ACC Seeks Clarity on CIPA’s Reach Over Website Cookies

The California Invasion of Privacy Act (CIPA) was written to stop illegal wiretapping, long before websites existed. Plaintiffs now argue that ordinary tracking tools—cookies, pixels, session‑replay scripts—are illegal “pen registers” under CIPA because they gather data without consent. Because the law predates the internet, courts disagree on how it applies, producing opposite rulings even in the same courthouse.

- Tens of thousands of arbitrations, demand letters, and lawsuits have been filed against companies that use common website tracking tools, driven by CIPA claims. - FP’s Kahf notes that identical cases receive different outcomes in the same courtroom, showing the law’s unclear application to new technology. - Susanna McDonald of ACC says reviewing each demand letter pulls in‑house counsel away from compliance work and corporate citizenship, consuming hours per letter. - ACC’s amicus brief argues that the California Consumer Privacy Act (CCPA) should govern online privacy because it explicitly addresses cookie usage and data sharing.

If the appeals court treats cookies as pen registers, firms would need a court order for every tracking tool they deploy, creating a massive administrative burden. If the court finds cookies fall outside CIPA, the wave of similar suits could subside, letting companies focus on compliance under the newer California Consumer Privacy Act (CCPA), which explicitly covers online data sharing.

The California Court of Appeal’s decision in Variety Media, LLC v. Superior Court (Rose) will set the precedent; businesses should monitor the ruling for changes to their tracking practices and legal budgets.