A 1967 California wiretapping law has found new life in the age of digital user tracking and data privacy, with implications that reach far beyond The Golden State.
The California Invasion of Privacy Act (CIPA) was enacted to prevent eavesdropping and the interception and recording of private communications. All parties involved in communications must consent to any interception (not just one, which is the standard set by the federal Electronic Communications Privacy Act). Violations carry a penalty of up to $5,000 per violation per day (or three times the plaintiff’s actual damages, whichever is greater).
CIPA was relatively obscure and seldom used until California courts began to consider website tracking as a form of wiretapping subject to the law as early as 2020. Combined with a 2006 case where a California court held that CIPA protected residents of the state even if the other party was located elsewhere, the stage was set for a new frontier for website data governance.
Does CIPA Apply to Websites and Businesses Outside of California?
If your website is accessible to California residents, CIPA applies to you. This means most organizations on the Internet could be liable under this law—not only website owners, but also third parties involved in tracking, serving ads, or other functions where intermediary software is used. Cookies, pixels, session replay and other such website tracking methods are ostensibly illegal under CIPA without explicit user consent.
Regardless of CIPA and other data privacy frameworks like Europe’s GDPR, organizations should be securing consent for tracking and limiting the data collected and stored from their website visitors in their data governance policy.
How Data Privacy Impacts Your Public Perception
While utilizing website data is critical to marketing and SEO efforts, ethical, user-friendly, and privacy-friendly data collection is equally important to an organization’s public perception.
Customers don’t want to engage with (or buy from) brands they don’t trust with their data. A strong data protection policy that secures consent and provides transparency is as much as a public relations concern as it is a technical or risk management one.
Here are some concrete steps organizations should take to ensure CIPA compliance and provide the trust and transparency their customers expect:
- Consult your web developer about data collection. Your web development, marketing and/or IT team can tell you what tools your site uses and whether user data is collected, used and stored directly or by third parties.
- Review your existing website privacy policy. Ensure it includes which data is collected, how it is used, and how it is stored. If necessary, update it to ensure data privacy compliance in line with CIPA and other privacy frameworks.
- Collect explicit consent for user tracking. The (sometimes annoying) pop-ups or banners seen across the web, known as “cookie popups” or “cookie consent popups,” are now a common and expected method of collecting explicit user consent and maintaining compliance with CIPA, GDPR and other privacy frameworks.
Balancing Privacy and Marketing with Niki Jones Agency
Niki Jones Agency is your partner for web design & development and strategic communications that protects your customers, their data, and your brand.
Contact us today to schedule a CIPA compliance review.