H.R. 10263 would retroactively kill thousands of pending wiretapping lawsuits against businesses that use tracking pixels, session-replay tools, and cookies — while simultaneously preempting California's Invasion of Privacy Act and the federal Wiretap Act for all commercial internet activity nationwide.
---
##
What It Does
H.R. 10263, introduced September 3, 2026 by Rep. Russ Fulcher (R-ID) and referred to the House Judiciary Committee, is a short but sweeping bill. Its operative provision states that "the collection, processing, or disclosure of information or communications for a commercial purpose shall give rise to no claim or enforcement action under Federal or State law with respect to pen registers, wiretapping, trap and trace, or eavesdropping" — and then explicitly names California's Invasion of Privacy Act as one of the laws being nullified. The bill defines "digital commerce" to include marketing, advertising, customer interactions, and selling goods or services online, and specifies the technologies covered by name: cookies, pixels, session replay, chatbots, tags, and analytics. Any business, service provider, or advertiser that deploys these tools for commercial purposes — meaning essentially every company with a website — gains categorical immunity from wiretapping and eavesdropping claims under both federal and state law. The bill contains a hard retroactivity clause: any claim or enforcement action already underway at enactment must stop immediately and cannot be continued, decided, or submitted to arbitration. The bill does not establish any new privacy standard, consent requirement, or data-security obligation in place of the liability it removes. It contains no sunset date, no regulatory implementation mechanism, and no federal agency is given oversight authority.
---
##
The Real Story
The underlying conflict is not really about abusive lawsuits — it's about who gets to decide the rules for online tracking. On one side: every company that makes money from the internet (retailers, publishers, ad-tech firms, and the major platforms like Meta that embed tracking pixels across thousands of third-party sites) wants a single, permissive federal standard that says using cookies and analytics for commercial purposes is categorically legal. On the other side: privacy advocates and state attorneys general want to preserve the right of states to set their own floors — particularly California, which has the nation's strongest consumer privacy laws — and to let individual consumers sue when companies track them without consent. The "abusive lawsuit" framing is partly real: federal judges have called out serial filers who send mass demand letters to extract settlements with no intent to litigate. But the bill is written so broadly that it would eliminate the same law that forced the Los Angeles Times, major retailers, and healthcare providers to pay settlements for silent, unconsented surveillance of their users.
---
##
Who Benefits
- Ad-tech platforms and data brokers — particularly Meta, Google, and the hundreds of companies whose pixels and tracking scripts appear on third-party websites. They face massive aggregate liability from CIPA wiretap claims and would have all pending actions terminated and future claims barred.
- Session-replay software vendors — companies like Hotjar, FullStory, and Microsoft Clarity, whose tools record users' mouse movements, keystrokes, and browsing behavior on client sites, have been named in lawsuits alleging unconsented interception. This bill would eliminate that category of liability entirely.
- Retailers and publishers with large U.S. web audiences — the 1,817 retail-sector CIPA cases documented through July 2026 would be wiped from dockets. Companies that have already paid legal fees for years of litigation would see cases dismissed.
- Plaintiffs' law firms specializing in defense work — corporate defense firms billing hourly on CIPA cases would lose ongoing matters, but the torrent of new suits would dry up, benefiting clients.
- Serial-filer targets — small businesses that received mass demand letters from serial CIPA litigants (a documented phenomenon that federal judges, including Judge Klausner in July 2026, have begun sanctioning) would gain real relief from shakedown-style cases.
---
##
Who Gets Hurt
- California consumers — CIPA is California's primary private enforcement tool against unconsented online surveillance. CIPA allows individuals to sue for up to $5,000 per violation without proving actual harm. H.R. 10263 would eliminate this right entirely for any "commercial" data collection — which includes most online activity.
- Current plaintiffs with active cases — individuals and classes who filed lawsuits, survived motions to dismiss, and are in discovery or settlement negotiations would have their cases terminated the day the law takes effect. Their legal costs and time invested would be unrecoverable.
