CIPA Lawsuits and Website Tracking Risks for Ecommerce Brands

An ecommerce store can have a privacy policy, a cookie banner, and a familiar marketing stack while still sending customer information in ways its team has never verified.

For brands using analytics, advertising pixels, session replay, or live chat, the practical concern is how those tools collect and transmit information, when that happens, and whether the customer’s choices actually control it.

California’s newly signed SB 690 will narrow one category of website privacy lawsuits beginning January 1, 2027. It leaves other claims available, including wiretapping claims that can involve everyday ecommerce technology.

The most useful response is to connect legal requirements with the site’s actual behavior: map the tracking stack, implement the right controls, and keep evidence that those controls work.

What CIPA covers

The California Invasion of Privacy Act, or CIPA, originated in 1967. Plaintiffs now invoke several of its provisions to challenge website tracking.

Three sections matter in this discussion:

• Section 631 supports claims involving the unauthorized interception or reading of communications in transit, including allegations that a website helped a third party do so.
• Section 632 addresses eavesdropping on or recording confidential communications without the required consent. Whether a communication is confidential is part of the analysis.
• Section 638.51 governs pen registers and trap-and-trace devices. Website claims have applied this theory to the collection of identifying or routing information. This is the provision addressed by SB 690.

Under Section 637.2, civil damages can be the greater of $5,000 per violation or three times actual damages. The statute does not require proof of actual damages.

That does not eliminate the need to establish a violation. Federal courts also require a concrete injury sufficient for standing. A demand letter’s calculation is an allegation, not an established damages award.

CIPA also has a different scope from the California Consumer Privacy Act, or CCPA. A brand should not assume that being below the CCPA’s business thresholds resolves its CIPA exposure, or that being headquartered outside California automatically prevents a California lawsuit.

Who is bringing these claims and what they can cost

Private plaintiffs and their attorneys bring these claims separately from government privacy enforcement. A demand may identify tracking technologies, allege that information was transmitted without adequate consent, and seek payment before litigation.

The volume has attracted legislative attention. In August 2026, Senator Anna Caballero’s office reported that the number of Section 638.51 suits had grown from approximately 600 when SB 690 was introduced in 2025 to nearly 4,000, driven by a small number of law firms. Those were reported lawsuit figures, not a verified count of demand letters.

Costs extend beyond any settlement. Brands may need outside counsel, a technical investigation, remediation, and staff time to reconstruct what happened.

A June 2026 Oxford Economics report, commissioned by the reform-advocacy coalition Reform CIPA, estimated approximately $30,000 in combined costs for a demand-letter matter, including settlement, legal fees, remediation, and internal time. The estimate drew on expert interviews and assumptions; it is not a market-wide average settlement or a guaranteed defense budget. Contested litigation can cost substantially more.

Brands should evaluate the claim’s merits and likely defense costs with counsel before deciding how to respond.

What SB 690 changes

Governor Gavin Newsom signed SB 690 on September 30, 2026. Its relevant amendments take effect January 1, 2027.

The enacted law reserves civil actions under Section 637.2 to the Attorney General when they are against a private actor for alleged Section 638.51 violations arising from website, online-application, or mobile-application conduct.

It also applies retroactively to qualifying pending claims in actions commenced during the two years before its operative date. Counsel should assess the filing date and allegations of an existing matter; a demand letter alone is not a commenced lawsuit.

SB 690 does not create a general exemption for ordinary marketing technology. It leaves private claims under other CIPA provisions available, including Sections 631 and 632. It also preserves the underlying Section 638.51 prohibition and Attorney General enforcement.

For ecommerce brands, that means the legislative change should inform legal strategy while technical privacy work continues.

Recent ecommerce cases show why the details matter

In Jones v. Skullcandy, a federal court denied a motion to dismiss in March 2026. The shopper’s allegations involved familiar Meta and Google tracking technologies and claims under Sections 631 and 632. The ruling allowed the case to proceed; it did not establish liability or declare those tools inherently unlawful.

