Guest Post – Received a CIPA Demand Letter? Here’s What to Do Next. A Practical Guide for Agencies and Brands

If your agency or brand operates a website using standard marketing tools like chat widgets, pixel trackers, session recording software or automated analytics, you may soon face (or already have received) a California Invasion of Privacy Act (CIPA) demand letter.

Plaintiffs’ attorneys are increasingly using CIPA to allege that standard website tracking technologies amount to illegal “wiretapping” or unauthorized “pen registers.”

Rather than focusing on specific legal adversaries, agencies and brands need to prioritize immediate operational risk management. Here is a practical, step-by-step action plan to protect your organization and client portfolio.

Immediate Action Plan: 4 Steps When a Letter Arrives

If a CIPA demand letter lands in your inbox or mailbox, take these four steps right away:

1. Preserve All Relevant Records

Do not clear server logs, delete user session recordings or modify tracking tag configurations immediately after receiving a letter. Standard spoliation-of-evidence rules apply. Implement a legal hold on data retention settings for the site in question.

2. Audit the Trackers on the Flagged URL

Determine exactly what third-party scripts were running on the URL referenced in the demand letter at the alleged time of the violation. Pay special attention to:

• Session Replay Tools (e.g., Hotjar, FullStory, Lucky Orange)
• Live Chat Widgets (e.g., Drift, Intercom, Zendesk)
• Ad & Analytics Pixels (e.g., Meta Pixel, Google Analytics, TikTok Pixel)

3. Contact Your Insurance Carrier & Privacy Counsel

Many Cyber Liability or Commercial General Liability (CGL) policies cover CIPA defense costs. Early notice to your insurer is often required to preserve coverage. Do not send a direct reply to the claimant without legal guidance and speak with a privacy software solution provider that has a compliance shield guarantee. 

4. Establish Agency-Client Alignment

If an agency implemented the tracking tool on behalf of a brand client, check your master service agreement (MSA) for indemnification clauses and legal liability boundaries. Align on a unified communication plan before responding.

Why Is CIPA Being Used Against Website Trackers?

CIPA is a California privacy law enacted in 1967 to prevent telephone wiretapping. However, plaintiffs’ lawyers are applying two specific sections of the law to modern web technologies:

• Section 631 (Wiretapping): Claims that third-party vendors (like chat services or session replay tools) intercept communications between a user and a website without prior consent.
• Section 638.51 (Pen Registers & Trap/Trace Devices): Claims that website tracking pixels, IP-logging tools or software tags record user routing data (like IP addresses or URL paths) without a court order or explicit consent.

Because CIPA carries statutory damages of $2,500 to $5,000 per violation, high-traffic websites face massive exposure—making pre-suit litigation threats a lucrative strategy for plaintiffs’ firms.

4 Proactive Steps to Reduce Risk Across Your Clients’ Sites

Don’t wait for a demand letter to evaluate your setup. Agencies and brands should take these four technical and operational steps now:

A. Implement Explicit Opt-In Consent

Move away from implicit “by using this site you agree to our privacy policy” banners. For California visitors, ensure tracking scripts—especially chat widgets and session replay tools—do not fire until the user actively consents via a Compliance Management Platform (CMP).

B. Audit Third-Party Vendor Agreements

Review contract terms with software providers (chat tools, analytics, session recordings). Look for:

• Provisions confirming the vendor acts solely as a service provider and does not use captured data for their own purposes.
• Direct indemnification support if their tool triggers wiretapping claims.

C. Update Privacy Policy Disclosures

Ensure your public privacy policy explicitly names the types of tools used on the site (e.g., chat recording, session analytics, pixel tracking) and clearly states that third-party vendors assist in processing this data.

D. Align MSAs (For Agencies)

Agencies should review client contracts to ensure clear boundaries around compliance responsibilities. Specify which party is responsible for ensuring cookie banners and consent frameworks meet state-specific requirements.

Please note that the 4As does not provide legal advice. The views and opinions represented here belong solely to the author. 

About the Author

Richart Ruddie is an experienced data privacy expert and founder of CaptainCompliance.com, a leading data privacy and compliance software company.

He’s been brought in to help as a consultant and expert witness for privacy litigation matters and has years of experience as an entrepreneur and strategic advisor specializing in privacy compliance, digital risk management and data governance.