- State attorneys general — California, Illinois, and other states that have built enforcement programs around wiretapping-analog privacy laws would lose jurisdiction over commercial online tracking, pushing them to rely on narrower unfair-business-practice statutes instead.
- Plaintiffs' class-action attorneys — this category of litigation has been a significant revenue source for consumer-privacy plaintiff firms; that market disappears on enactment.
- Users of healthcare and financial websites — without wiretapping-law backstops, users who are tracked without consent by hospitals, insurers, or banks have fewer legal remedies. (The bill does not restore that protection via any alternative route.)
- States with stronger privacy laws — Illinois (Biometric Information Privacy Act), Washington, and Texas each have their own privacy frameworks; the broad preemption language could create uncertainty about whether their laws survive for commercial online activity depending on how courts interpret the bill's scope.
---
##
Red Flags
- Immediate retroactive kill switch on pending cases. The bill contains explicit language stating that any claim or enforcement action already in progress on the date of enactment "may not be maintained, adjudicated, or arbitrated" after that date. This is not a prospective change in the law — it would void all currently pending CIPA and federal wiretap cases involving commercial digital activity the moment the President signs the bill. Plaintiffs who spent years building class actions would lose their cases overnight, regardless of how far along the proceedings are. This retroactive annihilation of pending litigation raises serious constitutional Due Process questions under the Supreme Court's framework in *Landgraf v. USI Film Products* (1994), which limits retroactive laws that destroy "vested rights."
- The scope is far wider than the "abusive lawsuit" framing suggests. California's state legislature simultaneously passed SB 690, which addresses the same CIPA problem but narrowly: it eliminates the private right of action only under the pen-register provision (§638.51) for website/app tracking, while leaving California's broader wiretapping (§631) and eavesdropping (§632) statutes fully intact for private plaintiffs. H.R. 10263 preempts ALL wiretap, eavesdropping, pen-register, and trap-and-trace claims — under both state AND federal law — for any commercial digital activity. It would override not just CIPA but also the federal Electronic Communications Privacy Act wiretap provisions themselves, for any business collecting data for commercial purposes.
- No carve-outs for sensitive contexts. The bill has no exceptions for health information, financial data, communications with attorneys, or children's data. A hospital using session-replay software on its patient portal, a bank using analytics on its login page, or a children's education app using tracking pixels would all receive the same blanket commercial-purpose immunity.
- "Commercial purpose" is defined so broadly it covers virtually every organization with a website. The bill defines "digital commerce" as covering promotion, sale, purchase, delivery, or support of products or services — effectively any website that sells anything or has an ad, including nonprofits with donation pages and news organizations with subscriptions.
- State attorneys general enforcement may be blocked. The bill bars "enforcement actions" — not just private lawsuits. If this language is read broadly by courts, it could prevent state AGs from enforcing their own wiretapping laws against commercial internet actors, stripping California's AG of a tool it uses for major data-privacy investigations.
- No floor protection replaces what's eliminated. Unlike the CAN-SPAM Act (which preempted state anti-spam laws but set federal standards) or HIPAA (which preempts state health privacy law but creates federal rules), H.R. 10263 provides no replacement federal privacy standard. It simply removes liability without creating any obligation on companies about how they must handle the data they collect.
---
##
Hidden Riders
- The federal Wiretap Act is quietly neutralized for commercial actors. The bill's language preempts "Federal or State law with respect to... wiretapping" — which includes the federal Electronic Communications Privacy Act's Title I wiretap provisions that Congress has never before suspended for commercial data collection. This has received almost no attention in coverage of the bill, which is framed primarily as a CIPA fix, but it would set a major precedent for the scope of the federal Wiretap Act itself.
- The "commercial purpose" standard has no bad-faith exception. A company that intentionally and deceptively intercepts private communications — knowing users believe they are communicating privately — would receive identical immunity to a company using standard analytics. There is no carve-out for intent, deception, or the sensitivity of the data intercepted.
