California Invasion of Privacy Act (CIPA) Defense Attorneys

Our Attorneys Defend Companies Nationwide that Are Facing California Invasion of Privacy Act (CIPA) Litigation

**James Bell**
Invasion of Privacy Attorney
Team Lead

**Nick Johnson**
Invasion of Privacy Attorney
Team Lead

The California Invasion of Privacy Act (CIPA) establishes broad prohibitions and requirements for companies both in and outside of California. Under CIPA, companies nationwide can face liability for a broad range of violations, and we have seen an increase in plaintiffs using CIPA to pursue damages claims in recent years.

CIPA allows California residents to pursue privacy claims in a wide range of circumstances—and plaintiffs’ firms are using this to their advantage. Under CIPA’s private right-of-action provisions, plaintiffs can receive damages of $5,000 per violation or three times their actual damages, whichever is greater. With the California courts allowing for a broad interpretation of the 1967 statute’s prohibitions in the modern era, this provides a substantial incentive for firms to recruit plaintiffs to pursue privacy litigation, particularly against large companies that have the ability to pay.

Experienced California Defense Counsel for Companies Nationwide Facing CIPA Claims

Our law firm provides experienced defense representation for companies nationwide that are facing privacy-related claims under California state law, including the California Invasion of Privacy Act (CIPA). CIPA and other laws provide substantial legal protections for California users of business websites, apps available on cellular phones and other electronic devices, and other devices and platforms. As noted above, statutory damages are available in some cases, and a user’s interactions with a platform or device can potentially implicate multiple violations—and this can create substantial liability exposure for website operators, app developers, device manufacturers, and other businesses.

Our California defense team is led by trial attorney James Bell. Our team represents in-state and out-of-state clients in litigation involving all California state privacy laws. Under California law, when in-state users visit an out-of-state business’s website or an out-of-state business makes telephone calls to in-state consumers, out-of-state businesses can face litigation in the California courts. In this scenario, it is imperative to have experienced local counsel who is capable of providing informed, strategic, and effective defense representation.

Examples of Potential Claims in CIPA Litigation

The California Invasion of Privacy Act (CIPA) was passed in 1967. At the time, the California legislature considered the potential implications of new technologies on privacy protection, and its concerns remain equally relevant today:

“The Legislature hereby declares that advances in science and technology have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications and that the invasion of privacy resulting from the continual and increasing use of such devices and techniques has created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society.”

Although CIPA was originally enacted to address issues related to recording devices and efforts to covertly record conversations without proper consent, today plaintiffs’ firms are using the statute (and the related statutes discussed below) to pursue lawsuits involving everything from data breaches to AI scanning of text messages, and from connected hearing aids to tracking consumers’ IP addresses. While there are certainly legitimate concerns related to violating consumers’ privacy for commercial business purposes, we have seen a substantial amount of overreach under CIPA as well.

Broadly, some examples of technologies (past and present) that can create potential liability exposure under CIPA include:

Technologies that record confidential communications
“Implied consent” technologies
Pen registers
Session replay software
Unauthorized interception of communications
Violations of consumers’ reasonable expectation of privacy
Website tracking technologies
Other tracking software and tracking tools (including “trap and trace” devices and other similar devices)
Other technologies and practices that violate California residents’ right to provide consent before being recorded or monitored
Using information obtained in violation of CIPA for unauthorized or unlawful purposes

Ultimately, any time a company collects or records private information belonging to California residents, it must address California statutory compliance. Companies that fail to meet their compliance obligations can face substantial liability risks; and, as a result, when facing litigation under CIPA, experienced defense representation is essential.

Dr. Nick Oberheiden

Founder

Attorney-at-Law

Lynette S. Byrd

Former DOJ Trial Attorney

Partner

Brian J. Kuester

Former U.S. Attorney

Hon. Kevin McCarthy

55th Speaker, U.S. House of Representatives (ret.)

Government Consultant

Mike Pompeo

Of Counsel

Former U.S. Secretary of State

John W. Sellers

Former Senior DOJ Trial Attorney

Linda Julin McNamara

Federal Appeals Attorney

Nicholas B. Johnson

Former Prosecutor

Roger Bach

Former Special Agent (DOJ)

Chris J. Quick

Former Special Agent (FBI & IRS-CI)

Michael S. Koslow

Former Supervisory Special Agent (DOD-OIG)

Ray Yuen

Former Supervisory Special Agent (FBI)

CIPA Violations Can Lead to Criminal Prosecution Under California Penal Code Section 632 in Some Cases

Along with facing civil liability, companies (and their owners and executives) targeted in CIPA litigation can also face criminal prosecution in some cases. Under Section 632 of the California Penal Code, willfully reading communications (or any portion thereof) without consent or using any “machine, instrument, or contrivance” to intentionally make an “unauthorized connection” carries both fines and prison time. We defend clients in criminal enforcement proceedings as well, and our team also has substantial experience in this area.

