Audited by Privisy

CIPA: California Invasion of Privacy Act

California courts (private right of action under Penal Code § 637.2)

California wiretapping and eavesdropping statute. Section 631 reaches anyone who reads or learns the contents of a communication in transit without the consent of all parties, a prior-consent standard rather than the opt-out standard the CCPA applies.

2Citations
1Audited
1Reference only
Jan 2023Last amended
Official source ↗Effective 1967

CIPA citations (2)

§ 631Audited

Wiretapping; Reading the Contents of a Communication in Transit

Section 631(a) makes it a crime to read, attempt to read, or learn the contents or meaning of a communication while it is in transit, willfully and without the consent of all parties to the communication, and reaches anyone who aids, agrees with, employs, or conspires with a person to do so. Plaintiffs apply it to website tools that receive what a visitor types or does on a page, such as session-replay scripts and hosted chat widgets, on the theory that the vendor is a third party listening in. Section 637.2 gives anyone injured by a violation a private right of action for $5,000 per violation or three times actual damages. Whether a particular vendor is a third-party eavesdropper or an extension of the website is contested in the courts, and a site scan cannot answer it. What a scan can observe is which such tools load before a visitor has made any consent choice. SB 690, presented to the Governor in September 2026, amends § 637.2 and leaves § 631 unchanged.

ConsentData Collection
§ 637.2Reference

Civil Action for Damages and Injunctive Relief

The private damages provision for the whole invasion-of-privacy chapter, § 631 included. Anyone injured by a violation may sue for the greater of $5,000 per violation or three times actual damages, may seek an injunction in the same action, and does not have to show actual damages to bring the claim. This per-violation figure is what turns a website tracking theory into class-action exposure. SB 690, presented to the Governor in September 2026, would amend this section so that claims under § 638.51 arising from website, online app, or mobile app conduct are enforceable by the Attorney General only, with no change to § 631. This record will be re-audited after the Governor acts.

Enforcement

Stop Guessing. Start Knowing.

Find out exactly where your website stands before a regulator does.

Get My Compliance Audit