What CIPA Pre-Consent Tracker Claims Actually Turn On

The California Invasion of Privacy Act is a criminal wiretapping statute. It was written for telephone lines, it speaks the language of interception and recording devices, and for most of its life it had nothing to do with marketing websites. It has become the basis for lawsuits plaintiffs' firms have filed against ordinary businesses over the trackers on their pages. The gap between what the statute describes and what it is being pointed at is the reason nobody can tell you with confidence how these cases come out.

That gap is also why CIPA lands differently on a compliance team than the CCPA does. The CCPA is a regulator problem. An agency has to open an investigation, and most mid-market companies will never be selected. CIPA is a plaintiff problem. Anyone who visited your site can be a named plaintiff, the complaint is largely a template once the tracker list is known, and the pleading is assembled from what the site itself broadcasts to anyone who loads it with a network panel open. There is no gatekeeper deciding you are interesting enough.

This page separates the two legal theories that get filed under the CIPA heading, walks the damages arithmetic that drives a demand letter, sets out where the courts currently disagree, and explains why the presence of a consent tool on your site does not answer the question a CIPA claim actually asks.

What CIPA is

CIPA is a chapter of the California Penal Code covering the interception and recording of communications. Two of its provisions carry the website-tracking claims, and they are not variations on one idea. They describe different conduct, they have different elements, and they are defended differently. Readers who treat them as a single "CIPA claim" tend to misjudge their own exposure, usually by assuming that a defense that works against one also works against the other.

• Section 631, the wiretapping provision. The theory is that a third party reads the contents of a communication between the visitor and the website while that communication is in transit. Applied to a web page, the alleged third party is the tracking vendor, and the alleged communication is what the visitor typed, clicked, or submitted. The fight in these cases is usually about two things: whether what was captured is content at all, and whether the vendor is a genuine third party or is better understood as an extension of the site itself.
• Section 638.51, the pen register and trap and trace provision. This provision addresses a device or process that records routing, addressing, or signaling information rather than content. Applied to a web page, the theory is that an advertising or analytics tag which reports the visitor's addressing information to a third party operates as a pen register. Because this theory does not require anyone to have read message content, it clears a lower factual bar than section 631.

Keep the two apart as you read anything else about CIPA. A ruling that a particular tracker is not intercepting content says nothing about whether it is recording addressing information, and the reverse is equally true.

The pen register theory in practice

The clearest illustration of how far the pen register theory has been pushed comes from Camplisson v. Adidas America, Inc., 2025 WL 3228949 (S.D. Cal. Nov. 18, 2025). As reported by the National Law Review and CIPAWorld, the plaintiff alleged that a TikTok Pixel and a Bing tracker on the retailer's site operated as pen registers, and the court denied the motion to dismiss. The reported reasoning is the part worth holding on to: the court rejected the argument that a pen register must capture all of a device's outgoing information rather than partial routing and addressing data.

We have not pulled the underlying opinion, which sits behind a paywall, so treat the description above as consistent secondary reporting from law firm sources rather than as a reading of the docket. The significance is structural rather than factual. If partial addressing data is enough, then the ordinary behavior of a mainstream advertising pixel is inside the theory, and no unusual configuration is required to get there.

The damages arithmetic that drives a demand letter

California Penal Code section 637.2 provides that a person injured by a CIPA violation may recover the greater of $5,000 per violation or three times the amount of actual damages. That is the number that makes CIPA a business problem rather than a legal curiosity, because it does not require the plaintiff to have lost anything.

A demand letter does the arithmetic in the most favorable direction available. It treats each affected visitor as a violation, it applies the statutory figure to each one, and it presents the product as the exposure. The scaling is what makes the letter work:

• One thousand affected California visitors, at $5,000 each, is $5 million.
• Ten thousand is $50 million.
• One hundred thousand, which is an unremarkable quarter for a regional retailer, is $500 million.

Two things stop that from being a prediction, and both belong in any honest description of the risk. First, whether "per violation" counts each communication or each lawsuit is genuinely contested among courts, so the multiplier that makes the headline number is not settled practice. Second, the arithmetic only matters if the claim survives, and as the next section sets out, the courts that have ruled on this theory so far are split on whether it does.

The more useful reference point for scale is a resolved case rather than a demand. Law360 reports that Mirmalek v. Los Angeles Times Communications LLC, No. 3:24-cv-01797 (N.D. Cal.), a website-tracker class action, settled for $3.85 million, with approval reported in late June 2026. Secondary reporting indicates an appeal of that settlement has been filed, so it is not a closed book. Still, it gives a better sense of the order of magnitude than any figure produced by multiplying a visitor count by a statutory penalty.

What actually triggers a letter

These claims are not built from your privacy policy or from your consent platform's settings. They are built from what a browser does on your live page, and specifically from what it does in the window before the visitor makes any consent choice. That window starts at navigation and ends at the visitor's first interaction with the consent interface. Everything that fires inside it fired without a choice having been made.

