HubSpot is the all-in-one marketing platform agencies deploy on hundreds of client sites. Its tracking code fires on page load by default. Its native consent banner — even after the May 2026 v2 migration — is designed as a notification tool, not a consent gate. And HubSpot is now explicitly named in active CIPA demand letters. Here’s exactly where the gaps are, which configurations are vulnerable, and what agencies need to fix for every client running HubSpot.

Microsoft Bing UET is named as a pen register in Camplisson v. Adidas (November 2025). Microsoft Clarity and the Bing UET tag together generated a $10 million CIPA settlement for Forbes in May 2026. Most agencies treat Microsoft as the safe, enterprise-grade tracking option. The case law says otherwise. Here’s what each tool captures, why the CIPA exposure is real, and the specific configuration changes agencies need to make across every client running Bing Ads or Clarity.

The Meta Pixel consent requirements vary by legal framework, visitor geography, feature set, and page type. What CIPA requires is different from GDPR. What Advanced Matching requires is different from the base pixel. What checkout pages require is different from blog pages. This article maps every scenario agencies actually manage — precisely, with case law to back each requirement.

In April through August 2025, three courts dismissed CIPA claims against the TikTok Pixel. In November 2025, a federal court in Camplisson v. Adidas found the TikTok Pixel could plausibly qualify as a pen register under CIPA — explicitly rejecting the earlier cases. The result is a genuine circuit split that leaves agencies running TikTok Ads on client sites in a legally uncertain but practically urgent position. Here’s the full picture.

Short answer: yes. But “cookie consent” is actually the wrong frame for US businesses. The Meta Pixel creates legal exposure under a 1967 California wiretapping law — not just cookie regulations — and the consent standard it requires is stricter, more specific, and far more technically demanding than the banner most agencies have installed. Here’s what’s actually required, what isn’t enough, and what happens when you get it wrong.

Most agencies treat Google Analytics as the “safe” tracker — lower profile than Meta Pixel, owned by Google, surely fine. In 2024, a court named Google Analytics specifically in a CIPA claim and let it proceed. In 2025, a Blue Shield of California misconfiguration sent 4.7 million patients’ health data to Google Ads for three years. Google Analytics has a CIPA exposure profile that’s different from Meta Pixel — and in some ways more insidious. Here’s what agencies need to know.

There are 1,919 apps in the Shopify App Store when you search “meta.” Trackify. Omega Pixel. CAPI Facebook Pixel Meta API. Parkour. Every single one installs pixels. Not one of them is a consent management platform. Installing a pixel app does not make your store CIPA-compliant. Here’s the gap most Shopify merchants don’t know exists — and what actually closes it.

Agencies buy pixel management apps through Shopify partner accounts and roll them out across dozens of client stores simultaneously. The clients assume the agency handled compliance. The agency assumes the app handles compliance. Nobody installs the CMP. The CIPA demand letter arrives at the client’s door — but under California’s aiding-and-abetting clause, the agency that deployed the configuration may be in the chain of liability too. Here’s the exposure and what to do about it across your entire Shopify portfolio.