USA-based websites will need to meet GDPR-level privacy standards

This is a long one, but an important one. I found that it’s no longer just California that’s requiring website opt-out banners.

Q: What California businesses need to be concerned about new legal threats from CIPA?

Unlike the California Consumer Privacy Act (CCPA), the California Invasion of Privacy Act (CIPA) does not have revenue, size, or data volume thresholds for businesses. Instead, it applies to any entity that “illegally” records or intercepts confidential communications involving at least one California resident.

Scope of CIPA and what it covers

CIPA’s requirements are triggered based on the activity being conducted, not the size of the company. Violations can occur through various means, both online and offline:

Intercepting electronic communication: Websites and apps that use tracking technologies, such as cookies, pixels, and session replay software, are at risk. Plaintiffs’ lawyers argue that these tools can be used by third parties to “eavesdrop” on user interactions without consent.
Recording confidential conversations: The act prohibits the recording of phone calls and other private conversations without the consent of all parties.
Using pen registers: CIPA bans the use of devices that record dialing, routing, or addressing information without a court order or user consent.

Business risk

Since CIPA has no baseline thresholds for who can get sued, even a small business with a single website visitor from California could be subject to litigation if it uses tracking technologies that can be argued to violate the law. This has led to a significant increase in class-action lawsuits targeting companies in various industries.

Protecting yourself from CIPA lawsuits

To mitigate risk, many businesses are adopting an opt-in consent model for tracking technologies. This practice, which can be implemented through a cookie consent banner, helps establish that a consumer has consented to the monitoring of their online activity.

Yes, unfortunately. Under California’s Invasion of Privacy Act (CIPA), a consumer can sue for statutory damages of $5,000 per violation, and a wave of litigation has applied this rule to websites using common analytics and advertising tools like Meta Pixel and Google Analytics. Even if a business uses these tools in a “customary manner,” plaintiffs’ lawyers argue that doing so can violate CIPA.

How ordinary cookies are treated as a violation

Plaintiffs’ lawyers are using CIPA, a decades-old wiretapping law, to allege that modern website analytics constitute an illegal “wiretap.” Their legal theory argues that the third-party company providing the tracking pixel or analytics tool (like Meta or Google) is an unauthorized third party eavesdropping on the communication between the consumer and the website.

Meta Pixel lawsuits: Cases argue that the Meta Pixel intercepts and transmits data about user activity, including potentially sensitive information, to Facebook and Instagram without the user’s consent. A federal jury in California recently ruled against Meta on this exact issue in a case involving health data transmitted through a period-tracking app.
Google Analytics lawsuits: In a 2024 case, a California court allowed a lawsuit to proceed based on the use of Google Analytics, finding that it could be considered an illegal interception of user communications. The lawsuit alleged that Google was tracking sensitive data, including what users entered into online forms.
Expansion to other tools: This legal theory is also being applied to AI chatbots and session replay software, which record user interactions on a website.

The risk for businesses in CA

Because CIPA provides for statutory damages of $5,000 per violation, the financial exposure for a class-action lawsuit can be significant. While many of these cases are dismissed or settled early, they can be costly to defend.

The legal landscape is evolving, with some courts showing skepticism toward CIPA claims based on minimal data like IP addresses. A 2025 California legislative bill (SB 690) aimed to provide an exemption for “commercial business purpose” tracking failed to advance, meaning the inconsistent legal interpretations continue to pose a risk to businesses.

To protect themselves, many businesses are adopting stricter privacy practices, including opt-in consent banners that require user permission before running tracking technologies. Relying solely on compliance with other privacy laws like the California Privacy Rights Act (CPRA) may not be enough to avoid a CIPA lawsuit.

Q: What led to increased CIPA litigation against websites?

Several factors have contributed to the surge in CIPA litigation against websites, including a broad reinterpretation of the law to apply to online activity and the proliferation of website tracking technologies.

A novel reinterpretation of an old law. Some would say a predatory reinterpretation.

CIPA was originally enacted in 1967 to combat telephone wiretapping. Plaintiffs’ lawyers have successfully adapted this pre-internet statute to modern technology by arguing that it prohibits website tracking in the following ways:

“Wiretapping” web communications: Lawsuits claim that third-party trackers, like the Meta Pixel, illegally “intercept” the communication between a website user and the website itself.
Aiding and abetting: The lawsuits allege that the website operator “aids and abets” the illegal wiretapping conducted by the third-party tech provider.
Using “pen registers”: Plaintiffs also argue that pixels and other tracking technologies that collect IP addresses or other metadata function as illegal “pen registers”.

