Privacy LitigationWeb Tracking
Why Are Website Search Bars a Target for CIPA Wiretapping Claims?
Website search bars have become a frequent target for wiretapping claims under the California Invasion of Privacy Act (CIPA). The claims allege that a visitor's search terms were shared with third parties without consent. Notably, SB 690 does not affect these claims, because they rely on a different section of the law.
By Alex Proctor
Published September 29, 2026
Summary
A search term typed into a website can qualify as the "contents of a communication." When the website's analytics or advertising tools send that term to a third party, plaintiffs allege an unlawful interception under Section 631(a) of CIPA. Some courts have allowed the theory to proceed, and at least one has dismissed it for lack of standing. The claims do not depend on cookies, and SB 690 does not impact them.
How Does a Search Bar Become a Wiretapping Claim?
When a visitor searches a website, the search term often becomes part of the address of the results page. Analytics and advertising tools on that page commonly send the page address to their vendors. So, when this happens, the search term is sent to the vendor along with it.
Plaintiffs allege that this transmission constitutes an unauthorized interception of the visitor's communication with the website. Vivek Shah, the serial plaintiff who was declared a vexatious litigant in July 2026, is known for this approach. He has searched websites for his own first name and for phrases such as "felony-friendly jobs," and then cited the transmission of those terms to third parties.
The approach has spread well beyond Shah. Other individual plaintiffs and class action firms now use the same theory in demand letters, arbitration demands, and lawsuits. This has been one of the most common wiretapping litigation approaches of 2026.
Why Do Search Terms Count as the Contents of a Communication?
Section 631(a) of CIPA prohibits reading or learning "the contents or meaning of any message, report, or communication" while it is in transit, without the consent of all parties. The claim therefore depends on whether the information constitutes contents. Courts distinguish contents from record information, such as an IP address, which describes a communication without revealing what was said.
The Ninth Circuit has held that contents means "the intended message conveyed by the communication." It also observed that divulging an address containing a search term to a third party "could amount to disclosure of the contents of a communication."
| Data sent to a third party | Treated as | CIPA section |
|---|---|---|
| Page address that includes a search term | Contents | 631(a) |
| Referrer header that includes a search term | Contents | 631(a) |
| IP address of the visitor | Record information | 638.51 |
| Device and browser details | Record information | 638.51 |
Based on federal case law and recent complaints, as of September 2026.
Have Courts Accepted the Theory?
Some courts have allowed search bar claims to proceed. In Heerde v. Learfield Communications, a federal court in Los Angeles ruled in 2024 that "search terms constitute 'contents' of a communication." The plaintiffs alleged that searches on college athletics websites were sent to Meta through its tracking pixel. The court let the Section 631(a) claim go forward.
Other courts have dismissed search bar claims on different grounds. In May 2026, a federal court dismissed Shah v. Talentbridge for lack of standing, after Shah searched a job website for phrases including "felony-friendly jobs." According to summaries of the ruling, the court found that generic search terms do not reveal anything private about the person who typed them. Shah has appealed, so the ruling is not final.
Why Doesn't SB 690 Affect Search Bar Claims?
SB 690 ends private lawsuits under Section 638.51, the pen register provision, starting January 1, 2027. Governor Newsom signed it on September 30, 2026. Search bar claims are brought under Section 631(a), which the law does not change, so they remain available to private plaintiffs.
The claims also do not depend on cookies. A website that blocks cookies after a visitor opts out may still send search terms to its vendors.
What Reduces the Risk?
The riskiest scenario is one in which a website shares search terms with third parties after a visitor has opted out of tracking. There are four common ways to reduce the risk:
- Process searches on the server side, so that terms are not exposed to third parties
- Remove search terms from page addresses and referrer headers
- Restrict analytics and session replay tools during searches without consent
- Explain in the privacy notice how search data is collected, used, and shared
I recommend identifying the scripts that send search data to third parties and hard-gating them behind consent logic derived from the consent banner. The right approach may differ by company and website.
Questions
Do search bar claims relate to cookies?+
Not directly. The claims concern the search term itself, which can reach a third party in a page address, a referrer header, or a network request. A website with cookie controls in place may still send search terms to its analytics and advertising vendors.
Does it matter what the visitor searched for?+
Yes, the search term can affect the outcome. One federal court dismissed a complaint in 2026 because generic search terms did not reveal anything private about the person who typed them. A search that reveals a health condition or another sensitive fact may be treated differently, so websites that handle sensitive topics may be at greater risk.
Can the website be liable if a vendor received the search terms?+
Plaintiffs allege that it can. A website is a party to its visitors' searches, so it cannot intercept them itself. However, Section 631(a) also applies to anyone who aids or permits another person's interception. Plaintiffs rely on that language when a website's vendor receives the search terms.
Briefings are informational and do not constitute legal advice.
Received a letter?
I'll test the claims against your live site.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.