CIPA demand letters about website tracking: what changed in 2026, and what didn’t

What a CIPA demand letter is

The California Invasion of Privacy Act (CIPA) is a 1967 law written for phone taps. Since 2022, plaintiffs’ firms have used it against websites, arguing that tools which pass a visitor’s activity to an outside company act like a wiretap or a tracing device.

A demand letter usually names the site, describes a tool seen on it, and offers to settle before a lawsuit is filed. Lawmakers heard that about 4,000 CIPA lawsuits had been filed in California by July 2026, and firms have sent letters to thousands more businesses.

The tools the letters point to

The letters and lawsuits tend to name the same kinds of everyday tools:

• Advertising pixels that send page visits and purchases to ad platforms.
• Analytics tags that build a profile of each visitor.
• Session recording, which captures clicks, scrolls and typing.
• Chat widgets run by an outside company, which can pass what a visitor types to that company.
• Tools that keep running after a visitor has pressed Reject on the cookie banner.

What SB 690 changes

Governor Newsom signed SB 690 on 30 September 2026. From 1 January 2027, private plaintiffs can no longer bring claims under CIPA’s “pen register” and “trap and trace” section (Penal Code 638.51) over what happens on a website or app. Only the California Attorney General can. It also reaches back to claims in cases filed in the two years before that date.

Many of the recent cases relied on that section, so the number of new filings built on it is likely to fall.

What SB 690 does not change

The wiretap section (631) and the section on recording confidential communications (632) are untouched, and private plaintiffs can still bring claims under them. Law firms tracking these cases expect complaints and letters to move to those sections and to federal and other states’ wiretap laws.

SB 690 creates no safe harbor for tracking tools, and it does not change California’s consumer privacy law (the CCPA), which the state’s privacy agency and Attorney General keep enforcing on their own.

What owners do first

On most online stores, the tools these letters describe were added by a marketing team, an app or an agency and left on their default settings. The useful first step is a plain list: what runs on your site before a visitor makes any choice, what keeps running after they say no, and which outside companies receive what they type or do.

If you have received a letter, show it to your own counsel before you reply. The facts about your site are what any answer starts from.

Public cases about tracking tools

• 3 Dec 2025 · U.S. District Court for the Northern District of California (class action) · $46 million

  Kaiser Permanente settles class claims over trackers on its sites and apps

  Analytics and ad tags inside patient portals and apps can turn into an eight-figure class settlement even when no misuse is shown.

  Read the summary
• 1 Jul 2025 · California Attorney General · $1.55 million

  Healthline settles claims that its opt-outs and consent banners did not work

  A consent banner is judged by what the trackers do after a click, not by how the banner looks.

  Read the summary
• 30 Sep 2025 · California Privacy Protection Agency (CalPrivacy) · $1.35 million

  Tractor Supply ordered to pay and to keep an inventory of its trackers

  Knowing every tracker running on your sites is now part of the work: this order requires a current list.

  Read the summary

Each case is summarised on our news page and linked there to the regulator’s or court’s own announcement. Allegations are the regulator’s own, and a settlement usually comes without any admission.

Common questions

Does SB 690 stop CIPA demand letters?

Not on its own. It ends one kind of private claim over website conduct from 1 January 2027. Claims under CIPA’s wiretap sections, and under other laws, are still open to private plaintiffs.

Does it matter if my business is not in California?

The letters are sent to businesses whose sites are visited by people in California, wherever the business is based. Whether any law reaches your business is a question for your counsel.

Is a cookie banner enough?

A banner is judged by what the tools on the page do before and after a visitor’s choice, not by how it looks. Several public cases turned on tools that kept running after a visitor said no.