1. Which Business Communications Require a CIPA Review?
A call center may know its recordings are on, yet overlook what a chat vendor collects in real time. Penal Code §§ 631, 632, and 632.7 address different conduct. The first question is what reaches whom, and when.
Map the Communication before Assessing Consent
- Identify call recordings, chat transcripts, and website interaction data.
- Determine when recording or transmission starts and who receives it.
- Check vendor access, retention settings, and available notice records.
A vendor dashboard may reveal collection missing from the public notice. A data governance review can clarify vendor oversight.
Distinguish Interception from Confidential Recording
Section 631 addresses prohibited interception or access to covered communications. Section 632 protects confidential communications against recording or eavesdropping without all-party consent. Section 632.7 separately addresses recording specified cellular or cordless calls without all parties' consent, even when confidentiality is not shown.
2. When Must a Business Obtain Recording Consent?
The timing of notice matters as much as its wording. A recording that begins before an announcement raises a different question from one started afterward. Chat notices and website banners should be assessed against the actual technology.
Review the Consent Mechanism
- Check when call announcements play relative to recording.
- Review whether chat participants see notice before capture begins.
- Preserve notice versions, configurations, and consent records.
Consent can depend on conduct and circumstances. A privacy policy alone may not establish it.
Separate State Rules from Federal Wiretapping Law
Federal law, 18 U.S.C. § 2511, generally allows interception with one party's consent, subject to exceptions. That rule does not override applicable, stricter state law. For calls crossing state lines, assess participant locations and the recording method.
3. How Can Website Tracking Create CIPA Litigation Risk?
A chat service may transmit message content as the conversation unfolds; analytics code may capture different signals. Sections 631 and 638.51 raise distinct legal questions. Installing a tracker does not automatically establish a violation.
Compare the Technologies and Legal Questions
| Technology | Question to Investigate |
|---|---|
| Chat or session replay | Does a third party receive communication content during the session? |
| Pixels and analytics | What information is captured, transmitted, and used? |
| Call recording | Was required consent obtained before a confidential call was recorded? |
Chat or session replay
- Question to InvestigateDoes a third party receive communication content during the session?
Pixels and analytics
- Question to InvestigateWhat information is captured, transmitted, and used?
Call recording
- Question to InvestigateWas required consent obtained before a confidential call was recorded?
Review operation, access, consent, and the alleged provision.
Account for SB 690 without Assuming Immunity
SB 690 was signed September 30, 2026, but its amendment to § 637.2 becomes operative January 1, 2027. It reserves covered § 638.51 civil actions against private actors involving website or app conduct to the Attorney General. It also applies to pending claims in actions filed within the preceding two years, without eliminating §§ 631 or 632 claims.
4. How Do CIPA and CCPA Obligations Differ?
An accurate privacy notice may tell visitors what data a company collects but not whether a chat transmission meets CIPA requirements. CCPA obligations depend on the business and its data practices. Review the two statutes separately.
Compare Notices and Legal Duties
| Issue | CIPA | CCPA |
|---|---|---|
| Primary concern | Interception and confidential recording | Collection, use, and sharing of personal information |
| Key review | Communication, participation, and applicable consent | Notice at collection and relevant consumer rights |
Primary concern
- CIPAInterception and confidential recording
- CCPACollection, use, and sharing of personal information
Key review
- CIPACommunication, participation, and applicable consent
- CCPANotice at collection and relevant consumer rights
CCPA duties depend on statutory coverage and data practices. For wider obligations, see data compliance considerations.
Test Disclosures against Actual Data Flows
- Compare collection notices with the site's active scripts.
- Identify vendors receiving personal information or communications.
- Check opt-out practices where CCPA sale or sharing rules apply.
Use the CCPA regulations effective in 2026, but assess recording consent on its own facts.
5. What Should a Business Do When a Privacy Claim Arrives?
A demand letter may name a script removed months earlier. Before responding, establish what version was running and what visitors saw during the alleged period. Preserve the relevant settings and records.
Preserve the Evidence Needed for Review
- Retain relevant script versions, call settings, and consent records.
- Collect vendor contracts and documentation of data access.
- Record dates of configuration changes and claim correspondence.
Preserve records without altering the underlying systems evidence. Related cybersecurity legal consulting may address broader response planning.
Assess the Claim and Available Remedies
Penal Code § 637.2 provides statutory or actual-damages-based remedies for qualifying violations, subject to exceptions and statutory changes. Attorneys can evaluate the cited provision, data transmission, and available consent records. A demand letter is an allegation, not a finding.
6. Frequently Asked Questions
Does a cookie banner satisfy CIPA consent requirements?
Not necessarily. Its wording, timing, and the communication captured matter; a general cookie notice may not address the conduct alleged.
Can a vendor's chat software create liability for the website operator?
Potentially. The software's operation, vendor access, and the relevant statutory elements require review. Vendor contracts alone do not decide liability.
Does SB 690 end all website wiretapping lawsuits?
No. Beginning January 2027, its restriction concerns specified § 638.51 claims against private actors involving websites or apps, not every CIPA claim.
Does CIPA require every business to register or file a privacy report?
No general CIPA registration requirement applies merely because a business records calls or operates a website. Other laws may impose separate obligations.
7. Review Communication Practices with SJKP
If a call recording or third-party tracking tool raises concerns, SJKP's attorneys can examine the applicable statutes, system settings, vendor terms, and demand letters. Bring the notices and configurations used during the relevant period so the assessment addresses what actually happened.
16 Oct, 2026
