Wiretapping; Reading the Contents of a Communication in Transit

What it requires

Section 631(a) makes it a crime to read, attempt to read, or learn the contents or meaning of a communication while it is in transit, willfully and without the consent of all parties to the communication, and reaches anyone who aids, agrees with, employs, or conspires with a person to do so. Plaintiffs apply it to website tools that receive what a visitor types or does on a page, such as session-replay scripts and hosted chat widgets, on the theory that the vendor is a third party listening in. Section 637.2 gives anyone injured by a violation a private right of action for $5,000 per violation or three times actual damages. Whether a particular vendor is a third-party eavesdropper or an extension of the website is contested in the courts, and a site scan cannot answer it. What a scan can observe is which such tools load before a visitor has made any consent choice. SB 690, presented to the Governor in September 2026, amends § 637.2 and leaves § 631 unchanged.

Legal text (excerpt)

(a) Any person who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, [...] or who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section, is punishable by a fine not exceeding two thousand five hundred dollars ($2,500) [...].

Primary source

Privisy checks

The following Privisy scanner checks are grounded in this citation:

• CIPA: Session Replay Before Consent

  A session-replay vendor receiving what a visitor types and does on the page before any consent choice is the fact pattern § 631 claims rest on. Exposure signal only: whether the vendor is a third party is not resolved by a scan.

• CIPA: Chat Widget Before Consent

  A hosted chat vendor is positioned to receive the contents of a visitor's messages. Lower confidence than session replay, because content only flows once the visitor types.