Courts also reject claims when the evidence is insufficient. In Smith v. Rack Room Shoes, a September 2026 order dismissed the three claims for which class certification was sought, without prejudice, for lack of federal standing. The named plaintiffs lacked reliable evidence that their own communications had been intercepted. The court denied class certification; other claims remained in the case.

These decisions illustrate why an audit should examine actual transmissions and consent behavior. The presence of a recognizable vendor name cannot answer the legal questions by itself.

How a consent banner can fail in practice

Consider a store that displays a banner immediately, but loads an advertising script first. The visitor selects “Reject,” yet an app continues sending purchase events through a separate integration.

The interface appears to offer a choice. The technical behavior may not match it.

Several implementation gaps deserve attention.

Tracking starts before the choice is processed

A tag can transmit data before a consent-management platform, or CMP, establishes its default state. A later opt-in does not change the fact that an earlier request occurred.

Where the approved consent strategy requires prior opt-in, the relevant scripts and transmissions need to start blocked. Testing should begin with the first network request, including on direct visits to product and campaign pages.

Scripts bypass the consent integration

Shopify explicitly notes that its banner governs Shopify-specific tools. Manually installed third-party cookies, pixels, and app integrations may require additional logic to honor customer choices. Shopify also warns that mismatched consent regions between its settings and a third-party CMP can allow nonessential processing before consent.

For a Shopify store, review Customer Events pixels, theme code, app embeds, tag-manager containers, and custom integrations. Include checkout and customer-account surfaces in the review. Apply the same inventory discipline to Adobe Commerce, BigCommerce, WooCommerce, and headless storefronts.

Reject and withdrawal do not reach every destination

A button may save a preference without changing every tool’s behavior. A backend marketing integration may also continue transmitting after browser tracking stops.

Google’s server-side tagging documentation shows that consent information must be passed into the server workflow so downstream tags can respond. Moving tracking to a server does not, by itself, establish that customer choices are enforced.

Cookieless tracking is mistaken for no tracking

Google distinguishes basic and advanced Consent Mode. Its advanced implementation can send cookieless measurements while consent is denied. In basic mode, Google tags remain blocked when consent is not granted.

This is not a determination that advanced Consent Mode violates CIPA. It does mean that a test showing “no cookies” is insufficient to prove “no data sent.” If counsel’s strategy requires blocking specified transmissions until opt-in, configure and verify that outcome.

The privacy notice does not describe the deployed stack

An old notice can miss a new chat provider, replay tool, advertising destination, or data use. A generic reference to “improving your experience” may also leave customers without a clear explanation of the activity for which consent is being requested.

Review the notice alongside a current inventory. For quizzes, search, forms, and chat, inspect whether free text or other sensitive information reaches analytics or advertising destinations. Minimize unnecessary collection rather than relying on a banner to address every data flow.

Why California IP geofencing is an incomplete solution

Geographic rules can help apply different configurations to different visitors. Their reliability depends on the location signal and the order in which the site processes it.

MaxMind’s documentation explains that IP geolocation is imperfect: VPNs can reveal the location of a server instead of the visitor, and mobile networks can complicate geographic accuracy.

A California-only rule therefore needs a tested response for uncertain or unavailable location data. It also needs to run before the tracking it is supposed to control.

Even a correctly functioning rule cannot establish what happened during earlier visits. IP location also does not, by itself, settle which law or court has authority over a dispute.

Treat geolocation as one input into a counsel-approved configuration. Discuss whether a broader consent approach would be easier to maintain, along with the measurement and customer-experience tradeoffs.

What a more defensible consent setup looks like

A useful privacy program combines legal decisions, working technical controls, and evidence. The following is a practical implementation framework, not a statutory safe harbor.

Define what requires consent and what must honor an opt-out

Have counsel identify the relevant obligations and decide where affirmative consent should precede particular analytics, advertising, chat, or replay activity.

Keep CIPA consent analysis distinct from CCPA sale-and-sharing opt-outs. California’s privacy framework does not translate into one universal rule requiring opt-in for every analytics cookie.

