California Invasion of Privacy Act (CIPA)

1967

CIPA Enacted

California passed the Invasion of Privacy Act (Penal Code §§ 630-638) making it unlawful to intercept or record confidential communications without consent.¹ 

1985

Cellular Phone Amendment

In response to the widespread adoption of cellular phones, California amended CIPA by adding Penal Code § 632.5 (Cellular Radio Telephone Privacy Act), explicitly prohibiting malicious and unauthorized interception of cellular phone communications.²

1990

Cordless Phone Amendment

Recognizing cordless telephone technology, the legislature introduced Penal Code § 632.6 to extend protections specifically to cordless telephone communications, prohibiting their malicious interception without consent.³

1992

Cellular and Cordless Calls Consent

Penal Code § 632.7 was enacted, eliminating the requirement of malicious intent and explicitly requiring all-party consent for any interception or recording of cellular or cordless telephone calls, regardless of whether the conversation is considered "confidential."⁴

2017

Healthcare Communication Amendment

In response to secret recordings of healthcare providers, California passed AB 1671, adding Penal Code § 632.01. This amendment criminalized not only the recording but also the intentional disclosure or distribution of confidential communications involving healthcare providers without consent.⁵

The California Invasion of Privacy Act was enacted to address growing concerns about invasions of privacy through emerging technologies. The legislative findings explicitly state that:

"The Legislature hereby declares that advances in science and technology have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications and that the invasion of privacy resulting from the continual and increasing use of such devices and techniques has created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society."⁶

CIPA aims to:

1. Protect fundamental privacy rights of California residents in their communications
2. Deter unauthorized surveillance by creating strong civil and criminal penalties
3. Establish clear consent requirements for recording or monitoring communications
4. Adapt privacy protections to evolving communication technologies
5. Create accountability for those who violate communication privacy

California has historically been at the forefront of privacy protection, and CIPA represents one of the nation's strongest and earliest laws protecting communication privacy. As one court noted, "CIPA was designed to protect a fundamental right of privacy... to control the nature and extent of firsthand dissemination of [one's] conversations."⁷

Who Must Comply

CIPA applies broadly to:

• Private individuals: Anyone who intentionally intercepts or records private communications⁸
• Businesses: Companies of all sizes that monitor, record, or intercept communications⁹
• Employers: Organizations that monitor employee communications or workplace conversations¹⁰
• Government entities: State and local agencies (with specific exceptions for authorized law enforcement activity)¹¹
• Technology providers: Manufacturers and operators of recording equipment¹²

Anyone who intercepts, records, or intentionally overhears private communications without clear consent is subject to compliance.¹³

What Communications Are Covered

CIPA protects "confidential communications," defined as communications made in circumstances that reasonably indicate the parties desire it to be confined to them, excluding communications made in circumstances where parties may reasonably expect that the communication may be overheard or recorded.¹⁴

Protected communications include:

• Telephone and cellular conversations: Both landline and mobile phone calls¹⁵
• Electronic messages: Email, text messages, and digital communications where privacy is expected¹⁶
• In-person conversations: Private discussions where participants reasonably expect confidentiality¹⁷

Exemptions

CIPA does not apply to:

• Public communications: Conversations occurring in public spaces where privacy is not reasonably expected¹⁸
• Certain Law enforcement: Authorized surveillance with appropriate warrants or judicial approval (Penal Code §633)¹⁹
• Emergency services: Recording to obtain evidence of certain crimes such as extortion, kidnapping, bribery, or felonious violence (Penal Code §633.5)²⁰
• Telecommunications providers: Limited exemptions for providers when performing necessary quality control or service-related functions²¹
• Hearing aids: The use of hearing aids and similar devices by persons with impaired hearing²²

Right to Consent

All-Party Consent Requirement

California is an "all-party consent" state, meaning all participants in a confidential communication must provide consent before the communication can be recorded or monitored.²³ This makes CIPA stricter than federal law and many other states that only require single-party consent.²⁴

Consent can be:

• Explicit: Verbal or written agreement to recording or monitoring²⁵
• Implied: Clearly indicated by circumstances or continued participation after notification²⁶

For business calls, consent is typically obtained through a recorded message stating "this call may be monitored or recorded for quality assurance purposes." Continuing the call after this notification generally constitutes implied consent.²⁷

Right to Privacy in Conversations

Individuals have the right to privacy in conversations and electronic communications where a reasonable expectation of confidentiality exists,²⁸ including:

• Private homes²⁹
• Private offices or workplaces³⁰
• Phone conversations³¹
• Private electronic communications³²
• Other settings where there is a reasonable expectation of privacy³³

Recording or monitoring without consent in these contexts violates CIPA.³⁴

Right to Notification

Advance Warning Requirements

Businesses recording customer calls must provide clear notification at the start of the call and offer an opportunity to consent or terminate the call.³⁵ Notification must be provided:

• Before any substantive communication occurs³⁶
• In clear and understandable language³⁷
• With an opportunity to opt-out or disconnect³⁸

Courts have consistently held that businesses must provide this warning at the beginning of each call, even for repeat customers.³⁹

Right to Legal Remedies

Individuals whose rights under CIPA have been violated have the right to:

• File civil lawsuits seeking damages⁴⁰
• Report violations for potential criminal prosecution⁴¹
• Seek injunctive relief to stop ongoing violations⁴²

Who Enforces the Act

CIPA is enforced through multiple mechanisms:

