Are CIPA Demand Letters a Scam? What the Texas AG Alert Changes — and What It Doesn't

If a CIPA demand letter landed in your inbox and you've since seen a headline saying the Texas Attorney General called these letters a "scam," you're probably feeling a wave of relief. Hold onto it for a second — because that relief is about to be tested. The AG's warning is genuine and useful, and it confirms something many business owners already suspected: a large share of these letters are mass-produced shakedowns. But "the letter is predatory" and "my website is clean" are two completely different statements, and the whole point of this article is to stop you from treating the first as if it proves the second. One is about the person who sent the letter. The other is about what your site actually does when a visitor lands on it. You can be the target of a bad-faith letter and have a site that genuinely fires trackers before consent. This piece walks through exactly what the Texas AG said, why the "scam" framing is fair, and — more importantly — the one thing it doesn't change.

What the Texas AG actually said

On September 17, 2026, Texas Attorney General Ken Paxton issued a consumer alert warning Texans about demand letters that allege website privacy violations under California's Invasion of Privacy Act (CIPA). The letters typically claim that ordinary website technology — cookies, pixels, analytics tools, session-replay scripts, even the site's search bar — amounts to illegal "wiretapping" under California law, and they demand a settlement to make the threatened lawsuit go away.

The AG's framing was blunt. His office described the letters as part of a pattern of "fraudulent demands and other scams," and advised recipients to consult qualified counsel before responding rather than paying on receipt. The alert also pointed to the broader litigation ecosystem behind these letters, noting serial filers — including one plaintiff, Vivek Shah, who had been declared a vexatious litigant and barred from filing new CIPA claims in a California federal court without permission.

Texas isn't acting alone in spirit. The statement reflects a growing pushback against the CIPA demand-letter wave — a mass-volume model in which law firms send near-identical letters to thousands of businesses, bank on a percentage settling to avoid legal costs, and move on. Courts have started pushing back too, and California's own SB 690 reform narrowed one of the theories these letters leaned on. So if your instinct was "this feels like a racket," the Attorney General of Texas just said, on the record, that your instinct has merit.

Here's where it gets slippery.

The trap in the word "scam"

"Scam" is a statement about the sender's business model — the volume, the boilerplate, the inflated math, the bet that you'll pay to avoid a fight. It is not a statement about your website's behavior. Those are two independent axes, and you need to know where you sit on both.

The AG's statement moves you along the horizontal axis — it's strong evidence that many of these senders are operating a volume racket. It tells you nothing about the vertical axis. And the vertical axis is the one a court cares about if a competent plaintiff ever files for real. The quadrant you most need to avoid getting trapped in is the top-right: a predatory letter arriving at a site that genuinely leaks, where the "it's just a scam" narrative talks you out of fixing a real problem.

Why these letters earn the "scam" label

Understanding why a regulator would use a word as strong as "scam" helps you see exactly what the warning does and doesn't cover. The predatory mechanics are about economics, not about whether any individual site is compliant.

All five of these are reasons to not panic-pay. None of them is a reason to assume your site is fine. That's the whole trick: the letter's flaws are real, and so, often, is the conduct it describes.

What "scam" does not change

Here's the part the relieved-headline-reader skips. A predatory letter can still point at a real statute and real conduct. Four things the "scam" framing leaves completely untouched:

Put plainly: the Texas AG is right that many senders are bad actors, and that changes how you should respond to the letter. It changes nothing about whether a tracker on your site fired before a California visitor said yes. Only your site can answer that.

The question that actually matters

Stop asking "is this letter a scam?" You'll never fully resolve it, and the answer doesn't protect you anyway. Ask the question a real plaintiff's technical expert would ask: if someone loaded my site from California tomorrow and recorded every network request, what would fire before the consent banner was clicked?

That question is answerable in minutes, and it's the only one that tells you which quadrant you're in. If nothing sensitive fires pre-consent, a scammy letter is just noise and you can respond from a position of strength. If your analytics, ad pixels, or session-replay scripts do fire on load, then the letter — predatory as it may be — is describing something real, and the next sender might not be a vexatious litigant a court has already flagged.

3 mistakes the "it's a scam" story invites

The relief that comes with "a regulator called it a scam" leads to three specific, avoidable errors.

So what should you do?

If you've received a letter, the Texas AG's warning changes your posture — don't panic, don't pay on receipt — but not your process. The short version of the triage:

This article is the gut-check that comes before that process: it keeps a reassuring headline from talking you into doing nothing. The response guide is where you go once you've decided to act.

Frequently asked questions