CIPA Session-Replay Lawsuits in 2026: What SB 690 Changes, and What It Doesn’t

If you run a site with US traffic and you have a session-replay tool, a chat widget, or a marketing pixel that fires on page load, you have probably seen a demand letter cite the California Invasion of Privacy Act. This is not a niche theory any more — it has produced a multi-million-dollar settlement this year — and the law under it is genuinely unsettled. Here is what is actually true right now, as of 30 August 2026, sourced to the statute, the bill text, and the case history rather than to the SEO round-ups that have flattened this into “CIPA bans cookies.”

What actually triggers a claim

CIPA Penal Code Sec. 631(a) is a wiretap statute written for telephone lines in 1967 and repurposed for websites. It requires the consent of all parties before a communication is intercepted. The leading case applying it to session replay is Javier v. Assurance IQ, LLC, decided by the Ninth Circuit on 31 May 2022: a session-replay tool recorded a visitor filling out an insurance form from the first keystroke, and only at the end did the site show a privacy policy with a consent click. The court held that consent obtained after the recording started does not cure it. Retroactive consent is not consent.

Two details matter for what this means technically. First, Javier is an unpublished, non-precedential memorandum disposition — district courts cite it constantly, but no court is bound by it. Second, Sec. 631(a) also has an “aiding” clause: a third party that receives the intercepted communication, not just the site operator who installed the script, can be named as a defendant. That is why session-replay vendors and chat-widget providers get sued alongside the sites that embed them.

2026 courts are split on how far this goes

A separate part of CIPA, Sec. 638.51, covers “pen register and trap and trace devices” — originally hardware that logs the numbers a phone dials. Plaintiffs have argued that tracking scripts and analytics SDKs are the modern equivalent. Courts disagreed with each other through 2026:

• Los Angeles Superior Court sustained a demurrer for Palo Alto Networks on 6 March 2026, holding an SDK deployed on a website is not a “trap and trace device.”
• Balabbo v. Wildflower Brands reached the same result, with the court noting that the CCPA and CPRA, not CIPA, are the statutes built to govern website data collection.
• The California Court of Appeal’s Second Appellate District issued a tentative ruling in Variety Media, LLC v. Superior Court in August 2026 taking a middle position: the pen-register statute can reach internet communications in principle, but a pen register captures only the destination of a communication, and an IP address identifies its source — so collecting IP addresses alone does not qualify.

None of that is a California Supreme Court ruling, and none of it resolves Sec. 631(a) wiretap claims, which is the theory the LA Times settlement was about. Treat “CIPA doesn’t apply to websites” and “CIPA definitely applies to websites” as both currently false, county by county.

SB 690 would narrow this, but it is not law

SB 690 is the legislative response, and it is narrower than much of the coverage suggests. Earlier versions of the bill added a “commercial business purpose” exemption to the wiretap and eavesdropping sections; the enrolled text does not. It is, in its own words, “An act to amend Section 637.2 of the Penal Code”, and it adds one subdivision: “An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.” That removes the private right of action for the pen-register theory on websites and apps, and a second paragraph applies it “retroactively to any pending claim in an action commenced within two years before the operative date”. Sec. 631, 632 and 632.7 are not amended.

The Legislature passed the bill on 28 August 2026, when the Senate concurred in the Assembly’s amendments (39–0), and it was enrolled and presented to the Governor on 4 September 2026. As of 28 September 2026 the bill history records no further action: it has not been signed, is not chaptered, and is not in force. The deadline comes from the California Constitution rather than a reported calendar. Under Article IV, section 10(b)(2), a bill passed before 1 September and in the Governor’s possession on or after 1 September that is not returned by 30 September becomes a statute. For SB 690 that date is 30 September 2026. Even once it takes effect, SB 690 removes one theory and leaves the other: a private plaintiff can no longer bring a Sec. 638.51 pen-register claim over a website, but the Sec. 631(a) wiretap claim — the one the LA Times settlement and most session-replay suits rest on — is untouched.

What to actually do about it

Whatever happens to SB 690, the underlying fact pattern in every one of these cases is the same: a script captured behaviour before the visitor had a chance to say no. That is fixable today, independent of how the litigation shakes out, and it is worth doing regardless of jurisdiction because the same pattern is also plain unlawful pre-consent tracking under GDPR for EU visitors.

Google Consent Mode signals do nothing here — session-replay and chat-widget scripts are not Google tags and do not read analytics_storage. They need their own gate, using whatever consent library you already run:

CookieConsent.run({
  categories: {
    necessary: { enabled: true, readOnly: true },
    analytics: {}
  },
  onConsent: loadSessionReplay,
  onChange:  loadSessionReplay
});

function loadSessionReplay() {
  if (!CookieConsent.acceptedCategory('analytics')) return;
  if (window.__replayLoaded) return;
  window.__replayLoaded = true;

  var s = document.createElement('script');
  s.src = 'https://static.hotjar.com/c/hotjar-XXXXXXX.js';
  document.head.appendChild(s);
}

The same pattern applies to a chat widget’s tracking pixel or any third-party embed that records interaction data: load the script from inside the consent callback, not from a template tag that runs on every page load. If you are not sure what is currently firing before that gate exists, that is the specific thing to check first — see our pre-consent tracking checklist and the same failure mode as it shows up in Google Analytics specifically. For the GDPR side of session-replay tools rather than the US wiretap theory, see our separate coverage of Hotjar and Clarity, and for the wider pattern of what gets sued over, the first five cases in our lawsuits series.

The bottom line

Nothing here is legal advice, and the law itself is unsettled enough that anyone telling you with certainty how a California court will rule on your specific setup is guessing. What is not unsettled is the technical fact pattern that keeps losing in court and keeps getting settled for real money: recording or transmitting visitor behaviour before they have consented. Fix the ordering, and the rest of this argument stops being about your site.

If a demand letter or discovery request asks what fired on your site before consent, guessing is expensive. Get an independent, timestamped record of what actually loaded pre-consent with CookieInspector.

Correction, 28 September 2026: we replaced an unverified deadline with the constitutional rule (30 September 2026) and corrected which chamber concurred.

Correction, 28 September 2026 (second): the version of SB 690 sent to the Governor amends only Penal Code Sec. 637.2. We had described a “commercial business purpose” exemption from an earlier version of the bill; it is not in the enrolled text, and Sec. 631 is not changed.