What is CIPA, and why does this matter?

The California Invasion of Privacy Act (CIPA) is a 1967 state law focused on the interception of communications by third parties that plaintiffs' attorneys have increasingly applied to website tracking technologies — session replay tools, chat widgets, analytics, and ad pixels — under wiretapping and "pen register" theories. Unlike the CCPA/CPRA, which use an opt-out model (you can collect data and simply give visitors a way to decline), CIPA claims argue that collecting or sharing a visitor's data before they've actively agreed to it counts as an unlawful interception in violation of the Act.

These are private actions, not regulator initiated, often preceded by demand letters. Statutory damages for CIPA violations can reach $5,000 per violation, with no need to prove actual harm. Any business reachable by California visitors is a potential target, regardless of where the business is based.

A visitor who has clearly opted in to tracking or cookie usage is harder to characterize as someone whose data was "intercepted" without permission. Configuring your consent banner so non-essential tools stay off until a visitor actively agrees — and pairing that with the CCPA/CPRA-required "Do Not Sell or Share My Personal Information" link — is the core idea behind the setup in this article.

About this workaround

This article shows how to approximate the protections using features already available in the CMP today: a GDPR-style opt-in configuration, a manually added opt-out link in the banner text, and a Geolocation Ruleset that scopes the stricter banner to California visitors.

Before you start

This workaround only helps if non-essential services are actually held back until consent is given. Under Service Settings, confirm that chat widgets, session replay, analytics, and advertising tools are all set to require prior consent rather than running automatically — a script that fires before the visitor interacts with the banner undermines everything below.

Step-by-step setup

1) Create a new configuration using the GDPR framework

In Configurations, click Add Configuration. There's no dedicated CIPA option in the Framework Type list, so choose GDPR — it's the closest existing framework that already defaults to an opt-in model, which is the behavior CIPA risk reduction depends on.  Similarly, if you are concerned with risk under the Video Privacy Protection Act (VPPA), you can also choose the GDPR framework for an opt-in model.

Framework Type — GDPR selected as the closest available opt-in framework

2) Name the configuration and add its domain and Data Controller

Give it a clear, identifiable name — you'll need to pick it out of a list again later when setting up geotargeting. Add the domain and Data Controller as usual, then select Create Configuration.

Configuration Details 

3) Set the Privacy Trigger to "Privacy Link"

Under Appearance > Layout, switch the Privacy Trigger from Privacy Button to Privacy Link. This avoids adding a permanent floating widget that isn't required for CIPA purposes, and gives you a code snippet you can place anywhere on the site (for example, the footer) to let visitors reopen their privacy settings on demand. Copy the generated snippet for later use if you plan to expose it elsewhere on the page.

Appearance > Layout — Privacy Link selected, with its code snippet

4) Add the required "Do Not Sell or Share" opt-out link to the banner text

Since there's no dedicated "Do Not Sell or Share" banner option in this framework, add it by hand: go to Content and in the Banner Message editor, type the exact required wording — "Do Not Sell or Share My Personal Information." — select it, and click the link icon in the toolbar.

Banner Message editor — inserting a URL link on the required opt-out text

Point the link at a URL that redirects the visitor to your own Data Subject Request form if you handle CCPA/CPRA opt-outs separately. Using the exact wording matters: CCPA/CPRA (which applies alongside CIPA for California visitors) requires this specific phrase.

Banner Message with the opt-out link added, shown as linked text

5) Preview the banner to confirm the link displays correctly

Use the Preview option to check that the linked text renders clearly above the Deny / Accept All buttons, and that clicking it does what you expect (navigating to your DSR form).

Preview — the opt-out link appears above Deny / Accept All

6) Publish using the V3 Script Tag

Go to Implementation and copy the V3 Script Tag for this configuration (it carries this configuration's own data-settings-id). Place it in the <head> section of your site, before any third-party script that requires consent.

Implementation — V3 Script Tag with this configuration's settings ID

7) Scope this configuration to California visitors

CIPA is a California-specific law, so this stricter opt-in banner and its opt-out link should apply to California traffic — visitors elsewhere should keep seeing your existing configuration. In Geolocation Rulesets, add or edit a rule, set Region to California (US), and set Configuration to the one you just created.  If you would like to apply this configuration to the entirety of the United States, you also have this option (this may be useful for VPPA, as a federal law applying to the whole of the US).

Edit Ruleset — Region set to California (US), Configuration set to the CIPA configuration

8) Save and confirm the rule

Save the ruleset and confirm it appears amongst the list of rulesets, scoped specifically to California (or the US more broadly), pointing at the new configuration.

Geolocation Rulesets — the new CIPA rule scoped to California