CCPA Now Being Used for Wiretapping Litigation, Lawyers Say

Dustin Taylor and David Navetta, attorneys in Troutman Pepper Locke’s Privacy + Cyber Practice Group, were quoted in the July 24, 2026, Privacy Daily article, “CCPA Now Being Used for Wiretapping Litigation, Lawyers Say.”

• Passed in 2018, the CCPA contains a narrow private right of action for data breach violations, Troutman lawyers said in a June 9 blog. The statute “allows a consumer to sue when their ‘nonencrypted and nonredacted personal information’ is ‘subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices.'”
• The plaintiffs’ bar has jumped on the word “disclosure,” and invoked the CCPA in instances where there “wasn’t a data breach per se,” but information “got out via a negligent” manner, Troutman lawyer Dustin Taylor told us in an interview. In that circumstance, plaintiffs argue the private right of action still applies, he said.
• The first of the cases that successfully used this argument was in 2020, he said, called Stasi v. Inmediata Health Group. Since then, complaints have gone “a little bit further” each time until one of the recent May decisions, where the argument was that a website was “negligently disclosing information via tracking pixels” and thus could be sued by individuals.
• …
• Then in May, the same district court issued two rulings further expanding the CPPA private right of action’s scope, the Troutman blog said. Relying on prior decisions, the court denied motions to dismiss both cases, holding “the CCPA was not so limited and noted ‘courts have let CCPA claims survive a motion to dismiss where a plaintiff alleges that defendants disclosed plaintiff’s personal information without his consent due to the business’s failure to maintain reasonable security practices.'”
• Taylor told us these interpretations are an “incorrect extension” of the CCPA, particularly because the court’s rulings “sidesteps the issue of personal information” and whether the data disclosed is data that would be protected under the statute.
• The California privacy law has “a very narrow definition” of personal information that “requires sensitive identifiers” like social security numbers, financial account numbers with access codes or patient status, he said.
• Troutman lawyer Dave Navetta also pointed to definitions in a LinkedIn post about the trend. “Tracking data isn’t ‘personal information’ under [CCPA’s] data breach privacy right of action provision,” he said, so “why are these CCPA privacy actions allowed to proceed forward?”
• Given the success of the two May cases allowing the claims to proceed, Taylor predicts “we’ll continue to see some exploration” from plaintiffs testing this CCPA theory until courts “shut it down.” In situations where there’s a “more colorful argument” that the data disclosed counts as personal information under the statute — such as against healthcare or financial institution defendants — plaintiffs may have more luck, though Taylor noted the plaintiffs would still have to prove the “information was actually disclosed.” The lawyer doesn’t believe this will become as big as wiretapping litigation generally, since the CCPA is “more limited,” but said companies that handle what the CCPA defines as personal information should be aware of this trend. Doing an audit to determine where the trackers are used and what information is being shared can help mitigate risk, he added.