Cookie consent banner with Accept all and Reject all buttons, badges reading Reject All works and Trackers blocked, and the headline: What fires before consent?

CIPA demand letters: why ordinary websites are getting them, and how to check yours

Mircea Sandu

If you run a website that uses Google Analytics, a Meta pixel, or a chat widget, there is a letter making the rounds that you should know about.

It arrives from a law office, or sometimes from an individual representing himself. It says your website “intercepted” a visitor’s communications in violation of the California Invasion of Privacy Act, cites $5,000 in statutory damages per violation, and offers to settle, usually on a deadline of a few weeks. The letters are templated. The businesses receiving them are, in many cases, small companies that had never heard of the law being cited.

This is not a fringe thing. Law firm Fisher Phillips counts more than 4,300 “digital wiretapping” cases filed since early 2022, about 3,300 of them in California, and demand letters stack on top of the lawsuits. One serial claimant alone, Vivek Shah, sent thousands of letters to businesses and nonprofits across the country between late 2025 and mid 2026, according to Fisher Phillips. On July 20, 2026, a federal judge in the Central District of California declared Shah a vexatious litigant in Shah v. Crain Communications, per TCPAWorld. The order is narrow: it requires Shah to get a judge’s approval before filing new CIPA or related digital-privacy suits in that district. In granting it, the court pointed to his pattern of filing claims, dismissing them when challenged, and never litigating one to the merits.

So what is actually going on, and what should you do about your own site? Let’s take it in order.

A 1967 wiretapping law, applied to your analytics

The California Invasion of Privacy Act, or CIPA, was written in 1967 to stop phone wiretapping. It never mentions websites, because websites did not exist.

The legal theory behind the current wave goes like this: when a visitor types into your search bar or browses your pages, that is a “communication” between the visitor and you. If a tracking pixel or analytics script sends any of that activity to a third party, such as Google or Meta, the plaintiffs argue the communication was “intercepted”, the same way a wiretap intercepts a phone call. Some letters cite a related CIPA provision about “pen registers” and “trap and trace devices”, equipment that historically recorded phone numbers, and argue that analytics tools are the modern equivalent.

Whether that theory holds up is genuinely unsettled, and you should know both halves of the picture.

What the courts are actually saying

The honest answer is: they are split, sometimes within the same month.

Through the spring of 2026, several California courts threw these claims out entirely. In Heiting v. Wildflower Brands, a Los Angeles judge dismissed a pen register claim with prejudice, which means it cannot be refiled. The judge concluded the provisions were designed for telephone surveillance, not commercial websites. In April, a federal court dismissed all CIPA claims in Sisti v. Bosley the same way, and in May another Los Angeles court dismissed a similar suit against NetScout Systems. Meanwhile, on June 26, 2026, a federal court gave final approval to a $3.85 million class settlement against the Los Angeles Times over the same category of claims, per Spencer Fane.

Dismissals are encouraging if you are a defendant. But a legal theory that loses in one courtroom and settles for millions in another is, by definition, unsettled. And defending even a weak claim costs real money before any judge rules on anything.

What actually triggers the claims

Here is the part most coverage skips, and the part you can act on. These letters are not really about whether you use analytics. Almost every website does. They are about three specific technical questions. The framing is ours, but it tracks the compliance advice that firms like Fisher Phillips have published:

  1. Does anything fire before the visitor makes a choice? If your analytics or ad pixels load and send data the instant the page opens, before anyone touches your cookie banner, that pre-consent window is exactly what the 2026 cases target. Law firm Loeb & Loeb calls it the millisecond problem: tracking that runs in the gap between page load and consent.
  2. Does “Reject All” actually stop the tags? A banner that shows up but does not control anything does not help you: if the tags keep collecting data no matter what the visitor clicks, the tracking the letters describe is still happening.
  3. Can you produce records showing what happened? If a claim ever lands, the question becomes evidence: what fired, when, and what the visitor chose.

Notice that none of these is “do you have a cookie banner”. Plenty of sites receiving letters have one. The issue is whether the banner is cosmetic or whether it genuinely controls the tracking.

