Your Website Might Be a Lawsuit Target
If your company website has a search bar, a contact form, a chat widget, or Google Analytics (most do), you may be exposed to a wave of lawsuits targeting California businesses — including SMACNA members.
Plaintiffs’ attorneys are suing businesses across California under a 1960s-era wiretapping statute, the California Invasion of Privacy Act (CIPA). The argument? Common tracking tools, including Meta Pixel, Google Analytics, session-replay software, chat widgets and even basic site search bars may function as an illegal “pen register” or “trap and trace” device when they send visitor data to third parties like Google or Meta without the visitor’s prior consent.
This is no longer a fringe issue. Filings under this section of CIPA have increased dramatically, with claims now making up a significant share of California privacy litigation. Nearly 4,000 California cases are reportedly on the books as of mid-2026.
The money is real too: $5,000 per violation (or triple actual damages), plus attorneys’ fees, usually filed as class actions. Even major organizations are choosing to settle. The LA Times agreed to a $3.85 million settlement in June 2026 over three ad trackers, without admitting wrongdoing.
Is This Actually Settled Law? Not Quite.
The legal landscape remains unsettled.Some federal judges have allowed these claims to proceed, while state courts have more frequently dismissed them. A California Court of Appeal case that could help clarify whether CIPA applies to website tracking had oral argument scheduled for late August 2026. A California Assembly analysis has also described the statute as ripe for abuse.
Meanwhile, CAL SMACNA is actively lobbying for SB 690 (Caballero), which would exempt certain ordinary business tracking activities from liability. The bill has not yet passed, meaning the potential risk remains while the courts and Legislature sort out where the law ultimately lands.
Practical Steps for Your Company
- Audit your website. Get a full list from IT of every script, pixel, cookie and analytics tool running, and what data each sends.
- Add a real consent banner. It must block trackers until visitors click “Accept” — simply displaying a banner isn’t enough.
- Update your privacy policy.
- Spell out tracking tools, data collected and who receives the data. Link to it from every page.
- Keep consent records. Proof of when/how visitors consented is key defense if targeted.
- Review vendor contracts. Ensure compliance and indemnification language is included.
- Loop in counsel now. Have an attorney review your site before a demand letter arrives.