Widespread use of tracking technology

With the vast majority of commercial websites using some form of tracking technology, this new legal “theory” gives plaintiffs’ firms a massive pool of potential targets. The specific technologies that have been targeted by CIPA lawsuits include:

Pixels and cookies: These trackers, ubiquitous on modern websites, have been used to file hundreds of lawsuits.
AI chatbots: Some lawsuits claim that AI-powered chat features that record user conversations violate CIPA.
Session replay software: This technology, which records a user’s mouse movements, keystrokes, and other interactions, was an early focus of CIPA suits.

Key legal developments

The recent surge was sparked by several important legal developments that enabled this new litigation trend:

Javier v. Assurance IQ (2022): In this case, the Ninth Circuit ruled that CIPA can apply to internet communications and that the defendant’s use of session replay technology without the user’s consent could violate the law. This decision legitimized the extension of CIPA to website tracking and opened the floodgates for litigation.
Conflicting court rulings: There have been a number of inconsistent rulings in CIPA cases, creating significant legal uncertainty. This provides an incentive for plaintiffs to file lawsuits, hoping for a favorable ruling or an early settlement.
High statutory damages: CIPA provides for statutory damages of $5,000 per violation, which makes class-action lawsuits very lucrative for plaintiffs’ attorneys. This has fueled the relentless filing of lawsuits and arbitration demands.
Failed legislative reform: A 2025 California bill (SB 690) that would have exempted “routine commercial tracking” from CIPA’s scope failed to advance. This leaves businesses without legislative relief and allows the existing lawsuits to continue.

Q: What is a ‘confidential communication’ under CIPA

Under the California Invasion of Privacy Act (CIPA), a “confidential communication” is defined as any conversation where at least one party has an objectively reasonable expectation that the communication is not being overheard or recorded. This definition is crucial in determining liability for CIPA violations, particularly in the context of website tracking.

Key elements of a “confidential communication”

Reasonable expectation of privacy
The central factor is whether a participant has a reasonable expectation of privacy. Communications made in public settings, where a person can expect to be overheard, do not qualify as confidential. For example, a discussion in a crowded restaurant or a political speech would likely not be considered confidential. Conversely, a phone call, a conversation in a private office, or a chat message would typically be considered confidential.

Exclusion of public settings
CIPA explicitly excludes from its definition of confidential communications those made under circumstances where the parties should reasonably expect the communication may be overheard or recorded. This is why the setting of the communication is a key element in legal analysis.

How courts interpret this for websites

In the context of websites, courts are grappling with how the decades-old law applies to modern technology. Plaintiffs’ lawyers argue that even seemingly minor data points, when combined, can constitute a confidential communication.

Website activity: Lawsuits have successfully argued that a user’s clicks, keystrokes, and other interactions on a website, especially when collected by a third-party tracker, constitute a confidential communication.
Sensitive content: Courts have found that URLs and event data transmitted through website trackers can reveal sensitive and private information, such as details about medical treatment. This kind of information is more likely to be deemed confidential by a court. This is particularly important to doctors, therapists, and other personal-services providers.
Chatbots and session replay: Litigation involving AI-powered chatbots and session replay software also centers on the “confidential communication” element, alleging that user conversations and browsing activities are recorded without consent.

Why this interpretation is significant

This broad judicial interpretation of “confidential communication” for websites has serious implications for businesses:

Expansion of liability: It has vastly expanded the scope of CIPA, applying it to online activities that were never contemplated when the law was written.
Increased risk: Because CIPA allows for statutory damages of $5,000 per violation, a company can face significant financial exposure for any online interaction with a California user where a confidential communication was collected without consent.
Importance of consent: To mitigate risk, businesses must assume that any customer-website interaction could be deemed confidential by a court. The safest approach is to obtain explicit, all-party consent before deploying any tracking technology that records or collects user interactions.

Q: Are there other state laws like CIPA?

Yes, other states have laws similar to CIPA, though they often differ in their specifics and are part of a larger patchwork of state-level data privacy laws. These can be categorized in a few ways: wiretapping laws and comprehensive consumer data privacy laws.

Two-party consent states

Following California’s lead, several other states have “two-party consent” wiretapping laws that require all parties in a communication to consent to being recorded. This has enabled a wave of litigation against businesses whose websites use tracking technologies like pixels, cookies, and session replays.

Some of these states include:

Massachusetts: The Massachusetts Wiretap Act (MWA) is similar to CIPA and has also been used in class action lawsuits over website tracking.
Illinois: Lawsuits alleging violations of Illinois’ wiretapping laws have also targeted websites for using tracking technology.
Florida, Maryland, New Hampshire, and Pennsylvania: These are also two-party consent states where similar legal theories could potentially be applied.

