CIPA explained
CIPA Section 631 lawsuits
By Papaya Privacy Co.
CIPA Section 631 website lawsuits ask whether tracking technology unlawfully tapped, read, or helped acquire a visitor's communications. The answer depends on the asserted statutory clause, the parties, the information involved, timing, and consent. A tracking pixel's presence does not by itself establish a violation.
What Section 631 covers
Section 631 is part of the California Invasion of Privacy Act. Its text addresses several kinds of conduct, including intentional tapping or unauthorized connections; reading or attempting to learn a communication's contents or meaning while it is in transit without the required consent; using information obtained through prohibited conduct; and aiding the prohibited acts. These are related clauses, not interchangeable descriptions of every analytics request. Read Section 631.
For a website dispute, start with the clause actually alleged. A claim about a third party learning a search query raises different questions from a claim about the website assisting that third party. Identifying the clause also helps separate factual allegations from the legal conclusions that a complaint asks a court to draw.
Why websites become involved
A tracking tool can cause a browser to send information to a destination other than the website the visitor intended to use. A complaint may characterize that recipient as a third-party listener and the transmission as an acquisition of the visitor's communication. Whether that description fits Section 631 requires analysis of the actual conduct, rather than the name of the tracker.
A script installed on a page, a request observed in a browser, and a recipient learning the meaning of a communication are different propositions. Likewise, a page URL, a typed search, and technical addressing information should not be treated as identical data. The statutory analysis needs to identify the communication, its alleged contents, the recipient, and the relevant party roles.
Why timing matters
The contents-or-meaning clause expressly refers to a communication in transit. Counsel therefore needs to distinguish the user's interaction, transmission to the intended recipient, any separate third-party request, and later processing. A shared timestamp or a request to an advertising domain does not, on its own, decide when another party read or learned the communication. Section 631(a).
This is also why a present-day investigation should not be described as proof of an earlier visitor's experience. A current observation concerns the tested configuration and conditions. Historical code, deployment records, logs, and other matter evidence may be needed to understand the period alleged in a complaint.
Consent is more than a banner
For the contents-or-meaning clause, Section 631 refers to the consent of all parties or otherwise unauthorized conduct. That wording makes the timing, scope, and mechanism of an asserted consent important. A screenshot showing that a banner exists is not the same as a record of what a particular person was told and chose before the conduct at issue. Section 631(a).
Questions may include what the notice described, which recipients or activities it covered, when the choice occurred, and whether the system's behavior matched it. A technical acceptance or rejection label does not itself resolve legally sufficient consent. Nor should obligations under other privacy laws be substituted for the elements of the CIPA provision alleged.
Keep the CIPA provisions separate
Section 631 is not shorthand for every CIPA claim. The following distinctions explain why a response should identify each provision separately.
- Section 631 includes tapping, unauthorized connections, learning contents or meaning in transit, use of information so obtained, and assistance in prohibited acts. Statutory text.
- Section 632 addresses intentional eavesdropping upon or recording a confidential communication without all-party consent. Its definition of confidentiality focuses on the surrounding circumstances and reasonable expectations. Statutory text.
- Section 638.51 addresses installing or using a pen register or trap-and-trace device without the required court order, subject to specified exceptions. Section 638.50 defines those processes around dialing, routing, addressing, or signaling information, excluding communication contents. Sections 638.50 and 638.51.
The same technology may be discussed under more than one provision, but a conclusion under one does not automatically answer the others.
A hypothetical search interaction
Suppose a visitor types a search into a website, and a separate request carries the search text to an analytics recipient. This is a hypothetical example, not a finding about any company or a prediction of liability.
The transmission raises factual questions about what the recipient received, when it received it, who initiated it, and what consent preceded it. The legal questions remain distinct: which Section 631 clause is alleged, whether the data qualifies as contents, whether the conduct occurred in transit, and how the parties' roles affect the claim. Replacing the typed search with a generic page-view event changes the facts and may change the analysis.
What the damages provision says
Section 637.2 provides a civil remedy for a person injured by a violation of the chapter. Its text specifies the greater of $5,000 per violation or three times actual damages, and states that actual damages are not a necessary prerequisite to an action. It also provides for injunctive relief. Those provisions do not mean that every detected tracker produces an automatic $5,000 recovery. A violation, the relevant claim, and applicable procedural requirements still need to be established. Section 637.2.
Common questions
Does Meta Pixel automatically violate Section 631?
No. Identifying the software does not establish the alleged statutory conduct, contents, timing, consent, or party roles. Evaluate the asserted clause and the actual interaction instead of treating a vendor name as a legal result.
Is Section 631 the same as a cookie-consent law?
No. It addresses the conduct described in its own text. A cookie notice may be relevant to a consent argument, but the existence of a banner is not a substitute for analyzing the statute's requirements.
Where should an evidence review begin?
Begin with the complaint's provision, the alleged communication, recipient, and time period. The separate CIPA evidence checklist addresses preservation in more detail. For another statutory theory, read the VPPA pixel-lawsuit explainer.
Sources and scope
This article explains statutory questions for defense-side review. It does not determine liability, address every defense, or replace counsel's review of controlling authority and the facts of a particular matter. The primary sources are California Penal Code 631, 632, 637.2, 638.50, and 638.51.