Tracking Pixels Are a Wiretapping Claim Waiting to Happen

A law written in the 1960s to stop illegal phone taps is now the basis for lawsuits against the marketing pixels on your website. That's not an exaggeration. Plaintiff's firms have found a way to argue that a pixel capturing your visitors' clicks and page views, before they've clicked "accept" on anything, works the same way as an illegal wiretap.

California's Invasion of Privacy Act (CIPA) has two provisions doing the work here. Section 631 covers wiretapping. Section 638.51 covers pen registers, a category built for devices that record routing information, like the numbers dialed on a phone call. The theory is that a tracking pixel captures IP addresses, device identifiers, and page activity, then sends that data to Meta or TikTok before the visitor has agreed to anything.

Courts are split on whether this holds up. Some judges dismiss these cases for lack of standing. Others let the same claims move into discovery. That split hasn't slowed the filings down. OneTrust's litigation tracking counted more than 800 CIPA claims in 2025, and 2026 is on pace to match it.

The settlements are real money. European Wax Center paid $5 million over pixels that fired before any consent interaction happened. The LA Times settled for $3.85 million. Forbes Media landed on a $10 million settlement in principle over the same theory. If your site runs a Meta pixel, Google Analytics, or a chat widget, you're running the exact setup these cases target.

The banner isn't a great safeguard

It's common to treat a consent management platform as the fix. But the 2026 wave of cases doesn't care whether you have a banner. It cares whether your systems do what the banner says, at the moment a visitor lands on the page. If your Meta pixel fires the instant the page loads, before the consent tool has even rendered, your system is doing one thing while your banner promises another. That gap between promise and behavior is the entire case.

One pattern shows up again and again in recent rulings. A visitor declines tracking. The site confirms the preference was saved. Tracking continues anyway. Courts have started treating that as a broken promise rather than a bug, which pulls in consumer protection claims on top of the CIPA count. Plaintiff's firms now stack CIPA with the federal Electronic Communications Privacy Act and state consumer protection law in a single filing. That combination raises the settlement number and makes an early dismissal harder to win. The evidence-gathering side of this is a lot less sophisticated than you might think. Plaintiff's firms aren't running some elaborate forensic operation. A lot of the time, someone opens a fresh browser session, loads the site with no cookies accepted, and runs a tool like Ghostery to watch which trackers fire and when. That log becomes the exhibit in a lawsuit. Timestamps will show a pixel firing at half a second, before any banner has even rendered. That's the kind of evidence that shows up directly in these filings. No one needs a subpoena to build that case. They need a browser and a few minutes on the site.

The fix

The fix is a tag audit. You have to map every tag on the site and figure out which ones fire on page load versus which ones wait for a consent signal. You have to get Google's Consent Mode V2 signals configured so tags stop firing when consent is denied, instead of firing regardless. And you have to check whether Global Privacy Control signals get honored across every vendor connected to your site, not just the ones your consent platform was built to watch.

If you installed a Pixel through a Zapier integration or some marketing automation tool, it probably sits completely outside the consent platform's field of view. That's the exact kind of gap plaintiff's firms have gotten good at finding.

None of this is a one-time project either. Tag setups drift every time a marketing team adds a new tool or a developer touches the site. The companies I've seen with the least exposure are the ones treating this as a recurring audit, built into how marketing operations actually run, versus a task somebody checked off once and forgot about.

This isn't staying in California

CIPA started as a California issue. It isn't one anymore. Florida's Security of Communications Act uses language close enough to CIPA's that Florida now trails only California in lawsuit volume. Illinois and Pennsylvania have seen activity too. Plaintiff's firms reach for the federal Electronic Communications Privacy Act to bring claims against companies with no California connection at all.

There was a legislative fix in motion. California's SB 690 passed the Senate 35-0 in 2025, then stalled in the Assembly as a two-year bill. On July 1, 2026, an Assembly committee revived a narrowed version that eliminates the private right of action under the pen register provision, shifts enforcement to the Attorney General, and applies retroactively to claims filed in the prior two years. It faces an August 31 deadline to pass and would take effect September 30, 2026 if it clears. Until then, the litigation landscape is unchanged, so a bet on the law rescuing you carries timing risk.

One clear note here: I'm not a lawyer, and this isn't legal advice. Your specific exposure depends on facts I can't evaluate from a blog post, so talk to counsel about your situation. What I can speak to is the technical side, because that's the work my team does every week.

Beyond the legal risk

Closing your CIPA exposure is the same work that makes your attribution data trustworthy.

A pixel firing before consent is a legal problem, but it's also a pixel misfiring relative to what the reporting assumes it's doing, which means Meta and Google Analytics numbers have been wrong in ways that go unnoticed. Get Consent Mode V2 set up right and you've closed the legal gap. You've also given GA4 the signal it needs to model the conversions you lose when a visitor declines tracking, instead of just losing that data with no way to account for it.

At Signal Lab, this has been the work for months across client accounts: full tag audits, Consent Mode V2 implementation, server-side tagging where it makes sense, and attribution models that hold up once the plumbing underneath them gets fixed. If you don't know whether your setup would survive an audit, that's the conversation worth having, before a plaintiff's firm has the same question for you.