “this is going away.” It is that one specific theory might lose its engine, and only if a bill that has already died once gets through in under four weeks.
Florida Is Opening Another
While California debates narrowing, Florida has become the growth market. The statute is the Florida Security of Communications Act, Fla. Stat. 934.03, with civil remedies under 934.10. Florida is an all-party consent state, meaning every participant in a communication has to consent before an interception is lawful.
The turn came from W.W. v. Orlando Health, decided in the Middle District of Florida on March 6, 2025. The court found the plaintiff had adequately alleged interception of content through third party pixels and let the claim survive a motion to dismiss. The parties dismissed the case themselves in February 2026, so no court ever ruled on the merits. It did not matter. The signal was enough, and plaintiffs have since filed hundreds of similar claims, many in small claims court where defending costs more than settling.
The damages math differs from California’s. FSCA provides $1,000 per violation or $100 per day of violation, whichever is greater, plus actual damages, fees, and possible punitive damages. That is lower per incident than CIPA’s $5,000, but the daily accrual means an uncorrected site keeps adding to the number while you decide what to do.
The case to watch is Magenheim and Neil v. Nike in the Southern District of Florida, set for trial November 2, 2026. It would be the first major FSCA pixel case to reach a jury, and however it lands will shape how aggressively these get filed next year.
One more thing worth knowing: liability follows the location of the person whose communication was intercepted, not where your business is headquartered. A company that has never set foot in Florida can be named because Florida residents visit its website. We went deeper on all of it in our post on Florida wiretapping lawsuits, including the single plaintiff behind more than 160 of these filings.
How CIPA Lawsuits Can Impact Your Business
Financial exposure comes first. CIPA allows statutory damages of $5,000 per violation, and when a claim covers many visitors the arithmetic gets alarming fast. That number is what gives a demand letter its leverage, whether or not the case would survive a real fight.
Then there is the time. Responding means reconstructing what your site loads, when it loads it, and what each vendor does with the data afterward. Most organizations have never documented any of that. Doing it under a deadline, with counsel billing hourly, is the expensive way to find out.
Reputation is real but usually overstated. Privacy stories fade. The audit is what lingers, because once you actually look you tend to find tracking nobody remembered installing and scripts left behind by vendors you stopped paying two years ago.
Talk to Your Counsel First
This is a legal question before it is a website question. Whether any of it applies to you depends on where you operate, who visits your site, what your tools capture, and what your vendor agreements say. E11 is not a law firm, and nobody at a web agency should be telling you whether you are liable. Your counsel makes that call.
If you have already received a demand letter or a complaint, talk to them before you change anything or write anything down. Remediation sequencing becomes a legal decision at that point, and internal notes about what you found can become discoverable.
What CIPA Mitigation Actually Looks Like
Counsel tells you what you need. Someone still has to build it. We have run several of these projects now, and the work is more specific than “install a cookie banner.” It is packaged as a fixed scope, which you can read in full on our privacy and consent compliance page.
The core of it is configuring a consent platform, usually CookieYes or Termly, to actually block third party cookies and scripts before consent rather than just displaying a notice about them. Most cookie banners, as installed, do close to nothing. They appear, they collect a click, and the tracking already fired before the visitor ever saw the banner. Real pre-consent blocking means classifying every cookie and script on the site, sorting them into categories, and wiring the platform to hold the ones that need holding.
There is a technical wrinkle worth naming, because it catches people. When a script tag is hardcoded into your page with a static source, the browser’s preload scanner can fetch it before any consent logic gets a chance to run. The banner is not broken. It never had the opportunity. Those scripts have to be handled differently, and finding them means watching what the browser actually requests rather than trusting the plugin’s dashboard.
The platform then has to behave correctly after consent, which is the half everyone forgets. A visitor who accepts should get the analytics and advertising they agreed to. A visitor who declines should stay blocked without quietly breaking the site.
