Received a CIPA demand letter about your website? What to do first

What does the letter claim?

Most letters rely on one or both of two sections of the California Penal Code:

• Section 631(a), the wiretapping provision. It reaches anyone who, without the consent of all parties, reads or attempts to read or to learn the contents of a communication, and anyone who aids or permits that. Letters argue that a vendor's script on your site learns what visitors type or click, and that you aided it.
• Section 638.51, the pen register and trap and trace provision. It prohibits installing or using a pen register or a trap and trace device without first obtaining a court order, except as specified. Letters argue that a tracker that collects IP addresses or device information is such a device.

The letter usually points to Section 637.2, which gives a person injured by a violation a civil claim. Relief includes the greater of $5,000 per violation or three times actual damages, and an injunction, and the plaintiff need not have suffered actual damages. That figure, multiplied across visitors, is what gives the letter its weight.

Sources: Penal Code § 631; Penal Code § 638.51; Penal Code § 637.2; Assembly Committee on Privacy and Consumer Protection, analysis of SB 690.

What does SB 690 change?

The Governor signed SB 690 on 30 September 2026. In his words, it "eliminates the private right of action under the California Invasion of Privacy Act (CIPA) for violations of the pen register and trap-and-trace statute arising from conduct occurring on an internet website, online application, or mobile application."

Under the California Constitution, a statute enacted at a regular session goes into effect on 1 January next following a 90-day period from its enactment, unless one of the Constitution's exceptions (such as an urgency statute) applies (article IV, section 8(c)). For a bill signed on 30 September 2026, that is 1 January 2027. In place of private claims, the Attorney General may enforce the pen register provision for this conduct. The bill also reaches some cases already filed: its author states that it "applies the change to qualifying claims filed during the previous two years", and the text proposed in the Assembly committee applies it to "any pending claim in an action commenced within two years before the operative date". Counsel should read the enacted text against the filing date of the case.

What SB 690 does not change: the private claim under Section 631 (wiretapping) and the other sections of CIPA remain. A letter that relies on Section 631 is not answered by SB 690, and many letters plead both. The Governor's message also asked the Legislature to look at the other CIPA provisions next year.

Sources: Governor of California, legislative update of 30 September 2026; signing message for SB 690; California Constitution, article IV (Assembly Clerk); SB 690, California Legislative Information; Senator Caballero, release of 31 August 2026; Assembly Committee on Privacy and Consumer Protection, analysis of SB 690, comment 7.

What should you do first?

1. Note the deadline, but do not reply yourself. Letters set short deadlines. A quick reply that explains or apologises can be used as an admission. Send the letter to counsel and to your insurer (step 5).
2. Preserve the evidence. Issue a written hold to the people who manage the website, the tag manager and the consent tool. Keep the site's configuration, the tag manager's version history and the consent banner settings as they stood on the dates the letter names. Do not delete scripts or logs before they are preserved; removing a tool going forward is a separate decision for counsel.
3. Find out what the site actually ran. List every script, pixel and cookie that loaded on the pages named in the letter, and whether each one fired before or after the visitor's choice in the banner. The letter's description of your site is often generic. This firm offers a free scan of a public website for this purpose (website scan); because the scan is offered by this firm, we mention it with that disclosure.
4. Check the vendors. For each tool named, find the contract, the data processing terms and any indemnity. Note whether the vendor may use the data for its own purposes or only for yours. Whether a vendor that uses the data only for the website owner is a third party to the communication is disputed; one federal court treated such a vendor as an extension of the website owner rather than a third party (Graham v. Noom, Inc., No. 3:20-cv-06903-LB (N.D. Cal. Apr. 8, 2021)).
5. Notify your insurers. Cyber, media liability and directors' and officers' policies may respond, and each has its own notice conditions. Some policies exclude claims based on wiretapping or privacy statutes; read the exclusions with counsel before relying on cover.
6. Check your own website terms. If your terms of use contain an arbitration clause and a class action waiver, whether they bind the visitor depends on how the visitor accepted them (a click, or only a link in the footer). See our guide on terms of service.
7. Have counsel answer. Counsel can test the letter's facts against the evidence from steps 2 to 4, assess which claims survive SB 690, and decide whether to answer, negotiate or wait.

Pixels, chat widgets and session replay: which theory reaches which tool?

What a cookie banner does, and does not, do

A banner helps only if the tools actually wait for the visitor's choice. A banner that shows "reject" but lets the pixel fire on page load supports the letter's claim rather than answering it. Consent also has to come first: in an unpublished decision, the Ninth Circuit held that Section 631(a) requires the prior consent of all parties, so agreement given later in a visit does not cure what was recorded before it (Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022)). Unpublished decisions of that court are not precedent except as its Rule 36-3 provides.

Source: Javier v. Assurance IQ, LLC, memorandum of 31 May 2022.

Checklist

• Letter sent to counsel and to the insurer within the policy's notice period
• Written hold issued; site configuration, tag manager history and banner settings preserved
• List of every script and pixel on the named pages, with firing order against consent
• Vendor contracts, data processing terms and indemnities collected
• Each claim mapped to Section 631 or Section 638.51, and to SB 690
• Website terms checked: arbitration clause, class waiver, how visitors accepted them
• No reply sent by the company itself

Questions people ask

Should we just pay? Not before counsel has compared the letter with what your site actually ran. A letter may describe tools the site never used, or raise claims that SB 690 removes. A payment made without a release drafted by counsel may not end the matter.

How long do we have? The deadline in the letter is the sender's, not the law's. It still matters for the negotiation, and your insurance policy may set its own notice period, so act within days.

Does SB 690 end our exposure? Only for private claims under the pen register provision based on website or app conduct. Claims under Section 631 continue.

Will our insurance cover it? It may. Cyber and media liability policies sometimes respond to privacy claims, and some exclude wiretapping statutes. Notify early and let counsel read the exclusions.

Is removing the pixel an admission? Changing the site going forward is not in itself an admission, but preserve the earlier configuration first and let counsel decide the timing.

Update log

• 16 October 2026: first published. Sources checked the same day; SB 690's look-back for filed cases and a court decision on vendors added.