To avoid CIPA lawsuits, block every tracking technology on your website until the visitor gives consent. Plaintiffs’ lawyers are looking for websites with trackers that fire before consent is given by the user, so a correctly functioning consent gate is what you need in place.
Here’s our 10-Step Checklist that we use when providing privacy compliance service to clients. We also highly recommend clients follow this protocol if they’re using our consent app.
CIPA Compliance Checklist
- Install a consent management platform (CMP) on your website.
- Connect the CMP to your tag manager so it controls when tags fire.
- Set every non-essential tag to blocked by default. That includes analytics, ad pixels, session replay, and chat widgets.
- Test it. Open your site in a fresh private browsing window with the network tab open, don’t click accept, and watch what loads. Any tracker that fires before consent is legal exposure. Gate it or remove it.
- Inventory every third-party script on your site. The full example list is in the next section. Remove anything you don’t actually use.
- Keep timestamped logs of every consent decision.
- Document your testing. Take a screen recording and dated screenshots showing no trackers fire before consent.
- Get independent verification. Documentation from an outside company attesting that tracking is blocked before consent is strong evidence against litigation.
- Re-test after every new marketing tag. One new pixel can undo a clean setup.
- Make the banner itself usable. A consent banner should meet WCAG 2.1 AA so keyboard and screen reader users can operate it. An inaccessible banner invites ADA claims on top of privacy claims.
Courts keep asking one question: did tracking start before the website visitor had a chance to consent?
If the answer is no, and you have the records prove it, if you received a CIPA complaint, it will not withstand scrutiny.
But, even better, if you’re already technically compliant, your chances of getting sued are much, much lower. Plaintiffs’ lawyers don’t want to be caught in a situation where they’re sending boilerplate lawsuits that have no merit.
| Key Point | What It Means for You |
|---|---|
| The one fix that matters most | No pixel, analytics tag, session replay tool, or chat widget loads until the visitor clicks accept. |
| Who gets sued | Any commercial website with California visitors. Your business location does not matter. |
| The two legal theories | Wiretapping under Penal Code Section 631 and pen register / trap and trace under Section 638.51. |
| The exposure | Statutory damages of $5,000 per violation, with no proof of actual harm required. |
| SB 690 reform | Passed the Legislature on August 28, 2026. If signed, it ends private pen register claims only. Wiretap claims continue. |
| What plaintiff’s lawyers scan for | Trackers firing on page load, session replay, third-party chat, and consent banners that don’t actually block anything. |
Let’s get detailed and talk about how this actually works in practice.
Privacy compliance (CIPA, GDPR, CCPA, etc.) isn’t a secret, but it’s technically complex and time consuming.
What most website owners aren’t aware of is installing a cookie banner isn’t enough. Neither is a privacy policy. You need to be thorough with this and have both the app and the testing in place to ensure you’re fully compliant.
Here’s how you actually implement the step-by-step checklist.
How Do You Know What Tracking Loads?
Use your browser’s developer tools. Here is the check:
- Open a private or incognito window so no prior consent is stored.
- Press F12, or right-click the page and choose Inspect.
- Click the Network tab.
- Load your website. Do not interact with the consent banner.
- Watch the list of requests fill in. Each row is something your page contacted.
Look for these domains in the request list. Each one means a tracker fired:
- connect.facebook.net or facebook.com/tr (Meta Pixel)
- google-analytics.com or analytics.google.com (Google Analytics)
- googletagmanager.com (Google Tag Manager container)
- analytics.tiktok.com (TikTok Pixel)
- bat.bing.com (Microsoft UET)
- clarity.ms (Microsoft Clarity)
- hotjar.com, fullstory.com, mouseflow.com (session replay)
- px.ads.linkedin.com, ct.pinterest.com, sc-static.net (LinkedIn, Pinterest, Snapchat)
These are just common examples; this is not an exhausitive list.
You can type a domain into the network tab’s filter box to search for it directly. If any of these appear before you click accept, your consent gate is not working.
This is the same check plaintiff’s firms run. They save the results as a network log and attach it to the demand letter.
Why Document and Verify Your Testing?
Because you need hard evidence if you face a legal claim. Blocking trackers is a great start, but being able to prove you blocked them on a specific date is the start of a paper trail that can really help in getting a case dismissed.
