Is Your Agency Liable When a Client Gets a CIPA Demand Letter?

If you run a web or digital agency in 2026, this scenario is no longer hypothetical. A client forwards you an email. It's a demand letter from a law firm alleging their website used tracking technologies — a Meta Pixel, Google Analytics, a session-replay tool like Hotjar — that "intercepted" visitor communications without consent, in violation of California's Invasion of Privacy Act (CIPA). It demands a settlement, often in the tens of thousands, within 20 to 30 days. And your client's first instinct is to look at the people who built and manage the site: you.

The wave is real and growing. Thousands of CIPA demand letters have gone out since 2023, and they don't require the sender to prove any actual harm — CIPA carries statutory damages commonly cited at $5,000 per violation under California Penal Code § 637.2, which is exactly what makes these letters so attractive to plaintiffs' firms and so alarming to the businesses receiving them. Crucially, you don't need to be in California, or even have California customers, to be targeted — any publicly reachable website with visitors in California can be.

So let's answer the question agencies actually lose sleep over, honestly and specifically. This is general information, not legal advice — your specific exposure depends on your contracts and your jurisdiction, and you should confirm it with your own counsel. But the shape of the answer is clear, and it's more reassuring than you might fear, with one important catch.

The portfolio nightmare

For a single business owner, a CIPA letter is a scare and an expense. For an agency, it's something worse: a pattern. Because here's the uncomfortable structural truth about how agencies build — you don't build each site from scratch. You have a standard stack. A go-to analytics setup. A tag-manager template. A theme with the same scripts wired in the same way, deployed across every client you onboard.

That efficiency is your business model. It's also your risk multiplier. If your standard build lets a pixel fire before consent — and most do, because a normal cookie banner records a preference while the tags fire anyway — then that single configuration flaw isn't on one site. It's on every site you've built the same way. One plaintiff's scanner finds it on one client. The same scanner, pointed at your other clients, finds the identical pattern. What starts as one forwarded email can become a queue of them.

This is the framing that makes agency exposure genuinely different from a single business's, and it's the lens for everything that follows: your leverage cuts both ways. The same standardization that lets you manage a hundred sites efficiently can expose a hundred sites simultaneously.

Are you actually liable? The honest answer

Start with the good news, because it's real. In the default case, the website owner — your client — is the liable party, not you.

The reason is structural. CIPA claims target the "business" that operates the website and allegedly did the intercepting. Under the statute's "direct party exception," the website owner is generally treated as a party to the communication on its own site. The legal exposure attaches to the entity whose site collected and transmitted the data — the client — not automatically to every vendor who touched the site along the way. As one privacy law firm summarizes it: unless a contract says otherwise, complying with website privacy regulations is the website owner's responsibility, not the web designer's.

So if you're an agency that built a site, handed it off, and moved on — with a sensible contract in place — the demand letter is, in the first instance, your client's problem to answer, not yours. That's the reassuring baseline.

But "in the first instance" and "by default" are doing real work in those sentences. There are three specific ways an agency gets pulled into the liability picture anyway — and if you manage many sites, you should assume plaintiffs' firms and clients' lawyers are aware of all three.

Three ways an agency gets pulled in

The default protects you, but it isn't a force field. Here are the three doors through which agency liability actually walks in — in order of how often they matter.

1. Your contract (the biggest one)

This is the door most agencies leave wide open. Your client contract governs your liability, and if it's silent — or worse, generous — you've handed exposure to yourself. The specific traps:

• You guaranteed compliance. If your contract, proposal, or even a marketing page promises the site will be "compliant" or "GDPR/CCPA compliant," you've made a warranty. When the site turns out not to be, that broken promise is a contract claim against you.
• You didn't limit your liability. With no liability cap, your exposure isn't bounded by your fee — it can reach the client's actual losses.
• You didn't get indemnification. Without an indemnity clause pushing responsibility for the client's own data practices back to the client, the default allocation may leave you carrying more than you should.

2. Vicarious liability — "aiding and abetting"

This is the door most agencies don't know exists. Even though the direct-party exception shields the website owner, plaintiffs can reach for vicarious theories — and law firms defending these cases name them explicitly: aiding and abetting, and conspiracy. The argument is that the party who installed and configured the tracking technology helped the alleged interception happen. For an agency, that's an uncomfortable fit: installing and configuring tracking is precisely what you did.

Whether such a theory succeeds is unsettled and fact-specific — but "unsettled" means "not foreclosed," and defending against it still costs time and money even when you ultimately prevail.

3. Your client's own lawyer may point at you

Here's the twist that catches agencies off guard. When a client takes a demand letter to counsel, a common piece of advice they receive is to look at the vendors and agencies in the middle. Privacy firms now routinely counsel businesses to "manage the vendors and agencies who sit in the middle" — to audit those relationships for indemnification and to allocate responsibility for privacy claims to them where a vendor's configuration drove the exposure. Translated: your client's attorney may be actively building the argument that you should absorb this. The blame doesn't just drift toward the agency; sometimes it's directed there on legal advice.

Legal liability vs practical liability

Now the distinction that matters most, and the one agencies most often miss. There are two separate questions hiding inside "am I liable?", and they have different answers.

Read those two columns together and the strategy writes itself. You manage legal liability with contracts. You manage practical liability by making sure the thing never happens in the first place — by delivering sites that don't fire trackers before consent, so there's nothing for a scanner to find and nothing for a client to blame you for. The best agencies do both, because winning a lawsuit you could have prevented is still a loss.

