Average Settlement for Invasion of Privacy: What CIPA Claims Are Really Worth in 2026

Average Settlement for Invasion of Privacy: What CIPA Claims Are Really Worth in 2026

What is the average settlement for an invasion of privacy lawsuit under CIPA? The California Invasion of Privacy Act sets statutory damages at $5,000 per violation or three times your actual damages, whichever is greater (Cal. Penal Code § 637.2). Real-world recoveries vary widely by case type: in recent website-tracking class settlements, estimated per-person shares have run from a few dollars to roughly $260, and the one already paying claimants distributed about $111 apiece. Individually litigated claims, such as illegal call recording, can recover at or above the $5,000 statutory floor per violation.

There is no official "average" settlement figure for privacy cases, and any site quoting one should be read skeptically. What the law actually guarantees, and what real court-approved settlements provide, are explained below with sources you can check yourself.

One thing to know right away: most courts apply a one-year statute of limitations to CIPA claims. If you believe your communications were recorded or intercepted, do not wait to get legal advice.

What is the California Invasion of Privacy Act (CIPA)?

CIPA is a criminal statute (Cal. Penal Code §§ 630-638.55, enacted 1967) that also gives private citizens the right to sue. The sections that drive civil lawsuits:

• Section 631 prohibits wiretapping and intentional interception of communications in transit, and reading or learning the contents of a communication without the consent of all parties. Modern lawsuits apply it to website session-replay tools, chat widgets, and tracking pixels that route visitor communications to third parties.
• Section 632 prohibits recording or eavesdropping on a "confidential communication" without the consent of all parties. California is an all-party consent state; a business that records your call without announcing it may violate this section.
• Section 632.7 protects communications involving cellular and cordless phones.
• Section 638.51 prohibits installing a "pen register" or "trap and trace" device without a court order. In recent years, plaintiffs have used this section against website trackers that capture visitor IP addresses and browsing data. As explained below, the Legislature has now moved to end private lawsuits under this specific theory.

What damages does CIPA allow?

Under Penal Code § 637.2, a person injured by a CIPA violation can recover the greater of:

1. $5,000 per violation, or
2. Three times actual damages, if any.

You do not need to prove you lost money; § 637.2(c) says actual damages are not a prerequisite. Injunctive relief (a court order stopping the practice) is also available.

Two things the statute does not provide, despite what many websites claim:

• No automatic attorney fee award. Section 637.2 itself has no fee-shifting provision. In practice, privacy attorneys work on contingency, and in class cases fees are paid from the settlement fund or awarded by the court under other statutes such as California's private attorney general provision (CCP § 1021.5). But CIPA does not simply hand a prevailing plaintiff their fees the way Florida's statute does.
• No separate punitive or "willfulness" multiplier. The three-times figure is an alternative measure based on actual damages, not a bonus for intentional conduct. Punitive damages are not part of § 637.2, though a plaintiff who also pleads common-law invasion of privacy can seek punitive damages on those companion claims under Civil Code § 3294.

Courts have also split on whether $5,000 applies to each individual violation or each action, which is one reason settlement values vary so much from case to case.

What do invasion of privacy settlements actually pay?

Real, court-approved numbers from CIPA and related privacy cases:

Case	Total	Per-person outcome
Mirmalek v. Los Angeles Times (N.D. Cal.), § 638.51 pen-register claims over ad-tech trackers; final approval June 26, 2026	$3.85 million	Pro rata share of the fund; per-person amounts not yet final, and distribution is on hold while an objector's appeal is pending
MarinHealth Meta pixel litigation (California hospital, settled 2025)	$3 million fund	$111.38 per approved claimant, checks issued beginning February 2026

Large headline settlements you may have seen quoted elsewhere were not CIPA cases: Facebook's $725 million settlement resolved the Cambridge Analytica consumer-privacy litigation (typical payouts were under $100 per user, not thousands), TikTok's $92 million settlement was driven by Illinois biometric-privacy claims, and Google's $39.9 million location-tracking payment went to the State of Washington, not to individuals.

Where do larger individual recoveries come from? Individually litigated CIPA claims, most commonly unlawful recording of phone calls under §§ 632 or 632.7, can recover the $5,000 statutory amount per violation, and repeated violations can stack. Businesses facing thousands of potential class members at $5,000 each face enormous theoretical exposure, which is why defendants settle; but by the time a class settlement is divided among everyone affected, individual checks are usually modest. An honest lawyer will tell you which kind of case you have before quoting numbers.

