Got a CIPA website tracking letter? What to do first
A CIPA letter says your website let other companies, like Meta or TikTok, see what California visitors did on it without their consent. It's a real legal claim, not an ADA claim, and you shouldn't ignore it or pay it in a panic.
This is not legal advice. Due Effort isn't a law firm. If you've been served with court papers, talk to a lawyer about your deadline today.
TL;DR: CIPA is the California Invasion of Privacy Act, an old wiretapping law. Law firms use it to claim that ad pixels, session recorders or chat widgets on your site share what visitors do with other companies before visitors agree. The law allows $5,000 per violation, which is why the demands are large. Call your business insurer and a California privacy lawyer, keep a record of how your site works today, and find out what your site loads before anyone clicks a cookie banner.
What is the letter actually claiming?
Most of these letters and lawsuits say that when a California visitor opened your website, tools from other companies started recording what they did before they had a chance to say no. The usual suspects:
- Ad pixels like the Meta (Facebook) Pixel, TikTok Pixel or Google Ads tag, which report page views and clicks back to the ad company.
- Session recorders like Hotjar, Microsoft Clarity or FullStory, which record mouse movements, clicks and scrolling.
- Chat widgets run by another company, where the claim is that the chat provider listens in on the conversation.
The legal theories come from a few sections of the California Penal Code, sections 630 to 638.55: section 631 (wiretapping), section 632 (eavesdropping) and section 638.51 (a "pen register", a device that records who is communicating). Law firms that defend these cases say section 631 claims over pixels, session replay and chat tools are still being brought (Procopio, October 2026).
Why is the amount so high?
Because the law sets the number, not the harm. Under Penal Code section 637.2, someone harmed by a violation can sue for $5,000 per violation or three times their actual damages, whichever is greater. They don't have to show they lost any money. That's what lets a letter ask for a lot from a small business.
Didn't California just fix this?
Partly. SB 690, signed on September 30, 2026, means only the California Attorney General can bring a section 638.51 claim about website or app tracking, and it reaches pending cases filed in the two years before it takes effect (bill text). It doesn't touch section 631 or 632 claims, and it doesn't change the $5,000 amount. So a letter based on wiretapping or eavesdropping is still a live claim.
What should I do this week?
- Don't ignore it, and don't reply to the other side yourself. A missed deadline can make things worse, and anything you write can be used later.
- Call your business insurer. Some policies cover privacy claims. Ask before you pay anyone.
- Talk to a California privacy lawyer. Your state bar's lawyer referral service can point you to one. This is a different specialty from ADA website defense.
- Keep a record before you change anything. Take screenshots of your cookie banner and privacy policy, and ask whoever runs your site to save the settings for your tracking tools. Your lawyer will want to know how the site worked when the letter says it did.
- Find out what your site loads before visitors agree. Our free scan now includes a privacy check. It opens your page without clicking anything and lists the ad pixels, session recorders and analytics that start right away, plus any chat widget, and tells you whether a consent tool or banner is there. Share the result with your lawyer.
The privacy check covers one page on first load. Our scanner visits from the eastern US, and some sites show different banners in different places. It can't see tracking that runs on your own server. It's a risk flag, not a legal finding.
Questions people ask
Is the Facebook pixel illegal in California?
There's no simple yes or no. These claims are about how the pixel is set up: whether it starts before a visitor agrees, what it sends to Meta, and what your site tells visitors. Many sites hold pixels back until a visitor accepts. A lawyer can tell you how the claims in your letter apply to your setup.
We use Hotjar or Microsoft Clarity. Is that a problem?
Session recorders are a common target in these letters because they capture what visitors do on the page. If you don't use the recordings, turning the tool off is the simplest step. If you do, ask your lawyer and web designer how to hold it back until visitors agree.
What about our chat widget?
Some suits target chat tools run by another company. It helps if your chat clearly says who runs it and that conversations may be recorded. Ask your lawyer what fits your situation.
We're not based in California. Does this apply to us?
These claims are usually brought on behalf of California visitors, so a business elsewhere can still receive one. Whether the law reaches your business is a question for a lawyer.
Is this the same as an ADA website letter?
No. ADA letters are about whether disabled people can use your site. CIPA letters are about tracking and privacy. They come from different laws and often different law firms. If you got an ADA letter instead, start with what to do in the first 72 hours.
Due Effort is not a law firm and this page is not legal advice. Our privacy check flags tools that load before consent; it doesn't decide whether any law was broken.