Share
A 1967 California law has become a weapon in lawsuits against utilities across the nation.
This concerning new application of an old law parallels what happened when Americans with Disabilities Act laws were applied to websites and digital experiences.
The California Invasion of Privacy Act, or CIPA, was written in 1967 to address wiretapping concerns for California residents—think vintage crime and spy movies. In the last couple of years, attorneys have started to test how it might apply to website tracking and advertising technologies.
Plaintiffs now use this dated legislation to challenge cookies, Google tags, advertising pixels, chat tools and session replay software. Since the California Legislature has been slow to respond, and California courts have different opinions on whether the law applies, the case count continues to rise.
A Pioneer member from the Midwest—not based in California, not serving California residents—received a demand letter this summer over the use of Google Analytics on its site without a cookie or consent banner that preempted the tag firing. The claim seems to be especially novel and predatory. We’ve not yet found an example case where a non-California business, not targeting California consumers, was the target.
The whole thing is reminiscent of the early ADA website market. Back then, utilities faced unclear standards and no substantiated legal guidance when the demand letters began to arrive. Some CIPA claims follow the same approach. Statutory damages of up to $5,000 per alleged violation give plaintiffs plenty of pressure to force a settlement and provide incentive for more filings.
Six Things You Can Do
Pioneer Web’s team recommends six steps to protect yourself. Remember, we’re not attorneys. You should talk to your counsel about how CIPA might impact your utility.
- Inventory your cookies and analytics tags.
- Check any chat tools or embedded scripts used for other marketing or technology solutions.
- Ensure you retain ownership and control over your website, analytics, and customer data, rather than introducing liability through third parties.
- Remove tracking you don’t use.
- Block nonessential tags until consent is given, at least for California-located users.
- Make sure your privacy policy matches what the website actually does.
Our team is happy to support Pioneer Web members with a tag audit, although how particular tags are used may be something you need to determine internally or with other advertising partners. Either before or after the tag audit, we can also implement a California-specific cookie and consent banner that triggers based on the user’s location. One advantage of Pioneer Web’s approach to Google Analytics is that your cooperative owns the account, rather than a third party.
If you actively target California residents through your online presence, take a stricter approach. Use opt-in consent before tracking begins and have your legal counsel review the setup.
California lawmakers are considering SB 690, which would narrow CIPA’s reach for ordinary commercial tracking. The bill passed out of committee in July and is expected to be considered by the full Assembly. Until California passes a clearer rule, you should know exactly what your website sends and consider stopping unnecessary tracking before it starts.