Here’s an evidence file you can build:
- Screen recordings of the network tab test, with the date visible
- Screenshots of the empty request list before consent and the tags firing after consent
- Your consent logs
- Documentation issued from an independent company that manually tested your site and confirmed tracking does not fire before opt-in
That last item matters most. Self-serving screenshots help. Third-party verification carries more weight and can end litigation before it starts, because a plaintiff’s firm reviewing your response sees a documented, tested setup instead of an easy target.
This is work we do at Accessible.org. Our consent management app blocks trackers until opt-in, and we manually test websites and provide documentation attesting that tracking is properly gated. Whether you use us or another provider, get the verification in writing.
How Do I Inventory Everything That’s Tracking Visitors?
You have to know what tracking exists to gate it. Most website owners are surprised by what a privacy compliance audit turns up. Marketing agencies, developers, and digital teams install tags over the years, and nobody keeps a list.
Go through every category below and write down what your site runs:
Advertising and social media pixels
- Meta Pixel (Facebook and Instagram)
- Google Ads tag and remarketing tags
- TikTok Pixel
- LinkedIn Insight Tag
- Pinterest Tag
- Snapchat Pixel
- X (Twitter) Pixel
- Reddit Pixel
- Microsoft Advertising UET tag (Bing)
- Amazon ad tags
- Criteo, Taboola, and Outbrain retargeting tags
Analytics tools
- Google Analytics (GA4)
- Adobe Analytics
- Mixpanel, Amplitude, Heap
- Segment and other data pipelines that forward visitor data to multiple vendors
- Matomo, Plausible, and other alternatives (still inventory them)
Session replay and heatmaps
- Microsoft Clarity
- Hotjar
- FullStory
- Mouseflow, Lucky Orange, Crazy Egg
- Any A/B testing tool that records sessions, like Optimizely or VWO
Chat and visitor engagement
- Intercom, Drift, Zendesk chat, LiveChat, Tidio
- Salesforce and HubSpot chat widgets
- AI chatbots from any third-party vendor
Marketing and CRM scripts
- HubSpot, Klaviyo, Mailchimp, and ActiveCampaign tracking scripts
- Pop-up and email capture tools
- Affiliate tracking scripts
Embedded content that phones home
- YouTube and Vimeo embeds
- Social share buttons
- Embedded maps, review widgets, and fonts loaded from third-party servers
Platform-installed tags
- Google Tag Manager itself, plus everything loaded inside its container
- Shopify apps, WordPress plugins, and theme features that inject their own pixels without telling you
Pay attention to 2 key spaces:
- tag manager container (tags hide inside it)
- ecommerce apps and plugins (they install tracking)
For each item, record what it is, what data it collects, where the data goes, and which pages it fires on. That inventory becomes your gating checklist and part of your evidence.
What Is CIPA and Why Are Websites Being Sued?
The California Invasion of Privacy Act (CIPA) is an archaic 1967 wiretapping law. Plaintiffs’ law firms are taking full advantage of the gray area and applying it website tracking technologies.
Two focus areas:
- Section 631 treats third-party tools that read visitor communications as illegal wiretaps. This covers session replay, chat vendors, and pixels that capture form entries.
- Section 638.51 treats tools that capture routing data, like IP addresses and device identifiers, as illegal pen registers or trap and trace devices.
Damages are $5,000 per violation under Penal Code Section 637.2. The visitor doesn’t need to show any actual harm. That math is why filings and demand letters keep surging.
CIPA follows the California visitor, not the business. In Briskin v. Shopify (9th Cir. 2025), the Ninth Circuit held that an online business that knowingly collects data from California users can be sued in California. Being based in Texas or Florida is not a defense.
What Do Court Decisions Say?
Case law does not come out evenly, but here are the key takeaways:
Consent must come before tracking starts
- Javier v. Assurance IQ (9th Cir. 2022): Section 631 requires prior consent. A privacy notice shown after data collection began doesn’t count.
- Camplisson v. Adidas (S.D. Cal. 2025): A privacy policy link in the page footer is not consent. The court let TikTok Pixel and Bing tracker claims proceed because nothing blocked the pixels before an affirmative opt-in.
Takeaway: disclosure is not consent. Your banner must block trackers until the visitor acts.
Tracking scripts count as surveillance devices
- Greenley v. Kochava (S.D. Cal. 2023): Software can be a pen register. This decision launched the current wave.
- Moody v. C2 Educational Systems (C.D. Cal. 2024): A TikTok fingerprinting script qualifies too.
Takeaway: courts will treat ordinary marketing scripts as surveillance tools. Audit them like they are.
