If your website has a live chat bubble, a Facebook pixel, or Google Analytics running in the background, you may have more legal exposure than you realize. Over the past two years, plaintiffs’ attorneys have been using a 1967 California anti-wiretapping law to sue businesses — including plenty of small, local ones — over the ordinary tracking and chat tools installed on their websites. The claims sound absurd at first. They are not a joke to the business on the receiving end of a demand letter.
What Is CIPA, and Why Is It Suddenly a Problem?
The California Invasion of Privacy Act (CIPA) was written decades before the web existed, aimed at phone tapping and electronic eavesdropping. Courts have since been asked to decide whether modern website technology — code that captures how a visitor moves through a page — counts as the same kind of interception the law was designed to stop.
In 2022, the Ninth Circuit’s decision in Javier v. Assurance IQ held that session-replay software, which records a visitor’s clicks, scrolls, and keystrokes for later playback, can qualify as an “interception” under CIPA. That ruling turned a once-obscure statute into a viable legal theory, and plaintiffs’ firms moved fast. According to a Bloomberg Law analysis, data privacy lawsuits built on old wiretapping statutes have surged as attorneys found a repeatable playbook across industries. The first wave targeted session-replay tools directly. As those claims have started to recede, a second wave has emerged alleging that chatbots — the little “Chat with us!” widgets installed on countless small business sites — also violate the law by letting a third-party vendor “listen in” on conversations without clear consent, according to Norton Rose Fulbright’s review of the litigation trend.
The Tools That Put You at Risk
The technology at issue is not exotic. It’s the stuff most small business websites run without a second thought:
- Live chat widgets (Intercom, Drift, Tidio, and similar tools) that route conversations through a third-party server
- Session replay or heatmap tools used to see how visitors use a site
- Advertising pixels from Meta, Google, or other ad platforms that track visitor behavior for retargeting
- Analytics scripts that log more than basic page views — particularly anything capturing form inputs or mouse movement
None of these are inherently illegal, and most businesses installed them precisely because a marketing agency or web developer recommended them as standard practice. That’s exactly the trap: these are default-install tools, not rogue surveillance software, which is why so many businesses have no idea they’re exposed.
How the Lawsuits Actually Work
This is what makes CIPA claims especially dangerous for a small operator: plaintiffs don’t have to prove they were harmed. CIPA allows for statutory damages of up to $5,000 per violation, and “violation” can be interpreted as every website visit by every person who wasn’t shown adequate disclosure. A single demand letter can threaten damages wildly out of proportion to any actual injury, and many businesses settle simply because litigating a class claim is more expensive than paying to make it go away — which is precisely the incentive structure plaintiffs’ firms are counting on.
It’s also a mistake to assume this only affects businesses based in California. CIPA claims generally turn on where the website visitor is located when their data is captured, not where the business is headquartered. A bakery in Ohio or a hardware store in Georgia with customers who browse from California can, in theory, find itself in the same legal exposure as a business physically operating there.
What Congress Is Trying to Do About It
Small business advocacy groups have taken notice. The National Federation of Independent Business recently threw its support behind H.R. 10263, the Halt Abusive Internet Lawsuits Act, which aims to curb this specific category of claims against businesses using standard website technology. The bill text, available through Congress.gov, is still working through the legislative process, and NFIB has cited survey data suggesting that roughly a quarter of small business owners who face frivolous litigation say it meaningfully harmed their operations — a reminder that even winning a nuisance suit can be expensive. Other pending proposals, including bills that would require a notice-and-cure period before a lawsuit over website issues can proceed, reflect the same underlying concern: the law hasn’t caught up to how ordinary websites work, and small businesses are the ones absorbing the cost while that gets sorted out.
Legislation like this can take years to pass, if it passes at all. In the meantime, the exposure is real today, not hypothetical.
What You Can Actually Do Right Now
You don’t need to rip every tool off your website, but a short audit is worth the afternoon it takes:
- Inventory what’s actually running. Pull up your site’s source code or ask your web developer for a list of every third-party script — chat tools, pixels, analytics, heatmaps. Most owners are surprised by how many there are.
- Add clear, upfront disclosure. A cookie consent banner that explains what’s being collected and lets visitors opt out before tracking starts is the single biggest risk reducer. Passive privacy policies buried in a footer link generally don’t count as adequate notice under these theories.
- Check your chat vendor’s consent flow. Ask whether your chat tool captures and stores full conversation transcripts, and whether it surfaces a disclosure before the conversation starts.
- Talk to your insurance broker. Some cyber liability and general liability policies have started addressing this category of claim; many don’t. It’s worth asking explicitly rather than assuming you’re covered.
- Loop in a lawyer before you get a letter, not after. A quick compliance review from an attorney familiar with CIPA claims is far cheaper than responding to an active demand.
The uncomfortable truth is that this entire category of litigation is built on technology most businesses added in good faith to serve customers better. Until the law catches up, the practical move is to treat your website’s tracking tools with the same scrutiny you’d give a lease or a vendor contract — know what’s running, disclose it clearly, and don’t assume “everyone has a chat widget” means you’re in the clear.
