Two kinds of website lawsuits shaped 2026 for California businesses. CIPA claims went after the tracking tools on a site. ADA claims went after the parts of a site that people with disabilities cannot use. Both pay plaintiffs per violation, both can start with a demand letter, and both usually come down to scripts running on your website that you may not know are there.
Here is what changed in 2026, what did not, and what a business owner should do before 2027.
CIPA and ADA lawsuits in 2026 at a glance
| CIPA (California Invasion of Privacy Act) | ADA (Americans with Disabilities Act) | |
|---|---|---|
| What triggers a claim | Pixels, cookies, chat widgets and session replay tools that collect visitor data without consent | Pages, forms and apps that screen reader or keyboard users cannot use |
| Typical exposure in California | $5,000 per violation, no proof of harm needed | Federal ADA allows only fixes and attorney fees, but California’s Unruh Act adds at least $4,000 per violation |
| Biggest 2026 change | SB 690 ends private pen register suits over website tracking starting January 1, 2027 | Federal filings hit their highest mid-year level since 2021 |
| What is still open | Wiretap and eavesdropping claims under Sections 631 and 632 | Everything; there is still no federal technical standard for private business websites |
What happened with CIPA lawsuits in 2026?
CIPA is a 1967 wiretapping law. Plaintiffs’ firms have used it to argue that a tracking pixel or cookie that records a visitor’s IP address or device ID works like a pen register, a device that logs phone numbers. Those claims were cheap to file and expensive to defend, and they piled up quickly. When lawmakers took up the issue this year, the Assembly Appropriations Committee assumed roughly 4,000 pending CIPA actions, most of them built on the pen register theory.
On September 30, 2026, Governor Newsom signed SB 690. Starting January 1, 2027, only the California Attorney General can bring a pen register claim under Penal Code 638.51 over tracking on a website or app. The change also reaches pending claims in actions filed on or after January 1, 2025, although defense lawyers expect that part to be challenged in court.
What SB 690 did not fix
- Wiretap claims are untouched. Section 631 claims focus on third parties capturing what a visitor types or says. Chat widgets, session replay, form analytics and site search tracking are the usual targets.
- The conduct is still illegal. Tracking without consent still violates Section 638.51. Only the person who can sue changed.
- Other states are unaffected. Pennsylvania, Florida and other states have their own wiretap laws, and visitors to your site are not only in California.
- More reform may come. The Governor asked lawmakers to look at other parts of CIPA in 2027.
Expect the demand letters to change their wording rather than stop. Many firms will reframe pen register claims as wiretap claims, which put more weight on chat tools, replay scripts and forms.
What happened with ADA website lawsuits in 2026?
ADA website lawsuits kept climbing. Seyfarth Shaw’s mid-year report counted 5,006 federal ADA Title III lawsuits in the first half of 2026, up 9% from the same period in 2025 and the highest mid-year total since 2021. California led every state with 2,426 of those cases, followed by Florida (709), Illinois (505) and New York (485). Seyfarth said the year could end with more than 10,000 federal filings.
Website and app cases are a large share of that total. In 2025, Seyfarth counted 3,117 federal website accessibility suits, a 27% jump from 2024 and about 36% of all federal Title III filings. UsableNet, which tracks digital accessibility suits more broadly, counted 4,605 for 2025 and projected about 6,176 for 2026.
Three patterns business owners should know
- Repeat targets are common. In October 2026 alone, UsableNet logged 431 new web accessibility suits. 97 of those defendants had been sued over digital accessibility before.
- Accessibility widgets do not prevent lawsuits. 107 of the October defendants were using a third-party accessibility widget or overlay when they were sued.
- New filers are entering. Seyfarth noted several new plaintiffs’ firms and a rise in self-represented filers, which spreads suits to states that used to see few of them.
Public agencies got a delay. In April 2026, the Department of Justice pushed back the ADA Title II web accessibility deadlines by one year. State and local governments serving 50,000 or more people now have until April 26, 2027, and smaller ones until April 26, 2028. The standard is still WCAG 2.1 Level AA. That rule covers government sites, not private businesses, but it is the clearest signal of what a court is likely to treat as an accessible website.
If you are new to the topic, our guide to ADA website compliance covers the basics.
Why CIPA and ADA risk often come from the same scripts
Most small business websites run a stack of third-party code: a tag manager, analytics, ad pixels, a chat widget, a booking tool, a reviews feed and sometimes an accessibility widget. Each one can create both kinds of risk.
- A chat widget that loads before consent and sends typed messages to a vendor is a CIPA wiretap fact pattern. If it cannot be reached by keyboard or read by a screen reader, it is also an ADA problem.
- An accessibility overlay that promises compliance often loads third-party tracking of its own, while doing little to fix the underlying code.
- A booking or payment form hosted by a vendor is still your website to a plaintiff. Its labels, error messages and data sharing are your exposure.
That is why the most useful first step for both risks is the same: know exactly what loads on your site, what each tool sends, and whether a real person can use it without a mouse.
CIPA and ADA checklist for your website before 2027
- List every script, pixel, widget and embedded tool on the site, along with the vendor and what data it sends.
- Load the site as a first-time California visitor and confirm nothing that collects personal data fires before a consent choice.
- Make sure your consent banner actually blocks tags when a visitor declines, and that it is not configured to skip California.
- Turn off session replay and form analytics on pages with contact, intake or payment forms unless you have clear consent.
- Test key pages with a keyboard only: navigation, forms, the chat widget, booking tools and the checkout or contact flow.
- Run an automated WCAG 2.1 AA scan, then have a person check the issues a scanner cannot find, like confusing link text or missing form error messages.
- Do not rely on an overlay or widget as your accessibility plan. Fix the code and templates.
- Update your privacy policy and accessibility statement so they match what the site really does. Our post on why privacy policies go unchecked explains the common gaps.
- Keep dated records of your reviews and fixes. They help your attorney if a demand letter arrives.
- Talk to your attorney about any letter you have already received. SB 690 may change its leverage, but it does not make it go away on its own.
Frequently asked questions
Does SB 690 end CIPA lawsuits in California?
No. Starting January 1, 2027, it removes private lawsuits under the pen register section for website and app tracking. Wiretap and eavesdropping claims under Sections 631 and 632 can still be brought by private plaintiffs.
Can a small business be sued under the ADA over its website?
Yes. Small and mid-size businesses are frequent targets, often because their sites have never been tested. In California, plaintiffs often pair a federal ADA claim with the state Unruh Act, which adds statutory damages of at least $4,000 per violation.
Will an accessibility widget protect my site from ADA lawsuits?
No. In October 2026 alone, more than 100 businesses were sued while using an accessibility widget. Courts look at whether people can use the site, not whether a plugin is installed.
Is there a legal standard for ADA website compliance?
There is no federal regulation that sets one for private businesses yet. Most settlements, and the Department of Justice’s own Title II rule for state and local governments, point to WCAG 2.1 Level AA.
Get a CIPA and ADA review of your website
CaliNetworks reviews business websites for both tracking and accessibility issues. We check what loads before consent, test your forms and tools with a keyboard and screen reader, and give you a prioritized fix list. Contact us to schedule a review. This article is general information, not legal advice; talk to your attorney about your specific situation.
