Start for free Start for free

CIPA Pixel Lawsuits

CIPA pixel lawsuits are claims under the California Invasion of Privacy Act and similar wiretap laws that say tracking pixels and other website tools let third parties collect visitor activity without consent. In 2026 California ended private suits for one type of claim, but wiretapping claims remain.

What are CIPA pixel lawsuits?

CIPA is the California Invasion of Privacy Act. In pixel lawsuits, visitors argue that a website broke privacy laws by letting another company collect what they did on the site. A tracking pixel is a small piece of code that sends page views, clicks or form activity to an ad or analytics company.

CIPA lets private plaintiffs sue, and these cases often rely on two parts of it: the ban on wiretapping (section 631) and the ban on pen registers and trap-and-trace devices, which are legal terms for tools that capture who is contacting whom.

The same question applies to any tool that sends visitor activity to another company, such as a chat widget or a session replay script: did the visitor agree?

As of October 2026, two recent developments stand out:

  1. California SB 690: Governor Newsom signed it on September 30, 2026. From January 1, 2027, pen register and trap-and-trace claims about websites and apps can be brought only by the California Attorney General. It also reaches pending claims in cases filed on or after January 1, 2025. Private wiretapping claims under section 631 are unchanged.
  2. The Fifth Circuit, October 23, 2026: in Rand v. Eyemart Express, the federal appeals court revived a class action claiming an optical retailer disclosed customers' health-related website activity to Meta through its pixel. The claims rely on the federal Wiretap Act and Missouri and Illinois laws, not CIPA. The court did not decide that the retailer broke any law, per the Fifth Circuit's opinion.

A real change we caught

Venpo flagged that OpenAI's ad pixel now appears in CircleCI's cookie policy. A new pixel in a cookie policy can be the first public sign that a site sends visitor data to another company.

Why it matters to you

The risk sits on your own website. Every analytics, ad, chat or replay tool you add may send visitor activity to its vendor. When a vendor changes what its script collects, or its cookie policy lists new partners, your exposure can change without any change on your side. Health-related pages carry extra risk, as the Eyemart case shows.

What to check

  • List every script and pixel on your site, including those loaded by tag managers.
  • Check that non-essential trackers wait for consent where you rely on consent.
  • Read each vendor's cookie policy and privacy policy for how it uses the data it collects from your visitors.
  • Keep chat, replay and form tools off pages with health, financial or other sensitive information unless you have reviewed them.

How Venpo helps

Venpo watches your vendors' cookie policies and privacy policies and emails you a plain-English alert when they add new tracking partners or change how visitor data is used. The Fine Print Scan answers, for each vendor, whether it sells data or uses it for ads.

Start for free

Frequently asked questions

Did SB 690 end CIPA pixel lawsuits?

No. Signed on September 30, 2026, it leaves pen register and trap-and-trace claims about websites and apps to the California Attorney General from January 1, 2027, but private wiretapping claims under section 631 remain.

What should I do if I get a CIPA demand letter?

Do not ignore it, and talk to a lawyer before you respond or pay. Find out which tools on your site the letter is about and what data they send.

Related terms

How Vendors Use Your Data Tracking Pixel A tracking pixel is a small, invisible piece of code on a web page or in an email that reports your visit, clicks or email opens to another company's server, often an ad network. How Vendors Use Your Data Session Replay Session replay is a tool that records what a visitor does on a website or app, such as clicks, scrolling and typing, so the company can play the visit back like a video. Vendor Documents Cookie Policy A cookie policy is a page that explains which cookies, pixels and similar trackers a company uses on its sites and apps, why it uses them and how you can turn them off. A change often means new tracking. How Vendors Use Your Data Global Privacy Control (GPC) Global Privacy Control (GPC) is a browser setting that tells websites not to sell or share your personal information, and businesses covered by California's privacy law must honor it. How Vendors Use Your Data Targeted Advertising Targeted advertising is showing ads to a person based on data about them, such as the sites they visit or what they click, often collected by a vendor's ad partners through cookies and pixels. Laws and Regulations CCPA and CPRA The CCPA is California's consumer privacy law, and the CPRA is the 2020 ballot measure that expanded it. It gives California residents, including business contacts, rights over their personal information and limits how businesses and their vendors can sell or share it.

Sources

Last reviewed