The Chatbot Wiretap Wave: What a CIPA Wiretap Chatbot Lawsuit Means for Anyone Running a Chat Interface

You bolted a third-party chat widget onto your product. It took an afternoon. Maybe you evaluated it on latency and UX, ran a quick security review, and shipped. You probably did not ask where the transcripts go after they leave your domain. A growing number of plaintiffs' attorneys are asking that question for you, and the answer is showing up as a CIPA wiretap chatbot lawsuit in your general counsel's inbox. This piece is for engineering and legal teams who need to understand the exposure, the evolving case law, and what architectural decisions actually reduce risk.

Key Takeaways

• CIPA class actions targeting chat interfaces grew from 2 matters in 2021 to 30 in 2025, with over 800 CIPA claims filed in California in 2025 alone. The trajectory is steep and shows no sign of flattening.
• Courts are increasingly adopting a "mere capability" standard: if your chat vendor's infrastructure retains the technical ability to use conversation data for its own purposes, that alone may be enough to sustain a wiretap claim, even if the vendor never actually exercises it.
• Disclosure banners and "this is an AI" notices do not immunize you. The company that embedded the widget, not just the vendor, is the party getting sued under aiding-and-abetting theories.
• Statutory damages of $5,000 per violation with no requirement to prove actual harm make this a volume-driven litigation category. The math scales with your user count.
• Legislative relief (California SB 690) is uncertain, possibly not retroactive, and irrelevant to the core architectural problem: if your vendor can read the transcripts, you have exposure.

What Is CIPA, and Why Does It Apply to Chat Widgets?

CIPA is the California Invasion of Privacy Act, a statute originally enacted in 1967 to govern telephone wiretapping. It makes it illegal for a third party to intercept or eavesdrop on a confidential communication without all-party consent. The statute provides for private lawsuits with $5,000 in statutory damages per violation, and plaintiffs do not need to demonstrate that they suffered any actual harm.

The application to chat widgets follows a straightforward analogy. When a user types into a chat interface on your site, and a third-party vendor receives, processes, logs, or analyzes that text on its own servers, the vendor is arguably a third party intercepting a two-party communication between the user and your business. If the user did not separately and specifically consent to that third party's involvement, and to the third party's independent data practices, the communication may have been "wiretapped" under CIPA's definition.

This is not a hypothetical framing. An analysis of 284 deployer-facing AI litigation matters found chatbot wiretap lawsuits to be the fastest-growing category of AI litigation tracked, accelerating from near-zero in 2021 to dozens of active matters by early 2025. As of late July 2026, nearly 4,000 CIPA cases have been tracked in California alone, with retail and technology as the most targeted industries.

Who Is Getting Sued: The Vendor or the Company That Embedded It?

Mostly you. The company that embedded the widget is the primary defendant in the majority of these cases, typically under an aiding-and-abetting theory. The logic: you invited the third-party vendor into the conversation, you controlled the user interface, and you failed to obtain CIPA-compliant consent on the vendor's behalf.

A federal court in the Northern District of California illustrated this in August 2025 when it denied a motion to dismiss a CIPA class action against ConverseNow Technologies, which supplies AI virtual assistants for restaurant phone and text orders. The plaintiff had called a Domino's franchise. ConverseNow's system intercepted and recorded the call. The court let the case proceed. The franchise, as the deployer, sat squarely in the chain of liability.

If you are an engineering team that integrated a chat SDK by dropping a script tag into your layout, you are the deployer. Your vendor's terms of service are not your user's consent.

What Does "Mere Capability" Mean, and Why Does It Change the Risk Calculus?

It means the bar for liability may be lower than you think. Courts are splitting on whether a third-party vendor must actually use intercepted data for its own purposes, or whether the vendor's technical capability to do so is sufficient to sustain a wiretap claim.

In January 2026, an Illinois court adopted the "mere capability" standard, finding that undisclosed phrase-spotting, AI conversation analysis, and sentiment detection performed by a third party were sufficient to plead eavesdropping. The vendor did not need to have actually trained a model on the transcripts or sold the data. The infrastructure's ability to do those things was enough.

