ARTICLE
19 February 2026

CIPA Lawsuits Keep Coming: Is Your Website In The Crosshairs?

SM
Sheppard, Mullin, Richter & Hampton LLP

Contributor

Businesses turn to Sheppard to deliver sophisticated counsel to help clients move ahead. With more than 1,200 lawyers located in 16 offices worldwide, our client-centered approach is grounded in nearly a century of building enduring relationships on trust and collaboration. Our broad and diversified practices serve global clients—from startups to Fortune 500 companies—at every stage of the business cycle, including high-stakes litigation, complex transactions, sophisticated financings and regulatory issues. With leading edge technologies and innovation behind our team, we pride ourselves on being a strategic partner to our clients.
A recently filed class action offers a snapshot of the ongoing wave of lawsuits under the California Invasion of Privacy Act (CIPA) – something that has been a topic for a few years now.
United States California Privacy
Liisa M. Thomas’s articles from Sheppard, Mullin, Richter & Hampton LLP are most popular:
  • with readers working within the Consumer Industries industries
Sheppard, Mullin, Richter & Hampton LLP are most popular:
  • within Cannabis & Hemp and Insolvency/Bankruptcy/Re-Structuring topic(s)

A recently filed class action offers a snapshot of the ongoing wave of lawsuits under the California Invasion of Privacy Act (CIPA) – something that has been a topic for a few years now. This latest case shows that CIPA continues to be a tool for plaintiffs' law firms to pursue companies using online tracking tools. But why?

According to the complaint, Carvana, an online platform for buying used vehicles, allegedly installed third-party trackers on its website. These trackers then collected and sent users' personal information (e.g., their IP addresses, browsing history, and the exact web pages they viewed), to outside companies. The plaintiffs argued that Carvana did this without giving users proper notice or getting their consent. This type of claim essentially attacks the way in which websites function and lies at the core of most plaintiffs' CIPA claims. With each new CIPA lawsuit, plaintiffs attempt to enforce alleged obligations, using these old laws (like CIPA), often trying to hold companies to higher standards than what is in state "comprehensive" privacy laws.

Here, the complaint asserts that Carvana's actions amount to illegal wiretapping, improper use of "pen register" technology, and an invasion of privacy. The plaintiff based their claim on the argument that people believe companies will not gather or sell "sensitive" browsing data, such as which cars they view, unless the company gets their consent first. As of right now, many state and federal courts have allowed these claims to proceed.

Putting it into Practice: This case demonstrates an ongoing trend for plaintiffs' attorneys: using CIPA as a cudgel to elicit settlements from companies whose sites collect information through cookies and other tracking tools. The case can serve as a reminder to conduct cookie and consent audits if using website third-party tracking mechanisms.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

[View Source]
See More Popular Content From

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More