- Kills cases beyond "abusive" ones. The retroactive clause wipes out all pending commercial-tracking wiretap cases, not just those brought by serial filers. The well-documented vexatious-litigant problem is already being addressed by courts (Judge Klausner's July 2026 order against Vivek Shah), but this bill eliminates the entire category of lawsuit, including legitimate class actions brought by established plaintiffs' firms on behalf of large consumer classes.
---
##
Current Status
H.R. 10263 was introduced in the House of Representatives on September 3, 2026, by Rep. Russ Fulcher (R-ID-1). It was immediately referred to the House Committee on the Judiciary, where it currently remains. The bill has had no committee hearings, no markup sessions, no amendments, and no recorded votes. It has not been scored by the Congressional Budget Office. No Senate companion bill has been identified. In practical terms, this bill is at the very beginning of the legislative process — the equivalent of a first draft being dropped in a inbox. Most bills introduced in committee never receive a hearing; for this one to advance, Judiciary Committee leadership (currently chaired by House Republicans) would need to schedule a hearing or attach it to other legislation. The 119th Congress's second session runs through January 3, 2027, giving the bill roughly four months to move before it expires and would need to be reintroduced in a new Congress.
---
Sources:
- [H.R. 10263 Full Text — Congress.gov](https://www.congress.gov/bill/119th-congress/house-bill/10263/text/ih)
- [H.R. 10263 — GovTrack.us](https://www.govtrack.us/congress/bills/119/hr10263/text)
- [H.R. 10263 — GovInfo](https://www.govinfo.gov/app/details/BILLS-119hr10263ih)
- [CIPA/ECPA Website-Tracking Privacy Litigation in 2026 — Barnes & Thornburg](https://btlaw.com/en/insights/alerts/2026/cipa-ecpa-website-tracking-privacy-litigation-in-2026)
- [2025 Website Wiretapping Roundup — Inside Class Actions](https://www.insideclassactions.com/2026/01/27/2025-website-wiretapping-roundup/)
- [CIPA Lawsuit Tracker — ConsentPixel](https://consentpixel.com/blogs/cipa-lawsuit-tracker/)
- [CIPA Lawsuit Tracker — Cookie-Script](https://cookie-script.com/privacy-laws/cipa-lawsuit-tracker)
- [How Silicon Valley Used Main Street's Outrage Against California Privacy Law — CalMatters](https://calmatters.org/economy/technology/2026/09/california-privacy-act-reform-for-small-business-helped-big-tech/)
- [California Legislature Passes SB 690 — Fenwick](https://www.fenwick.com/insights/publications/california-legislature-passes-sb-690-narrowing-private-rights-action-under)
- [SB 690 and CIPA: What Changed in July 2026 — Enzuzo](https://www.enzuzo.com/blog/sb-690-and-cipa)
- [California's SB 690 Clears the Legislature — Sidley Austin](https://www.sidley.com/en/insights/newsupdates/2026/09/californias-sb-690-clears-the-legislature-what-it-means-for-cipa-website-tracking-claims)
- [SB 690 Passed the Legislature — Spencer Fane](https://www.spencerfane.com/insight/sb-690-passed-the-legislature-what-does-that-mean-for-pending-cipa-website-tracking-cases/)
- [Courts and Lawmakers Push Back on Website Litigation Abuse — Lathrop GPM](https://www.lathropgpm.com/insights/courts-and-lawmakers-push-back-on-website-litigation-abuse/)
- [$3.85M LA Times CIPA Settlement — Top Class Actions](https://topclassactions.com/lawsuit-settlements/closed-settlements/3-85m-los-angeles-times-website-trackers-class-action-settlement/)
- [CIPA Website Tracking Lawsuits: Current State of the Law — Jeffer Mangels](https://articles.jeffer.com/2026/08/28/website-privacy-lawsuits-under-cipa-current-state-of-the-law/)
- [Federal Preemption of State Privacy Law Hurts Everyone — EFF](https://www.eff.org/deeplinks/2022/07/federal-preemption-state-privacy-law-hurts-everyone)
- [Session Replay Lawsuits: CIPA & Wiretapping Claims 2026 — BigDelta](https://bigdelta.com/blog/session-replay-lawsuits)
- [Russ Fulcher — OpenSecrets](https://www.opensecrets.org/members-of-congress/russ-fulcher/summary?cid=N00041335)
Bill hr10263ihhaltabusiveinternetlawsuitsactof2026
Bill decoded. Results are now available.
