California’s Invasion of Privacy Act (CIPA) is a 1967 criminal wiretapping statute being stretched to govern 2025-era internet technologies.  The result has been a patchwork of conflicting decisions that turn on hair-splitting distinctions about what it means to “read” a communication “in transit,” whether URLs and clickstream data constitute “contents,” and how third-party service providers fit within a statute that never contemplated real-time web analytics, session replay tools, or ad technology.

The U.S. District Court for the Northern District of California recently addressed these issues in its order granting a defendant’s motion for summary judgment (Jane Doe v. Eating Recovery Center LLC, Case No. 3:23-cv-05561-VC).  As the Court noted, “[t]he language of CIPA is a total mess. It was a mess from the get-go, but the mess gets bigger and bigger as the world continues to change and as courts are called upon to apply CIPA’s already-obtuse language to new technologies. Indeed, we have reached the point where it’s often borderline impossible to determine whether a defendant’s online conduct fits within the language of the statute.”   

Courts have oscillated between expansive and narrow readings of CIPA, producing different, often irreconcilable outcomes on materially similar facts and leaving businesses without clear compliance guardrails while also facing the threat of punitive civil damages.  In some cases, the same technologies have been treated as unlawful interception; in others, as outside the statute’s reach.  This disarray imposes substantial, recurring costs on California businesses—defense expenditures, insurance pressures, product redesigns, and settlement leverage untethered to any clear statutory boundaries—without delivering predictable privacy outcomes for consumers.  That is an unsustainable public policy for a statute that carries statutory damages per violation and threatens to punish commonplace digital practices that other California privacy regimes, such as the CCPA, already regulate with far greater specificity.

The California Legislature must modernize CIPA to reflect how the internet actually works. SB 690, which we previously discussed here, is a necessary first step in that direction.  The bill unanimously advanced in the California Senate and, if passed, will narrow CIPA’s application.  Passing SB 690 and undertaking a broader, technology-informed rewrite of CIPA would deliver the clarity that courts and businesses need, while preserving consumer protections.