The email looks official. A law firm says your website broke the California Invasion of Privacy Act. It says the chat widget, the ad pixel or the analytics script on your site "intercepted" a visitor's communications. It mentions $5,000 per violation, a class action, and a deadline. It offers to make it all go away for a payment.
You run a small business. You have never heard of this law.
Take it seriously, and do not panic. Thousands of businesses have received these letters, many of them as small as yours. Here is what the letter is, what California signed into law on 30 September 2026, and what to do first.
In a hurry? Do not ignore the letter. Before you reply, take it to a lawyer who handles California privacy claims, and do so before the deadline in the letter. Keep a record of what your website loads today. Then find out whether your trackers fire before visitors agree to them. The steps are below.
What a CIPA demand letter is
It is a letter from a plaintiffs' law firm, sent before any lawsuit is filed. It claims your website broke the California Invasion of Privacy Act (CIPA), and it asks you to pay to settle the claim. If you do not, it says, a lawsuit, a class action or a wave of individual arbitrations will follow.
CIPA is a 1967 California law written for telephones. Plaintiffs' firms now apply it to ordinary website tools. A demand letter is not a court finding. It is the firm's claim, and many of these claims have been dismissed when businesses fought them. But the letters keep coming because many businesses decide it is cheaper to pay.
The three theories most letters use
1. Wiretapping (Penal Code §631). The law makes it unlawful to read or learn the contents of a communication while it is in transit, without the consent of all parties, or to help someone else do it. The claim is that a chat widget, a session replay script or an ad pixel lets a third party "read" what visitors type or click on your site, and that you helped by installing it.
2. Pen register and trap and trace (§638.51). This section, added in 2015, bars using a "pen register" or "trap and trace device" without a court order. The claim is that analytics and ad scripts capture visitors' addressing information, such as IP addresses and device identifiers. Pen-register and trap-and-trace claims have made up roughly two thirds of active California privacy litigation, according to legislative estimates that one defense firm cites. It is also the one SB 690 limits (see below).
3. Recording (§632 and §632.7). Section 632 covers recording a confidential communication without everyone's consent. Section 632.7 covers communications between a mobile or cordless phone and another phone. These sections usually come up with website chat and call recording. Most courts that have looked at it have said §632.7 does not cover a website chat typed on a smartphone; a federal court in 2024 called this the view of the "overwhelming majority". At least two courts let such claims go forward in 2023, and we found no appeals court ruling on the question.
Why the letters work
The law lets a private person sue, and it sets the damages at $5,000 per violation, or three times the actual damages if that is more. The person does not have to show they lost money. Multiply $5,000 by the number of visitors a firm says were affected, and the number in the letter looks frightening.
So many businesses settle. Lawyers who defend these claims describe five-figure settlements as common. The bill's sponsor, the Alliance for Legal Fairness, told the California Assembly that settlement demands ranged "from $20,000 to as high as $5 billion".
Who gets them
Small businesses, very often. The same sponsor described a jump from about 600 lawsuits against California businesses in early 2025 to 4,000 eighteen months later, and said: "Tens of thousands more have received demand letters". The defendants they named included businesses such as Howdy Plumbing and Sweet E's Bakeshop, and the Sacramento Food Bank, a nonprofit, and they said one Los Angeles law firm targeted about 40 plumbing and HVAC companies in the Sacramento area alone. These are the sponsor's figures, quoted in a committee analysis, not counts by the Legislature.
Being based outside California is not a reliable shield. In 2025, the federal appeals court that covers California ruled that an out-of-state online business can be sued in California over how it treats California users' data when its contacts with the state are its own choice, even if it serves a nationwide audience. That case decides where a business can be sued, not whether it broke the law. But it means distance alone will not end the conversation.
Some letters come from people who visit websites specifically to find a claim. One federal court held in 2025 that a "tester", a plaintiff who went looking for violations, had no standing to sue. That is one court's view, not a rule everywhere.
What SB 690 changed
California's Governor signed SB 690 on 30 September 2026. It changes one of the three theories:
- From 1 January 2027, only the Attorney General can sue a private business under the pen-register section (§638.51) over conduct on a website or app. Private plaintiffs, and the firms behind them, lose that route.
- It reaches back. It applies to pending claims in suits filed within the two years before it takes effect.
