Audited by Privisy

CIPA: California Invasion of Privacy Act

California courts (private right of action under Penal Code § 637.2)

California wiretapping and eavesdropping statute. Section 631 reaches anyone who reads or learns the contents of a communication in transit without the consent of all parties, a prior-consent standard rather than the opt-out standard the CCPA applies.

2Citations
1Audited
1Reference only
Jan 2023Last amended
Official source ↗Effective 1967

CIPA citations (2)

§ 631Audited

Wiretapping; Reading the Contents of a Communication in Transit

Section 631(a) makes it a crime to read, attempt to read, or learn the contents or meaning of a communication while it is in transit, willfully and without the consent of all parties to the communication, and reaches anyone who aids, agrees with, employs, or conspires with a person to do so. Plaintiffs apply it to website tools that receive what a visitor types or does on a page, such as session-replay scripts and hosted chat widgets, on the theory that the vendor is a third party listening in. Section 637.2 gives anyone injured by a violation a private right of action for $5,000 per violation or three times actual damages. Whether a particular vendor is a third-party eavesdropper or an extension of the website is contested in the courts, and a site scan cannot answer it. What a scan can observe is which such tools load before a visitor has made any consent choice. SB 690, signed September 30, 2026 and effective January 1, 2027, amends § 637.2 and leaves § 631 unchanged.

ConsentData Collection
§ 637.2Reference

Civil Action for Damages and Injunctive Relief

The private damages provision for the whole invasion-of-privacy chapter, § 631 included. Anyone injured by a violation may sue for the greater of $5,000 per violation or three times actual damages, may seek an injunction in the same action, and does not have to show actual damages to bring the claim. This per-violation figure is what turns a website tracking theory into class-action exposure. SB 690, signed September 30, 2026, amends this section effective January 1, 2027: a claim against a private actor under § 638.51 arising from conduct on an internet website, online application, or mobile application may be brought only by the Attorney General, including any pending claim in an action commenced within two years before that date. Claims under § 631 are unchanged. The excerpt below is the text in force until then.

Enforcement

See what your site actually does under these rules.

The Privisy audit runs 56 checks on your live site and cites the section behind every finding.

Get Your Audit