The California Invasion of Privacy Act, known as CIPA, is a state law that makes it illegal to record, eavesdrop on, or intercept someone’s private communications without the consent of every person involved. Codified at Penal Code sections 630 through 638, the statute has been on the books since 1967 and carries real consequences: criminal fines up to $2,500 per violation for a first offense, possible jail time, and $5,000 per violation in a civil lawsuit brought by the person who was recorded.1California Legislative Information. California Penal Code – Invasion of Privacy What began as an anti-wiretapping measure now reaches website tracking tools and AI-powered chatbots, making CIPA one of the most aggressive privacy laws in the country.
What CIPA Prohibits
CIPA targets two related activities: intercepting communications while they travel, and recording private conversations.
Penal Code 631 covers interception. It prohibits tapping into or making unauthorized connections with any telephone wire, line, cable, or instrument, and it bars anyone from reading or learning the contents of a message in transit without the consent of all parties.2California Legislative Information. California Penal Code 631 Courts have read “instrument” broadly enough to include smartphones, not just traditional landlines.
Penal Code 632 covers recording. It prohibits the intentional use of any electronic amplifying or recording device to eavesdrop on or record a “confidential communication” without every participant’s consent.3California Legislative Information. California Penal Code 632 A communication is confidential when the circumstances reasonably indicate the participants want it to stay between them. That can mean a face-to-face conversation, a phone call, or a video call held in a private setting.
A separate provision, Penal Code 632.7, applies specifically to calls involving cell phones and cordless phones. It does not require the communication to be “confidential.” It covers any call transmitted between cellular phones, cordless phones, or any mix of those with landlines.4California Legislative Information. California Penal Code 632.7 That distinction matters, because the usual defense of “no reasonable expectation of privacy” is harder to run when a cell phone is on the line.
The All-Party Consent Rule
California is an all-party consent state. Every person in a conversation must agree before anyone else can record or intercept it.3California Legislative Information. California Penal Code 632 That is stricter than federal law and stricter than the rule in most other states, where only one participant has to agree.
On phone calls, consent usually arrives as the familiar recorded message: “this call may be recorded.” Courts have generally accepted that staying on the line after hearing such a notice counts as implied consent. On digital platforms, consent takes different forms, from pop-up banners to checkboxes before a chat session begins. The notice has to be clear and conspicuous before the recording starts. Burying it in a terms-of-service document the user never opens does not satisfy the rule.
The California Supreme Court addressed the geography question in Kearney v. Salomon Smith Barney, Inc. (2006). A Georgia-based brokerage had recorded phone calls with California clients without telling them, relying on Georgia’s one-party consent law. The court held that California’s all-party rule applies whenever one end of the call is in California, regardless of what the law says in the other state.5FindLaw. Kearney v. Salomon Smith Barney, Inc. A business cannot sidestep CIPA by routing calls through an out-of-state call center.
When Recording Is Allowed
CIPA does not reach every recording. Several situations fall outside the statute.
Public and Non-Private Settings
Section 632 only protects confidential communications. A conversation at a public gathering, during a government proceeding open to the public, or in any setting where the speakers could reasonably expect to be overheard is not covered.3California Legislative Information. California Penal Code 632 A loud exchange at a crowded coffee shop probably lacks the expectation of privacy CIPA requires. Two people whispering at the corner table in the same shop may still have one. Context does the work.
Law Enforcement
Penal Code 633 exempts certain law enforcement officials, including the Attorney General, district attorneys, sheriffs, police chiefs, California Highway Patrol officers, and peace officers in the Department of Corrections and Rehabilitation’s Office of Internal Affairs. These officials, and anyone acting under their direction, may record communications they could have lawfully recorded before January 1, 1968.6California Legislative Information. California Penal Code 633 In practice, that means recording a conversation they are participating in or one happening where they have a lawful right to be present.
The exemption does not override the Fourth Amendment. When a person has a reasonable expectation of privacy, electronic surveillance by law enforcement generally still requires a warrant backed by probable cause.
Website Tracking and AI Tools
The busiest area of CIPA litigation today involves technology the 1967 legislature could not have imagined. Plaintiffs have brought hundreds of cases arguing that session replay software, chatbot transcripts, and AI-driven call tools amount to illegal wiretapping under Section 631.