California Invasion of Privacy Act (CIPA) vs. California Consumer Privacy Act (CCPA)

Companies that are required to comply with the California Invasion of Privacy Act (CIPA) must also generally comply with the California Consumer Privacy Act (CCPA). The CCPA governs the collection and management of consumer data, and it also allows consumers to pursue civil claims for certain violations. Our law firm also defends companies nationwide against CCPA claims, and we have substantial experience in this area as well.

California Invasion of Privacy Act (CIPA) vs. California Privacy Rights Act (CPRA)

The California Privacy Rights Act (CPRA) is an amendment to the California Consumer Privacy Act (CCPA). It enhances the protections afforded to consumers under the CCPA by establishing additional prohibitions and giving consumers additional control over their data. Data breaches are among the most common issues underlying CPRA claims, and it is not uncommon for companies to face litigation involving CIPA, the CCPA, and the CPRA.

California Invasion of Privacy Act (CIPA) vs. Federal Law

Congress is yet to establish a comprehensive data privacy law protecting consumers in the United States. While there are laws that apply in specific circumstances and to specific populations (i.e., the Children’s Online Privacy Protection Act (COPPA)), most privacy-related litigation takes place at the state level—and much of this litigation takes place in California. With that said, companies that are facing privacy-related litigation can also face federal claims in some cases, and we also have significant experience defending companies in federal litigation.

FAQs: Defending Against California Invasion of Privacy Act (CIPA) Claims

Why are companies increasingly facing lawsuits under the California Invasion of Privacy Act (CIPA)?

The California Invasion of Privacy Act (CIPA) has recently become a favorite tool of certain plaintiffs’ law firms for pursuing litigation against companies both in and outside of California. This is due to two primary factors: (i) the breadth of CIPA’s prohibitions; and, (ii) CIPA’s provision for statutory damages. Companies targeted in CIPA litigation need to be prepared to defend themselves effectively, and this starts with engaging experienced defense counsel.

Does CIPA apply to my business?

Probably. Due to its breadth, the California Invasion of Privacy Act (CIPA) applies to a wide range of businesses. This includes businesses that have websites accessible to California residents but that otherwise have no connections to California. Since CIPA’s protections are significantly broader than those afforded by most other states’ privacy laws, many companies violate CIPA without realizing it.

My company received a demand letter citing CIPA—what should I do?

If your company has received a demand letter alleging violations of the California Invasion of Privacy Act (CIPA), you should engage experienced defense counsel promptly. CIPA lawsuits can present substantial liability risks for companies of all sizes.

Our law firm represents companies nationwide in CIPA litigation in California’s state and federal courts. Once engaged, we can promptly assess the demand letter’s validity, and then we can help you make informed decisions about your next steps based on your company’s risk exposure.

What can happen if a company doesn’t respond to a CIPA demand letter?

Companies that ignore CIPA demand letters can face lawsuits—and they can ultimately face default judgments if they continue to ignore the risks involved. As a result, practically speaking, ignoring a CIPA demand letter is not an option. Our law firm can help your company respond appropriately; and, regardless of the circumstances at hand, we can help you efficiently target a favorable resolution that protects your company’s interests to the fullest extent possible.

Can companies face criminal penalties for failing to comply with CIPA?

Yes, companies (and their owners and executives) can face criminal penalties for failing to comply with the California Invasion of Privacy Act (CIPA) in some cases. Specifically, under Section 632 of the California Penal Code, certain intentional and willful violations of CIPA carry fines of up to $10,000 and one year of incarceration. In cases involving multiple violations, targeted entities and individuals’ exposure can be substantial.

Speak with a CIPA Defense Attorney at Oberheiden P.C. Today

We defend companies nationwide in California Invasion of Privacy Act (CIPA) litigation. We provide defense representation for criminal CIPA enforcement matters in California as well. If you need to speak with a CIPA defense attorney, we strongly encourage you to contact us right away. To speak with one of our senior attorneys as soon as possible, call us at 888-680-1745 or tell us how we can reach you online today.