This matters for engineering teams because it shifts the compliance question from "what does our vendor's privacy policy say?" to "what does our vendor's infrastructure permit?" A contractual promise not to use transcript data is weaker than an architecture that makes use technically impossible. If the vendor's servers receive plaintext transcripts and retain the ability to process them, the capability exists regardless of what the contract says.

How Should Engineering Teams Evaluate This?

Ask your vendor three questions. First: does your system receive, store, or log plaintext conversation content on infrastructure you control? Second: does your system perform any analysis on conversation content (sentiment detection, keyword extraction, conversation routing, quality assurance, model training) beyond the immediate inference request? Third: is there a technical mechanism (not just a policy) that prevents your system from accessing conversation content after the response is delivered?

If the answer to the first two is yes and the answer to the third is no, you have a "capability" problem under the emerging standard, regardless of your vendor's stated intentions.

Does Telling Users They're Talking to an AI Fix This?

No. This is the single most common misconception we see from teams that have already shipped a chat integration. California's SB 243, which took effect January 1, 2026, requires disclosure that a user is interacting with AI. Several other states have passed or are advancing similar requirements. Complying with those laws is necessary and good. It is also legally irrelevant to CIPA exposure.

As Jones Walker's analysis lays out, a company can satisfy every disclosure requirement of SB 243 (telling users they are talking to AI, posting crisis protocols, reminding minors to take breaks) and still face a CIPA wiretap class action if its chatbot vendor retains the ability to use conversation data for its own purposes without CIPA-compliant consent. The two statutes address different things. SB 243 is about transparency regarding the nature of the interlocutor. CIPA is about consent to third-party interception of the communication itself.

The same analysis applies to "implied consent" defenses. Courts have grown more skeptical of the argument that a user impliedly consented simply by continuing to chat after a generic disclosure, particularly where the specific third-party vendor and its independent data interests were not separately identified.

What About the Otter.ai Case? Is This Really About Chat Widgets?

The theory extends beyond web chat. Four separate suits filed against Otter.ai in August and September 2025 were consolidated into In re Otter.AI Privacy Litigation before Judge Eumi K. Lee in the Northern District of California. The consolidated complaint, filed December 5, 2025, alleges that Otter obtained consent only from the meeting host who added the AI assistant, not from other participants whose voices were recorded and transcribed. It further alleges that Otter used the recorded content to train its AI models.

The case is considered one of the first federal tests of whether decades-old wiretap statutes apply to an AI bot silently recording a video call. A ruling from Judge Lee was still pending as of mid-June 2026. Related developments (a BIPA case against Fireflies.AI, bans on AI meeting-recording tools at the University of Washington, Chapman University, and UC Riverside) all point in the same direction.

The relevance to chat widgets is structural: in both cases, the claim is that a third party intercepted a communication that the user expected to be between two parties. Whether the medium is a video call, a phone order, or a text-based chat interface does not change the statutory framework. If your chat widget routes transcripts to a vendor that retains them, you are in the same risk category.

How Big Is the Damages Exposure?

$5,000 per violation, no proof of harm required. "Per violation" generally means per intercepted communication or per affected user, depending on how the class is certified. If your chat widget handles 10,000 conversations a month in California, the arithmetic speaks for itself.

A newer strand of litigation illustrates the scale concern. A complaint filed in 2026 alleges that a plaintiff shared sensitive financial and tax information with an AI chatbot, and that the product's "Incognito" mode did not actually stop data from flowing to outside parties. The complaint invokes CIPA, the federal Wiretap Act, and California's computer fraud and unfair competition statutes. Reporting cites roughly 20 million monthly active users as a measure of potential class scale.

A near-identical complaint filed against a different chatbot in May 2026 was voluntarily dismissed by the plaintiff shortly after, which illustrates how fast and speculative some of these filings are. But the speculative filings still cost money to defend, and the meritorious ones carry real statutory exposure.

For a sense of settlement scale: a federal judge approved a $3.85 million class settlement against the Los Angeles Times on June 26, 2026 over website tracking claims. Three weeks earlier, a California state court dismissed a near-identical claim with prejudice. The outcomes are inconsistent. The defense costs are not.

What About Serial Filers?