Comprehensive consumer data privacy laws

Beyond wiretapping, numerous states have passed broader consumer privacy statutes that give residents rights over their personal data. While most of these laws do not include a private right of action for non-data-breach violations (making them less prone to the kind of lawsuits seen under CIPA), they are changing the privacy landscape.

States with such laws include:

Virginia, Colorado, Connecticut, and Utah: These states, along with California, have some of the most prominent comprehensive privacy laws.
A growing list of others: Many more states, including Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, and Texas have also enacted their own versions.

New types of privacy laws

Other states are experimenting with new types of privacy protections:

Consumer health data laws: Washington’s My Health My Data Act (MHMD) and similar laws in Nevada and Connecticut have broad definitions of health data and a private right of action, creating unique risks for companies that handle user data.
Universal opt-out mechanisms (UOOMs): Several states, including New Jersey, are requiring businesses to honor universal opt-out signals from consumers, which may affect how some tracking technologies are deployed.

Why this matters for businesses

The proliferation of these diverse state laws creates a compliance patchwork that is difficult for businesses to navigate. A company operating across the United States cannot simply follow the rules of its home state. Instead, it must consider the strictest applicable law, which could mean implementing opt-in consent for all customers, not just those in California.

Here are some effective methods for websites to obtain consent from users, particularly relevant for navigating wiretapping laws like CIPA and privacy laws like the GDPR and CPRA.

Use a Consent Management Platform (CMP)

A CMP automates and centralizes the process of obtaining, managing, and documenting user consent.

Automatic blocking: The CMP automatically blocks non-essential tracking technologies, like cookies and pixels, until a user gives consent.
Geolocation: A CMP can use geolocation to display the correct consent banner and model (opt-in vs. opt-out) based on the user’s location, helping comply with different laws in various jurisdictions.
Record-keeping: It securely records a user’s consent choices, including the date, time, and specific versions of your policies shown. This audit trail is critical for demonstrating compliance.

Implement an “opt-in” consent model

For websites targeting users in two-party consent states like California, the most defensible approach is to adopt a global opt-in model, which is generally considered the safest and most robust method.

Clear affirmative action: Users must take a distinct action to give consent, such as clicking an “Accept All” button. Simply continuing to browse the site is not valid consent under this model.
No pre-checked boxes: All checkboxes for non-essential tracking purposes should be unchecked by default. Pre-ticked boxes are invalid under strong privacy laws like the GDPR.

Design a compliant consent banner

The user interface for gathering consent must be transparent, specific, and easy to use.

Offer granular controls: Give users control over specific categories of cookies, such as analytics, marketing, or performance, instead of an all-or-nothing choice.
Avoid “dark patterns”: Do not use deceptive design practices that confuse or manipulate users into giving consent. This includes making the “Reject All” button smaller or less visible than “Accept All”.
Use clear, plain language: Avoid legal jargon. Your banner should use simple and straightforward language to explain why you are collecting data.

Provide transparency and control

Effective consent is both informed and easy to manage.

Link to privacy policy: The consent banner should include a clear and accessible link to your full privacy and cookie policies for users who want more detail.
Allow easy withdrawal: Users must be able to change or withdraw their consent at any time. This can be done via a persistent “Cookie Settings” link in the footer of your website.

Ensure proper implementation

Even the best consent banner can fail if the underlying technology does not function correctly.

Block non-essential trackers: You must ensure that non-essential trackers, like the Meta Pixel or Google Analytics, do not fire until after the user has given consent. A CMP can help automate this process.
Sync with marketing platforms: Your consent solution must communicate user choices to third-party ad networks, like Google and Meta, via mechanisms such as Google Consent Mode, so tracking stops for non-consenting users.

In cases where a user does not consent to tracking, Google handles the data differently depending on which version of Consent Mode the website owner has implemented. All data is anonymized to respect user privacy, and no personally identifiable information (PII) is stored or used for personalization.

How Google handles non-consenting users

Google Consent Mode has two primary implementation options, each with a different approach to collecting information from users who deny consent.

Basic Consent Mode

No data transfer: When a user denies consent, the Google tags are completely blocked from firing. No data, not even anonymous signals, is sent to Google’s servers.
General modeling: Because no data is collected, conversion modeling in Google Ads and Google Analytics is based on a very general model of user behavior, resulting in less detailed reporting for non-consenting users.

Advanced Consent Mode

Cookieless pings: When a user denies consent, Google’s tags send cookieless “pings” to the Google server. These lightweight signals are not tied to an individual user but still communicate basic, aggregate information.
Data collected in pings: The cookieless pings from non-consenting users can include anonymous details such as:
- Timestamp
- Type of user activity (e.g., page view or conversion)
- Device and browser type
- Approximate country of origin
AI-powered modeling: Google uses AI and machine learning to analyze the anonymized, aggregate data from these pings. The system can then model the behavior of non-consenting users based on the observed trends of consenting users.
More accurate estimates: This data modeling provides advertisers with more accurate reporting and optimization for Google Ads, helping fill the gaps from missing user data.