Three categories of tooling account for most of what plaintiffs point at:

• Session replay and behavior analytics. These tools exist to record what the visitor does on the page, which is the fact pattern the wiretapping theory was built around. A tool that begins recording keystrokes or form interaction before any consent choice is the cleanest version of the section 631 allegation.
• Advertising pixels. The pen register theory's natural target, because a pixel's ordinary job is to report addressing information about the visitor's device to a third party. The Adidas allegations involved a TikTok Pixel and a Bing tracker, and nothing about those two products makes them special; the allegation was about what the tag reported, not about which vendor supplied it.
• Chat and support widgets. These sit in an awkward place because the visitor is typing message content into them, so the content question that complicates a section 631 claim elsewhere is easier for a plaintiff to plead here. Many of these widgets also load their own third-party analytics alongside the feature you actually wanted.

The uncomfortable part is that none of these categories has to have been installed deliberately or recently. A tag added for one campaign three years ago, a widget bundled into a theme, or a vendor script that quietly added a piggybacked request in an update all produce the same observable behavior on the wire.

What the evidence looks like

A pre-consent finding is not a judgment about a vendor. It is a timestamped list of requests the browser made before the visitor touched the consent interface. The shape of that record is what makes it usable, whether you are handing it to a vendor or attaching it to a ticket:

t+0.00s  navigation start
t+0.41s  GET  https://www.example.com/                     200  document
t+0.98s  GET  https://cdn.consent-tool.example/loader.js   200  script
t+1.12s  POST https://ads.example-network.com/collect      204  xhr
         payload: page_url, referrer, viewport, client_id
t+1.40s  GET  https://replay.example-vendor.com/rec.js     200  script
t+2.75s  [consent interface first interaction]

The two requests at t+1.12s and t+1.40s are the entire finding. The consent loader was present, it had already run, and two third-party endpoints were contacted anyway before the visitor had chosen anything. Whether that amounts to a CIPA violation is a legal question this page does not answer. What it is, unambiguously, is the factual predicate a complaint is drafted from, and it is visible to anyone who loads the page.

Where the courts actually disagree

Anyone telling you that California courts have settled whether CIPA reaches website tracking is describing a record that does not exist. The decisions cut both ways, and the split is not subtle.

• Claims allowed to proceed. The Adidas court denied the motion to dismiss on the pen register theory, as described above.
• Claims dismissed with prejudice. Consumer Finance + Privacy Counsel reports that the Los Angeles County Superior Court sustained a demurrer and dismissed pen register and trap and trace claims against NetScout with prejudice on May 27, 2026. The same reporting notes an Orange County Superior Court demurrer sustained without leave to amend on January 27, 2026. These were materially similar claims, and they did not survive.
• No appellate answer yet. Two California Courts of Appeal have the question pending. Zwillgen and Carpe Datum Law report that Variety Media, LLC v. Superior Court (Second District, No. B350578) drew a tentative ruling on August 21, 2026 and was argued on August 25, 2026, with no final opinion issued as of late August 2026, and that Reuters News & Media, Inc. v. Superior Court is pending in the Sixth District. The reported tentative in Variety Media went to whether collecting a visitor's IP address alone constitutes pen register activity. A tentative ruling is not a holding, and neither appeal has produced binding guidance.

The practical consequence of an unresolved split is that the expected value of a claim is unstable in both directions. A defendant cannot rely on the dismissals, because another court reached the opposite result on similar facts. A plaintiff cannot rely on Adidas for the same reason. What both sides can rely on is the underlying factual record, which is why the network capture matters more than the doctrinal argument for a business trying to understand its own position.

There is also pending legislation. Senate Bill 690 passed the California Legislature on August 28, 2026 and was enrolled and presented to the Governor on September 4, 2026. He has until September 30, 2026 to sign or veto it, and under Cal. Const. art. IV, § 10(b)(2) it becomes a statute without his signature if he returns nothing by then. It is not law today, and a separate post in this series works through what each outcome would and would not change; the short version is that the bill addresses the pen register provision and leaves the wiretapping provision alone.

Why an installed consent tool does not answer this

The most common response to a CIPA letter inside a mid-market company is to point at the consent platform. It is deployed, it is configured, someone reviewed the categories, and the dashboard is green. None of that is evidence of anything a CIPA claim asks about, and the reason is a mismatch of subject matter rather than a defect in any product.

A consent platform reports its own configuration. It can tell you which vendors it knows about, which categories they sit in, and what its loader is set to block before a choice is recorded. That is a complete and accurate description of the platform's intended behavior. A CIPA claim is about something else entirely: what the browser actually did on the live page, in the seconds before the visitor chose. Those two things agree most of the time, and the cases are built out of the times they do not.