Vendor configuration decides the case
- Gutierrez v. Converse (9th Cir. 2025): No violation where the chat vendor could not actually read messages in real time. Converse won.
- Mikulsky v. Bloomingdale’s (9th Cir. 2025): Claims survived where session replay captured names, addresses, and card details as visitors typed.
- Valenzuela v. Nationwide (C.D. Cal. 2024): A website owner can be liable for aiding and abetting when its vendor intercepts chats.
Takeaway: configure session replay and chat so the vendor cannot independently read content. Mask sensitive fields. Put service-provider limits in the contract.
Sensitive data keeps lawsuits alive
- Popa v. Microsoft (9th Cir. 2025): Tracking ordinary shopping behavior is not a concrete injury. Case dismissed.
- In re Meta Pixel Tax Filing Cases (N.D. Cal. 2025): The Meta Pixel on tax prep sites plausibly violated both CIPA sections.
Takeaway: keep pixels off pages that touch health, financial, tax, or account data. Data minimization is a defense.
Weak demand letters can be fought
- Shah v. Talentbridge (C.D. Cal. 2026): A prolific serial filer’s claim was dismissed. Typing generic search terms into a public website implicates no privacy interest.
- Blaker v. NetScout (Cal. Super. 2026): A state judge dismissed pen register claims with prejudice, holding those provisions cover telephones, not websites.
Many website owners first instinct is to respond right away once they receive a demand letter or notice of a complaint. Make sure you talk to a defense attorney experienced in CIPA lawysuits first.
What Are Plaintiff’s Lawyers Looking For?
Plaintiff firms run automated scans before they ever send a letter. They look for:
- Meta Pixel, TikTok Pixel, Google Analytics, or Bing tags firing on page load
- Session replay tools like FullStory, Hotjar, and Microsoft Clarity
- Third-party live chat and chatbot widgets
- IP address and device fingerprinting scripts feeding third parties
- A consent banner that displays but tracks anyway
They document everything in a browser network log that shows each tracker, its timestamp, and the data it sent before consent. That log becomes Exhibit A. Your prevention goal is a clean log.
The targeting pattern is consistent: the letter goes to whoever’s site tracks first and asks later.
Does SB 690 End CIPA Lawsuits?
No. SB 690 passed the California Legislature on August 28, 2026 and awaits the Governor’s signature. If signed, it takes effect January 1, 2027.
What it does: removes the private right of action for pen register and trap and trace claims against websites. Only the Attorney General could bring those.
What it does not do: touch Section 631. Wiretap claims over pixels, session replay, and chat continue with full $5,000 per violation exposure. The consent gate stays necessary either way.
One appellate case to watch: Variety Media v. Superior Court. A tentative ruling in August 2026 suggested IP address collection alone doesn’t make a pixel a pen register. A final opinion is expected later in 2026.
Frequently Asked Questions
Does my privacy policy protect me from CIPA claims? No. Courts in Javier and Camplisson held that consent must come before tracking starts. A policy link is disclosure, not consent.
My business isn’t in California. Can I still be sued? Yes. Under Briskin v. Shopify, collecting data from visitors you can identify as Californians creates jurisdiction there.
Do I have to remove Google Analytics and the Meta Pixel? No. You have to gate them. Tags that fire only after opt-in, with consent logged, are the compliant setup. Remove only what you don’t use.
What should I do if I receive a CIPA demand letter? Send it to privacy counsel immediately. Do not let marketing or IT respond. Many demands fail on standing, as Shah v. Talentbridge shows.
Are consent banners required to be accessible? Yes, as a practical matter. A banner that keyboard and screen reader users cannot operate creates ADA exposure and undermines the consent itself. Build banners to WCAG 2.1 AA.
Summary
- Block all non-essential trackers before consent. This is the answer to the title question.
- Audit third-party scripts quarterly and after every marketing change. Track what fires, when, and where the data goes.
- Configure session replay and chat vendors so they cannot read content. Mask sensitive fields.
- Keep pixels off sensitive pages entirely.
- Log every consent decision with a timestamp.
- Document your testing with screen recordings and screenshots, and get independent written verification. Evidence prevents litigation.
- Watch SB 690’s signature status and the Variety Media final opinion.
- Treat demand letters as legal matters, not customer service tickets.
This article is general information, not legal advice. For a specific demand letter or setup question, consult with an experience attorney.
Do you need to make your website CIPA compliant?
We’d love to help. Send us a message and we’ll reply as soon as possible.
