Ninth Circuit Affirms that CIPA Only Applies to Third-Party Eavesdropping

Crowell attorneys have closely monitored developments related to the California Invasion of Privacy Act (“CIPA”). In particular, we have watched plaintiffs attempt to extend this wiretapping law to encompass website chatbot communications that are managed by third parties.

The Ninth Circuit Court of Appeals recently addressed key CIPA issues in Thomas v. Papa John’s International, Inc., No. 24-3557. The decision reaffirms CIPA’s eavesdropping standard as well as the specific personal jurisdiction standard set out in its recent en banc decision, Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025).

CIPA Liability Limited to Third-Party Eavesdropping

Plaintiff sued Papa John’s alleging that it was liable under CIPA § 631(a) because it employed software that allowed it to monitor user interactions on its website. According to plaintiff, this violated section 631 because Papa John’s “eavesdropped and learned the content of its users’ communications.” Because a software company called FullStory Inc., provided and managed the software, plaintiff alleged that FullStory was the third-party eavesdropper. Specifically, plaintiff alleged that FullStory used the code to intercept data in real time from website visitors, then used the data to reenact each user's visit to the Papa John's website. FullStory then, the complaint continued, "fingerprinted" each user, and associated that user with visits to other websites that also used FullStory's code.

The district court dismissed the complaint, finding that using a tool like that supplied by FullStory did not constitute third-party eavesdropping. The district court analogized Papa John’s use of the code to a person recording a phone call using a tape recorder. Cast in this light, the court concluded that the activity fell under CIPA’s “party” exception that states that CIPA does not apply to parties to the communication themselves.

The Ninth Circuit affirmed, finding that “a party to a conversation cannot be liable under section 631 for ‘eavesdropping’ on its own conversation.” In so finding, the Ninth Circuit could have cited recent district court decisions dismissing CIPA claims on similar grounds, such as Garcia v. Build.com, Inc., 3:22-cv-01985-DMS-KSC (S.D. Cal. 2023). It instead relied on Rogers v. Ulrich, 125 Cal. Rptr. 306 (Ct. App. 1975), a classic CIPA case which actually involved an individual recording a phone call with a tape recorder. The Rogers court relied on the dictionary definition of eavesdropping to confirm that it “is never a secret to one party to a conversation that the other party is listening to the conversation; only a third party can listen secretly to a private conversation.” Id. at 309. Thus, the party exception to CIPA was born. This Ninth Circuit opinion allows businesses operating websites with embedded software, chatbots, or similar technologies to breathe a little easier. This decision provides guidance and reduces the likelihood of exposure to CIPA liability for using these tools.

Personal Jurisdiction: The Briskin Standard Applies

The Ninth Circuit’s decision also dispatches with Papa John’s challenge to personal jurisdiction raised on cross-appeal. Papa John’s argued that its conduct was not expressly aimed at California and thus could not support jurisdiction in the state. The Ninth Circuit rejected this argument, relying heavily on its recent en banc decision in Briskin v. Shopify, 135 F.4th 739 (9th Cir. 2025).

The court found that Papa John’s operates an interactive website with “national viewership and scope” that “appeals to, and profits from, an audience in California.” Furthermore, the court concluded that plaintiff’s allegations that Papa John’s intentionally collected information from California users knowing any alleged harm would be suffered in the state satisfied the “purposeful direction” test articulated in Briskin, particularly because Papa John’s failed to show that exercising jurisdiction would be unreasonable.

The Ninth Circuit’s permissive approach to personal jurisdiction in the digital age contradicts the Third Circuit, which weighed in on this issue last year in Hasson v. FullStory Inc., 2024 WL 4049220 (3d Cir. Sept. 5, 2024). The court held that the defendant did not “expressly aim” its website-based conduct at Pennsylvania.

Given the proliferation of lawsuits, including CIPA cases, involving purely online conduct, other circuits and even the Supreme Court may be inclined to weigh in on this important threshold issue.

Conclusion

The Ninth Circuit’s application of the party exception to CIPA raises the bar for plaintiffs, who are already stretching CIPA beyond telephonic communications to new technologies. Plaintiffs will have to plead and provide evidence showing that the website owner is doing more than using code or chatbots for monitoring, like a tape recorder.

That said, the decision may be remembered more for its commentary on personal jurisdiction in the digital age. The Ninth Circuit has affirmed its more permissive approach to jurisdiction over a website owner, in contrast to the Third Circuit. A circuit split on a critical threshold issue like personal jurisdiction seems likely to catch the Supreme Court’s attention sooner rather than later.

Crowell attorneys will continue to monitor developments in this body of law and advise clients on technology-related issues such as website code and the use of generative AI.