Judge Calls CIPA “a Total Mess” in Major Privacy Ruling

Picture this: you run an online store. You add the Meta Pixel to track conversions and improve ads. It’s standard practice, until a demand letter arrives accusing you of “wiretapping” your own customers under a 1967 California privacy law.

That’s the kind of claim at issue in Doe v. Eating Recovery Center, 2025 U.S. Dist. LEXIS 208110 (N.D. Cal. Oct. 17, 2025), where Judge Vince Chhabria finally said what many in the digital business world have been thinking.

In a blunt opinion, he called California’s Invasion of Privacy Act (CIPA) “a total mess,” explaining that it “gets bigger and bigger as the world continues to change” and is now “borderline impossible to determine whether a defendant’s online conduct fits within the language of the statute.”

The case involved a mental health provider accused of violating CIPA by using the Meta Pixel to track website activity. The plaintiff claimed the Pixel “read” her communications while they were “in transit,” language borrowed from a pre-internet wiretapping statute.

Judge Chhabria disagreed. He ruled for the defendant, finding that while the Pixel collected webpage URLs and button clicks, it did not “read or attempt to read” data in transit. More importantly, he found CIPA’s language ambiguous, which triggers the rule of lenity. That legal principle requires courts to interpret unclear criminal laws in favor of defendants.

For years, plaintiffs have used CIPA to target websites that use analytics or chat tools, filing hundreds of suits against retailers, healthcare providers, and online merchants. Courts often let those cases move forward. Judge Chhabria’s decision marks a turning point, confirming that ambiguity should be resolved narrowly and giving companies a stronger defense.

He also faulted the Legislature for letting CIPA stagnate, warning that businesses “have no way of telling whether their online activities will subject them to liability.” His message was clear: it’s time to bring the law into the modern age.

If your website uses analytics, chat widgets, or advertising pixels, this case matters. It doesn’t erase risk, but it changes the landscape. Ambiguity now favors defendants (at least in this district), and courts may be more willing to dismiss CIPA claims early. Privacy statements still matter, as the defendant’s promise of “100% confidentiality” shows the need for accurate disclosures.

Lawmakers are on notice that, until CIPA is updated, uncertainty and litigation will continue.