Important privacy considerations

Even with Consent Mode, websites still need to be aware of privacy rules.

CIPA concerns: Some legal scholars and plaintiffs’ lawyers argue that even the anonymized pings from Advanced Consent Mode could potentially fall under broad interpretations of wiretapping laws like California’s CIPA.
Ethical implications: Some visitors may find the practice of sending signals without consent intrusive. Therefore, some businesses may prefer the more privacy-focused Basic Consent Mode to avoid any perception of unauthorized tracking.
Website owner’s responsibility: The website owner is responsible for managing user consent and ensuring that Google’s tags respect those choices. Failure to implement Consent Mode can result in a significant loss of data for advertisers, as Google stops collecting data on users from certain regions without it.

Numerous triggers can lead to litigation under the California Invasion of Privacy Act (CIPA) related to website data collection. These triggers stem from a broad interpretation of the decades-old wiretapping statute, applying it to common online technologies. The primary triggers involve third-party tracking, the collection of sensitive data, and a failure to obtain proper, explicit consent.

Third-party “eavesdropping”

A central theory in CIPA litigation is that a website is not a private conversation between the user and the site operator. Instead, plaintiffs’ lawyers argue that third-party vendors are secretly “eavesdropping” on user interactions.

Aiding and abetting: Plaintiffs allege that website operators aid and abet the third-party tech provider in unlawfully intercepting communications.
Key legal precedent: The Ninth Circuit has clarified that while a website operator is a party to the conversation and generally can’t be sued for wiretapping itself, it can be liable for aiding and abetting a third party. This has made the presence of certain third-party services a key trigger for lawsuits.

Specific tracking technologies

Certain technologies are frequently targeted in CIPA litigation because of their ability to capture and transmit user interactions to a third party:

Session replay software: This technology records a user’s activity, such as mouse movements, clicks, and keystrokes. Lawsuits allege that this practice is a form of illegal wiretapping.
Chatbots: AI-powered chatbots that record and store user conversations with a third-party vendor have also triggered CIPA lawsuits.
Pixels and cookies: Tools like the Meta Pixel and Google Analytics can be alleged to be illegal “pen registers” or wiretaps by capturing and transmitting user data to third-party ad networks.
Trap and trace devices: Lawsuits can also allege that website tracking tools violate CIPA’s prohibition against using “trap and trace” devices, which capture identifying information about the origin of a communication.

Capturing sensitive information

When tracking tools are placed on webpages that handle sensitive information, the risk of a CIPA lawsuit increases significantly.

Health websites: Placing tracking pixels on pages related to medical conditions, appointment scheduling, or patient portals has led to lawsuits against healthcare providers. A jury recently found Meta liable under CIPA for collecting sensitive health data from a period-tracking app.
Mental health websites: Tracking users who fill out online forms on websites for mental health professionals was cited as a basis for a CIPA lawsuit, with a court determining that the collected information constituted “contents of a communication”.

Inadequate or missing consent

A primary trigger for CIPA litigation is the failure to obtain clear, prior consent from users before any tracking begins.

Retroactive consent is insufficient: In Javier v. Assurance IQ, LLC (2022), the Ninth Circuit ruled that consent must be given prior to any recording or interception, not retroactively through an agreement to a privacy policy after the fact.
Weak consent banners: Banners that do not block tracking until a user explicitly opts in can trigger CIPA claims, as the tracking often begins before a user has a chance to provide consent.
Lack of disclosure: Many lawsuits allege that users were simply unaware that a third party was collecting their data, highlighting the importance of clear disclosures in the consent process.

An EU-based website under GDPR faces similar, and in some ways stricter, requirements for consent than those implicated by California’s CIPA. Both laws can apply to EU-based businesses if they have users in California, highlighting the complexity of global data privacy compliance.

Here is a breakdown of how the CIPA risk relates to EU websites already under GDPR:

GDPR: The opt-in standard

The GDPR is based on a “privacy by default” philosophy and is more prescriptive about how consent must be obtained than most U.S. laws.

Opt-in consent: GDPR requires explicit, unambiguous, and freely given user consent before any non-essential data collection can occur.
No pre-ticked boxes: Passive consent methods, such as pre-ticked boxes or implying consent through continued browsing, are illegal under GDPR.
Pre-blocking: Non-essential cookies and other trackers, such as analytics, marketing pixels, and session replays, must be blocked from running until the user actively provides consent.

