Does CIPA apply to businesses outside California?

Yes. CIPA applies when one party to the communication is in California. If your website has visitors from California, the law can apply to you regardless of where your business is located.

What are the damages for a CIPA violation?

Statutory damages are $5,000 per violation, or three times actual damages — whichever is greater. In a class action involving website visitors, those per-violation amounts compound across every affected California visitor.

Is Google Analytics a CIPA violation?

Not automatically. The issue is whether Google Analytics fires before the visitor consents. If your site loads Google Analytics before a consent banner appears and the visitor has a chance to opt out, that's where the legal risk arises.

Is a cookie consent banner enough to comply with CIPA?

Not necessarily. As the Garcia v. AEG case (May 2026) shows, a banner that appears after tracking has already started doesn't protect you. The banner needs to actually block tracking scripts until the visitor makes a choice.

How is CIPA different from CCPA?

CCPA governs the sale and sharing of personal data and is primarily enforced by the California Attorney General. CIPA is a criminal wiretapping statute that allows any individual to sue directly for $5,000 per violation. You can be CCPA-compliant and still violate CIPA.

What tools can help with CIPA compliance on a WordPress website?

Consent management platforms like CookieYes integrate with WordPress and can block Google Analytics, Meta Pixel, and Google Tag Manager scripts until the visitor consents. This consent-first approach aligns with the defense strategy that succeeded in the Sisti v. Bosley, Inc. case.

Home > Our Blog & Thoughts > Marketing

Read Blog

1 2 3 … 6