The ever evolving litigation landscape under the California Invasion of Privacy Act (CIPA), with a specific lens on healthcare-adjacent defendants and website tracking tools is highlighted now because of the covered California lawsuits.
CIPA’s Modern Reawakening
The California Invasion of Privacy Act (CIPA), enacted in 1967, was originally designed to protect Californians from wiretapping and eavesdropping. But in recent years, and particularly the last two years insurers are telling us as well as new inbound clients first hand have seen since 2023–2025, CIPA has been reinterpreted through a the modern day internet and it’s causing a lot of issues as we you can imagine. Plaintiffs’ attorneys have increasingly used it as a basis for class action lawsuits targeting companies that deploy third-party tracking technologies tools like Meta Pixel, Google Analytics, or session replay software—on their websites without obtaining prior, explicit consent.
The litigation trend has evolved rapidly, moving beyond e-commerce and media sites into healthcare-adjacent and public benefit entities, including platforms like Covered California—California’s official health insurance exchange. These cases raise critical questions about lawful consent, contractual responsibility, and the ever-shifting ground of what constitutes a “lawful basis” under both state privacy laws and global privacy principles.
The Covered California Case: A Sign of What’s to Come
What Happened?
In a surprising legal turn, plaintiffs filed class action suits against two well-known companies for operating third-party tracking technologies on the Covered California website (www.coveredca.com). The lawsuit claims that these companies, through embedded pixels or analytics tools, captured visitor interactions without adequate consent—allegedly in violation of CIPA Sections 631(a) and 632.7.
“We will only collect and process personal data about you where we have lawful bases.”
— Excerpt from a common privacy policy
This line, quoted directly from one defendant’s privacy policy, became a focal point in the complaint. The plaintiffs argue that if tracking occurred without consent, such a blanket assurance of lawfulness may be misleading inviting scrutiny under both privacy and consumer protection statutes.
Why This Litigation Is So Important
The Covered California case reflects a growing risk profile for organizations that operate or embed tracking tools on healthcare-related, government, or nonprofit websites, even if those companies are not the website operators themselves.
What are the liabilities:
- Vicarious Liability: Companies may face CIPA claims even when they are not directly collecting the data but merely supplying the tracking technology. Even if you’re not located in California you are still at risk.
- Consent Delegation Ambiguity: Courts are increasingly skeptical about consent delegation clauses in contracts, especially if users aren’t explicitly presented with meaningful opt-in choices.
- Litigation Magnet Language: Policy statements such as “we only collect personal data with lawful bases” may inadvertently create strict liability traps for companies if the underlying facts (or consent) are disputed.
What is CIPA Section 631(a)?
As we covered in the past. Section 631(a) prohibits the unauthorized interception of wire or electronic communication in transit without the consent of all parties. While originally crafted to target phone line tapping, modern courts have interpreted it to apply to intercepting communications between a user’s browser and a website server, including:
- Mouse clicks
- Keystrokes
- Page navigation paths
- Form input behavior (even if not submitted)
When tools like Hot Jar and Microsoft Clarity that provide session replay, pixel trackers, or behavioral analytics are used without first-party consent, plaintiffs argue that these tools act as unauthorized “eavesdroppers” under CIPA. We covered this in a recent webinar about a legal case with Carnival Cruise lines and since their privacy notice has been updated and Microsoft Clarity is no longer running on the site.
What’s a Lawful Basis Anyway? (And Why It’s a Legal Landmine)
The “lawful basis” language borrowed from the EU General Data Protection Regulation (GDPR) has increasingly found its way into American privacy policies. Under GDPR, six lawful bases exist for processing personal data, with consent and legitimate interests being the most cited in digital tracking scenarios.
However, in the U.S.—and particularly in California’s CIPA litigation environment—there is no universally accepted equivalent to GDPR’s lawful bases doctrine. So when a U.S. company says “we only process data when we have a lawful basis,” they risk:
- Overpromising, especially when lawful basis may hinge on whether the user meaningfully consented to tracking tools.
- Misrepresenting, if the consent mechanism fails to meet explicitness or opt-in standards under recent district court decisions.
- Future-proofing failure, as new legal interpretations may retroactively undermine what was once considered compliant behavior.
The Problem with Pixel Trackers on Healthcare Sites
Healthcare is a regulated sector under laws like HIPAA, but many entities adjacent to healthcare—such as insurance providers, wellness platforms, or public exchanges—may fall into a regulatory gray zone.
When third-party trackers are deployed on these platforms:
- They may capture health-related search queries, insurance plan details, or zip codes that can be linked to sensitive data.
- Plaintiffs argue that even if no “protected health information” (PHI) is transmitted, the perception of surveillance is enough to state a claim under CIPA.
- The FTC has recently taken action against companies like GoodRx and BetterHelp for improper sharing of health-adjacent user data via pixels.
Why CIPA Class Actions Are Rising
- Volume of Web Trackers: Many websites have dozens of embedded third-party scripts, often without granular consent toggles.
- Plaintiff-Friendly Interpretation: California courts are more open to broad readings of CIPA and less deferential to “technical” defenses.
- Regulators Watching: The FTC, DOJ, and state AGs are increasingly investigating improper sharing of user data with adtech vendors.
- Healthcare Is High Risk: Health-related websites are treated with heightened privacy sensitivity—especially post-Roe v. Wade legal climate shifts.
- Ambiguous Privacy Policies: Generic or GDPR-style legalese may confuse U.S. consumers and attract legal scrutiny.
How Companies Can Mitigate CIPA Risk
- Audit Third-Party Trackers: Identify every tracking script running on your public-facing websites.
- Implement Prior Consent: Use a Consent Management Platform (CMP) that blocks all cookies and trackers until opt-in is granted.
- Clarify Contracts: Ensure contracts with vendors clearly define who is responsible for obtaining consent and documenting it.
- Update Privacy Policies: Avoid sweeping statements like “we always process data lawfully” without providing detail or context.
- Configure Pixels Properly: For healthcare-adjacent sites, restrict or remove pixel usage, or utilize server-side implementations with strict access controls.
- Map Legal Obligations: Don’t rely solely on GDPR frameworks—align policies with CIPA, VPPA, CPRA, and FTC Act requirements.
- Train Marketing Teams: Ensure adtech and web teams understand the privacy risks of embedded tools and pixels.
Say What You Do, But Say It Carefully
Transparency is a cornerstone of good privacy practice, but imprecise transparency can be weaponized. In the absence of clear national legislation, companies must be cautious when importing foreign privacy constructs (like “lawful basis”) into their U.S. disclosures.
In the Covered California case, the disconnect between policy language and technical implementation was enough to trigger a class action. More importantly, it signals a judicial willingness to pierce corporate structures and focus on data practices across entire data ecosystems, not just the party collecting the data directly.
For legal, privacy, and compliance professionals, this is the new battleground: accountability by implication where silence or ambiguity may cost millions. If you want to protect against legal liabilities and stay compliant book a demo with Captain Compliance below and meet with one of our privacy superheroes who can help with CIPA legal claims.