CIPA and GDPR: Key differences

Feature	GDPR (EU)	CIPA (California)
Applicability	Applies to any business that processes personal data from residents physically located in the EU, regardless of the business’s location.	Applies to any entity that records or intercepts a “confidential communication” involving at least one California resident.
Legal basis	Requires a legal basis for processing personal data, with explicit consent being the most relevant for tracking.	Is a wiretapping law. It regulates the interception of confidential communications, which plaintiffs argue includes online data.
Consent model	Strictly requires an opt-in model for all non-essential tracking.	Has been interpreted by courts to imply an opt-in, all-party consent model for “confidential communications”.
Focus	Provides broad data privacy and consumer rights, including the right to be informed, access data, and object to processing.	Focuses narrowly on the act of recording or intercepting a communication without all parties’ consent.
Enforcement	Heavy regulatory enforcement, with fines of up to €20 million or 4% of global annual revenue for serious violations.	Driven by statutory damages of $5,000 per violation, which has fueled a wave of class-action lawsuits against businesses.

CIPA risk for EU websites

An EU website that is already GDPR compliant is in a strong position to defend against CIPA litigation, especially if it adheres to the stricter opt-in standard globally.

However, risks can still arise if an EU business:

Fails to apply GDPR consent globally: Some companies use geo-targeting to show a strong opt-in consent banner to EU users but a weaker, opt-out banner to U.S. users. This leaves the U.S. users, including those in California, vulnerable to CIPA lawsuits.
Has an imperfect CMP implementation: If a website’s Consent Management Platform (CMP) fails to block a third-party tracker, like a Meta Pixel, before a user gives consent, it could still be found in violation of CIPA, even if the user is in California.
Collects sensitive data: If a website gathers health or other sensitive information, it increases the likelihood of a lawsuit under both GDPR and CIPA, as this data is more likely to be considered a “confidential communication” under CIPA.

Q: What disclosures satisfy CIPA’s notice requirement for website data collection?

For online data collection, no disclosure alone is sufficient to satisfy the California Invasion of Privacy Act (CIPA). Because CIPA is an all-party consent statute, website operators must obtain affirmative consent from all users before any tracking of a confidential communication begins. A website’s standard privacy policy is generally not a substitute for this prior consent.

Disclosures are essential for compliance with other privacy laws, such as the California Privacy Rights Act (CPRA), but they are not the central requirement for CIPA.

Why a standard privacy policy is not enough

Consent vs. notice: A privacy policy provides notice, but CIPA requires affirmative consent. The disclosure is an informational tool, while consent is the legal basis for processing data.
Retroactive consent is invalid: A user agreeing to a privacy policy after they have already navigated a website is considered retroactive consent, which courts have found invalid under CIPA.
Third-party consent: A standard privacy policy describes how the website operator uses data. CIPA litigation often centers on third-party tracking (e.g., analytics or pixels) and alleges that the website operator aided and abetted an unlawful wiretap by the third party. The privacy policy does not provide consent for the third party’s interception of communications.
Location: CIPA applies to a “confidential communication,” defined as a conversation where at least one party has a reasonable expectation of privacy. While some website browsing may not be confidential, lawsuits have successfully argued that tracking certain online activities—especially when sensitive information is involved—violates this standard.

What is required for CIPA-compliant consent

To meet CIPA’s all-party consent standard and mitigate litigation risk, websites should implement the following:

Explicit opt-in consent: Users must take a clear, affirmative action to agree to tracking. This is typically done through a Consent Management Platform (CMP) banner that requires the user to click “Accept” before any non-essential tracking is deployed.
Pre-blocking of trackers: All non-essential tracking technologies, including pixels, cookies, and chatbots, must be blocked from running until the user provides consent. A “decline” option must also be equally prominent.
Informed consent: The consent banner must provide sufficient information so users can make an informed decision. The information should clearly explain what data is being collected and which third parties will receive it.
Easy withdrawal of consent: Users must have the ability to withdraw their consent at any time, typically via a persistent button or link that re-opens the CMP.

Best practices for disclosures

While disclosures alone do not satisfy CIPA, they are still a legal requirement under other laws, and a comprehensive privacy strategy is vital. Best practices include:

A separate, detailed privacy policy: This policy should disclose data handling practices in a clear, easy-to-understand manner, detailing the categories of personal information collected, the business purposes, and any sharing with third parties.
Notice at Collection: The CPRA requires businesses to provide a “Notice at Collection” that informs consumers at or before the point of data collection about the categories of information being collected.
“Do Not Sell or Share” link: Websites must provide a conspicuous link that allows users to opt out of the sale or sharing of their personal information for targeted advertising.

Q: What’s the latest on CIPA and AI chatbots?