Global Privacy Control, or GPC, needs its own handling. Covered businesses must honor it as a request to stop selling or sharing personal information. It does not provide affirmative consent, and its precise effect on a particular analytics service depends on the service’s data uses.

Map each legal requirement to specific tools and destinations so the development team has a testable specification.

Make the choice clear and usable

Use plain language about the relevant purposes and recipients. Offer visible, usable choices on mobile and desktop, and an accessible way to reopen preferences.

California’s CCPA regulations require symmetry in choices: they identify “Accept All” paired only with “Preferences” as an example of an unequal choice, and recognize “Accept All” with “Decline All” as a symmetrical alternative. A more prominent acceptance button can also be problematic under those rules.

Those are CCPA requirements, not a complete CIPA defense. They are also a useful reminder that banner design should help customers exercise a real choice.

Verify the full shopping journey

Run tests in fresh and returning sessions, across representative browsers and regions. Include product pages, on-site search, cart, checkout, order confirmation, forms, and chat.

For a configuration that requires prior consent for specified optional tracking, a useful test matrix is:

Visitor state	What to verify
No choice yet	Tracking designated as consent-dependent remains blocked.
Reject optional tracking	The choice persists after navigation and reload; restricted destinations remain blocked.
Accept analytics only	Only the permitted categories activate.
Withdraw consent	Future disallowed processing stops across the relevant browser and server paths.
GPC enabled	Applicable sale-and-sharing opt-outs are honored and the processed status is reflected to the visitor.
Location unknown or CMP unavailable	The documented fallback runs before restricted tracking can begin.

The GPC status check reflects California’s current regulations, which require covered businesses to display whether they processed the opt-out preference signal.

Include an actual test order. Confirm that customer privacy choices are respected while necessary purchasing and payment functions continue to work.

Keep proportionate consent records and technical evidence

Retain enough information to reconstruct the choice and the implementation: a consent identifier, timestamp, relevant category selections, notice version, GPC status, and later changes or withdrawal.

Pair those records with configuration versions, deployment history, and dated test results. A consent entry at 2:05 p.m. cannot, on its own, establish what a script transmitted at 2:04 p.m.

Set retention periods and access controls with counsel. Avoid collecting excessive personal information merely to create a consent record.

Recheck after changes

Use scanning to detect new scripts and destinations, then investigate the actual behavior. Automated scans can miss interaction-dependent activity, authenticated areas, and server-to-server transfers.

Add consent checks to app installations, theme releases, tag-manager changes, and new marketing integrations. Assign an owner to resolve failures and keep the inventory current.

A separate CCPA enforcement action illustrates the operational stakes. In 2025, the California Privacy Protection Agency required clothing retailer Todd Snyder to pay a $345,178 fine to resolve allegations including a failure to process sale-and-sharing opt-outs for 40 days because of improperly configured privacy infrastructure. This was a CCPA enforcement matter, not a CIPA settlement.

What to do when a demand letter arrives

Bring privacy litigation counsel and the technical team together promptly. The first objective is to preserve the evidence and understand the allegation while addressing any ongoing problem.

1. Preserve relevant material before substantive changes. Keep the letter and attachments, alleged visit dates, source code, tag-manager and CMP versions, deployment records, notices, consent records, and relevant vendor agreements. Ask counsel which routine deletion processes must be suspended.

2. Identify the exact claim. Establish which statutory sections, visits, technologies, and transmissions are alleged. Have counsel evaluate jurisdiction, consent, the evidence, and whether SB 690’s scope and timing affect the matter.

3. Capture current behavior carefully. Preserve network-request records, screenshots, and test conditions. A current capture shows current behavior; historical versions and logs are needed to help evaluate an earlier visit.

4. Check notification obligations. Ask counsel and the insurance broker about potentially applicable coverage, notice deadlines, and relevant vendor or agency contract provisions.

5. Remediate through a documented process. Secure the evidence, then coordinate necessary changes without unnecessarily prolonging problematic tracking. Record what changed and when. Let counsel manage substantive responses and settlement discussions.

A technical fix helps address future behavior. Its effect on historical allegations is a separate question for counsel.

