Observed Signal · Apr 20, 2026 · Litigation · Source: AdExchanger · Impact: 4/5 · Sentiment: Negative
1967 CIPA Fuels New Wave of Ad Tech Lawsuits
The California Invasion of Privacy Act (CIPA), enacted in 1967 to address wiretapping, has re-emerged as a major legal threat to the ad tech ecosystem. Because CIPA provides a private right of action with steep statutory damages (typically $5,000 per violation or treble actual damages plus fees), plaintiffs’ lawyers are filing suits that recast cookies, pixels, SDKs and real-time bidding (RTB) data flows as intercepted communications. Cases have expanded from pixel-focused complaints to include SSPs, DSPs and RTB plumbing. Some judges have allowed early-stage claims to proceed, prompting settlements that sometimes require technical fixes (for example, an RTB opt-out mechanism in a recent Google settlement). Lawyers quoted urge firms to pursue data hygiene and “litigation mitigation” measures, while advocates say CIPA remains an important enforcement backstop; a 2024–25 bill (SB 690) to narrow CIPA has stalled, so the statute still applies.
CIPA-based litigation poses material legal and product risk to core programmatic infrastructure (SSPs, DSPs, RTB), can trigger technical remedies in settlements, and creates precedent affecting data practices across the ad tech industry.
Track IAB Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- California Invasion of Privacy Act (CIPA) was enacted in 1967.
- CIPA provides a private right of action with statutory damages of $5,000 per violation or three times actual damages, plus attorney’s fees in some cases.
- Plaintiffs are alleging that cookies, pixels, SDKs and RTB bid requests constitute intercepted communications under CIPA.
- Ad tech intermediaries including SSPs and DSPs have been named in CIPA-style complaints as litigation has expanded beyond publisher pixels.
- A recent Google RTB class-action settlement in the Northern District of California included building a tool to prevent personal data leaking into ad auctions (an RTB opt-out mechanism); the settlement included no damages.
Connected Companies & Entities
1 Entity mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
CIPA reshapes the digital tracking debate
The California Invasion of Privacy Act (CIPA), a 1967 law originally aimed at wiretapping, has resurfaced in modern litigation claiming common web tracking (pixels, tags, cookies, fingerprinting, session replay, SDKs) can amount to unlawful interception. Plaintiffs can bring private actions and potential civil penalties include up to $5,000 per violation per day or triple actual damages. Early court rulings denying motions to dismiss have prompted more settlements, increasing legal scrutiny. Marketers are advised to work closely with legal teams, consider blocking tracking until consent, explore server-side tracking and tools like Google Tag Gateway, and prioritize zero- and first-party data and stronger data governance to reduce exposure while preserving marketing operations.
Weakening CIPA: A Free Pass for Big Tech's Data Abuse
An AdExchanger analysis argues that weakening California's privacy law, CIPA, would effectively grant Big Tech a free pass on data abuse. The piece notes CIPA has allowed private civil action since 1967 and was updated in 2016 to cover electronic communications, forming the basis for modern tracking-pixel cases. It references the Flo case (Frasco v. Flo Health), where a jury found Meta violated CIPA by receiving menstrual-cycle data from a mobile app. A 2024 legislative analysis is cited confirming CIPA should evolve with technology, countering claims it is obsolete alongside CCPA/CPRA. The article mentions SB 690, which passed the California Senate in June, and argues that consent alone cannot legitimize tracking, invoking Calhoun v. Google (9th Circuit) and a broader move away from surveillance-based models, asserting private action remains essential to privacy enforcement.
CIPA Private Right of Action Kept, Shifting Privacy to Research
California's legislature passed a compromise version of SB-690, maintaining most of the private right of action provisions of the California Invasion of Privacy Act (CIPA). This means that juries, rather than regulators, will set privacy standards in the state, as individuals can sue companies for online tracking practices. With over 4,000 CIPA lawsuits filed, mostly against legitimate businesses, the shift emphasizes the need for companies to align data practices with consumer (and juror) expectations. The author argues that privacy compliance should now be research-driven, focusing on customer attitudes, rather than purely legal compliance. This could lead to a competitive advantage for customer-centric businesses over Big Tech, which may face greater legal exposure.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.