As of late 2025, litigation related to AI chatbots and CIPA is active, costly, and rapidly evolving. A wave of class-action lawsuits alleges that AI chatbots and other voice assistants violate CIPA by secretly recording and “eavesdropping” on user conversations and data.

Several key trends define the current state of CIPA and AI chatbot litigation:

Third-party vendor as “eavesdropper.” Plaintiffs’ primary legal theory argues that the third-party AI vendor (e.g., Google’s Contact Center AI) is illegally “wiretapping” the communication between the user and the website or call center.
Aiding and abetting. The business that deploys the AI chatbot can be held liable under CIPA for “aiding and abetting” the vendor’s illegal interception by embedding the third-party code and benefiting from its data practices.
Vendor’s “capability” is enough. In a significant February 2025 ruling in Ambriz v. Google, LLC, a court found that a third-party AI provider could be liable under CIPA based on its technical capability to use customer call data for its own purposes, like training its AI models. This capability was sufficient to survive a motion to dismiss, even without proof of actual data misuse.
Mixed court outcomes. As with other web-tracking CIPA cases, outcomes remain inconsistent. Some judges dismiss cases, citing issues with standing or a narrow interpretation of “confidential communication,” while others allow them to proceed. This unpredictability further fuels new filings.
Legislative reform failed. A 2025 California bill (SB 690) that sought to clarify that “routine commercial tracking” does not violate CIPA failed to advance. This legislative inaction leaves the legal landscape fragmented and uncertain.

Risks for businesses using chatbots

Given the current legal climate, businesses that use AI chatbots face several key risks:

Increased litigation: The novel legal theories and significant statutory damages ($5,000 per violation) have made chatbots a prime target for litigation and mass arbitration.
Third-party vendor risk: Businesses must vet their AI chatbot vendors carefully. If a vendor has the capacity to use customer data for its own purposes, it could be deemed an eavesdropper, regardless of whether it uses the data.
Inadequate consent: A simple “This chat may be monitored” disclosure may not be sufficient to satisfy CIPA’s all-party consent requirement. The safest approach is explicit, prior consent from users.

Mitigation measures

To reduce legal risk related to AI chatbots, businesses should:

Obtain affirmative consent. Present users with a clear and conspicuous consent banner at the start of any chatbot interaction, asking for their explicit permission before engaging.
Vet AI vendors. Review and update vendor agreements to explicitly prohibit the use of customer data for the vendor’s own product improvement or AI training purposes.
Provide clear disclosures. Ensure disclosures explicitly state that the user is interacting with an AI and not a human. A 2025 California law (SB 243) mandates this for “companion chatbots” but the practice is a sound risk mitigation measure for all AI chat.
Review data flows. Understand how your chatbot vendor collects, stores, and uses data, and implement controls to minimize data collection and block non-consensual sharing.

Q: What are the key differences between CIPA and California’s CPRA regarding data practices?

CIPA and the California Privacy Rights Act (CPRA) are both critical California privacy laws, but they differ significantly in their origins, scope, requirements, and enforcement. The CPRA is a modern, comprehensive data privacy law, while CIPA is an older wiretapping statute adapted by plaintiffs’ attorneys for the internet age.

Key differences: CIPA vs. CPRA

Feature	California Invasion of Privacy Act (CIPA)	California Privacy Rights Act (CPRA)
Origin	A 1967 wiretapping statute originally designed to prevent the unauthorized interception of telephone calls.	An expansion of the California Consumer Privacy Act (CCPA), approved by voters in 2020 and effective in 2023.
Purpose	Protects the confidentiality of private communications. Focuses on who is “listening in” on a conversation, not just what data is collected.	Gives California residents broad control over their personal information and regulates how businesses collect, use, and share it.
Applicability	Applies to virtually any entity that records or intercepts a confidential communication involving a California resident. There are no revenue, data volume, or size thresholds.	Applies to businesses that meet specific criteria, including revenue and data processing thresholds (e.g., $25 million in revenue, or buying/selling/sharing the data of 100,000+ consumers).
Core Requirement	Requires all-party consent for recording or intercepting a “confidential communication.” The consent must be obtained before the communication is intercepted.	Follows a general opt-out model, which allows businesses to collect and use personal data but requires them to provide clear and accessible methods for consumers to opt out of the sale or sharing of their data.
Online Tracking	Courts have interpreted the law to require prior, affirmative consent (opt-in) for many online tracking activities, such as session replay software and AI chatbots.	Requires an easily accessible “Do Not Sell or Share My Personal Information” link for consumers to opt out of their data being used for cross-context behavioral advertising.
Enforcement	Primarily enforced through costly class-action lawsuits filed by private plaintiffs. CIPA provides a statutory damage award of $5,000 per violation, which motivates litigation.	Enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General’s Office. Enforcement is administrative, with fines up to $7,500 per violation.

