Wiretapping in the Digital Age: How an Old Law in California Is Reaching Into South Carolina

• Citation: Vol. 38 No. 1
• Year: 2026

Wiretapping In the Digital Age: How An Old Law In California Is Reaching Into South Carolina

Vol. 38 Issue 1 Pg. 27

South Carolina Lawyer

Spring, 2026

How An Old Law In California Is Reaching Into South Carolina

BY EMILY BOHAN AND MAX YOUNG

Introduction-The National Expanse of California Privacy Law

For many attorneys in South Carolina, the notion that a California state law enacted in 1967 regulating industrial espionage and wiretapping could impose significant liability on a manufacturing firm in Greenville or a hospitality group in Charleston may seem farfetched. Yet, the California Invasion of Privacy Act (CIPA) has been repurposed to target modern tracking technologies. What began as a statute designed for technology running on copper wires may now apply to website pixels, chatbots, and session replay software, creating a minefield of potential liability for companies nationwide.

This expansion presents a unique threat to entities outside of California, including those here in the Palmetto State. Due to the borderless nature of the internet and aggressive jurisdictional theories. South Carolina businesses and other non-California entities are increasingly finding themselves appearing in California courts. The core of this liability lies in CIPAs strict "all-party consent" requirement. Unlike federal law and other state statutes that permit recording with the consent of one party involved in a communication, CIPA requires the consent of all parties to a communication before recording is permitted. Consequently, the un-disclosed use of third-party tracking scripts may lead to both criminal and civil penalties with significant statutory damages, and this law has already caught many businesses off guard.

Statutory Framework: What is the CIPA?

CIPA aims to protect individuals' privacy rights against unauthorized eavesdropping and recording of confidential communications. The Act prohibits the intentional recording of or eavesdropping on confidential communications without the consent of all parties involved. A communication is deemed confidential if a party to the communication has an objectively reasonable expectation that it is not being overheard or recorded. The confidentiality of a communication is determined using an objective standard rather than the subjective intent of the parties. Depending on the circumstances, this determination is generally a question of fact. California Penal Code section 632.7 extends these protections to include unauthorized recording of communications transmitted via cellular or cordless phones.

California courts generally require that plaintiffs allege some form of injury, which may include an invasion of privacy interests, to have standing. However, the California State Legislature has the authority to grant standing even in the absence of concrete harm depending on legislative intent. As such, the California courts have allowed claims to proceed based on statutory violations alone in some cases but required proof of concrete harm in others, based on their interpretation of legislative intent.

GIPA applies to "any person'' who engages in activities prohibited by the statute, which means GIPA casts a wide net. For example, businesses located outside of California can be held liable under CIPA if their conduct involves communications or if they have employees—even remote ones—in California that establish minimum contacts within California. Technology providers may be implicated if they intercept or record communications without proper consent. For example, government entities engaging in non-law enforcement activities could be liable under CIPA if they fail to obtain proper consent before recording or intercepting communications. Even employers may face liability under CIPA for recording employee communications without consent.

Today's plaintiffs allege that standard web tools function as illegal wiretaps or pen registers. CIPA's broad net captures Software Development Kits (SDKs), third-party tracking pixels. Application Programming Interfaces (APIs), website analytics, "fingerprinting" software designed to identify users without traditional cookies, and conversation intelligence SaaS^[i] platforms that record customer interactions in real-time.

A critical evolution of CIPA concerns the definition of "communications," which is much broader when compared to CIPA's initial coverage. Courts have expanded the concept of confidential communications beyond traditional phone calls to include digital messages, chat logs, and mundane website interactions like clicks, mouse movements, and form inputs, which are frequently litigated as the "contents" of a communication protected by CIPA.

Emerging Theories of Liability

Unfortunately, entities attempting to defend against CIPA claims currently lack a clear-cut arsenal of legal defenses due to divided rulings in the Ninth Circuit and the stalled California Senate Bill 690. which would have carved out routine commercial tracking from CIPA's reach. However, recent developments in case law have highlighted several competing theories of liability that attorneys across the nation should understand. One theory emerged in Ambriz v. Google LLC,^[ii] in which the court established the "capability test." Under this standard, a vendor is not considered a mere service provider if it retains the technical capability to use client data for its own purposes, including training artificial intelligence models. If a vendor has the right to monetize or aggregate the data, it functions as a liable third party rather than a privileged agent of the business.

Another standard that has emerged through California court decisions applying GIPA is the "extension test," which requires plaintiffs to allege that the vendor used the acquired data for its own independent purpose. From a plaintiff's point of view the "capability test" is a more permissive standard than the "extension test'' because the latter requires plaintiffs to allege that the vendor used the acquired data for its own independent purpose, whereas the "capability test'' only requires plaintiffs to exhibit that the vendor has the ability to use such data by merely retaining it for independent purposes.

However, the court in Swarts v. Home Depot. Inc.^[iii] delineates the boundaries of the "party exemption" defense. The court held that a party to a communication cannot wiretap their own conversation under California law. The distinction often hinges on whether the vendor acts as an independent listener or simply as a tool. The Swarts holding suggests that when a vendor is strictly prohibited in contract from using the data for any purpose other than serving a client, they are acting as a "tape recorder" and are more likely shielded from liability through this "party-exemption" defense. The critical difference between the Swarts and Ambriz rulings concerns data monetization or the potential to monetize data. Vendors are more protected from liability when they contractually silo transmitted data. Retaining the right or ability to use the intercepted data effectively strips the vendor of the "party-exemption" defense.