They diverge for ordinary reasons, none of which involve the tool malfunctioning:

• A tag hardcoded into a template or a landing page builder never routes through the platform's loader, so no configuration reaches it.
• A vendor script that was well behaved at audit time adds a piggybacked request to a fourth party in a later release, and nothing in your settings changes.
• A campaign page ships outside the usual template and carries its own tags.
• Server-side forwarding runs outside the browser altogether, where a client-side consent decision has no reach.
• A race condition lets a tag fire before the loader has resolved the consent state, which is a timing outcome rather than a configuration one.

In each case the platform is doing exactly what it was told. The divergence is a property of the site's markup and its release history, not of the vendor's software, which is why reading the settings screen more carefully never surfaces it. Only an observation at the network layer does, because the network layer is the only place where the question "what did the browser send before the visitor chose" has an answer.

This gap between a configured tool and observed behavior is not hypothetical, and it is not confined to CIPA. Under the CCPA, which is a different statute enforced by a regulator rather than by private plaintiffs, the California Privacy Protection Agency issued a stipulated order against American Honda Motor Co. in March 2025 carrying a $632,500 administrative fine. Honda had a third-party cookie management tool deployed. The order's findings turned on how the resulting flow behaved for the consumer, including that turning advertising cookies off took two steps while turning them back on took one, which the agency found failed the symmetry requirement in section 7004. The fine, findings, and remedial obligations ran against Honda as the business operating the site, not against the tool's provider. The lesson that transfers to CIPA is narrow and worth stating precisely: having the tool is not the measurement. The measurement is what the page does.

Where CIPA and the CCPA overlap, and where they do not

The two regimes are frequently discussed together because the same observed behavior can matter to both, but they are asking different questions and the answers do not transfer.

• Different enforcers. The CCPA is enforced by the California Privacy Protection Agency and the Attorney General. CIPA claims of the kind described here are brought by private plaintiffs, usually as putative class actions.
• Different subject matter. The CCPA regulates notice, consumer rights, and the sale and sharing of personal information, including the notice at collection duty in section 7012 and the symmetry requirement in section 7004. CIPA regulates interception and the recording of communications. A site can satisfy one framework's requirements and still present the fact pattern the other is concerned with.
• Different remedies. The CCPA's enforcement pathway runs through administrative penalties and orders. CIPA carries the private statutory damages provision in section 637.2 described above.
• One shared factual record. The list of third-party requests that fired before a visitor chose is relevant to both. That is the practical reason to collect it once and keep it, rather than assembling it separately each time someone asks.

What is observable, and what is not

A scan is a measurement instrument, and it is worth being precise about its edges before treating a clean result as reassurance. A network-layer observation of a page load can establish which third-party endpoints were contacted before any consent interaction, when each request went out relative to navigation start, and what the request URL carried. That is the factual predicate, and it is the thing your own server logs cannot give you, because a log records that a request arrived, not that a tag was held back.

What no page-load observation can establish is whether a given request amounts to a violation of section 631 or section 638.51. That is a legal question, it depends on facts about the vendor relationship that are not visible on the wire, and as this page has set out, the courts are not currently in agreement about it. A scan tells you what happened. It does not tell you what it means, and anyone selling you a tool that claims to do the second thing is overstating what the instrument does.

There are also failure modes on the measurement side worth knowing about. Consent interfaces are frequently gated by geography, so a capture taken from outside California may not see the same interface a California visitor sees. Tags fire on some routes and not others, which is why a homepage-only check understates coverage. And a capture is a snapshot of one moment in a codebase that keeps changing. A separate post in this series walks the manual version of this check step by step, including where the manual version produces false negatives.

How to think about the risk without overstating it

A description of CIPA exposure that is useful to a general counsel has to hold several things at once, and the temptation in this category is to drop whichever one is inconvenient.

1. The statutory damages figure is real. Section 637.2 says what it says, and the arithmetic that produces a large demand is arithmetic anyone can do.
2. The multiplier that makes the headline number is contested. Whether "per violation" means per communication or per lawsuit is unsettled, so the largest figures in a demand letter rest on an unresolved reading.
3. The underlying theory is unsettled too. Some courts have let these claims proceed and others have dismissed materially similar ones with prejudice. Two appeals are pending specifically because the question is open.
4. The factual predicate is not unsettled at all. Whether your site contacts third-party endpoints before a visitor chooses is a matter of observation, not argument. It is the one part of this that resolves to a yes or a no on the day you check.

That last point is why the measurement is worth having regardless of how the law lands. If the appellate courts narrow these theories, or if the pending legislation is signed, the specific claim being described here changes shape. What does not change is that a page contacting an advertising endpoint before the visitor makes a choice is a fact about your site, and it is a fact that shows up in more than one framework. Knowing it is a different position from assuming it, and the assumption is usually the one that turns out to be wrong.

For the mechanics of the consent-signal side of this, the same network-layer question applied to opt-out preference signals is covered in our guide to honoring the GPC signal, and the gap between a configured consent platform and observed runtime behavior is treated at more length in why a consent platform cannot see every tracker.