Session Replay Software
Session replay tools record a visitor’s activity on a website, including keystrokes, mouse movements, scrolling, and form entries, then let the site operator play it back like a video. In Mikulsky v. Bloomingdale’s, LLC, the Ninth Circuit held that a complaint plausibly alleged a CIPA violation where session replay software captured the content of a user’s interactions during transmission without consent. The court distinguished this from collecting mere metadata, finding that reconstructing exact website behavior went further.2California Legislative Information. California Penal Code 631 The ruling opened the door to a wave of lawsuits against retailers and other companies deploying these tools without adequate disclosure.
AI Chatbots and Virtual Call Agents
A newer front involves AI chatbots and virtual call agents. In Ambriz v. Google LLC, plaintiffs alleged that Google’s AI-powered Cloud Contact Center used virtual agents to listen in on, record, and analyze calls between consumers and businesses without consumer consent. Google argued it was simply a tool provider, akin to selling someone a tape recorder. In February 2025, the court denied Google’s motion to dismiss, applying a “capability test”: if Google’s technology had the capability to use intercepted data to improve its own AI models, Google could be treated as an unauthorized third party rather than a passive tool.7Courthouse News. Ambriz v. Google LLC – Order Denying Motion to Dismiss The case is still active, but the ruling signals that companies deploying AI in customer communications face real CIPA exposure.
Criminal Penalties
A first violation of Section 631 or Section 632 is punishable by a fine of up to $2,500 per violation, up to one year in county jail, or both.2California Legislative Information. California Penal Code 631 First offenses can also be charged as felonies with state prison time under Penal Code 1170(h), giving prosecutors discretion to treat even a first violation seriously when the circumstances warrant it.
Repeat offenders face stiffer consequences. Anyone previously convicted of violating Section 631, 632, 632.5, 632.6, 632.7, or 636 faces fines up to $10,000 per violation along with the same imprisonment options.3California Legislative Information. California Penal Code 632 The same penalty structure applies to unauthorized recording of cell phone calls under Section 632.7.4California Legislative Information. California Penal Code 632.7
Criminal prosecutions under CIPA are less common than civil lawsuits, partly because district attorneys weigh these cases against competing priorities. The criminal provisions still function as a deterrent and give law enforcement a tool against the most egregious conduct, such as stalkers using spyware or employers secretly recording employees in private spaces.
Civil Lawsuits and Damages
The civil side of CIPA is where most of the activity happens. Penal Code 637.2 gives anyone injured by a CIPA violation the right to sue for the greater of $5,000 per violation or three times their actual damages.8California Legislative Information. California Penal Code 637.2 You do not have to prove you suffered any actual harm to collect the $5,000 statutory amount. The statute explicitly says actual damages are not a prerequisite to filing suit.
That per-violation structure is what makes CIPA class actions so potent. When a company records thousands of customer calls or runs session replay software across a high-traffic website, each affected interaction is a separate violation. Multiply $5,000 by thousands or tens of thousands of incidents and the exposure grows quickly. Companies in call-center-heavy industries and online retail have paid multimillion-dollar settlements to resolve these claims.
Courts can also issue injunctive relief, ordering a company to stop the violating practice.8California Legislative Information. California Penal Code 637.2 An injunction often reshapes business conduct more than a payment does, forcing companies to redesign consent flows, add recording disclosures, or remove tracking tools from their websites.
How CIPA Compares to Federal Wiretap Law
The federal Wiretap Act (18 U.S.C. ยง 2511) sets a national floor for wiretapping protections, and CIPA goes further on the parts that matter most. The biggest gap is the consent threshold. Federal law requires only one party’s consent, so you can legally record your own phone call under federal law without telling the other person.9Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications CIPA requires everyone’s consent.
Penalties also look different. Unauthorized interception under federal law is a felony punishable by up to five years in prison.9Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications A first CIPA offense is a misdemeanor with up to a year in jail. CIPA’s civil side is where the pressure really sits: the $5,000 per-violation statutory damages, with no need to prove actual harm, create private-lawsuit incentives the more restrictive federal civil framework does not match. A business that records 10,000 customer calls without disclosure faces theoretical CIPA civil exposure of $50 million.
Because CIPA is stricter, it controls for any communication touching California. The federal one-party rule will not save a company that violates California’s all-party rule on a call with a California resident.