• Private litigation: Individual plaintiffs who have had their privacy rights violated⁴³
• Criminal prosecution: County district attorneys and the California Attorney General⁴⁴
• Civil enforcement: The California Attorney General and other authorized agencies⁴⁵
• Regulatory oversight: Various state agencies with jurisdiction over specific industries⁴⁶

Private Right of Action

Individuals can file lawsuits against alleged violators of CIPA. To succeed, plaintiffs must establish:

• A confidential communication occurred⁴⁷
• They had a reasonable expectation of privacy⁴⁸
• The communication was intercepted or recorded⁴⁹
• The recording or interception occurred without proper consent⁵⁰

Available Remedies

Individuals may recover:

• Statutory damages: $5,000 per violation⁵¹
• Actual damages: Compensation for proven harm (and the greater of statutory or triple actual damages may be awarded)⁵²
• Punitive damages: Additional compensation for especially egregious violations⁵³
• Injunctive relief: Court orders to stop violations⁵⁴
• Attorney's fees and costs: Legal expenses incurred in bringing the action⁵⁵

Criminal Penalties

Violations of CIPA can also lead to criminal prosecution, with penalties including:

• Classification as misdemeanors or felonies depending on circumstances⁵⁶
• Fines up to $10,000 per violation⁵⁷
• Imprisonment for up to one year for most violations⁵⁸
• Enhanced penalties for repeat offenders⁵⁹

Evidence Exclusion

In addition to civil and criminal penalties, evidence obtained in violation of CIPA may be excluded from court proceedings. California courts have consistently held that recordings made in violation of CIPA are inadmissible in both criminal and civil cases.⁶⁰

Statute of Limitations

• Civil actions: Must typically be filed within one year of discovering the violation⁶¹
• Criminal cases: Generally subject to a one-year statute of limitations for misdemeanors⁶²

¹ Cal. Penal Code § 630
² Cal. Penal Code § 632.5
³ Cal. Penal Code § 632.6
⁴ Cal. Penal Code § 632.7
⁵ AB 1671 (2016); see also Cal. Penal Code § 632.01
⁶ Cal. Penal Code § 630
⁷ Flanagan v. Flanagan, 27 Cal. 4th 766, 775 (2002)
⁸ Cal. Penal Code §§ 631, 632
⁹ Cal. Penal Code § 632(a)
¹⁰ Cal. Penal Code § 632(a)
¹¹ Cal. Penal Code § 633
¹² Cal. Penal Code § 635
¹³ Cal. Penal Code § 632(a)
¹⁴ Cal. Penal Code § 632(c)
¹⁵ Cal. Penal Code §§ 632.5, 632.6, 632.7
¹⁶ Cal. Penal Code § 632(a)
¹⁷ Cal. Penal Code § 632(a)
¹⁸ Cal. Penal Code § 632(c)
¹⁹ Cal. Penal Code § 633
²⁰ Cal. Penal Code § 633.5
²¹ Cal. Penal Code § 633.02
²² Cal. Penal Code § 632(g)
²³ Cal. Penal Code § 632(a)
²⁴ 18 U.S.C. § 2511(2)(d) (federal single-party consent)
²⁵ Kearney v. Salomon Smith Barney, Inc., 39 Cal. 4th 95 (2006)
²⁶ NEI Contracting & Engineering, Inc. v. Hanson Aggregates Pacific Southwest, Inc., 926 F.3d 528, 533 (9th Cir. 2019)
²⁷ Kearney v. Salomon Smith Barney, Inc., 39 Cal. 4th 95 (2006)
²⁸ Cal. Penal Code § 632(c)
²⁹ Cal. Penal Code § 632(c)
³⁰ Cal. Penal Code § 632(c)
³¹ Cal. Penal Code § 632(c)
³² Cal. Penal Code § 632(c)
³³ Cal. Penal Code § 632(c)
³⁴ Cal. Penal Code § 632(a)
³⁵ Cal. Penal Code § 632(d)
³⁶ Smith v. LoanMe, Inc., 11 Cal. 5th 183 (2021)
³⁷ Kearney v. Salomon Smith Barney, Inc., 39 Cal. 4th 95 (2006)
³⁸ Cal. Penal Code § 632(d)
³⁹ Smith v. LoanMe, Inc., 11 Cal. 5th 183 (2021)
⁴⁰ Cal. Penal Code § 637.2
⁴¹ Cal. Penal Code §§ 631(a), 632(a)
⁴² Cal. Penal Code § 637.2
⁴³ Cal. Penal Code § 637.2
⁴⁴ Cal. Penal Code §§ 631(a), 632(a)
⁴⁵ Cal. Penal Code §§ 631, 632
⁴⁶ Cal. Bus. & Prof. Code §17200
⁴⁷ Cal. Penal Code § 632(c)
⁴⁸ Cal. Penal Code § 632(c)
⁴⁹ Cal. Penal Code § 632(a)
⁵⁰ Cal. Penal Code § 632(a)
⁵¹ Cal. Penal Code § 637.2(a)
⁵² Cal. Penal Code § 637.2(a)
⁵³ Cal. Penal Code § 637.2
⁵⁴ Cal. Penal Code § 637.2
⁵⁵ Cal. Penal Code § 637.2
⁵⁶ Cal. Penal Code §§ 631(a), 632(a)
⁵⁷ Cal. Penal Code § 637
⁵⁸ Cal. Penal Code §§ 631(a), 632(a)
⁵⁹ Cal. Penal Code § 637
⁶⁰ People v. Nazary, 191 Cal. App. 4th 727 (2010)
⁶¹ Cal. Civ. Proc. Code § 340(a)
⁶² Cal. Penal Code § 801