The month a CIPA demand letter arrived and my fix was sitting on a desk (70K MRR)

The letter arrived on a Tuesday, ran to nine pages, and never once asked me to stop doing anything. It asked for a number. We were at $70,000 MRR, eleven people, a B2B product with a chat widget in the corner and a session-analytics script I had installed in an afternoon two years earlier and had not thought about since. The letter said that script made me a wiretapper.

Quick answer (2026): This diary is a composite. It is assembled from several real operator situations and one real demand letter, with the company, the numbers and the timeline changed. The law in it is not changed, and every figure below comes from the statute text I have linked. What I learned is this: California's wiretap statute gives a private individual who suffered nothing a fixed recovery of five thousand dollars per violation, which is double the maximum criminal fine the State itself could impose on me for the same act on a first conviction. A bill that would remove part of that exposure passed both houses without a single no vote, and on the day I am writing it is sitting on the Governor's desk. It reaches one of the three counts against me.

Three counts, one script

The statute is the California Invasion of Privacy Act, Penal Code chapter 1.5. It was added in 1967. Its opening section says the Legislature acted because "advances in science and technology have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications", which is a sentence written about tape recorders and is now read onto a JavaScript tag.

My letter pleaded three counts, and it took me a week to understand that they are genuinely different claims.

The first was section 631, the wiretapping section. It reaches anyone who acts "by means of any machine, instrument, or contrivance, or in any other manner". The part that matters for a founder is at the end of the same sentence, where liability extends to a person "who aids, agrees with, employs, or conspires with any person or persons" to do the prohibited thing. Employs. Hiring the vendor is one of the verbs in the statute. I had assumed the theory was that I was listening to my own visitors, which is nonsense, because you cannot eavesdrop on your own conversation. The theory is that my vendor was the listener and I paid them to be there.

The second was section 632, confidential communications, aimed at the chat widget.

The third was the one I had never heard of, and it is the one the reform is about. Section 638.51 says a person "may not install or use a pen register or a trap and trace device without first obtaining a court order". A pen register is defined one section earlier as a device or process that records "dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication". That definition, section 638.50, is written for telephone equipment. Plaintiffs read it onto anything that logs where a visitor came from without logging what they said.

The number that is not the number

Here is the arithmetic that reorganised my week.

The criminal fine under section 631 is "a fine not exceeding two thousand five hundred dollars ($2,500)" for a first offence, rising to "a fine not exceeding ten thousand dollars ($10,000)" for a repeat. Those are ceilings, and they belong to the State, which has to prove a crime.

The civil remedy is in section 637.2. A private plaintiff may sue for "the greater of the following amounts": "Five thousand dollars ($5,000) per violation", or "Three times the amount of actual damages, if any, sustained by the plaintiff".

So the private figure is twice the State's own criminal ceiling for a first conviction. The repeat-offender criminal maximum of ten thousand dollars is exactly two civil violations. That is not a rhetorical comparison, it is division.

The greater-of has a crossover. Three times actual damages beats five thousand dollars only once actual damages pass $1,666.67 per violation. I spent an evening trying to work out which side of that line a website visitor sits on before I read subdivision (c), which settles it: "It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages."

That subdivision decides the whole class. The leg of the greater-of that was written for a person whose telephone was tapped and who lost something real is unreachable here, by construction, because the statute expressly lets a plaintiff sue with nothing. Everyone in this claim class lands on the five thousand dollar leg. The alternative is not an alternative.

Then the multiplier. At $70,000 MRR, one month of revenue is 14 violations. A year of revenue, $840,000, is 168 violations. One hundred and sixty-eight visits. I looked at my analytics dashboard, which is the same tool the letter was about, and understood that the instrument that created the liability is also the one that sizes it.

The exemption I thought was mine

I had a cookie banner. I assumed it was my defence, because that is what the banner is sold as.