- It does not touch the wiretap or recording sections. Claims under §631, §632 and §632.7 are unchanged, with the same $5,000 per violation.
Earlier versions of the bill would have exempted tracking done for a "commercial business purpose". That approach was dropped in July 2026, so do not rely on summaries written before then.
Law firms that defend these cases expect plaintiffs to move to what is left. They report firms recasting pen-register claims as wiretap claims under §631, and adding claims under the federal Wiretap Act and California's computer data access law. One new line matters most for small businesses: claims that a cookie banner ignores the visitor's choice, by setting cookies before consent or after the visitor clicks "Reject". Those claims, one firm reports, have "largely survived motions to dismiss", though a few courts have ruled for the businesses.
In his signing message, the Governor said the bill addresses "the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses". He added that CIPA "contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants", and urged the Legislature to take them on in 2027. Any further change would need new legislation.
Where the courts stand
Courts are split, which is why the letters still have settlement value.
- A Los Angeles court dismissed a pen-register claim in May 2026, saying the statute "applies to telephonic communications and not to software on a commercial website."
- In June 2026, a federal court approved a $3.85 million class settlement in a pen-register case against the Los Angeles Times.
- The federal appeals court for California affirmed a win for the defense in a 2025 chat case, Gutierrez v. Converse, but in an unpublished decision that does not bind other courts.
- A California appeals court is considering a pen-register case, Variety Media v. Superior Court. It issued a tentative ruling in August 2026. After SB 690 was signed, it withdrew the case from submission, asked both sides how the new law affects it, including whether the law makes the case moot, and set the case for resubmission on 15 October 2026. It has not been decided.
What to do first
This is general information, not legal advice about your letter. These are general first steps; your lawyer will tell you which apply to you.
- Do not ignore it, and get advice before you reply. Note the deadline in the letter, and take the letter to a lawyer who handles California privacy claims before that date. A reply written without advice can make things harder.
- Find out which sections it cites. A claim that rests only on the pen-register section looks different after SB 690 from one that also cites §631, §632 or the federal Wiretap Act. Your lawyer will tell you what that means for your letter.
- Keep a record before you change anything. Ask your lawyer how to preserve what your website loads today, which scripts, pixels and chat tools, and keep your consent records. Those records are the evidence of what visitors agreed to, and when.
- Find out what your site actually does. Which third-party tools load on your pages? Do any of them fire before a visitor makes a choice? Does "Reject" actually stop them? You need the answers whether or not this letter goes anywhere.
- Do not treat the letter as a verdict. It is one firm's claim, and some have been dismissed. Your lawyer can tell you whether this one is worth fighting.
How to make the next letter less likely
No tool or setting makes a business lawsuit-proof. But the defense courts keep coming back to is consent obtained before the tracking starts.
- Ask before the trackers fire. The federal appeals court for California said, in an unpublished 2022 decision under §631, that consent has to come first; consent after the fact does not count. At least one federal court has dismissed CIPA claims on consent given through a cookie banner and account-creation and checkout screens. If the trackers start before the visitor clicks, the click comes too late for what they have already sent.
- Make "Reject" work. A banner that sets cookies anyway, or ignores a rejection, is now the basis of claims of its own.
- Know your vendors. Chat widgets, session replay and ad pixels are the tools these letters name. If you do not know what a script on your site does, find out or take it off.
- Say what you do. Your privacy notice (often called a privacy policy) should describe the tools you use and who receives the data.
The relief of having the record
Most small businesses that get one of these letters cannot answer the first question a lawyer asks: what did my site load, and what did visitors agree to? Dxtra is built so that you can.
- Tags only fire after consent. Dxtra's consent management and server-side tag manager hold back analytics, advertising and marketing tags until the visitor agrees to that category.
- "Reject" means reject. A visitor's choice is applied, including the Global Privacy Control opt-out signal sent by some browsers.
- Every decision is on the record. Each consent decision is logged with a timestamp, the categories agreed to, the mechanism used and the visitor's jurisdiction. If a lawyer asks what a visitor agreed to and when, that log is the answer.
Want to know where your site stands before anyone asks? The free privacy scan opens your site in a real browser, checks which cookies and trackers load before consent and whether "Reject all" actually works, and returns a risk band with cited findings. No account needed. Plans start at $10/month, with a 14-day money-back guarantee on the START plan.