Q: What AI chatbot disclosures satisfy CIPA and SB 243?

No single disclosure can fully satisfy CIPA for an AI chatbot, as CIPA requires affirmative, all-party consent before a confidential communication is intercepted. However, specific disclosures are mandatory for “companion chatbots” under California’s new SB 243, which took effect in 2025. The most robust legal approach combines proactive consent mechanisms to address CIPA with the required disclosures for SB 243.

CIPA requirements: Consent, not just disclosure

CIPA is a wiretapping statute, and courts have consistently held that informing a user about recording after it has begun is insufficient. Instead, the following must be in place before any chat interaction is recorded or shared with a third-party AI provider:

Prior, affirmative consent: Obtain explicit, opt-in consent from the user before they begin the chat. The safest method is a click-through consent screen that requires the user to agree to the terms before they can type their first message.
Acknowledge third-party interception: Because AI chatbots often involve a third-party vendor (e.g., Google or a specialized AI company), disclosures should explicitly state that a third party may intercept and process the conversation.
Describe the full extent of data collection: Disclose that the chatbot may record, store, and analyze user inputs, including free-text messages, sensitive information, and any personally identifiable information.

SB 243 requirements: Chatbot identity and safety

SB 243, the “companion chatbot” law, focuses on transparency and safety, with specific disclosure rules for all users and enhanced protections for minors.

Disclosures for general users

Identity disclosure: A “clear and conspicuous notification” that the chatbot is artificially generated, not a human, is required if a “reasonable person” could be misled.
Example language: “This is an AI chatbot, not a human. Your conversation may be recorded to improve our service.”

Disclosures for minors

For operators who know they are interacting with a minor, SB 243 adds layers of disclosure and protection:

AI disclosure: The operator must explicitly disclose that the user is interacting with an AI.
Suitability warning: A “clear and conspicuous” warning that the chatbot may not be suitable for some minors must be provided.
Regular reminders: For ongoing interactions, reminders must be sent at least every three hours stating that the user is interacting with an AI and should take a break.

Safety protocols

SB 243 also mandates safety protocols that must be disclosed and implemented:

Crisis prevention: Protocols must be in place to prevent the chatbot from generating content related to suicide or self-harm.
Crisis referrals: If a user expresses suicidal ideation, the chatbot must provide notifications that refer the user to appropriate crisis service providers. The details of these protocols must be published on the operator’s website.

How to satisfy both laws simultaneously

To provide the strongest defense against litigation and ensure compliance:

Present a CMP with a pre-chat consent banner. Before a user can initiate a chat, present them with a prominent consent banner. This banner must clearly state that the conversation is being recorded by an AI chatbot and processed by a third-party vendor. The user must provide affirmative, opt-in consent to proceed.
Display disclosures during the chat. Once the user has consented, the chatbot window should prominently display disclosures required by SB 243, including its AI identity and the minor suitability warning.
Implement minor protections. If your service has minor users, implement age detection and the required three-hour break reminders.
Publish safety protocols. Detail and publish your safety protocols for handling suicide and self-harm expressions on your website, as required by SB 243.

Q: What direction is privacy legislation and are court case decisions heading in?

Privacy legislation and court case decisions are moving toward stricter regulation, increased consumer control, and a more complex and fragmented legal landscape. Enforcement is ramping up at the state and federal levels, with a growing focus on AI, sensitive data, and website tracking.

Here are the key directions in privacy legislation and court case decisions:

Stricter and more fragmented state-level privacy laws

Expansion of state laws: By the end of 2025, 16 U.S. states will have comprehensive privacy laws in effect, joining others already online. These laws are creating a patchwork of varying requirements, with some states adopting more stringent standards than California’s CPRA.
Enhanced consumer rights: These state laws are giving consumers more control, including rights to access, correct, and delete personal data, as well as more robust opt-out rights for targeted advertising.
Focus on sensitive data: Many new state laws require explicit opt-in consent for processing sensitive data, such as health, biometric, or location information. Maryland’s law, for example, has some of the most rigorous requirements on this front.
Regulatory enforcement: State regulators are increasing enforcement actions. This is in contrast to the traditional multi-state approach, focusing instead on aspects unique to their own state laws.

Escalating litigation under older laws

Wiretapping claims: Despite mixed judicial outcomes, CIPA and other state wiretapping laws continue to fuel privacy lawsuits related to online tracking. Plaintiffs’ lawyers are applying decades-old statutes to modern website technologies like pixels, session replay, and chatbots.
AI chatbot claims: A growing area of CIPA litigation targets AI-powered chatbots, with lawsuits alleging that the AI vendors illegally “intercept” user communications. This echoes earlier litigation against pixels and session replay tools.
Inconsistent court rulings: The lack of uniformity in court decisions creates significant uncertainty for businesses. While some courts dismiss CIPA cases on technical grounds (e.g., lack of standing or no confidential communication), others allow them to proceed, incentivizing continued lawsuits.