Check your own site in about ten minutes

You do not need to be a developer to see what your site does before consent. Here is the short version:

  1. Open a new private or incognito browser window, type your site’s address in the address bar, but don’t press Enter yet.
  2. Right-click anywhere on the empty page and choose Inspect (this works in Chrome, Edge, and Firefox). A panel opens with several tabs across the top; click Network.
  3. Now press Enter and let your site load. The panel fills with rows. Each row is a request your site makes. Don’t touch the cookie banner yet.
  4. In the filter box at the top of that list, try typing google-analytics, then facebook, then doubleclick, tiktok, or clarity.

If requests to those domains appear before you have clicked anything on the banner, your site is tracking pre-consent. That is the pattern the letters describe. Repeat the test once more, this time clicking “Reject All” first, and see whether those requests still appear as you browse. If they do, your banner is not actually blocking anything.

One caveat: most people are surprised by what they find. Sites accumulate tags. A marketing plugin here, an old campaign pixel there. Termageddon’s co-founder, who has run a website-policies company for ten years, says in a recent explainer that he constantly hears site owners admit “I have no idea what I’m loading on my website”. That is not a position you want to be in.

Where ConsentLayer fits

We built ConsentLayer around the same three questions, so this is the part where we tell you plainly what it does and does not do.

It blocks trackers before consent, not after. The ConsentLayer loader is a small script that runs at the very top of your page, before any tracker gets a chance to, and holds tracking scripts until the visitor decides. It ships with built-in blocking rules for common services like Google, Meta, and TikTok, plus custom rules for anything site-specific. Embedded content, like YouTube videos or maps, can be held back until consent the same way. That closes the pre-consent gap for the scripts it controls: trackers covered by your rules are held until the visitor chooses.

It tells you what your site is actually loading. The scanner crawls your pages, identifies known services, and puts anything unrecognized into a review queue for you to categorize. Every scan is compared with the previous one, so when you re-scan three months from now (scans run on a schedule automatically on paid plans), a new tag stands out instead of running silently. “I have no idea what I’m loading” stops being your default answer.

It applies region-specific behavior by visitor location. Geo consent rules ship with GDPR, CCPA/CPRA, and LGPD templates, so visitors in different regions see different treatment, and the CCPA/CPRA template can honor the Global Privacy Control browser signal (a setting you switch on), with each honored signal recorded on the consent record.

It keeps the records. Every consent decision is logged with its categories, jurisdiction, and banner version (visitor IP addresses are stored in a scrambled, anonymized form, never raw), and the log exports to CSV. If you are ever asked what a visitor chose and what your site did about it, you have an answer instead of a shrug.

And to be equally plain about the limits: no tool can promise you will never receive a demand letter, and using ConsentLayer does not make legal claims against you impossible. Anyone can put a letter in the mail. What a properly configured consent platform changes is the technical facts underneath the three questions above.

If a letter has already arrived

The response guides that law firms have published for these letters, including one specifically for the Shah letters, tend to make the same two points: ignoring a letter rarely helps, and paying immediately is not the only option. The letters set short deadlines, but the case law above is still moving.

What the right response is for your letter depends on facts we cannot see from here. Talk to a privacy lawyer before you decide anything; this article is background, not legal advice.

The ten-minute version

Open your site in a private window with the Network tab open, and see what fires before you touch the banner. If the answer is “nothing until I consent, and Reject All actually works”, your site does not show the pre-consent tracking behavior these letters describe. If the answer is anything else, fix that first, whether with ConsentLayer or otherwise.

If you want the fix to take minutes instead of a weekend: create a free account, run the scanner, and see for yourself what your site loads. Or, if you build with an AI coding agent, connect our MCP server and ask it to do the whole thing:

npx -y @consentlayer/mcp setup

“Add ConsentLayer to this site. Scan it, map the tracking scripts to categories, and give me the install snippet.”

This article is general information about a developing area of law, not legal advice. If you have received a demand letter or been named in a lawsuit, consult a lawyer licensed in your jurisdiction.