Client Alert: Is Your Website Putting Your Business at Legal Risk?
What the California Invasion of Privacy Act Means for Businesses

If your business has a website, and most do, the common website tracking tools and standard data collection practices you are likely using may expose your business to claims under the California Invasion of Privacy Act (“CIPA”), a California law that was not originally written with modern websites in mind.

You do not need to be doing anything unusual or aggressive to become a target.  These claims, which we are increasingly seeing, often focus on ordinary website tools such as analytics platforms, advertising pixels, session replay technologies, embedded mobile SDKs, browser fingerprinting tools, and features that capture search terms or information entered into forms.

In many cases, the issue is not whether a company uses these tools.  Rather, the issue is whether they are configured to start collecting or sharing information before a user has had a meaningful opportunity to accept or reject tracking.

Why Businesses Are Seeing these Claims

The CIPA is a decades-old California wiretapping statute that plaintiffs are now applying in the website context.  The core allegation is that information about a user’s activity on a website or app is being intercepted, recorded, or shared with third parties without the user’s consent.

Many businesses believe they have addressed website privacy by adding a cookie banner, updating their privacy policy, or taking other compliance steps consistent with the notice-and-opt-out approach traditionally reflected in U.S. privacy laws. But the CIPA claims now being asserted apply a more restrictive standard, with plaintiffs arguing that certain tracking tools cannot operate until the user has affirmatively consented. As a result, even businesses following common U.S. privacy practices may still face exposure.

CIPA claims have gained momentum over the past year and are increasingly being asserted against companies whose websites rely on standard digital tools rather than unusual or high-risk practices. Many of these tools are embedded in ordinary website infrastructure and may activate automatically, putting at risk any business with a website. The legal landscape is developing. The California Legislature recently passed Senate Bill 690, which, if enacted, would substantially limit private claims under one provision of CIPA that has been used to challenge certain website and app tracking technologies. The legislation would not, however, eliminate other CIPA claims, including claims alleging the unlawful interception of the contents of communications.

The Everyday Tools That Are Getting Businesses Sued

You may be using some of these tools without realizing that their configuration can create legal exposure:

Many of these tools are embedded into standard website infrastructure and may activate automatically as soon as a page loads. If they are not properly configured, they may begin collecting and sending information to third parties before the user has made any choice about tracking.

Why a Cookie Banner May Not Be Enough

A cookie banner alone may not be enough.  Many companies believe they are compliant because they added a cookie consent banner or updated their privacy policy.  But those steps alone do not ensure that user consent is obtained before embedded tracking tools begin collecting or sharing data.

The issues we commonly see include:

• Tracking tools load or fire and start collecting data before the user has interacted with the website’s consent mechanism.
• Clicking “Reject All” does not fully disable tracking or downstream data sharing, even though the banner appears to indicate that it has.
• Third-party scripts or integrations operate independently of the site’s consent mechanism.
• Tag management systems are set to fire automatically and are not tied to user consent choices.

The result can be a gap between what the website appears to do and what is actually happening when the site loads and begins collecting or sharing data.

Why These Claims Are Hard to Ignore

Courts are continuing to work through how the CIPA applies to website tracking technologies, and the viability of these claims can depend on the particular technology and information at issue. Nevertheless, these cases can be difficult to dismiss early and can be expensive to defend.  When a complaint is filed, it is often pled in a way designed to survive a motion to dismiss, creating pressure on defendants to resolve the claim before significant litigation costs accrue.  The pattern is a familiar one:  a claimant sends a demand letter together with a draft complaint and pushes for a quick settlement on a compressed timeline. Claims may be brought on behalf of an individual or as a putative class action, with class claims presenting potentially substantial defense costs and exposure.  If the underlying technical issue is not corrected, other plaintiffs can, and often do, assert similar claims based on the same website behavior. This can result in repeated exposure over time, particularly where the same tracking setup remains in place across the site or app.

Even where a claim is brought by an individual, resolving that claim generally does not prevent another claimant from asserting similar claims based on prior or ongoing website activity. Correcting the website’s underlying configuration can help reduce the risk of additional claims arising from the same website behavior.

What a Lower-Risk Website Setup Looks Like

A lower-risk setup generally means that user choices align with how data is actually collected and shared.  In practical terms, non-essential tracking tools should not activate until the user has provided consent, and user selections such as “Reject All” should prevent tracking and data sharing.  That usually requires making sure that the website’s consent management platform or cookie banner controls how tags, scripts, and third-party tools load and operate across the website or app.

What Every Business Should Know About Its Website or App

At a minimum, businesses should understand the following:

1. What tracking tools are active?
   Identify all analytics, advertising, replay, SDK, fingerprinting, and form-capture technologies running on the website or app.

2. When do those tools load or fire?
   Determine whether they activate before or after a user interacts with the site’s consent mechanism.

3. What data is being collected and transmitted?
   Understand what information each tool collects or sends, including whether it includes information about what a user communicates or does on the site and whether it identifies, or can be linked to, a particular website visitor.

4. Does the consent banner actually control data collection?
   Confirm that user choices truly control how and when data is collected and shared.

5. Where is the data going?
   Understand which third parties receive the data and whether that flow matches your intended approach and the disclosures made to users.

The goal is to confirm that the website’s behavior matches both the company’s intended compliance approach and the disclosures made to users.

Weighing Legal Risk and Business Impact

For some businesses, especially those that rely heavily on digital advertising, campaign measurement, and user behavior analytics, moving to a stricter prior-consent approach can reduce available data and affect marketing performance or revenue.  For this reason, this is often not just a legal compliance issue but also a business decision that requires weighing the operational impact against the potential litigation risk and associated costs.  Different businesses may reach different conclusions depending on their reliance on these tools and the level of legal risk they are prepared to accept.

We Can Help

If you are not sure how tracking is actually functioning on your website or app, now is a good time to review it.  We can help evaluate how your tracking tools operate in practice, identify where exposure may exist, and recommend practical, prioritized steps to reduce risk without losing sight of your business objectives.

A focused review can provide a concrete picture of your current risk profile and the changes most likely to reduce it.

Contact: Brian Hall at .

****

This Client Alert does not create an attorney-client relationship. The information provided is for general informational purposes only and should not be construed as legal advice or as a substitute for professional legal counsel or services.