Home › Guides › CIPA demand letters
Got a CIPA demand letter about your website? What it means
In short: a CIPA demand letter usually claims your website let a third party — an ad pixel, a chat widget or a session-replay tool — capture visitor data before the visitor agreed. Don't ignore it, don't panic, and call a licensed attorney. On the technical side, find out exactly what loads before consent and make it wait.
Not legal advice. This page explains the technical side in plain English. If you received a letter or were served with a lawsuit, talk to a licensed attorney before you respond.
What the letter is claiming
The California Invasion of Privacy Act (CIPA) was written for phone wiretaps. Plaintiff firms now apply it to websites. The typical letter says that when someone visited your site, a third-party tool "listened in" on that visit — for example:
- Advertising pixels (Meta Pixel, TikTok Pixel, Google Ads, Pinterest, LinkedIn) sent page views and identifiers to an ad platform.
- Chat widgets run by a vendor received messages the visitor typed.
- Session-replay tools (Microsoft Clarity, Hotjar, FullStory) recorded clicks, scrolling and typing.
The key word in almost every letter is before: the tools fired before the visitor had a real chance to say yes. CIPA § 637.2 allows claims of $5,000 per violation, which is why the numbers in these letters add up fast.
What these letters usually look like
| Item | What's common |
|---|---|
| Who sends it | A plaintiff law firm on behalf of one visitor (sometimes "and others similarly situated") |
| What it asks | A pre-lawsuit settlement, commonly reported in the $10,000–$40,000 range |
| Deadline | Often 20–30 days |
| Evidence | A list of trackers or screenshots of network requests from your site |
Ranges are reported by law firms and industry sources; your situation may be very different.
What to do in the first week
- Don't ignore the deadline. Put it on your calendar today.
- Talk to a licensed attorney, ideally one who handles privacy or CIPA claims. Check whether your business insurance (cyber or general liability) covers privacy claims.
- Don't delete evidence. Ask your attorney before changing anything they may need to document. A screenshot or a dated scan of your site "as it is" can help.
- Get a technical picture. Find out which tools load before consent today. Our free scan shows that in about 15 seconds; your attorney may also want an independent check.
- Fix what loads before consent — after your attorney is aware of it.
Did SB 690 end these claims?
No. SB 690, signed September 30, 2026, provides that from January 1, 2027 only the California Attorney General can bring "pen register" claims (CIPA § 638.51) over website or app tracking. Wiretapping claims under CIPA § 631 — the ones usually aimed at chat, session replay and ad pixels — are not affected, and other states have similar laws. Read the full breakdown.
The technical fix that removes the usual pattern
The pattern behind most letters is simple: tracking starts before consent. The fix is equally simple to describe:
- A consent banner that is actually shown to U.S. visitors (many are set to appear only in Europe).
- Ad pixels, chat and session-replay tools configured to wait until the visitor accepts.
- Google Consent Mode v2 so Google tools respect the choice.
- A re-scan to prove nothing fires early, and regular checks so new apps don't bring pixels back.
None of this makes a business immune to claims, but it removes the evidence most letters rely on.
See what your site loads before consent
Free, 15 seconds, no signup. If something fires early, we can fix it for $149 and prove it with a clean re-scan.
Common questions
Can I just remove the pixel and ignore the letter?
Removing or delaying trackers fixes the problem going forward, but it doesn't make an existing claim disappear. Talk to an attorney about the letter itself, and coordinate any website changes with them.
My business isn't in California. Does CIPA apply?
Claims are typically based on where the visitor is. Businesses outside California have received CIPA letters because California residents visited their sites. Only an attorney can assess your situation.
I have a cookie banner. Why did I get a letter?
Many banners don't block anything, or they're only shown to European visitors. What matters is what loads before the visitor says yes. Here's how to check yours.