High alert
H.R. 10263 would retroactively kill thousands of pending wiretapping lawsuits against businesses that use tracking pixels, session-replay tools, and cookies — while simultaneously preempting California's Invasion of Privacy Act and the federal Wiretap Act for all commercial internet activity nationwide.
---
##
Why now
Courts across the country have been flooded with lawsuits arguing that a 1967 California phone-wiretapping law — the California Invasion of Privacy Act (CIPA) — applies to modern website tools like tracking pixels, chatbots, and session-replay software that record what users do in their browsers. By July 2026, litigation trackers documented nearly 4,000 active CIPA cases in California alone, with over $153 million in disclosed settlements. That litigation wave, combined with courts issuing contradictory rulings (a $3.85 million settlement against the Los Angeles Times was approved in late June 2026, while an almost identical claim against another defendant was dismissed weeks earlier), created enormous legal uncertainty for any business with an American website. Rep. Fulcher's bill is a direct response: introduce federal law that simply declares commercial data collection cannot be illegal wiretapping, and wipe the litigation slate clean at enactment.
---
##
The real story
The underlying conflict is not really about abusive lawsuits — it's about who gets to decide the rules for online tracking. On one side: every company that makes money from the internet (retailers, publishers, ad-tech firms, and the major platforms like Meta that embed tracking pixels across thousands of third-party sites) wants a single, permissive federal standard that says using cookies and analytics for commercial purposes is categorically legal. On the other side: privacy advocates and state attorneys general want to preserve the right of states to set their own floors — particularly California, which has the nation's strongest consumer privacy laws — and to let individual consumers sue when companies track them without consent. The "abusive lawsuit" framing is partly real: federal judges have called out serial filers who send mass demand letters to extract settlements with no intent to litigate. But the bill is written so broadly that it would eliminate the same law that forced the Los Angeles Times, major retailers, and healthcare providers to pay settlements for silent, unconsented surveillance of their users.
---
##
Red flags
▸ Immediate retroactive kill switch on pending cases. The bill contains explicit language stating that any claim or enforcement action already in progress on the date of enactment "may not be maintained, adjudicated, or arbitrated" after that date. This is not a prospective change in the law — it would void all currently pending CIPA and federal wiretap cases involving commercial digital activity the moment the President signs the bill. Plaintiffs who spent years building class actions would lose their cases overnight, regardless of how far along the proceedings are. This retroactive annihilation of pending litigation raises serious constitutional Due Process questions under the Supreme Court's framework in *Landgraf v. USI Film Products* (1994), which limits retroactive laws that destroy "vested rights."
▸ The scope is far wider than the "abusive lawsuit" framing suggests. California's state legislature simultaneously passed SB 690, which addresses the same CIPA problem but narrowly: it eliminates the private right of action only under the pen-register provision (§638.51) for website/app tracking, while leaving California's broader wiretapping (§631) and eavesdropping (§632) statutes fully intact for private plaintiffs. H.R. 10263 preempts ALL wiretap, eavesdropping, pen-register, and trap-and-trace claims — under both state AND federal law — for any commercial digital activity. It would override not just CIPA but also the federal Electronic Communications Privacy Act wiretap provisions themselves, for any business collecting data for commercial purposes.