Sources
Current as of 15 October 2026. Court decisions, case counts and the effect of SB 690 are moving quickly; check the linked source before you rely on any of them.
- Cal. Penal Code §631 (Justia): reading or learning the contents of a communication in transit without the consent of all parties; aiding others to do so
- Cal. Penal Code §632 (Justia): recording a confidential communication without the consent of all parties
- Cal. Penal Code §632.7 (Justia): communications between cellular or cordless telephones
- Cal. Penal Code §637.2 (Justia): $5,000 per violation or three times actual damages, whichever is greater; no need to show actual damages
- Cal. Penal Code §638.51 (Justia): pen register and trap and trace devices
- Cal. Penal Code §630, history note (CounselStack): CIPA added by Statutes of 1967
- SB 690, chaptered text, Chapter 976, Statutes of 2026 (LegiScan): pen-register actions over website and app conduct only by the Attorney General; applies to pending claims in actions commenced within two years before the operative date
- CIPA update: SB 690 is law (Jones Walker): operative 1 January 2027; Variety Media: tentative ruling, submission withdrawn on 1 October 2026 for supplemental letter briefs on the effect of SB 690 (including whether it makes the case moot), resubmission set for 15 October 2026
- SB 690 signed into law (Baker Donelson): the dropped "commercial business purpose" approach (July 2026); §631, §632 and §632.7 "remain fully available"; takes effect 1 January 2027
- California Governor signs SB 690 (Covington): takes effect 1 January 2027
- Signing message for SB 690, 30 September 2026 (Office of the Governor): "the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses"; CIPA's "other decades-old statutes"; the request that the Legislature take this on the following year
- Newsom signs SB 690 as privacy plaintiffs shift to new theories (ZwillGen): recasting as §631 claims, the federal Wiretap Act, CDAFA, and claims against cookie banners that ignore rejections, which have "largely survived motions to dismiss"
- SB 690 analysis (California Assembly Privacy Committee): the sponsor's figures on lawsuits, demand letters and settlement demands; named small targets
- California limits e-commerce claims under CIPA (Olshan): five-figure settlements
- Briskin v. Shopify, Ninth Circuit en banc opinion (2025): personal jurisdiction over an out-of-state online business
- Tester plaintiff lacks standing (Covington, on Rodriguez v. Autotrader.com): one court's ruling on "tester" plaintiffs
- CIPA win in California Superior Court (National Law Review, on Blaker v. NetScout): May 2026 dismissal
- CIPA website tracking lawsuits (Spencer Fane): pen-register and trap-and-trace claims as roughly two thirds of active California privacy litigation, "according to legislative estimates"; Mirmalek v. Los Angeles Times settlement approval
- CIPA claims stumble at summary judgment (Mayer Brown, on Gutierrez v. Converse): the Ninth Circuit's unpublished 2025 decision
- Chatbot lawsuits push California courts to rethink wiretap law (Crowell) and Online chat and California's two-party consent rule (Hudson Cook): trial courts divided on §632.7 and website chat in 2023; Another California court rejects privacy claims targeting online chat feature (Inside Class Actions, on Jones v. Tonal Systems): a 2024 federal decision describing the "overwhelming majority" view
- Ninth Circuit rejects retroactive consent (Troutman, on Javier v. Assurance IQ): consent must come first
- Consent becoming a forceful defense (Freeman Mathis & Gary): Lakes v. Ubisoft, claims dismissed on consent given through the cookie banner, account-creation and checkout screens
- Consent management (Dxtra): tags only fire after consent; what each consent log records
- Dxtra product: server-side tag management that respects consent preferences
- Dxtra pricing: $10/month START plan, 14-day money-back guarantee
This article is general information, not legal advice. If you have received a demand letter, take it to a lawyer licensed in California who handles privacy claims, before the deadline in the letter. The California Attorney General's directory of privacy laws lists the Penal Code's eavesdropping sections (630 to 638).
Know what your site does before anyone asks
The businesses that handle these letters best are not the ones with the biggest legal budget. They are the ones that can show what their site loaded and what each visitor agreed to. Run the free scan, and then get started with Dxtra from $10/month.