What CIPA covers

The California Invasion of Privacy Act is a collection of provisions with different elements. A script match is a starting point for investigation. The legal claim depends on what was acquired, how and when it was acquired, the parties, consent, territorial facts and the person affected.

Separate the statutory routes

Section 631

Identify the applicable clause. Online content-interception allegations generally require evidence that a recipient learned communication contents while in transit, together with the necessary consent and party analysis. A URL can contain substantive information, but a hostname or routine addressing data is not automatically content. Statutory text.

Section 632

Establish an actual confidential communication, reasonable confidentiality in its circumstances, recording or eavesdropping and lack of required consent. The presence of a chatbot or chat vendor does not establish these facts. AI processing alone is not a settled liability rule. Statutory text.

Section 638.51

Keep metadata observations separate from content evidence. The enacted online private-enforcement restriction above materially changes prospective case evaluation. Do not reclassify the same metadata as §631 content merely to replace an unavailable theory.

Preserve banner and policy wording, timestamps, actual interaction, storage state and payloads before and after a choice. A request after rejection is not necessarily a prohibited disclosure. Prior consent, its scope and the actual communication parties matter. A proxy location does not establish a consumer plaintiff or standing.

Standing is a separate inquiry

Popa v. Microsoft (9th Cir. 2025) rejected automatic federal standing from ordinary session-replay shopping data. Fons v. Grocery Outlet (N.D. Cal. Sept. 24, 2026) found an allegedly ignored Reject All choice insufficient on the ordinary-data facts there. Neither a tracker signature nor a broken banner establishes a person's concrete injury. Sensitive data and cross-site profiling require factual proof; a business category is not proof of sensitive disclosure.

Remedies

Subject to the available cause of action, §637.2 provides the greater of $5,000 per violation or three times actual damages. It does not itself provide attorney fees or punitive damages. Requests, scripts and pageviews are not legal violation units. Read the remedies framework.

Federal and sector theories

The Federal Wiretap Act needs its own elements and one-party-consent analysis. A CIPA allegation does not automatically invoke the crime-tort exception. HIPAA, FERPA, COPPA and GLBA do not supply automatic private damages overlays. Read the federal guide.

Using Discover

Discover supplies technical observations and research questions for attorney review. Historical catalogue entries are not automatically available for purchase. The reviewed-package pilot requires a defined scan, checked artifacts and human review; availability and delivery dates are confirmed individually. View the synthetic sample or discuss a pilot investigation.

Deliberize LLC is a technology company, not a law firm. These materials are not legal advice and do not establish a violation, admissibility, standing, class certification or recovery. Legal reference date: October 5, 2026.