▸ No carve-outs for sensitive contexts. The bill has no exceptions for health information, financial data, communications with attorneys, or children's data. A hospital using session-replay software on its patient portal, a bank using analytics on its login page, or a children's education app using tracking pixels would all receive the same blanket commercial-purpose immunity.
▸ "Commercial purpose" is defined so broadly it covers virtually every organization with a website. The bill defines "digital commerce" as covering promotion, sale, purchase, delivery, or support of products or services — effectively any website that sells anything or has an ad, including nonprofits with donation pages and news organizations with subscriptions.
▸ State attorneys general enforcement may be blocked. The bill bars "enforcement actions" — not just private lawsuits. If this language is read broadly by courts, it could prevent state AGs from enforcing their own wiretapping laws against commercial internet actors, stripping California's AG of a tool it uses for major data-privacy investigations.
▸ No floor protection replaces what's eliminated. Unlike the CAN-SPAM Act (which preempted state anti-spam laws but set federal standards) or HIPAA (which preempts state health privacy law but creates federal rules), H.R. 10263 provides no replacement federal privacy standard. It simply removes liability without creating any obligation on companies about how they must handle the data they collect.
▸ --
Who benefits
• Ad-tech platforms and data brokers — particularly Meta, Google, and the hundreds of companies whose pixels and tracking scripts appear on third-party websites. They face massive aggregate liability from CIPA wiretap claims and would have all pending actions terminated and future claims barred.
• Session-replay software vendors — companies like Hotjar, FullStory, and Microsoft Clarity, whose tools record users' mouse movements, keystrokes, and browsing behavior on client sites, have been named in lawsuits alleging unconsented interception. This bill would eliminate that category of liability entirely.
• Retailers and publishers with large U.S. web audiences — the 1,817 retail-sector CIPA cases documented through July 2026 would be wiped from dockets. Companies that have already paid legal fees for years of litigation would see cases dismissed.
• Plaintiffs' law firms specializing in defense work — corporate defense firms billing hourly on CIPA cases would lose ongoing matters, but the torrent of new suits would dry up, benefiting clients.
• Serial-filer targets — small businesses that received mass demand letters from serial CIPA litigants (a documented phenomenon that federal judges, including Judge Klausner in July 2026, have begun sanctioning) would gain real relief from shakedown-style cases.
• --
Who gets hurt
• California consumers — CIPA is California's primary private enforcement tool against unconsented online surveillance. CIPA allows individuals to sue for up to $5,000 per violation without proving actual harm. H.R. 10263 would eliminate this right entirely for any "commercial" data collection — which includes most online activity.
• Current plaintiffs with active cases — individuals and classes who filed lawsuits, survived motions to dismiss, and are in discovery or settlement negotiations would have their cases terminated the day the law takes effect. Their legal costs and time invested would be unrecoverable.
• State attorneys general — California, Illinois, and other states that have built enforcement programs around wiretapping-analog privacy laws would lose jurisdiction over commercial online tracking, pushing them to rely on narrower unfair-business-practice statutes instead.
• Plaintiffs' class-action attorneys — this category of litigation has been a significant revenue source for consumer-privacy plaintiff firms; that market disappears on enactment.
• Users of healthcare and financial websites — without wiretapping-law backstops, users who are tracked without consent by hospitals, insurers, or banks have fewer legal remedies. (The bill does not restore that protection via any alternative route.)
• States with stronger privacy laws — Illinois (Biometric Information Privacy Act), Washington, and Texas each have their own privacy frameworks; the broad preemption language could create uncertainty about whether their laws survive for commercial online activity depending on how courts interpret the bill's scope.
