A recent Northern District of California decision stated what we’ve all known for awhile: “The language of CIPA is a total mess.” Doe v. Eating Recovery Center LLC, 2025 WL 2971090 (N.D. Cal. Oct. 17, 2025).

The California Invasion of Privacy Act (“CIPA”) is an antiquated wiretapping statute that Plaintiffs’ lawyers have been urging courts to apply to standard web analytics and advertising pixels. As the Doe court aptly observed, the CIPA “mess gets bigger and bigger as the world continues to change and as courts are called upon to apply CIPA’s already-obtuse language to new technologies.” 

In Doe v. Eating Recovery Center LLC, Plaintiffs made the now-standard allegation that defendant violated CIPA by using the Meta pixel on its website. Not only did the Court grant summary judgment in defendant’s favor; it implored the California Legislature to “bring CIPA into the modern age” and to “speak clearly” as to whether it applies to these sort of website tracking technologies. 

The Court emphasized that although most CIPA cases are private civil actions, CIPA is actually a criminal statute. It must therefore be narrowly construed. The Court refused to hold that California’s 1967 wiretapping statute was intended to criminalize the use of standard third-party tracking pixels. 

This decision provides hope that some judges are finally “getting it.” But the problem remains that courts continue to issue conflicting rulings. As the Doe court noted, this is problematic because “companies have no way of telling whether their online activities will subject them to liability.”

Unfortunately, SB 690, a bill aimed at limiting the scope of CIPA liability, is currently on hold. In the interim, rulings like this are encouraging more companies to fight these claims in court.