CIPA Session-Replay Lawsuits in 2026: What SB 690 Changes, and What It Doesn’t

If you run a site with US traffic and you have a session-replay tool, a chat widget, or a marketing pixel that fires on page load, you have probably seen a demand letter cite the California Invasion of Privacy Act. This is not a niche theory any more — it has produced a multi-million-dollar settlement this year — and the law under it is genuinely unsettled. Here is what is actually true right now, as of 30 August 2026, sourced to the statute, the bill text, and the case history rather than to the SEO round-ups that have flattened this into “CIPA bans cookies.”

What actually triggers a claim

CIPA Penal Code Sec. 631(a) is a wiretap statute written for telephone lines in 1967 and repurposed for websites. It requires the consent of all parties before a communication is intercepted. The leading case applying it to session replay is Javier v. Assurance IQ, LLC, decided by the Ninth Circuit on 31 May 2022: a session-replay tool recorded a visitor filling out an insurance form from the first keystroke, and only at the end did the site show a privacy policy with a consent click. The court held that consent obtained after the recording started does not cure it. Retroactive consent is not consent.

Two details matter for what this means technically. First, Javier is an unpublished, non-precedential memorandum disposition — district courts cite it constantly, but no court is bound by it. Second, Sec. 631(a) also has an “aiding” clause: a third party that receives the intercepted communication, not just the site operator who installed the script, can be named as a defendant. That is why session-replay vendors and chat-widget providers get sued alongside the sites that embed them.

2026 courts are split on how far this goes

A separate part of CIPA, Sec. 638.51, covers “pen register and trap and trace devices” — originally hardware that logs the numbers a phone dials. Plaintiffs have argued that tracking scripts and analytics SDKs are the modern equivalent. Courts disagreed with each other through 2026:

• Los Angeles Superior Court sustained a demurrer for Palo Alto Networks on 6 March 2026, holding an SDK deployed on a website is not a “trap and trace device.”
• Balabbo v. Wildflower Brands reached the same result, with the court noting that the CCPA and CPRA, not CIPA, are the statutes built to govern website data collection.
• The California Court of Appeal’s Second Appellate District issued a tentative ruling in Variety Media, LLC v. Superior Court in August 2026 taking a middle position: the pen-register statute can reach internet communications in principle, but a pen register captures only the destination of a communication, and an IP address identifies its source — so collecting IP addresses alone does not qualify.

None of that is a California Supreme Court ruling, and none of it resolves Sec. 631(a) wiretap claims, which is the theory the LA Times settlement was about. Treat “CIPA doesn’t apply to websites” and “CIPA definitely applies to websites” as both currently false, county by county.

SB 690 would narrow this, but it is not law

SB 690 is the legislative response, and it is more consequential than most coverage suggests. Checked directly against the bill text and history on leginfo.legislature.ca.gov rather than a law-firm summary: it adds a “commercial business purpose” exemption to Sec. 631, 632 and 632.7 — covering ordinary processing that is also subject to a consumer’s CCPA opt-out rights — and it moves civil enforcement of website/app pen-register claims under Sec. 638.51 to the Attorney General exclusively, removing the private right of action for that specific theory. It also has a retroactivity clause reaching pending claims filed within the prior two years.

As of the bill history’s most recent entry, 28 August 2026, the Assembly concurred in Senate amendments and ordered the bill to engrossing and enrolling. It has not been signed, is not chaptered, and is not in force. Coverage citing a 9 September 2026 gubernatorial deadline was not independently confirmed against a primary calendar for this post, so treat that date as reported rather than verified. Even if signed, SB 690 narrows exposure — it does not repeal Sec. 631(a) outright, and the “commercial business purpose” exemption has conditions attached, not a blanket carve-out.

What to actually do about it

Whatever happens to SB 690, the underlying fact pattern in every one of these cases is the same: a script captured behaviour before the visitor had a chance to say no. That is fixable today, independent of how the litigation shakes out, and it is worth doing regardless of jurisdiction because the same pattern is also plain unlawful pre-consent tracking under GDPR for EU visitors.

Google Consent Mode signals do nothing here — session-replay and chat-widget scripts are not Google tags and do not read analytics_storage. They need their own gate, using whatever consent library you already run:

CookieConsent.run({
  categories: {
    necessary: { enabled: true, readOnly: true },
    analytics: {}
  },
  onConsent: loadSessionReplay,
  onChange:  loadSessionReplay
});

function loadSessionReplay() {
  if (!CookieConsent.acceptedCategory('analytics')) return;
  if (window.__replayLoaded) return;
  window.__replayLoaded = true;

  var s = document.createElement('script');
  s.src = 'https://static.hotjar.com/c/hotjar-XXXXXXX.js';
  document.head.appendChild(s);
}

The same pattern applies to a chat widget’s tracking pixel or any third-party embed that records interaction data: load the script from inside the consent callback, not from a template tag that runs on every page load. If you are not sure what is currently firing before that gate exists, that is the specific thing to check first — see our pre-consent tracking checklist and the same failure mode as it shows up in Google Analytics specifically. For the GDPR side of session-replay tools rather than the US wiretap theory, see our separate coverage of Hotjar and Clarity, and for the wider pattern of what gets sued over, the first five cases in our lawsuits series.

The bottom line

Nothing here is legal advice, and the law itself is unsettled enough that anyone telling you with certainty how a California court will rule on your specific setup is guessing. What is not unsettled is the technical fact pattern that keeps losing in court and keeps getting settled for real money: recording or transmitting visitor behaviour before they have consented. Fix the ordering, and the rest of this argument stops being about your site.

If a demand letter or discovery request asks what fired on your site before consent, guessing is expensive. Get an independent, timestamped record of what actually loaded pre-consent with CookieInspector.