Until California’s legislature provides clearer guardrails, companies should expect continued class action activity under the California Invasion of Privacy Act (CIPA), targeting common website tracking technologies. Plaintiffs’ firms are actively testing how far this decades-old statute extends in the modern web environment, and courts have not reached a consensus. That uncertainty creates real litigation risk for organizations that rely on tools like chat widgets, session replay, and analytics.

Many companies use website tools that help improve customer experience, measure performance, prevent fraud, and support marketing efforts. These tools often capture data about how visitors interact with webpages, including clicks, cursor movements, page navigation, chat messages, and form entries. Plaintiffs are increasingly arguing that certain implementations of these tools amount to unlawful interception or recording of communications under CIPA.

The result is a rising wave of proposed class actions that can be expensive to defend, difficult to predict, and costly to resolve. The practical takeaway is straightforward—even if you believe your organization’s practices are reasonable, it is worth reviewing disclosures, consent flows, and vendor configurations now, rather than after a demand letter or complaint arrives.

CIPA was enacted in 1967 to prevent secret wiretapping by both law enforcement and private individuals. The plaintiffs’ bar has since repurposed the statute to challenge modern website technologies, including:

• Chat features that allow visitors to communicate with a company in real time;
• Session-replay tools that record user interactions with webpages for troubleshooting and UX improvements; and
• Analytics code that tracks usage patterns and behavior across the site.

The core allegation is that these tools record or “listen in” on communications without proper consent. Plaintiffs often frame routine website telemetry as covert monitoring, particularly when data flows to third-party vendors.

Some courts have concluded that visitors could reasonably expect chats, form entries, or even certain click activity to remain private. In these decisions, disclosures may not be treated as sufficiently clear or sufficiently tied to meaningful consent for the specific tracking at issue. Other courts have held that website interactions are not confidential where users are clearly told their data and usage may be collected or tracked. In these decisions, prominent disclosures and clear notice can undermine the claim that a “secret” interception occurred.

This lack of uniformity is a major driver of continued filings. Plaintiffs can point to decisions that let claims survive early motions, while defendants can cite dismissals, but neither side has a guaranteed playbook.

While the courts remain split, companies can reduce risk by focusing on a few concrete areas:

• Revisit Privacy Policy and Terms of Use disclosures;
• Evaluate consent banners and how consent is captured;
• Reassess whether you need each tracking tooland its configuration; and
• Consider arbitration provisions and class action waivers.

CIPA was not written with session replay, chat widgets, or modern analytics in mind, but is being used to challenge them now. With courts split on whether website interactions are “confidential” and what level of disclosure and consent is sufficient, the best risk-management approach is proactive: confirm what your site is doing, align disclosures with reality, strengthen notice and consent flows, and evaluate contractual tools like arbitration clauses and class waivers.