Overview
The California Invasion of Privacy Act (CIPA) has become a favored statute for the plaintiffs' bar and individual litigants over the past several years, in large part due to the significant statutory damages ($5,000 per violation) available under the statute even in the absence of actual consumer injury. These CIPA cases have an assembly line-like quality to them—they often allege that commonly deployed features and software on websites, including chatbots, cookies, and pixel trackers, run afoul of CIPA. In an attempt to mold CIPA to the digital age, plaintiffs frequently claim that these technologies transmit to third parties information about their interactions with websites without their consent, which they claim violate CIPA's prohibitions on wiretapping, eavesdropping on, or recording confidential communications, or using a "pen register" or "trap and trace device." And CIPA has become a posterchild for lawsuit abuse. In fact, one enterprising individual (who recently was determined to be a vexatious litigant by a California federal court, see Shah v. Crain Commc'ns, Inc., No. 2:26-cv-03070, Order Re: Defendant's Motion to Declare Plaintiff a Vexations Litigant (ECF No. 34) (C.D. Cal. July 20, 2026)), has filed dozens of pro se CIPA complaints in court along with a legion of arbitrations. In addition, according to a brief recently filed in a declaratory judgment action brought against him, that individual has sent "hundreds or thousands of demand letters to companies across the country." See Lofty Inc. v. Shah, No. 2:26-cv-07425, Pl. Lofty Inc.'s Opp'n to Def.'s Mot. to Dismiss or, in the Alternative, to Decline Declaratory Jurisdiction (ECF N0. 20) (C.D. Cal. Aug. 14, 2026).
We previously reported on California legislation, S.B. 690, aimed at reigning in these rampant CIPA filings (available here). At the end of August 2026, the California Legislature passed a narrowed version of S.B. 690, which prohibits private plaintiffs from bringing CIPA pen register and trap and trace claims arising out of conduct occurring on websites, online applications, or mobile applications. If enacted, S.B. 690 will apply retroactively to pending CIPA claims asserted in litigations commenced within two years prior to the effective date of the legislation (likely to be January 1, 2027). The bill was presented to Governor Newsom on September 4, 2026 and, if signed, should help stem some of the wave of CIPA filings, although not all of them.
Enter the federal government (maybe) to provide additional relief. Introduced on September 3, 2026, the "Halt Abusive Internet Lawsuits Act of 2026" (H.B. 10263) seeks to bar all claims and enforcement actions brought under either federal or state law concerning the use of pen registers, trap and trace devices, eavesdropping, or wiretapping where the underlying conduct relates to the collection, processing, or disclosure of information or communications for a commercial purpose, including CIPA specifically by name. The Act would define "commercial purpose" to mean normal-course business activity, "include[ing] the use of digital commerce for—(A) the operations of a business or a service provider or contractor to a business; (B) marketing or advertising; (C) prompting, receiving, or responding to consumer input; (D) facilitating the sale or purchase of goods or services; or (E) any commercial business purpose as defined under law or regulation of a State in which the collection, processing, or disclosure of information occurs." "Digital commerce," in turn, would mean "the promotion, sale, purchase, delivery, or support of products or services through connected digital networks and tools, including through the use of cookies, pixels, session replay, chatbots, tags, and analytics." The legislation is pending before the House Committee on the Judiciary.
If passed, the Halt Abusive Internet Lawsuits Act of 2026 will provide needed relief to industry. We will continue to track the legislation, so check back often. However, businesses should strongly consider lobbying their representatives to support H.B. 10263. And Steptoe can assist.
