California privacy law triggers thousands of digital wiretapping lawsuits

Thousands of businesses across various sectors, including retail, insurance, healthcare, and media, are facing lawsuits under the California Invasion of Privacy Act (CIPA). The litigation centers on the use of website tools such as chat widgets, tracking pixels, and analytics scripts, which plaintiffs argue constitute illegal interception of communications.

Many of these legal challenges arise from discrepancies between what a website’s cookie banner promises and the actual background code execution. Since a 2022 appellate ruling in Javier v. Assurance IQ, more than 4,300 digital wiretapping lawsuits have been filed nationwide, with over 75% occurring in California.

CIPA, originally enacted in 1967 to prevent telephone wiretapping, allows private citizens to sue directly. Statutory damages can reach $5,000 per violation or three times actual damages, without a requirement to prove real harm. Consequently, cyber insurer Coalition reported that privacy-related insurance claims roughly doubled in the first half of 2026 compared to 2025, with nearly 75% of those claims citing CIPA.