What Is the ECPA, and How Does It Compare to CIPA?

What Is the ECPA?

The ECPA was enacted in 1986, long before the internet as we know it existed. It protects electronic communications while they are being made, while they are in transit, and when they are stored.

The ECPA involves more than one law. Title I is the Wiretap Act, which prohibits intercepting, using, or disclosing a wire, oral, or electronic communication. Title II is the Stored Communications Act, which covers data held by service providers. Title III deals with pen registers and trap-and-trace devices.

Title I is particularly relevant to website tracking litigation. That is where claims about analytics and marketing tools come into play. Plaintiffs argue that these tools intercept communications between visitors and websites, especially when data is shared with a third-party vendor in real time. Defendants tend to argue that the website collects the data itself, in the ordinary course of business, and that no unlawful interception occurs.

CIPA vs. ECPA

Damages per Cal. Penal Code Section 637.2 and 18 U.S.C. Section 2520, as of September 2026.

Why Is Consent the Key Distinction?

The ECPA allows an interception if one of the parties to the communication consents. If the company operating the website is one of those parties, and it has authorized a third-party service to process the communication, many courts have found that this situation fits within the one-party consent exception.

In contrast, CIPA requires all-party consent. Every party to the communication has to agree to the recording, so a visitor who never consented has a more clear claim under CIPA than under the ECPA. That difference is part of the reason California produces most of the wiretapping litigation volume.

There is an important limitation on the ECPA's one-party rule, known as the crime-tort exception. The ECPA says one-party consent does not apply if the interception is carried out for the purpose of committing a criminal or tortious act. If a plaintiff can plausibly allege that the website or its vendor used a tracking tool to invade privacy or violate consumer-protection law, that exception can strip away the consent defense.

This is why so many complaints frame the use of pixels as inherently unlawful or deceptive, and it is invoked in some creative ways, particularly in healthcare tracking cases. HIPAA does not give patients a right to sue, so plaintiffs allege that sharing health-related browsing data with advertising platforms is the tortious purpose. That framing has turned the ECPA into a stand-in for HIPAA in court.

Why Do Plaintiffs Use the ECPA?

The ECPA is a federal law, which gives plaintiffs access to federal courts and nationwide class actions, and it provides a private right of action where other laws, such as HIPAA, do not.

The economics differ from CIPA's. Under Section 2520, courts can award actual damages or statutory damages of the greater of $100 per day of violation or $10,000, plus punitive damages for willful conduct and attorneys' fees. Courts have generally treated that figure as a per-plaintiff amount, while CIPA's $5,000 applies per violation and plaintiffs argue that every visit is one. A single plaintiff can do better under the ECPA, while a class usually does better under CIPA.

As with CIPA cases, courts have also been inconsistent when interpreting the ECPA. Some have ruled that when data goes directly to a third-party server, or is used for marketing rather than communication, the one-party consent rule does not apply. Others have dismissed similar cases. The inconsistency gives plaintiffs enough room to keep filing.

How Are the Two Laws Used Together?

Plaintiffs commonly plead both statutes in the same complaint. The ECPA offers a federal cause of action with nationwide reach, and CIPA adds a state claim with stricter consent requirements.

If the one-party consent defense works under the ECPA, the CIPA claim may remain. If jurisdictional limits weaken the CIPA claim, the ECPA claim keeps the case alive. Even when one claim is dismissed, the other can survive, which keeps defense costs mounting and settlement pressure on.

The same facts can trigger both theories. A pixel firing on a healthcare or financial website, for example, can support a federal wiretap claim and a state one at the same time, and both statutes allow damages on a per-violation basis. The dual approach is spreading beyond California too, with ECPA claims paired against state wiretapping laws in Florida, Pennsylvania, and other states.