Updated October 2026. Feroot does not provide legal advice; consult your own counsel.
TL;DR
- What CIPA is. The California Invasion of Privacy Act (Penal Code sections 630 to 638) prohibits intercepting the contents of a communication in transit or recording a confidential communication without the consent of all parties, and installing pen-register or trap-and-trace devices without a court order.
- What changed. From January 1, 2027, private pen-register claims over websites and apps are gone (SB 690). Sections 631 and 632 remain, with $5,000 per violation.
- Who CIPA applies to. Any business whose website or app communicates with people in California, wherever the business is based.
- What matters now. Chat, session replay, form-field capture and search terms in page URLs: what each one captures, where that data goes, and whether consent came first.
- How Feroot supports your program. DXComply inventories every script and its endpoints, validates consent at run time in every consent state, and keeps a dated record you can hand to counsel.
Does CIPA apply to my website?
If people in California use your website or app, assume CIPA applies. CIPA was written for telephone wiretapping, and courts have applied its "technology-neutral" terms to online communications for years. The business's location does not matter; the visitor's does.
The three statutes that matter, and what each requires
| Section | What the section prohibits | Website example | Private claim after January 1, 2027? |
|---|---|---|---|
| 631(a) | Reading or learning the contents of a communication while in transit without consent, and aiding anyone who does | A chat transcript or a typed form field sent to a vendor's servers before the visitor agreed | Yes. Requires content, a third party, interception in transit and no prior consent. |
| 632(a) | Recording a confidential communication without all-party consent | A live chat the visitor reasonably expected to be private | Yes. Courts presume ordinary browsing is not confidential, so these cases are fewer. |
| 638.51 | Installing a pen register or trap-and-trace device without a court order | An analytics pixel that records IP address and referrer (the theory behind most 2023 to 2026 suits) | No. Only the Attorney General, for website and app conduct. Retroactive to suits filed since January 1, 2025. |
Section 637.2 supplies the remedy for all three sections: the greater of $5,000 per violation or three times actual damages, without proof of actual damages.
The capture paths that survive
- Chat and chatbot vendors. The conversation is content. If the vendor receives the conversation before consent, or uses the conversation for its own purposes, the 631 question is open.
- Session replay. Keystrokes, mouse movement and form entries, reconstructed as a video. Some courts have held that replay tools do not read content "in transit." Whether a particular tool does depends on how the site integrates that tool.
- Form-field capture. Scripts with access to what a visitor types, including before submission.
- Search terms in page URLs. When a site search puts the query in the URL and a third party receives the URL, the content travelled with the request. Search terms in URLs are how plaintiffs' counsel most often prove interception.
Why the consent banner is not the answer
A consent banner records a choice. It does not show what fired on the page before the banner appeared, what kept firing after a visitor declined, or where the data went. Those are the facts a 631 claim turns on, and the facts a defense needs. These facts can only be observed in the browser, page by page, across every consent state, and they change with every release and every new tag.
What a defensible record looks like
- An inventory of every script, pixel, tag and SDK on every page and app screen, including the third and fourth parties your vendors load.
- The endpoints each script sends data to.
- Which scripts have access to chat, form and interaction data.
- What fired before consent, and what fired after a visitor declined, in each jurisdiction you serve.
- A dated history, so the record for a given month describes that month, not a reconstruction made after the letter arrived.
How DXComply supports your CIPA program
- Discovery and inventory. Continuous discovery of scripts, cookies, trackers and data flows across websites and mobile apps, with no code changes.
- Consent validation at run time. Banners and app privacy controls are checked on every page and screen, and downstream scripts are verified against the visitor's choice in every consent state, including what loads before consent.
- Interaction-data access. Scripts with access to chat, form or interaction data are flagged, with the endpoints those scripts send data to.
- Enforcement when you choose it. Block first- and third-party cookies, pixels, tags and scripts that load before consent or ignore a decline.
- Continuous evidence. Consent activity, enforcement actions and script behavior captured continuously; audit-ready documentation that is current, not reconstructed.
DXComply works alongside your consent management platform, including OneTrust, Cookiebot and TrustArc. DXComply verifies the CMP rather than replacing the CMP.
Frequently asked questions
What are the penalties under CIPA? Civil: the greater of $5,000 per violation or three times actual damages (section 637.2). Criminal penalties also exist for sections 631 and 632. From January 1, 2027, private civil claims under the pen-register statute are not available for website or app conduct.
Do other states have similar laws? Florida and Pennsylvania courts have allowed some website wiretap claims; Massachusetts' highest court has rejected such claims under that state's statute. The federal Wiretap Act is often pleaded alongside state claims.
Can Feroot detect pre-consent data capture? Yes. DXComply detects trackers that load before consent and opt-outs that do not take effect, on every page and screen.
Can Feroot show what a chat or replay tool captured? DXComply flags scripts with access to chat, form and interaction data and shows the endpoints those scripts send data to. Ask for a demo on your own site to see the detail available.
Does Feroot make us CIPA compliant? No product can. DXComply produces the observations and the evidence your program and your counsel rely on.
