Hunton Retail Law Resource

Retailers face growing privacy liability from commonplace website technologies such as cookies, tracking pixels, and similar analytics and marketing tools. Plaintiffs invoke the California Invasion of Privacy Act (“CIPA”) and the federal Electronic Communications Privacy Act (“ECPA”), statutes enacted decades before these technologies existed. These claims pose a heightened risk for retailers whose e-commerce operations depend on high-traffic websites and apps, real-time analytics, advertising technology, and customer-support chat features.

CIPA Section 631(a), among other things, prohibits willfully reading or learning the contents of a communication in transit without all-party consent. Section 638.51 bars installing or using a “pen register” or “trap-and-trace device” without a court order unless all-party consent is obtained. CIPA provides statutory damages of $5,000 per violation and does not require a showing of actual damages.

ECPA adds a federal layer of liability by prohibiting the intentional interception of electronic communications while in transit. Unlike CIPA’s all-party consent standard, ECPA operates as a one-party consent regime. However, one-party consent does not apply where the interception is for the purpose of committing any criminal or tortious act. ECPA provides damages of $100 per day for each day of violation or $10,000, whichever is greater. 

CIPA claims have surged, with the number of reported cases under the pen register provision growing from roughly 600 to more than 4,000 in approximately one year. Technologies such as Google Analytics, Meta Pixel, and TikTok Pixel are common targets. Because courts remain divided on whether these statutes reach common tracking technologies, a motion to dismiss is far from assured, and litigation costs mount quickly. Because CIPA provides $5,000 per violation without requiring proof of actual harm, putative class exposure can reach tens or hundreds of millions of dollars even where the merits are contested.

Retailers are natural targets because they operate high-traffic websites reliant on tracking technologies for advertising, analytics, and customer engagement. Recent decisions illustrate a divergence in outcomes in the courts.

In Camplisson v. Adidas America, Inc., 2025 WL 3228949 (S.D. Cal. Nov. 18, 2025), the court denied a motion to dismiss a CIPA pen register claim by declining to credit the retailer’s consent defense given its reliance on footer-based disclosures that did not require affirmative consent before tracking began. In contrast, in Doe v. Eating Recovery Center LLC, 2025 WL 2971090 (N.D. Cal. Oct. 17, 2025),  the court granted summary judgment on a CIPA wiretap claim, finding no evidence that the third-party vendor actually read or attempted to read plaintiff’s communications while they were in transit. The court also expressed skepticism that CIPA can be applied to internet communications, finding it’s “virtually impossible to apply it to the online world.”

Senate Bill 690 (S.B. 690) represents the California legislature’s effort to provide partial relief. As amended in July 2026, the bill would amend Section 637.2 (the provision that supplies CIPA’s private right of action and statutory damages) so that a private action under Section 638.51 (the pen register statute) may be brought only by the Attorney General. In practical terms, the bill would not declare the underlying tracking lawful but would remove the private damages remedy. The current version would apply retroactively to claims filed within two years before its operative date of January 1, 2027. S.B. 690 remains pending.  Senate Bill 690 (S.B. 690) represents the California legislature’s effort to provide partial relief. As amended in July 2026, the bill would amend Section 637.2, the provision that supplies CIPA’s private right of action and statutory damages, to provide that a private action for an alleged Section 638.51, the pen register statute, violation arising from conduct on an internet website, online application or mobile application may be brought only by the Attorney General. In practical terms, the bill would not declare the underlying tracking conduct lawful, but it would remove the private damages remedy. The current version would apply retroactively to pending Section 638.51 claims filed within two years before its operative date of January 1, 2027. S.B. 690 remains pending.

Website-tracking litigation remains a live and escalating risk. Even if S.B. 690 is enacted, it would address only the private right of action for pen register claims. Wiretap theories under Section 631 of CIPA and ECPA would remain available.

The case law presents a mixed picture. In many cases, plaintiffs have been able to survive a motion to dismiss where tracking pixels fire before any affirmative opt-in and disclosures are located in a footer. At the same time, a growing number of judges have expressed skepticism that CIPA reaches ordinary internet practices. Standing challenges have also gained traction, with courts dismissing claims where the plaintiff failed to allege a concrete, particularized injury. Outcomes may turn on the specific facts of each website’s consent flow, the nature and timing of data transmissions, and the jurisdiction in which a case is filed.

The volume and trajectory of website-tracking litigation underscore the importance of treating consent architecture as a risk-management priority. Key steps include: auditing all tracking technologies deployed on websites and apps; aligning cookie management platforms with the organization’s consent approach (e.g., blocking all nonessential tracking until consent is received for a conservative approach); confirming privacy notices accurately describe data flows; reviewing vendor contracts to ensure data cannot be used in ways that increase legal exposure; and preserving website configurations and consent artifacts to support defenses.

We are actively monitoring S.B. 690 and the developing case law. Please contact us if you would like to assess your current tracking configuration, evaluate your litigation exposure under these legal theories, or respond to a demand letter or litigation.