How long do I have to file a CIPA lawsuit?

One year, in most courts. Because § 637.2 is a statutory penalty, courts apply the one-year limitations period of California Code of Civil Procedure § 340(a). The clock runs from when you knew or should have known of the violation: California courts apply the delayed-discovery rule to CIPA claims (Montalti v. Catanzariti (1987) 191 Cal.App.3d 96), though proving late discovery is fact-specific.

This is the single most important practical fact on this page. If you suspect your calls were recorded or your data intercepted, talk to a lawyer promptly. Waiting can extinguish an otherwise strong claim.

Is CIPA changing? SB 690, explained

Yes. On August 28, 2026, the California Legislature unanimously passed Senate Bill 690, which amends the CIPA damages statute (§ 637.2) to rein in one category of lawsuits. As passed, the bill:

• Ends the private right of action for § 638.51 pen-register and trap-and-trace claims based on websites, online services, and mobile apps. Only the California Attorney General could pursue those claims.
• Applies retroactively to pending pen-register claims filed within two years before the operative date.
• Takes effect January 1, 2027, if signed. The Governor has until September 30, 2026 to act.

What SB 690 does not do: it leaves § 631 wiretapping, § 632 eavesdropping and recording, and § 632.7 claims fully intact for private plaintiffs. Lawsuits over session replay, chat widgets, and pixels under those sections, and unlawful call-recording claims, continue. Earlier drafts of SB 690 would have exempted all tracking done for a "commercial business purpose," but that broad exemption was stripped from the bill in July 2026.

If you currently have a pending pen-register claim, or were counting on one, this change directly affects you; get advice on whether your facts also support a § 631 or § 632 theory.

What makes a privacy claim stronger?

• No consent, clearly. If the business disclosed the recording or tracking and you proceeded anyway, consent is a defense. Claims are strongest where there was no disclosure at all, or tracking began before any banner or notice appeared.
• Confidentiality (for § 632 claims). The communication must be one you reasonably expected to stay private. Calls to customer-service lines that announce recording do not qualify.
• Evidence. Preserve call logs, recordings, screenshots, and, for web-tracking claims, technical evidence such as browser network logs showing data flowing to third parties.
• Repeated violations. Each unlawful interception or recording can be a separate violation, and statutory damages can stack.

Does Florida have a similar law?

Yes, and it is in some ways stronger. Louis Law Group is a Florida firm, and Florida's Security of Communications Act (Fla. Stat. § 934.03) also requires all-party consent to record or intercept private communications. Its civil-remedies provision, § 934.10, allows:

• Actual damages, with a floor of liquidated damages of $100 per day of violation or $1,000, whichever is higher
• Punitive damages
• Attorney fees and costs (unlike CIPA)
• A two-year window from when you first had a reasonable opportunity to discover the violation

Florida courts have read the Act more narrowly than California courts read CIPA for website tracking, but for recorded phone calls and intercepted private communications in Florida, it is a real remedy with real teeth.

Frequently asked questions about CIPA settlements

How long does a privacy lawsuit take?

Individual claims often resolve in months to about a year. Class actions routinely take two to four years from filing to checks in the mail; the Los Angeles Times case was filed in early 2024 and received final settlement approval in June 2026.

Can I sue if the violation happened years ago?

Possibly. Most courts give you one year, but the year runs from when you knew or should have known of the violation (Montalti v. Catanzariti (1987) 191 Cal.App.3d 96). Florida's Act allows two years from a reasonable opportunity to discover the violation. This is exactly the kind of question to put to a lawyer with your specific dates, because the answer decides everything.

Are privacy settlements taxable?

Generally yes. Statutory and punitive damages that do not compensate for physical injury are ordinary taxable income. Talk to a tax professional about your specific situation.

Do I need to show I lost money?

No. CIPA's $5,000 statutory damages and Florida's $1,000 liquidated-damages floor apply without proof of financial harm. Actual losses (for example, identity theft that followed a data interception) can increase the recovery.

Think your privacy was violated?

If a business recorded your calls without telling you, or you have questions about how your communications or data were intercepted, Louis Law Group can evaluate your situation at no cost. We handle claims on contingency: no fees unless we win.

Call (833) 657-4812 for a free, confidential case evaluation, or use our two-minute eligibility check. Statutes of limitations on privacy claims are short, in California often just one year, so do not wait.