They are a real phenomenon. One prolific filer has filed 21 CIPA lawsuits so far in 2026, out of many more demand packets sent. On July 20, 2026, a federal court in the Central District of California declared this litigant vexatious, finding his pattern of filing and dismissing similar actions suggested an effort to pressure settlements rather than litigate in good faith. That is a notable pushback signal. But "some plaintiffs are vexatious" is not a defense strategy. The underlying statute still exists, and the non-vexatious claims are proceeding.

Will California SB 690 Fix This?

Maybe. Partially. Eventually. SB 690 is under active consideration as of July 1, 2026. The bill, as amended, would bring pen-register and trap-and-trace conduct under CIPA while eliminating the private right of action entirely, shifting enforcement solely to the state Attorney General. It would apply retroactively for two years to bar pending individual-plaintiff suits. But the bill is not yet law, and the Legislature must pass it before an August 31, 2026 adjournment for it to take effect this year.

Even if SB 690 passes, three caveats apply. First, retroactivity provisions in privacy statutes face constitutional challenges; whether a two-year retroactive bar survives litigation is an open question. Second, eliminating the private right of action does not eliminate enforcement; it centralizes it with the AG, who may be more selective but can also pursue larger targets more aggressively. Third, SB 690 is California-specific. Seventy-eight chatbot-related bills were filed across 27 states in the first weeks of 2026. Florida already has 811 tracked CIPA-adjacent cases. Illinois has 108. The multi-state surface area is growing.

Betting on legislative relief as your compliance strategy is a bad engineering decision. You are taking a dependency on a political process with an uncertain timeline and uncertain scope, while your chat widget continues to generate potential violations every day it runs.

What Architecture Actually Reduces CIPA Exposure?

The durable fix is architectural, not documentary. A consent banner is a document. A privacy policy is a document. Documents get challenged. Architectures do not get challenged the same way, because they describe what is technically possible rather than what someone promises not to do.

Here is the framework, aimed at engineering teams evaluating or re-evaluating a chat integration:

1. Minimize third-party transcript access. If your chat vendor processes conversation content via API (sends a request, gets a response, does not retain the content), the "interception" theory is harder to sustain than if the vendor logs, stores, or indexes transcripts on its own infrastructure. Ask for and verify no-retention architecture, not just a no-retention clause.
2. Separate the inference path from the data path. Using a frontier model provider for inference is different from using a vendor that bundles inference with analytics, sentiment scoring, conversation tagging, or model training on your users' data. The bundled vendor has the "capability" that courts are flagging. The unbundled API call has a narrower surface.
3. Get vendor-specific, pre-collection consent if retention exists. If your vendor does retain transcript data (for quality assurance, model improvement, or any other purpose), CIPA-compliant consent likely requires disclosing the specific vendor, its independent data interests, and obtaining affirmative consent before the conversation begins. "By using this chat, you agree to our privacy policy" is not meeting the emerging standard.
4. Encrypt content at rest with keys you control. If transcripts must be stored (for customer support history, compliance, or product functionality), encrypt them at rest with keys your organization controls. This does not eliminate CIPA exposure (the interception happens at the point of collection, not storage), but it limits the "capability" argument downstream and reduces your blast radius if the data is subpoenaed or breached.
5. Audit the SDK. Many chat widgets load third-party scripts that phone home to analytics endpoints, load additional trackers, or share data with advertising networks. Your engineering team should proxy or inspect outbound network calls from the widget in a staging environment. If the widget makes requests to domains you did not expect, those are additional "third parties" in the CIPA analysis.

How Does This Interact with the Federal Wiretap Act?

The federal Wiretap Act (Title III of the Omnibus Crime Control and Safe Streets Act, sometimes called ECPA) has a similar structure but different consent requirements. Most federal circuits apply a "one-party consent" standard, meaning that if one party to the communication (typically the business operating the chat) consents to the recording, there is no federal violation. California, however, is an all-party consent state, which is why CIPA claims are more potent than federal claims for the same conduct.

Some complaints plead both. The AI chatbot complaint discussed above invokes CIPA, the federal Wiretap Act, and California's computer fraud and unfair competition statutes. The federal claim is harder to win in a one-party consent jurisdiction, but it extends the geographic reach: a user in any state can bring a federal Wiretap Act claim, while CIPA claims require a California nexus.