Section 638.51 does contain exemptions, five of them, and the fifth is "If the consent of the user of that service has been obtained". I read that and relaxed for about an hour. Then I read the line above the list. The subdivision opens: "A provider of electronic or wire communication service may use a pen register or a trap and trace device for any of the following purposes". All five exemptions, consent included, sit under a heading addressed to a communications provider. I am not one. Section 631's exemptions are the same shape, reserved to a public utility, a telephone company, and correctional facility systems.

I also went looking, with a plain text search, for the words a small company hopes to find in a statute. Across the whole chapter: "de minimis" appears zero times. "small business", zero. "fewer than", zero. "exempt", zero. "consumer", zero. The words "website" and "internet" appear zero times as well, which is the strangest fact in this whole episode. The chapter that has produced years of website litigation does not contain the word website.

There is exactly one instance of "good faith" in the chapter, and it is in section 638.51(d): "A good faith reliance on an order issued pursuant to Section 638.52, or an authorization made pursuant to Section 638.53, is a complete defense to a civil or criminal action brought under this section or under this chapter". So a complete defence does exist. It is available to someone who went and obtained a court order before installing the thing. There is no mirror for the business that believed in good faith that its analytics was not a pen register. I looked for that mirror and it is not there.

The bill on the desk

While I was reading all this, the Legislature had already acted.

Senate Bill 690 amends section 637.2. It adds a new subdivision (d)(1): "An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application" may be brought "only by the Attorney General". It also applies retroactively, to "any pending claim in an action commenced within two years before the operative date of that legislation".

It passed the Assembly 66 to 0 and the Senate concurred 39 to 0. Not one recorded no vote in either house. Its status page describes it as "An act to amend Section 637.2 of the Penal Code, relating to crimes", lists its house location as the Governor, and records the action: "Enrolled and presented to the Governor at 2 p.m." on 4 September 2026.

Two things about that bill mattered to me more than the headline.

The first is scope. It reaches section 638.51 and nothing else. My letter pleaded three counts. If the bill becomes law, count three goes away and counts one and two do not. Every summary I read described it as ending website privacy suits. Read against its own text it removes one theory from a pleading that has two more.

The second is what happens if nobody signs it. I assumed an unsigned bill dies on the desk, because that is the intuition everyone has. Article IV, section 10 of the California Constitution says the opposite in this window. Subdivision (b)(2) covers a bill "passed by the Legislature before September 1 of the second calendar year of the biennium of the legislative session and in the possession of the Governor on or after September 1", and provides that such a bill, if it is "not returned on or before September 30 of that year becomes a statute". This bill passed on 28 August and was presented on 4 September. Silence enacts it.

What I got wrong

Three things, and the first two were the expensive ones.

I assumed the bill sitting unsigned was bad news. Under Article IV, section 10(b)(2), inaction is enactment for a bill in this position. The default runs my way, not against me.

I assumed the reform would end my problem. It amends one section and reaches one of my three counts. I had been reading commentary rather than the bill.

I assumed the consent banner was my exemption. The consent language is real, and on the text it sits inside a subdivision addressed to communications providers. I have not read the case law on how courts have applied that subdivision to ordinary website operators, and it is entirely possible they read it more broadly. What I can say is that the text does not hand it to me.

Limits

I am not a lawyer and this is not advice. I read statute text and a bill; I did not read the case law, and this area is decided by trial court rulings that go both ways. I have not checked whether the Governor has acted since I wrote this, and by the time you read it the answer will exist. The retroactivity clause protects pending claims in actions commenced within two years before the operative date, which means the oldest cases get the least protection, and I did not work out where my own letter would fall because no action had been commenced against me at all.

What actually happened

We did not pay the demand. We turned off the session-replay tool the same week, which cost us nothing we have missed, and we kept the analytics. I cannot tell you the ending because the ending is a date that had not arrived when I wrote this.

The one thing I would tell you

The number in a demand letter is never the interesting number. The interesting number is the one the statute uses as its unit, and then the question is what you already count that matches that unit. Mine was sessions. I had a dashboard of them, updated hourly, that I had built for growth and that turned out to be a liability meter pointed the other way. Go and find out what your statute counts in, before somebody else does it for you.