The Ninth Circuit's decision in Javier v. Assurance IQ^[iv] clarified that retroactive consent is legally insufficient under CIPA rules. Consent must be obtained before the recording or tracking begins. This ruling renders many traditional browse-wrap agreements^[v] or privacy policy links inadequate for real-time tracking scripts. Tracking scripts often begin functioning the moment a page loads, which occurs before a user has had the opportunity to click "accept" or review a privacy policy. Under this ruling, this gap constitutes a violation because the interception of transmitted data occurred prior to the acquisition of user consent.

The issue of personal jurisdiction within CIPA cases recently expanded under the Ninth Circuit's holding in the Briskin v. Shopify case. Briskin v. Shopify, Inc.^[vi] The court found that an online platform purposefully directed its conduct towards California even without differentially targeting the state through forum-specific marketing or outreach. Despite being a Canadian corporation with an international platform, Shopify was subject to specific personal jurisdiction in California because it knowingly extracted, retained, and monetized data belonging to California residents. The court found that Shopify's geolocation technology allowed it to know the plaintiff's location in California and that its actions, including collecting and selling personal data, were intentionally directed at California consumers. The court emphasized that allowing corporations to avoid jurisdiction in any state by operating nationwide would undermine the principles of specific personal juris diction. However, there are a number of cases distinguishing Briskin, and a thorough discussion of the personal jurisdiction topic, while outside the scope of this article, is worthy of further consideration because how the courts apply personal jurisdiction in the context of CIPA continues to evolve.

Practice Points Risk Mitigation and Compliance

Ensuring compliance with CIPA implicates both technical and contractual aspects of communications management. The primary line of defense against CIPA litigation begins with properly configuring the website itself. Plaintiffs have previously used "testers" to visit websites and document the transmission of data to third parties, so technical tools must be legally defensive by design.

The most effective defense against a CIPA claim is obtaining consent from all parties in a communication prior to interception. Many sites currently employ tracking scripts and pixels immediately when the page loads and before a user has interacted with any consent mechanisms. The best practice for CIPA compliance is to use affirmative consent mechanisms rather than commonly used implied consent models. If possible, South Carolina entities may limit such affirmative consent mechanisms to California users and maintain CIPA compliance through geofencing, but such limitation may raise the risk of misidentifying users' location and unintentionally resulting in CIPA violations. This approach also carries the risk of violations in the event any other state begins to follow this novel way of applying similar laws. The website's privacy policy and terms of service should be clear and easily accessible to the user when the affirmative consent mechanism is triggered to bolster the efficacy of a defense based on affirmative user consent.

Another key element in CIPA claims is the nature of the data intercepted. Plaintiffs frequently target session replay tools and argue that such tools capture sensitive personally identifiable information like credit card numbers or medical data as they are typed. South Carolina entities should implement rigorous data masking, encryption, and redaction protocols to defend against this allegation. Technical tools should be configured to automatically redact sensitive input fields at the client side, ensuring that the raw data never leaves the user's browser in a readable format.

Regular technical audits using tag scanning software are essential to identify and purge unauthorized trackers. Businesses should consider shifting from client-side tracking, where the user's browser sends data directly to a vendor (like Meta or Google), to server-side tracking. In server-side tracking, the data goes to the business's own server first. This change in architecture bolsters the legal argument that the business is the primary recorder of the communication, rather than a third-party eavesdropping on the transmitted data.

Technical fixes must be supported by legal frameworks that prevent contractual matters from becoming liabilities. Vendor management and due diligence are key components of limiting CIPA liability from a contractual standpoint. Relationships with software vendors must be strictly defined. Courts are more likely to view a vendor as an extension of the business if the vendor is contractually prohibited from using the intercepted data for its own purposes. Agreements must explicitly state that the vendor acts solely as a service provider and is strictly prohibited from aggregating, selling, or using the client's data to train its own AI models or improve its services. South Carolina entities and their counsel should also aggressively negotiate indemnification clauses with vendors to carve out claims arising from privacy violations, wiretapping statutes, and unauthorized data interception from standard liability caps that are often one-sided in favoring SaaS providers.

Conclusion

As the digital landscape evolves, so too does the reach of California's privacy laws, transforming a 1967 wiretap statute into a formidable compliance challenge for businesses across the country. The expansion of CIPA liability through decisions like Briskin and the "capability test" exhibits that geographic distance is no longer a shield for out-of-state entities collecting consumer data. While some recent rulings provide guidance on defensive footholds regarding the meaning of eavesdropping and confidential communications, the risk of liability remains substantial for any organization utilizing third-party tracking technologies. Attorneys must work closely with their clients to navigate this minefield and adopt a proactive posture implicating rigorous vendor contract management, robust affirmative consent mechanisms, and consistent technical audits. By treating data privacy as a core operational requirement rather than a compliance checkbox, South Carolina businesses can better insulate themselves from the expanding national dragnet of California privacy litigation.

Emily Bohan is an attorney at Kim, Lahey &Killoughs Greenville, S.C. office, focusing her legal practice on business formation, corporate law, franchise law and mediations. She is licensed to practice in both South Carolina and Virginia.

Max Young is a J.D. candidate, Class of 2026, at University of South Carolina.

---------

Notes:

^[i]SaaS stands for "Software as a Service" and SaaS platforms in tills context include those that provide chatbot services on a web page or track other customer interactions such as clicks within a web page.

^[ii]No. 23-CV-05437-RFL, 2025 WL 830450 (N.D. Cal. Feb. 10, 2025).

^[iii]689 F.Supp.3d 732 (N.D. Cal. 2023).

^[iv]649 F.Supp.3d 732 (N.D. Cal. 2023).

^[v]A browse-wrap agreement is a type of online contract typically located in the footer of a web page containing terms for using the web site. The user is considered to have agreed to these terms merely by continuing to browse the web site.

^[vi]135 F.4th 739 (9th Cir. 2025).

---------