Short answer: Google Analytics itself is not illegal. How and when it collects data on your site can create liability under California's Invasion of Privacy Act (CIPA) — specifically around whether consent was obtained before tracking started, not whether GA4 was used at all.
Two sections of the California Penal Code get cited in these cases: §631 (wiretapping) and §638.51 (pen register / trap-and-trace). Courts have applied both to browser-based trackers that log which domains a visitor's browser contacts. Civil penalty: $5,000 per violation, with no cap on total liability.
The recurring mistake: assuming a privacy policy or cookie notice satisfies consent. Under §631, consent has to be obtained before the tracker fires — not disclosed somewhere a visitor can read afterward. This is the core holding courts have relied on in recent CIPA litigation, and it's why a well-written privacy policy and an actively-exposed site aren't mutually exclusive.
Google Analytics 4 logs pages visited, time on page, referral source, and device fingerprint, retained on Google's servers for 2 months by default (up to 14 months only if manually configured in Admin). It's usually deployed through Google Tag Manager or a direct script tag, and fires on page load — before any user action.
| Case | Amount | Tracker(s) | Status |
|---|---|---|---|
| LA Times | $3.85M | TripleLift, GumGum, Audiencerate | Final approval June 26, 2026 — appeal filed Aug. 2026, payments on hold |
| MarinHealth | $3M | Meta Pixel | Final approval Nov. 21, 2025 |
| Aspen Dental | $18.7M | Meta Pixel | Final approval Oct. 20, 2025 |
| Eisenhower Medical Center | $875,000 | Meta Pixel | Settled |
Sources: Jeffer Mangels & Mitchell — CIPA case law update · HIPAA Journal — MarinHealth · Top Class Actions — Aspen Dental · HIPAA Journal — Eisenhower Medical Center
California SB 690 passed the Assembly 66–0 and Senate 40–0 on August 28, 2026, and is awaiting the Governor's signature (deadline September 30, 2026). If signed, it eliminates the private right of action for §638.51 pen-register claims specifically, effective January 1, 2027. It does not touch §631, CCPA, GDPR, COPPA, or VPPA exposure — those remain unchanged either way.
Source: California Legislative Information — SB 690
TrackGuard Pro runs a 5-layer scan (HTML, network, JavaScript globals, cookies, server-side signals) and shows you what a plaintiff attorney's scanner would find first.
Run a Free Scan at TrackGuard ProTrackGuard Pro (trackguardpro.com) is a technical scanning service, not a law firm, and this page is not legal advice. It does not remove trackers — that's performed by your own web team; TrackGuard Pro re-scans to verify removal.