On September 30, Governor Gavin Newsom signed SB 690, a significant new law aimed at curbing the wave of lawsuits and demand letters asserting “pen register” claims under the California Invasion of Privacy Act (“CIPA”). The legislation eliminates the private right of action for pen register and trap-and-trace claims arising
Continue Reading California Governor Signs SB 690, Eliminating Private Website-Based CIPA Pen Register Claims and Calling for Broader CIPA Reform
California Legislature Passes CIPA Pen Register Reform Bill and Sends It to Governor
On August 28, 2026, the California Legislature passed SB 690, a significant bill aimed at curbing the flood of demand letters and lawsuits asserting “pen register” claims under the California Invasion of Privacy Act (“CIPA”). If enacted, the bill would eliminate the private right of action for website-based pen register claims and could affect many pending lawsuits filed since January 1, 2025.
Continue Reading California Legislature Passes CIPA Pen Register Reform Bill and Sends It to GovernorGemini Tracking Allegations Fall Short of Article III Standing
In a recent decision challenging Google’s Gemini AI features, a California federal court held that allegations concerning an AI tool’s capabilities, without facts showing actual access or use of plaintiffs’ data, were insufficient to demonstrate the “concrete” harm required for Article III standing. Thele v. Google LLC, 2026 WL
Continue Reading Gemini Tracking Allegations Fall Short of Article III StandingLetting the Cat Out of the Bag: Named Plaintiffs’ Own Conduct Defeats Privacy Claims
In a decision highlighting the importance of testing standing through discovery, a Florida federal court dismissed privacy claims at the class-certification stage after concluding that neither named plaintiff could establish Article III standing. Although the plaintiffs’ allegations survived a motion to dismiss, discovery later exposed their “utter disregard” for the allegedly private information at issue, leaving them with nothing more than “a bare statutory violation.” Cobbs v. PetMed Express, Inc., 2026 WL 2234135 (S.D. Fla. July 31, 2026).
Continue Reading Letting the Cat Out of the Bag: Named Plaintiffs’ Own Conduct Defeats Privacy ClaimsCalifornia Legislature Advances Bill Targeting Wave of CIPA Pen Register Lawsuits
On July 1, 2026, a California legislative committee advanced amendments to SB 690 that would eliminate private suits asserting website-based “pen register” claims under the California Invasion of Privacy Act (“CIPA”), leaving enforcement exclusively to the California Attorney General. The amendments come amid a surge of lawsuits and demand letters challenging the use of website technologies under the pen register provision, which the committee described as a “poster child for abusive lawsuits.” According to the committee analysis, “[b]ecause the potential liability can be staggering,” businesses often settle quickly, thereby “encouraging vexatious litigants to continue blasting out demand letters.”
Continue Reading California Legislature Advances Bill Targeting Wave of CIPA Pen Register LawsuitsPennsylvania Court Dismisses WESCA Suit Alleging Use of Analytics Tools Against Health System, Requiring “Specifics” for an “Actionable Dispute”
Recently, a Pennsylvania federal judge dismissed a suit challenging the use of a third-party website analytics tool by defendant Highlands Healthcare, Inc., an integrated health system with eight hospitals in Pennsylvania. The Court concluded plaintiffs had failed to plead the “specifics” of their interactions with defendant’s website, which were “essential to convert [the] case” from a “law-school hypothetical to an actionable dispute” under the Pennsylvania Wiretapping and Electronic Surveillance Control Act (“WESCA”), the state law analog to the Federal Wiretap Act. Muraski v. Penn Highlands Healthcare, Inc., 2026 WL 353041 (W.D. Pa. Feb. 9, 2026).
Continue Reading Pennsylvania Court Dismisses WESCA Suit Alleging Use of Analytics Tools Against Health System, Requiring “Specifics” for an “Actionable Dispute”Another Federal Court Dismisses Wiretapping Claims Premised on Crime-Tort Exception
Another recent federal court decision endorsed the “heightened intent requirement” for satisfying the crime-tort exception of the federal Wiretap Act. Progin v. UMass Mem’l Health Care, Inc., 2026 WL 632770, at *4–5 (D. Mass. Mar. 6, 2026).
In Progin, the plaintiffs claimed that the defendants, healthcare and hospital
Continue Reading Another Federal Court Dismisses Wiretapping Claims Premised on Crime-Tort ExceptionCourt Dismisses Federal Wiretap Claim Premised on Crime-Tort Exception, Rejects Aiding-and-Abetting Liability
A recent Washington federal court decision emphasizes two key federal Wiretap Act principles. First, the Act’s crime-tort exception only applies if there are plausible allegations that a party to the communication intercepted communications specifically to commit a separate wrongdoing. Second, the statute does not allow secondary liability for “procuring” an interception by a third party. Nichols v. PeaceHealth Networks on Demand LLC, 2026 WL 607763, at *3-4 (W.D. Wash. Mar. 4, 2026).
Continue Reading Court Dismisses Federal Wiretap Claim Premised on Crime-Tort Exception, Rejects Aiding-and-Abetting LiabilityUse of AI Call Center Without Consent Not a Federal Wiretap Violation, Court Holds
As businesses increasingly deploy AI-powered call centers to streamline customer service, plaintiffs have turned to decades-old wiretapping laws to challenge these tools. In a recent decision, however, an Illinois federal district court held that use of an AI call analysis platform without caller consent does not violate the federal Wiretap Act because it falls within the statute’s ordinary course of business exception. Lisota v. Heartland Dental, LLC, 2026 WL 91667, at *6 (N.D. Ill. Jan. 13, 2026).
Continue Reading Use of AI Call Center Without Consent Not a Federal Wiretap Violation, Court HoldsWebsite Wiretapping Roundup: 2025 Decisions and Developments
In 2025, courts continued to issue significant decisions concerning the application of wiretap and privacy laws to pixels, session replay, and other website technologies. Over the past year, we have featured posts discussing claims regarding website analytics and advertising tools brought under the federal Wiretap Act, the California Invasion of Privacy Act (“CIPA”), the Video Privacy Protection Act (“VPPA”), and other laws. A selection of posts highlighting important developments in this area is below.
Continue Reading Website Wiretapping Roundup: 2025 Decisions and Developments