In the 2026 legal landscape, California courts are actively defining the boundaries of digital privacy through the California Invasion of Privacy Act (CIPA). The treatment of these class actions is currently characterized by significant legal uncertainty and a notable judicial split regarding how decades-old wiretapping statutes apply to modern web technologies.

Key aspects of how courts are handling these cases include:

• Judicial Split on “Content” vs. “Record”: Courts remain divided on whether recordings from session replay software constitute protected “content” or a mere “record.” This split often determines whether a case is dismissed at the pleadings stage or allowed to proceed to expensive discovery.
• Digital Pen Register Theory: Under Penal Code 631, plaintiffs argue that logging IP addresses and behavioral data (keystrokes, scrolls, and clicks) functions as an illegal digital pen register. While some courts have dismissed these claims by ruling that IP addresses only serve a routing function not tied to content, others allow claims to proceed if the tracking involves more extensive behavioral data.
• Strict Consent Standards: The courts have moved away from accepting implied consent or buried privacy policies. In 2026, the legal standard generally requires informed, explicit, and affirmative opt-in consent before any tracking begins. Procedures like pre-checked boxes or continued browsing are increasingly viewed as legally insufficient.
• Statutory Damages Focus: Because CIPA allows for statutory damages of $5,000 per violation, courts are seeing these claims aggregated into massive class actions. This makes them a high-stakes risk for businesses, as the focus often shifts to the technical operation of pixels and the specific wording of disclosure mechanisms.

• California Invasion of Privacy Act Litigation 2026: Essential Guide