A wiretap law passed in 1967 has fueled more than 5,600 website lawsuits, and small businesses want Congress to end them
A wiretapping law written when Lyndon Johnson was president, long before the first web browser, is now being used to sue small businesses over their website cookies.
Attorneys have filed more than 5,600 lawsuits claiming that chat boxes, cookies, analytics software and tracking pixels violate the California Invasion of Privacy Act (CIPA). That count comes from an op-ed by House Small Business Committee Chairman Roger Williams. The National Federation of Independent Business (NFIB) is now backing a federal bill that would shut those claims down.
The money at risk is real. California law sets damages at $5,000 per violation or 3 times actual losses, whichever is greater, and plaintiffs don’t have to show they lost anything. Being outside California doesn’t protect you either. Williams cites a Texas skincare company that was threatened with a CIPA lawsuit over its cookies.
What the bill would do
Rep. Russ Fulcher, an Idaho Republican, introduced H.R. 10263, the Halt Abusive Internet Lawsuits Act of 2026, on September 3, 2026. The bill text says that collecting or sharing information for a business purpose can’t be the basis for a claim under federal or state wiretap, eavesdropping or “pen register” laws. It names CIPA directly.
A pen register originally meant a device that logged the numbers a phone dialed. Plaintiffs argue that website tracking tools do the same thing to visitors.
- The bill covers cookies, pixels, session replay (tools that record how visitors use a site), chatbots, tags and analytics
- It protects marketing, advertising, responding to customers and selling goods or services
- Lawsuits already underway could not continue once the bill becomes law
NFIB sent Fulcher a letter of support on October 8. “Small businesses have been increasingly targeted in frivolous CIPA lawsuits,” said Mary Alex Hamby, who leads federal lobbying for NFIB as its principal of federal government relations.
California already acted, but only partly
Gov. Gavin Newsom signed SB 690 on September 30, 2026. Starting January 1, 2027, only the state Attorney General, not private plaintiffs, can bring pen register claims over website and app activity. The change also applies to qualifying lawsuits filed since January 1, 2025.
Newsom said the law targets the “vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses.” Private plaintiffs can still sue under CIPA’s main wiretap and eavesdropping sections, though, and that is the gap the federal bill aims to close.
Until then, list every cookie, pixel, chat widget and analytics script on your site, and check that your consent banner and privacy notice actually match what those tools do. If a demand letter arrives, have a lawyer review it before you pay anything.
The federal bill has not moved since it was sent to the House Judiciary Committee, and GovTrack gives it a 1% chance of becoming law. If it doesn’t pass before the current Congress ends in early January 2027, Fulcher will have to introduce it again.