• --
What it does
H.R. 10263, introduced September 3, 2026 by Rep. Russ Fulcher (R-ID) and referred to the House Judiciary Committee, is a short but sweeping bill. Its operative provision states that "the collection, processing, or disclosure of information or communications for a commercial purpose shall give rise to no claim or enforcement action under Federal or State law with respect to pen registers, wiretapping, trap and trace, or eavesdropping" — and then explicitly names California's Invasion of Privacy Act as one of the laws being nullified. The bill defines "digital commerce" to include marketing, advertising, customer interactions, and selling goods or services online, and specifies the technologies covered by name: cookies, pixels, session replay, chatbots, tags, and analytics. Any business, service provider, or advertiser that deploys these tools for commercial purposes — meaning essentially every company with a website — gains categorical immunity from wiretapping and eavesdropping claims under both federal and state law. The bill contains a hard retroactivity clause: any claim or enforcement action already underway at enactment must stop immediately and cannot be continued, decided, or submitted to arbitration. The bill does not establish any new privacy standard, consent requirement, or data-security obligation in place of the liability it removes. It contains no sunset date, no regulatory implementation mechanism, and no federal agency is given oversight authority.
---
##
Hidden riders
- The federal Wiretap Act is quietly neutralized for commercial actors. The bill's language preempts "Federal or State law with respect to... wiretapping" — which includes the federal Electronic Communications Privacy Act's Title I wiretap provisions that Congress has never before suspended for commercial data collection. This has received almost no attention in coverage of the bill, which is framed primarily as a CIPA fix, but it would set a major precedent for the scope of the federal Wiretap Act itself.
- The "commercial purpose" standard has no bad-faith exception. A company that intentionally and deceptively intercepts private communications — knowing users believe they are communicating privately — would receive identical immunity to a company using standard analytics. There is no carve-out for intent, deception, or the sensitivity of the data intercepted.
- Kills cases beyond "abusive" ones. The retroactive clause wipes out all pending commercial-tracking wiretap cases, not just those brought by serial filers. The well-documented vexatious-litigant problem is already being addressed by courts (Judge Klausner's July 2026 order against Vivek Shah), but this bill eliminates the entire category of lawsuit, including legitimate class actions brought by established plaintiffs' firms on behalf of large consumer classes.
---
##
Precedent
The closest federal analog is the CAN-SPAM Act of 2003, which preempted state anti-spam laws and replaced them with a weaker federal standard — widely regarded as a failure because it legitimized bulk commercial email rather than stopping spam. A more relevant structural comparison is the PREP Act (Public Readiness and Emergency Preparedness Act), which retroactively eliminated pending tort liability for medical countermeasure manufacturers during declared emergencies — but that retroactive immunity was tied to a specific public emergency context, not a permanent carve-out. At the state level, the California legislature itself tried in 2025 to pass a broad CIPA commercial-purpose exemption (the original SB 690), but after intense opposition from privacy groups including the Electronic Frontier Foundation, ACLU California Action, and the Privacy Rights Clearinghouse, the bill was gutted and rewritten in July 2026 to cover only the narrowest pen-register provision. H.R. 10263 is essentially the original, broader version of SB 690 that California rejected — now being attempted at the federal level, where it would override California's decision.
---
##
Current status
H.R. 10263 was introduced in the House of Representatives on September 3, 2026, by Rep. Russ Fulcher (R-ID-1). It was immediately referred to the House Committee on the Judiciary, where it currently remains. The bill has had no committee hearings, no markup sessions, no amendments, and no recorded votes. It has not been scored by the Congressional Budget Office. No Senate companion bill has been identified. In practical terms, this bill is at the very beginning of the legislative process — the equivalent of a first draft being dropped in a inbox. Most bills introduced in committee never receive a hearing; for this one to advance, Judiciary Committee leadership (currently chaired by House Republicans) would need to schedule a hearing or attach it to other legislation. The 119th Congress's second session runs through January 3, 2027, giving the bill roughly four months to move before it expires and would need to be reintroduced in a new Congress.
