In 2026, violations of the California Invasion of Privacy Act (CIPA) primarily involve the unauthorized interception or recording of digital communications. As technology evolves, courts are applying traditional wiretapping statutes to modern web tools like analytics scripts, chat widgets, and pixels.

According to the current legal landscape, the following actions constitute violations:

• Digital Wiretapping (Penal Code § 631): This occurs when a business uses session replay scripts or software to intercept electronic communications in real-time without the consent of all parties. This includes recording mouse movements, scrolls, and keystrokes as they happen.
• Digital Pen Register Violations (Penal Code § 638.51 / § 635.5): Businesses may violate this provision by using tracking technologies (like pixels) that capture “dialing, routing, addressing, or signaling information.” This includes the unauthorized logging of IP addresses or metadata that tracks how a user interacts with a site.
• Recording Confidential Communications (Penal Code § 632): A violation occurs if a confidential communication—where a party has a reasonable expectation of privacy—is intentionally recorded without consent. In 2026, this expectation extends to various online interactions that are not public broadcasts.
• Inadequate Consent Mechanisms: Simply having a privacy policy is insufficient. Violations occur when tracking begins before a user has provided informed, explicit, and affirmative opt-in consent. Legally insufficient methods include:
• Pre-checked cookie boxes.
• Implied consent through continued browsing.
• Burying disclosures in fine print.
• Third-Party Data Transmission: A violation may occur if a website embeds third-party code that transmits detailed user behavioral data to advertising or analytics vendors without adequate disclosure and prior consent.

• California Invasion of Privacy Act Litigation 2026: Essential Guide