By Ryan Windt | Head of Growth Marketing | Updated September 2026
If your website runs an advertising pixel, a chat widget, session-replay software, or almost any third-party analytics tag, you are sitting inside one of the most active areas of privacy litigation in the country. A 1967 California wiretapping statute, written for telephone eavesdropping, has become the engine behind thousands of class actions and demand letters aimed at ordinary website tracking. The exposure is real, the damages are steep, and most businesses have never asked the question that matters most: if one of these claims lands, does my insurance actually respond?
This guide explains what is driving the lawsuits, why the legal ground is genuinely unsettled, and where cyber insurance does and does not cover this risk.
Why routine website tools became a lawsuit target
The statute at the center is the California Invasion of Privacy Act, or CIPA. It requires all-party consent before a communication can be intercepted or recorded. Plaintiffs argue that when a website loads a third-party tracker, the pixel or script intercepts the visitor’s interaction without consent, which they frame as a modern form of wiretapping. What makes CIPA so attractive to the plaintiffs’ bar is its structure: a private right of action, statutory damages that can reach the greater of $5,000 per violation or treble actual damages, and fact patterns that are easy to plead at scale. If a site had a pixel or replay script, the complaint almost writes itself.
The tools drawing fire are the ones nearly every business uses: advertising pixels, cookies, session-replay software, chat widgets, keystroke monitoring, and analytics SDKs. The theory does not turn on what data was collected. Under CIPA, capturing the interaction itself can be enough.
This is no longer just a California problem
California is still the center of gravity, with the large majority of filings, but the playbook has spread. Plaintiffs are increasingly pairing or replacing CIPA claims with the federal Wiretap Act and state wiretapping statutes in Florida, Pennsylvania, and elsewhere. That means a business with no California presence can still face a materially similar claim under another state’s law. The industries drawing the most cases are the ones with heavy consumer web traffic: retail leads by a wide margin, followed by technology and professional services, with a fast-growing wave in healthcare and telehealth.
The legal ground is genuinely unsettled
What makes this risk hard to price, and hard to dismiss, is that courts are not agreeing with each other. Recent 2026 activity shows the split plainly:
- In June 2026, a federal court granted final approval to a $3.85 million class settlement over trackers on a major newspaper’s website, built on a pen-register theory.
- Weeks earlier, a different court dismissed a near-identical claim, and another dismissed a serial plaintiff’s case for lack of standing, holding that typing generic terms into a public website implicates no protectable privacy interest.
- In other cases, courts have let the core wiretapping claims survive a motion to dismiss even while tossing the pen-register theory.
Appellate courts in California are only now preparing the first rulings on whether CIPA reaches website tracking at all. Meanwhile, proposed legislation that would narrow these claims has moved and stalled more than once, so the statutory picture is not settled either. For a business, unsettled law is not comfort. It means a claim cannot be quickly and cheaply dismissed, which is exactly what drives up defense costs and settlement pressure.
Does cyber insurance cover it? Where coverage can respond
This is where it gets specific, and where reading your own policy matters. A website tracking claim can potentially implicate several parts of a cyber or media policy, but none of them is automatic. The most relevant coverage areas are the third-party liability sections, since these are claims by outside parties, not first-party losses to your own systems. Our guide to first-party versus third-party cyber coverage explains that distinction, which is central here.
Coverage typically turns on how your policy handles a few things:
- Privacy liability. Many cyber policies include coverage for claims arising from the wrongful collection or disclosure of personal information. Whether a CIPA tracking claim fits depends on the specific wording.
- Media or advertising liability. Because the tools are ad-tech, some claims may implicate media coverage instead, if the policy carries it.
- Defense costs. Even where the eventual liability is disputed, the cost to defend these cases is substantial, so whether defense is covered, and whether it erodes your limit, is a central question.
Where the gaps and exclusions bite
Coverage is far from guaranteed, and this is the part buyers miss. Several common policy features can leave a tracking claim partly or entirely uncovered:
- Wiretapping and unlawful collection exclusions. Some policies specifically exclude claims arising from the interception of communications or violations of statutes like CIPA, TCPA, or the Wiretap Act. If your policy has one, it can go straight to the heart of these claims.
- Sublimits. Privacy or regulatory coverage may be capped well below your aggregate limit, so even a covered claim may only be partly paid.
- Intentional-conduct wording. If a claim is framed around a deliberate business decision to deploy tracking, a carrier may argue it falls outside coverage meant for accidents.
These are the same reading-the-fine-print problems that show up across cyber coverage. Our guides to what cyber policies exclude and how to read a cyber policy walk through where this language hides. And because statutory-damages claims can also raise the question of whether penalties are insurable at all, our post on cyber insurance and regulatory fines is worth reading alongside this one.
What to do before a demand letter arrives
The practical steps split into two tracks: reduce the exposure, and confirm the coverage.
- Inventory your trackers. Know every pixel, tag, replay tool, and chat widget on your site, and which are third-party. You cannot manage a risk you have not mapped.
- Fix consent. Most theories hinge on pre-consent tracking. A properly configured consent banner that actually blocks trackers until consent is given removes the core factual hook for many claims.
- Read your policy for interception language. Look specifically for wiretapping, CIPA, or unlawful-collection exclusions, and for any sublimit on privacy or media liability.
- Ask your broker directly. Get a written answer on whether a website tracking or wiretapping class action would be covered, under which section, and whether defense costs erode the limit.
This risk hits some businesses harder than others. If you run a high-traffic consumer site, our guides for ecommerce, retail, and marketing and advertising agencies cover the wider exposure picture for those sectors.
Frequently Asked Questions
What is a CIPA website tracking lawsuit?
It is a claim, often a class action, alleging that a website’s third-party trackers (pixels, cookies, session-replay, chat widgets) intercepted a visitor’s interactions without consent, in violation of the California Invasion of Privacy Act’s wiretapping provisions. Similar claims are now brought under other states’ wiretap laws.
Does cyber insurance cover website tracking or pixel lawsuits?
Sometimes, most often through a policy’s third-party privacy or media liability coverage, but it is not automatic. Many policies contain wiretapping or unlawful-collection exclusions, or sublimits, that can limit or bar coverage. The answer depends entirely on your specific policy wording.
Are these lawsuits only a California issue?
No. California has the most filings, but plaintiffs increasingly use the federal Wiretap Act and state wiretapping statutes in Florida, Pennsylvania, and other states, so businesses outside California face similar exposure.
How much are these claims worth?
CIPA allows statutory damages of up to $5,000 per violation, which multiply quickly across a class. Recent settlements have ranged into the millions, and defense costs alone are significant given how uncertain the law is.
How do I reduce the risk?
Inventory every tracker on your site, implement a consent mechanism that blocks third-party trackers until the visitor consents, and confirm with your broker whether your policy would respond to a wiretapping claim.
Related Resources
- First-Party vs. Third-Party Cyber Coverage: What Every Business Should Know
- Cyber Insurance Exclusions: What Most Policies Will Not Cover
- Cyber Insurance and Regulatory Fines: GDPR, CCPA, HIPAA
- Cyber Insurance for Marketing and Advertising Agencies
- Understanding Your Cyber Policy: Coverage Sections, Exclusions, and Limits
Not sure whether your policy would respond to a website tracking or wiretapping claim, or whether an exclusion sits in the way? Talk to a specialist who works cyber coverage every day, and we will help you find the gap before a demand letter does.