Growing scrutiny of AI

AI-specific legislation: Policymakers are turning their attention to AI, with states like California and Colorado enacting specific laws to regulate its use. The EU’s AI Act, which takes effect in 2026, categorizes AI based on risk levels and imposes strict governance requirements.
Focus on transparency: The trend is toward greater transparency regarding AI’s use, particularly in areas affecting consumers, such as automated decision-making and content generation.
Liability and accountability: There is a push to increase accountability for developers and users of AI, with some lawmakers seeking to hold companies responsible for algorithmic bias or other harms caused by AI systems.

A continued stalemate on federal legislation

Stalled efforts: Bipartisan support for federal privacy legislation continues to stall due to disagreements over key issues like federal preemption and a private right of action. The failure of the American Privacy Rights Act (APRA) in 2024 reinforced this trend.
FTC enforcement: The Federal Trade Commission (FTC) is likely to continue enforcing privacy protections under its existing authority, focusing on specific cases rather than broad rule-making.
Focus on children’s privacy: One area of likely federal progress is children’s privacy, with broad bipartisan agreement on the need for stronger protections.

What this means for businesses

The overall direction points toward a more difficult and costly compliance environment. The convergence of strict state laws, active litigation under older statutes, and new AI-specific regulations means businesses must adopt proactive strategies. This includes robust Consent Management Platform (CMP) implementations, a focus on privacy-by-design, and meticulous data mapping to address the varied and expanding legal landscape.

Q: What best practices are recommended for managing website privacy across US states?

Navigating the patchwork of U.S. state privacy laws requires adopting a strategic approach that prioritizes the most stringent requirements while maintaining flexibility. Rather than managing compliance state-by-state, most businesses find it more effective to implement a single, robust privacy program that meets or exceeds the strictest applicable standards.

Adopt a “privacy-by-default” and “privacy-by-design” approach

Privacy-by-design: Integrate privacy considerations into your products and services from the earliest stages of development. This approach is more efficient and effective than trying to add privacy controls later.
Privacy-by-default: For online tracking, default to an opt-in consent model, which is the standard required by wiretapping laws like CIPA, the GDPR, and an increasing number of state laws for sensitive data processing.

Use a comprehensive Consent Management Platform (CMP)

Geotargeting and compliance: Use a CMP that can detect a user’s location to display the correct consent banner and apply the appropriate consent model. For maximum safety, you can deploy a global opt-in model for all U.S. users.
Pre-blocking trackers: Ensure your CMP is correctly configured to pre-block all non-essential tracking technologies until a user gives affirmative consent. This is critical for preventing lawsuits under CIPA and complying with GDPR standards.
Support universal opt-out signals: The CPRA, as well as laws in Colorado and Connecticut, require honoring universal opt-out mechanisms like Global Privacy Control (GPC).
Avoid “dark patterns”: Ensure your consent banner provides a clear and equally prominent option to accept or decline all non-essential cookies. Avoid manipulative designs that nudge users toward accepting tracking.

Practice transparent and thorough disclosures

Provide a clear privacy policy: Make your privacy policy easily accessible and write it in plain, comprehensible language, avoiding legal jargon.
Disclose data practices: Clearly inform consumers about what personal information you collect, the purpose of collection, how it is used, and which third parties it is shared with.
Update regularly: As privacy laws, technology, and business practices evolve, regularly review and update your policies. Implement a mechanism to transparently communicate changes to users.

Prepare for consumer data requests (DSARs)

Establish request systems: Provide consumers with easy-to-use channels, such as an online form or toll-free number, to submit Data Subject Access Requests (DSARs).
Define internal processes: Create clear internal procedures for handling consumer requests to access, correct, or delete their personal data within the legally required timeframes.

Conduct regular data audits and assessments

Map data flows: Perform a comprehensive data mapping exercise to identify all data touchpoints on your website and understand how data moves through your systems.
Minimize data collection: Collect and retain only the data that is necessary for your business purposes. De-identify or destroy data when it is no longer needed.
Assess third-party risk: Review and update vendor contracts and Data Processing Agreements (DPAs) to ensure third parties also comply with privacy standards.

Maintain a culture of privacy and security

Train employees: Educate employees on data privacy best practices, including secure data handling, phishing awareness, and procedures for responding to consumer requests.
Implement strong security: Use encryption, access controls, and other robust security measures to protect consumer data.
Create a breach response plan: Have a plan in place to minimize damage, inform affected individuals, and notify regulators in the event of a data breach.