Where responsibility sits between brands and agencies

The brand, its agency, legal counsel, and technology providers each have work to do. A clear division of responsibilities helps prevent a gap in which everyone assumes someone else has tested consent.

Team	Practical responsibility
Brand leadership	Approve data uses and vendors, appoint an accountable owner, fund maintenance, and disclose changes made outside the agency’s workflow.
Legal counsel	Interpret applicable requirements, approve the consent approach and disclosures, assess contracts, and lead claim response.
Agency and development team	Implement the approved requirements, inspect integrations, test behavior, retain implementation evidence, and escalate limitations.
Marketing teams and vendors	Explain data collection and downstream uses, follow change controls, and verify that new tools honor the approved settings.

This is an operating model, not a determination of legal liability. Section 631 includes language addressing assistance in prohibited conduct, so an agency’s own role can matter. Contracts should define implementation scope, ongoing monitoring, approval rights, and responsibility for later changes.

Hiring a vendor or buying a CMP does not automatically discharge the brand’s obligations. The Todd Snyder enforcement announcement expressly emphasized the responsibility of businesses to ensure their privacy tools work.

Make consent part of ecommerce maintenance

A site’s tracking behavior can change whenever its marketing stack changes. Consent controls should be maintained alongside checkout functionality, site performance, and measurement quality.

At Absolute Web, we can help brands review their ecommerce tracking stack, implement counsel-approved consent requirements, and test the customer journey across storefront and marketing integrations.

If your team cannot confidently explain what loads before consent, what stops after rejection, and what happens when GPC is enabled, those are useful starting points for a technical review.

Talk to Absolute Web about reviewing your ecommerce tracking and consent implementation. Contact us today!

This article provides general business and technical information, not legal advice. Laws and court interpretations can change; qualified counsel should evaluate your specific circumstances.

Sources

Linked references for the article. Research checked November 5, 2026.

1. SB 690 Chapter 976 Statutes of 2026. Enacted text, September 30, 2026, reproduced by LegiScan.

2. Governor Newsom legislative update. September 30, 2026. Official confirmation of SB 690 signature.

3. California State Administrative Manual Section 6945. California Department of General Services. Constitutional effective-date rules.

4. Senator Anna Caballero statement on SB 690. August 31, 2026. Legislative sponsor’s attributed litigation figures.

5. California Penal Code Section 631. Statutory text reproduced by Justia.

6. California Penal Code Section 632. Statutory text reproduced by Justia.

7. California Penal Code Section 638.51. Pen-register and trap-and-trace provision. Statutory text reproduced by Justia.

8. California Penal Code Section 637.2. Civil damages and actual-damages prerequisite. Statutory text reproduced by Justia.

9. Smith v Rack Room Shoes. Northern District of California, September 21, 2026, Document 260. Standing and class-certification order.

10. Mikulsky v Bloomingdales. Ninth Circuit, June 20, 2025. Unpublished memorandum, including California personal-jurisdiction analysis.

11. California CIPA Demand Letters. Harris Beach Murtha, July 1, 2026. Practitioner guidance on preservation and initial response.

12. The Economic Costs of CIPA Litigation. Oxford Economics, June 2026. Commissioned by Reform CIPA; illustrative estimates based partly on expert interviews.

13. Jones v Skullcandy. Southern District of California, March 12, 2026, Document 13. Order denying motion to dismiss.

14. Shopify customer privacy settings. Shopify Help Center. Third-party scripts, consent regions, and privacy controls.

15. Consent Mode with server-side Tag Manager. Google for Developers. Propagation of consent to server-side tags.

16. Google Consent Mode overview. Google for Developers. Basic and advanced mode behavior.

17. MaxMind geolocation accuracy. Provider documentation on IP-location limitations.

18. Global Privacy Control. California Attorney General guidance.

19. California CCPA regulations. California Privacy Protection Agency. Approved text effective January 1, 2026; Sections 7004 and 7025.

20. Todd Snyder privacy enforcement announcement. California Privacy Protection Agency, May 6, 2025.

21. Contact Absolute Web. Article call to action.