Blocking Works, and It Will Cost You Data
Here is the tradeoff nobody selling compliance likes to lead with. When tracking only fires after consent, every visitor who declines or ignores the banner disappears from your reporting. Not from your traffic. From your ability to see it.
This hits every channel that depends on a cookie or a pixel. GA4 sessions, Google Ads conversions, Meta attribution, remarketing audiences, and any dashboard built on top of them. Advertising and retargeting take the worst of it, because those platforms need to recognize a specific person across visits, which is exactly what consent blocking prevents. Organic search reporting holds up better, since Search Console counts clicks at Google’s end rather than on your site.
The size of the drop varies more than any vendor benchmark suggests. We have seen it land anywhere from 5 to 40 percent depending on the audience and how the banner is built, and published studies put it higher still when analytics is fully gated. We wrote about that mechanic on its own in a separate post about cookie consent and analytics data loss, including what actually recovers the data rather than simply blocking less.
What matters is planning for the drop instead of discovering it. Tell whoever reads the reports before the change, not after. Treat the first month of post-consent numbers as a new baseline rather than a decline, and keep a record of the switchover date so next year’s comparison does not look like a catastrophe. If measurement is critical to the business, there are ways to recover part of it, and that conversation should happen during the build rather than a quarter later.
Around all of that, we update cookie and privacy policies so they describe what the site genuinely does, and we set up the request forms you need to handle access and deletion requests, including the verification steps that keep you from handing someone else’s data to whoever asks for it.
Then the whole thing gets packaged for your counsel to review and approve. We make the technical calls and document each one. They decide whether the calls were the right ones.
Where This Leaves You
The risk is shifting rather than simply growing. California may narrow one theory, if a bill that has already stalled once can clear both chambers before the end of August. Florida is expanding, with a jury verdict coming in November that will tell us a great deal. Other all-party consent states are watching both.
You do not need to panic, and you should be skeptical of anyone selling you something on the premise that you will be sued tomorrow. What you should do is find out what your website actually loads before a visitor consents to anything, because that answer drives your exposure under every one of these statutes. Most organizations have never checked. It takes an afternoon.
Start with your counsel on whether it applies to you. If you want help with the build, that is exactly what we do.
Common Questions About CIPA Lawsuits
Do CIPA lawsuits only affect California businesses?
No. These claims turn on where the visitor is, not where the business is, so a company anywhere can be named if California residents use its website. Florida’s FSCA works the same way.
Geofencing your consent banner does not solve this, which is the part people get wrong. Someone on a VPN looks like they are in a different state entirely. A California resident visiting family in Ohio is still a California resident. A Florida customer reading your site from an airport in Denver is still covered by Florida law. Location detection tells you where a request appears to come from, and that is not the same thing as who the person is or which state’s law protects them.
Does having a cookie banner protect me?
Only if it actually blocks. A banner that displays a notice while tracking scripts fire anyway is documentation that you knew about the issue, not a defense. The blocking behavior is the part that matters.
What is the difference between CIPA Section 631 and Section 638.51?
Section 631 covers intercepting the contents of a communication, such as text typed into a chat window or a form. Section 638.51 covers routing and signaling data, closer to metadata. Most recent filings use 638.51, and it is the section SB 690 would change.
If SB 690 passes, is this over?
No. It would remove the private right of action for 638.51 claims only. Section 631 wiretapping claims and Section 632 recording claims would keep theirs, and it would do nothing at all about Florida. It also has to pass first, before the legislature adjourns on August 31, 2026, having already stalled once in 2025.
Will blocking trackers before consent hurt my analytics?
Yes, and you should budget for it. Everyone who declines or ignores the banner drops out of your reporting. We have seen the loss run from 5 to 40 percent, with published studies reporting higher, and paid advertising feels it more than organic search. The traffic does not change. Your visibility into it does.
Should nonprofits worry about CIPA lawsuits?
Yes. These statutes do not carve out nonprofits. Nonprofit sites run the same analytics, chat widgets, and donation page pixels that generate claims for commercial sites, and a nonprofit’s legal budget is usually a lot smaller.
