In 2026, these letters are arriving in the inboxes of businesses across the country at an increasing rate. Many of the recipients are small businesses whose sites run the same analytics and advertising tools found on millions of other websites. Governor Newsom has publicly criticized the use of these lawsuits and demand letters to extract settlements from small businesses. Lets talk about what the California Invasion of Privacy Act (CIPA) demand letter is, why these letters have become so common, how recent legislation affects them, and what a practical path to compliance looks like.
What a CIPA Demand Letter Is
CIPA was enacted in 1967 as a criminal statute meant to prevent the wiretapping of telephone calls. Plaintiffs’ attorneys have since argued that its provisions extend to modern web technologies such as cookies, advertising pixels, session replay tools, and chat widgets. Two sections appear most frequently in demand letters. Section 631 prohibits the unauthorized interception of electronic communications, and Section 638.51 addresses pen registers and trap and trace devices, which record routing or addressing information without capturing the content of a communication. Although CIPA is part of the Penal Code, Section 637.2 allows an injured individual to bring a civil claim directly, with statutory damages of $5,000 per violation.
A demand letter is a pre-litigation notice. It typically identifies a tracking tool on the recipient’s website, asserts that the tool loaded without the visitor’s prior consent, and proposes a settlement within a short window, with deadlines of 20 to 30 days commonly reported. Receiving a letter does not mean that a court has found a violation. The letter states an allegation and serves as the opening position in a negotiation.
The tools at issue are generally called third-party tracking technologies. These are scripts that load from another company’s server and share information about site visitors with that company. Common examples include Google Analytics, the Meta Pixel, Google Ads tags, the LinkedIn Insight Tag, HubSpot forms, and third-party live chat embeds. A script that begins with a script tag and points to an external web address is a strong indicator that a third party is receiving visitor data.
Why the Letters Are Arriving Now
The volume of these letters reflects the economics of the litigation more than the conduct of any individual website. According to figures reported by Usercentrics, more than 70 percent of these privacy claims originate from only four law firms. Those firms operate high-volume, template-driven practices in which network traffic is captured on a consumer-facing site, a tracking script is identified, and a near-identical letter is sent. Sending a letter costs the plaintiff’s firm roughly a few thousand dollars, and filing a templated complaint costs somewhat more. By comparison, defending a case through a motion to dismiss with a conventional law firm team can reportedly cost between $400,000 and $800,000.
This imbalance explains the structure of the settlement demands. A business facing a six-figure defense bill will often find that paying a smaller settlement is the rational short-term choice, which is exactly the outcome the plaintiffs’ firms anticipate. The $5,000 per-violation figure strengthens their position further. When it is multiplied across a large number of California visitors, the theoretical exposure becomes enormous, even though realistic settlements are far smaller. The gap between those two numbers is the source of the plaintiffs’ leverage.
Basically, the big guys want to bully the little guys.
Why CCPA Compliance Does Not Resolve the Issue
Many business owners assume that a compliant privacy policy and a working “Do Not Sell or Share” link will protect them. The California Consumer Privacy Act (CCPA) operates primarily as an opt-out framework, which means a business generally may collect personal information as long as consumers can later opt out of its sale or sharing. CIPA rests on a different legal foundation and, as plaintiffs apply it, centers on whether the visitor gave consent before the tracking tool loaded. A site can therefore satisfy its CCPA obligations and still be exposed under CIPA if third-party scripts fire as soon as a page opens. This difference explains why businesses that believed they were compliant have still received letters.
What Compliance Looks Like in Practice
The conditions that attract a demand letter are largely technical. A tracking script loads before the visitor has made a choice, and the business has no record of what its site is sharing or with whom. Our process at The Digital Hand addresses these conditions in four stages, and the sequence mirrors the way a plaintiff’s firm would evaluate a site.
Discovery. We begin by inventorying every third-party technology that loads on the website, including advertising pixels, analytics tags, embedded forms, and chat widgets. This work combines browser tools with a review of the site’s backend, and it establishes which scripts fire and under what conditions. We also ask whether each tool is still needed. Sites frequently carry pixels from advertising campaigns that ended long ago, and removing an unused script eliminates the associated risk entirely. In some cases a privacy-focused alternative can replace a high-risk tool.
Setup. Once the necessary tools are identified, we walk through the privacy policy and configure the consent solution. Every non-essential technology is classified, usually as functional or marketing, and set to remain off by default. A visitor’s explicit action, such as accepting the banner, is the only event that allows those scripts to load. The consent banner should appear at minimum to California visitors, and many businesses choose to display it to all visitors so that everyone receives the same privacy protections.
Build. The implementation stage is where most compliance efforts succeed or fail, because creating a policy and a banner is considerably simpler than ensuring that the website actually obeys them. We configure the site so that blocked scripts remain blocked until consent is given. Sites that load tags through Google Tag Manager require Google Consent Mode so that each tag fires only when the visitor has agreed to it. Plugins, widgets, and the integrations pages of website builders add further complexity, because they often load tracking scripts in ways a consent tool cannot control. In those cases we frequently replace the integration with the standard embed code placed directly in the site’s head section, which allows consent to be enforced properly.
Hand Off. We test the finished build in a fresh browser session, confirming that the consent banner appears and that no non-essential cookies or third-party network requests occur before the visitor accepts. Any issue discovered during testing is corrected before delivery. The client then receives a PDF documenting the compliance work for their records. This process typically takes five to seven business days. Clients who later add new tracking or analytics can continue with us on a monthly retainer so that the consent setup keeps pace with changes to the site.
An Important Caveat
No consent solution can eliminate legal risk, and this work does not replace legal counsel. A business that has already received a demand letter should send it to an attorney with specific experience in privacy litigation before responding, and it should preserve its website logs, consent records, and vendor contracts. Our role is to address the technical conditions that make a site an attractive target and to leave the business with documentation of what was done.
Conclusion
The current wave of CIPA demand letters reflects a litigation strategy built on low costs for plaintiffs and high defense costs for businesses. Legislative and judicial developments may narrow some of the theories involved, but the wiretapping theory under Section 631 remains available to private plaintiffs, and the rules continue to change. A website that knows exactly what it shares and obtains consent before sharing it is in a stronger position under any version of the law. If you would like to understand where your site stands, we offer a free consultation and can walk you through what a compliance audit would involve.
The Digital Hand does not provide legal advice. This article is intended for educational purposes only, and businesses that have received a demand letter should consult qualified legal counsel.