Why agencies are uniquely exposed

It's worth dwelling on the scale point, because it's what separates agency risk from ordinary business risk and it's the part no one else is talking about.

A single business has one website and one exposure. An agency has one method and many exposures. When your process is good, that's leverage — you deliver consistent quality efficiently. When your process contains a compliance flaw, that same consistency propagates the flaw everywhere. A pixel-fires-before-consent default isn't a bug on one site; it's a bug in your template, and it ships with every project.

The optimistic flip side is genuinely optimistic: because your exposure lives in a template, so does your fix. An agency that gets blocking-before-consent right once, at the standard-build level, protects its entire book at once. Scale is the risk, but scale is also the remedy — which is exactly why the agencies that handle this well turn it into a competitive advantage rather than a liability.

Protect your agency, part 1: your contracts

The legal-liability layer is won or lost in your client agreement, long before any demand letter arrives. You don't need to become a lawyer — you need your lawyer to make sure four things are true. Treat this as a checklist to take to counsel, not as counsel itself.

Protect your agency, part 2: the build

Contracts handle legal liability. The build handles practical liability — the blame, the lost client, the damaged reputation — by making sure the demand letter never has a factual basis in the first place. This is the layer you control most directly, and it comes down to one principle.

Block trackers before consent, by default, on every site you ship. This is the single most important technical fact in CIPA exposure, and it's where most sites — and most agencies — quietly fail. The failure mode is subtle: a normal cookie banner records a visitor's choice, but the tracking scripts have often already loaded and fired the moment the page opened, before anyone clicked anything. The banner is showing while the pixel is already transmitting. That gap — a tag firing before consent — is precisely what a plaintiff's scanner is built to catch, and it's the entire basis of the "interception without consent" claim.

So the standard to build to isn't "do we have a banner?" It's "does the tag actually stay dormant until the visitor opts in?" Three things belong in every agency's standard delivery:

• True pre-consent blocking. Non-essential trackers — Meta Pixel, Google Analytics, and especially session-replay tools like Hotjar, FullStory, Clarity, and Lucky Orange — must not load until consent. Not load-and-pause. Not fire-then-record. Genuinely blocked.
• Continuous monitoring. A site that's clean at launch doesn't stay clean. Marketing teams add tags through tag managers; new scripts arrive bundled in other tools. Without ongoing monitoring, a compliant handoff quietly decays into an exposed site months later — on your watch.
• Consent records as evidence. An immutable, timestamped log proving consent was obtained before each tracker fired is the single most useful artifact if a client ever does get a letter. It turns "we think we were fine" into "here is the record."

Turn liability into recurring revenue

Here's the reframe that changes this from a cost center into a growth line. Everything above — the pre-consent blocking, the monitoring, the consent records — is a service clients will pay for, monthly, indefinitely.

The market has already figured this out. Across the agency ecosystem, compliance is being packaged as a recurring managed service: scheduled scans, tracker monitoring, consent logging, and monthly reporting, bundled into a retainer. It's reliable recurring revenue that also deepens the client relationship — and it's naturally sticky, because the monitoring only works if it's continuous. Industry guidance puts the going rate at roughly $50–100 per site per month for compliance management, which is meaningful margin when multiplied across a book of clients.

The strategic move is to stop treating compliance as an unbilled risk you absorb and start treating it as a product you sell. You were going to carry the practical liability anyway; productizing it means you get paid to eliminate it, your clients get genuine protection, and your agency gets recurring revenue that campaign work and one-off builds don't provide. The liability becomes the offer.

Two paths, same starting point

Every agency starts in the same place: a book of client sites, built on a standard stack. What happens next depends entirely on whether trackers are blocked before consent. Here are the two roads — the one most agencies are on without realising it, and the one the fix puts you on.

How ConsentPixel gives agencies relief

This is the part where we're direct about what we do, because it maps exactly onto the two-layer problem above — and it's built for the portfolio scale that makes agency exposure unique. ConsentPixel is prevention-first consent tooling: instead of a banner that records a choice while tags fire anyway, a single pixel blocks non-essential trackers until a visitor genuinely consents, and proves it did. Here's what that means for an agency managing many client sites.

Put together, that's the whole relief picture: you see your portfolio's exposure, you prevent it at the build level across every site, you prove it with immutable records, and you bill for it as a branded service. The practical liability that used to be an unpaid worry becomes a productized, defensible, revenue-generating part of what your agency offers.

If a client already got a letter

If you're reading this because a letter already landed, a few honest pointers — with the reminder that this is information, not legal advice, and both you and your client should involve counsel.

• Don't quietly "fix" the site first. Before changing anything, preserve the current state — tag-manager configuration, the consent setup, any logs. The site's configuration at the time of the alleged violation is evidence, and altering it before it's documented can hurt the defense.
• The letter goes to your client's counsel, fast. These letters carry real deadlines (often 20–30 days), and a templated format doesn't make a claim invalid or safe to ignore. The response belongs with the client and their attorney, not handled casually.
• Know your contract position. Quietly re-read your agreement with that client for compliance guarantees, liability caps, and indemnification — this is the moment those clauses matter. Loop in your own counsel about your exposure.
• Then close the gap — everywhere. Once the immediate response is handled, this is the signal to fix the underlying pattern across your whole portfolio, so the same letter can't arrive from your other clients next month.

Frequently asked questions