---
Sources:
- [H.R. 10263 Full Text — Congress.gov](https://www.congress.gov/bill/119th-congress/house-bill/10263/text/ih)
- [H.R. 10263 — GovTrack.us](https://www.govtrack.us/congress/bills/119/hr10263/text)
- [H.R. 10263 — GovInfo](https://www.govinfo.gov/app/details/BILLS-119hr10263ih)
- [CIPA/ECPA Website-Tracking Privacy Litigation in 2026 — Barnes & Thornburg](https://btlaw.com/en/insights/alerts/2026/cipa-ecpa-website-tracking-privacy-litigation-in-2026)
- [2025 Website Wiretapping Roundup — Inside Class Actions](https://www.insideclassactions.com/2026/01/27/2025-website-wiretapping-roundup/)
- [CIPA Lawsuit Tracker — ConsentPixel](https://consentpixel.com/blogs/cipa-lawsuit-tracker/)
- [CIPA Lawsuit Tracker — Cookie-Script](https://cookie-script.com/privacy-laws/cipa-lawsuit-tracker)
- [How Silicon Valley Used Main Street's Outrage Against California Privacy Law — CalMatters](https://calmatters.org/economy/technology/2026/09/california-privacy-act-reform-for-small-business-helped-big-tech/)
- [California Legislature Passes SB 690 — Fenwick](https://www.fenwick.com/insights/publications/california-legislature-passes-sb-690-narrowing-private-rights-action-under)
- [SB 690 and CIPA: What Changed in July 2026 — Enzuzo](https://www.enzuzo.com/blog/sb-690-and-cipa)
- [California's SB 690 Clears the Legislature — Sidley Austin](https://www.sidley.com/en/insights/newsupdates/2026/09/californias-sb-690-clears-the-legislature-what-it-means-for-cipa-website-tracking-claims)
- [SB 690 Passed the Legislature — Spencer Fane](https://www.spencerfane.com/insight/sb-690-passed-the-legislature-what-does-that-mean-for-pending-cipa-website-tracking-cases/)
- [Courts and Lawmakers Push Back on Website Litigation Abuse — Lathrop GPM](https://www.lathropgpm.com/insights/courts-and-lawmakers-push-back-on-website-litigation-abuse/)
- [$3.85M LA Times CIPA Settlement — Top Class Actions](https://topclassactions.com/lawsuit-settlements/closed-settlements/3-85m-los-angeles-times-website-trackers-class-action-settlement/)
- [CIPA Website Tracking Lawsuits: Current State of the Law — Jeffer Mangels](https://articles.jeffer.com/2026/08/28/website-privacy-lawsuits-under-cipa-current-state-of-the-law/)
- [Federal Preemption of State Privacy Law Hurts Everyone — EFF](https://www.eff.org/deeplinks/2022/07/federal-preemption-state-privacy-law-hurts-everyone)
- [Session Replay Lawsuits: CIPA & Wiretapping Claims 2026 — BigDelta](https://bigdelta.com/blog/session-replay-lawsuits)
- [Russ Fulcher — OpenSecrets](https://www.opensecrets.org/members-of-congress/russ-fulcher/summary?cid=N00041335)
What to watch
The bill was introduced just two weeks ago (September 3, 2026) and is currently sitting in the House Judiciary Committee with no scheduled hearings, no cosponsors listed in the available record, and no Senate companion bill identified. Its fate almost certainly depends on whether it gets attached as a rider to a larger vehicle — a tech-regulation omnibus, a "Big Beautiful Bill" reconciliation package, or a continuing resolution — rather than advancing as a standalone measure. Citizens concerned about privacy should watch for the bill being quietly added to must-pass legislation; that is the most plausible path to enactment for a bill this narrow and this controversial. The California governor's decision on SB 690 (which passed the legislature August 28 and awaits a signature) will also signal the political temperature: if California's governor signs even the narrower state fix, it removes some urgency from the federal version, but if Big Tech lobbying pivots to Washington after a state setback, momentum for H.R. 10263 could accelerate.
---
##
Follow this bill
This decode is a snapshot. Bills change. Get emailed when this one is amended, voted on, or signed.
No spam. Unsubscribe anytime.
LegisPlain is free. Decoding costs aren't. Support us so we can support you.