California Invasion of Privacy Act (CIPA)
A 1967 California law against wiretapping and secretly recording private communications. People can sue for $5,000 per violation, which fuels website-tracking cases.
Also called: CIPA, California wiretap law, Penal Code 630
A 1967 California law against wiretapping and secretly recording private communications. People can sue for $5,000 per violation, which fuels website-tracking cases.
What it means
The California Invasion of Privacy Act (CIPA) is a state law adopted in 1967, found in Penal Code section 630 and the sections after it. It bars wiretapping, eavesdropping and recording private communications without consent. Section 631 covers wiretapping. Section 632 bars recording a confidential communication without the consent of all parties. Section 638.51, added in 2015, limits pen registers and trap-and-trace devices. These capture the signals that show who is communicating.
Section 637.2 lets a person injured by a violation sue for the greater of $5,000 per violation or three times actual damages. The person does not have to show actual harm. That is why CIPA sits behind many class actions over website tracking, session recording and chat tools.
In September 2026 California enacted SB 690. For conduct on websites and apps, it provides that only the Attorney General can bring a civil action over a violation of section 638.51. It also reaches some claims already filed. Claims under sections 631 and 632 are not affected.
What it means for you
CIPA matters when a notice says you visited a website, used a chat tool or made a recorded call while in California. Settlements built on it usually define the class by location and dates. They pay shares of a fund, not $5,000 each. California changed the law in 2026, so check which CIPA section a case relies on. SB 690 sends pen register claims about websites and apps to the Attorney General. Claims about wiretapping or recording confidential communications can still be brought by individuals.
Example
Say a hypothetical retailer's website uses a chat widget that sends every message you type to a third-party analytics company. You never agreed to that, and you were in California when you chatted. A class action might allege the company violated sections 631 and 632 and seek $5,000 per violation. In a later settlement, the notice would describe the class by location and dates, and you would claim a share of the fund.
FAQ
The law allows the greater of $5,000 per violation or three times your actual damages, and you do not have to prove actual harm. Settlements pay far less per person because the money is shared among many class members.
Not entirely. A law signed in September 2026, SB 690, provides that only the Attorney General can bring pen register claims over website and app conduct. Claims under the wiretapping and recording sections can still be brought by individuals. The new law also reaches some claims already filed.
Related terms
- California Assembly Privacy Committee analysis of SB 690 (2026): CIPA sections 631, 632, 637.2 and 638.51
- Senator Caballero: SB 690 passes the Legislature (August 31, 2026)
- Governor Newsom: legislative update of September 30, 2026, listing SB 690 as signed
Updated Oct 18, 2026. Plain-English definitions for general information — not legal or tax advice.