For multi-state products, this means the exposure is not confined to California users. If your chat widget serves users nationally and routes transcripts through a third-party vendor, you may face claims under the wiretap statutes of every all-party consent state where a user resides. There are currently twelve such states.

What Should Your Vendor Diligence Checklist Look Like?

If your legal and engineering teams are evaluating a chat vendor (or re-evaluating one you already shipped), here is a minimum set of questions. These are not legal advice. They are engineering inputs to a legal analysis.

• Does the vendor receive plaintext conversation content on infrastructure it controls?
• Does the vendor retain conversation content after delivering the response? If so, for how long, and for what purposes?
• Does the vendor perform any processing on conversation content beyond immediate inference (sentiment analysis, keyword extraction, conversation categorization, quality scoring, model training)?
• Does the vendor share conversation content with any additional third parties (sub-processors, analytics providers, advertising networks)?
• Does the vendor's contract include a signed, enforceable no-training clause covering conversation content?
• Is there a technical mechanism (not just a policy) that prevents the vendor from accessing conversation content after inference?
• Does the vendor's SDK or script make outbound requests to domains other than the primary API endpoint?
• Has the vendor been named in any CIPA, ECPA, or state wiretap litigation? (This is public record. Check PACER.)

If your vendor cannot answer these questions clearly, or if the answers reveal retention, secondary processing, or third-party sharing, you should understand that as an engineering fact with legal consequences, not as a policy question to be resolved by updating your privacy page.

Is the Disclosure-Law Wave Separate from the Wiretap Wave?

Yes, and conflating them is a common mistake. Washington signed HB 2225 in March 2026 requiring disclosure at the start of AI interactions and every three hours after. Oregon's SB 1546 requires mandatory conversation interruption on detected suicidal ideation and annual public health reporting. These are important compliance obligations with their own enforcement mechanisms.

But they are legally separate from wiretap-consent exposure. You can comply with every AI disclosure law in every state and still face a CIPA class action, because the disclosure laws address the user's knowledge that they are talking to AI, while the wiretap laws address the user's consent to third-party interception of the conversation's content. Two different legal theories. Two different sets of requirements. Two different risk surfaces.

A December 2025 executive order directing the U.S. Attorney General to establish a task force challenging state AI laws seen as inconsistent with federal policy adds a federal-preemption wildcard to the disclosure-law landscape. But federal preemption of state wiretap laws is a much heavier lift, given the deep statutory history and the Supreme Court's treatment of state privacy protections.

What Is the Practical Upshot for a Team That Shipped a Chat Widget Last Quarter?

You need to do three things, and they should happen in this order.

First, audit the data flow. Have an engineer trace what happens when a user sends a message through your chat widget. Where does the plaintext go? What domains receive it? What comes back? This is a two-hour exercise in a staging environment with a network inspector open. If the answer surprises you, it will also surprise a plaintiff's expert.

Second, get your vendor's answers to the diligence questions above in writing. Not in a sales call. In a signed document, ideally a data processing addendum with specific representations about retention, secondary use, and sub-processors. If your vendor will not sign such a document, that tells you something.

Third, evaluate whether your current consent mechanism is CIPA-adequate under the emerging standard. This requires legal judgment, not engineering judgment, but the engineering team needs to provide the legal team with accurate, specific information about the data flow before the legal team can evaluate the consent mechanism. Most legal teams we have talked to were working from the vendor's marketing page, not from a network trace. That gap is the root of the problem.

If you are building a product where users share sensitive information in a chat interface (financial data, health information, legal questions), the exposure is proportionally higher, both because the statutory-damages math is the same but the reputational and discovery costs are worse, and because courts may be less sympathetic to "implied consent" arguments when the conversation content is sensitive.

We built Selina around the principle that your conversation data should not be accessible to us for secondary use. Content is encrypted at rest. Memory is adaptive, not a raw transcript log. We route inference through a stack of frontier models via API, with a short retention window for non-content operational metadata. That architecture does not make us immune to litigation (nothing does), but it means the "capability" question has a different answer than it does for vendors that log, index, and train on your conversations.

If your current chat vendor cannot say the same, and you serve users in California or any other all-party consent state, the clock is running.

Start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io