CIPA & Legal Risk

A demand letter just landed: formal letterhead, a 1967 statute you’ve never heard of, and a damages figure that made your stomach drop. Here’s exactly what it means, what to do in the first 72 hours, what not to do, and a checklist you can act on immediately.

CIPA demand letters don’t start with a wronged customer. They start with an automated scan that detects the trackers on your site. Here’s how the two best-known plaintiff firms actually operate — and how to get ahead of the scan instead of reacting to the letter.

Three privacy laws, three completely different triggers, three different ways to get sued. Here’s how CIPA, CCPA/CPRA, and GDPR actually differ — and the uncomfortable answer to which ones apply to your website.

FullStory has been named as a defendant alongside Nike, Bloomingdale’s, and Noom in CIPA wiretapping lawsuits. The Ninth Circuit’s June 2025 rulings sent mixed but consequential signals about session replay liability.

CIPA litigation is still accelerating. Hundreds of lawsuits have been filed in the last year alone — and courts are issuing decisions at a pace that makes it genuinely hard to keep up.

Microsoft Clarity is free, powerful, and installed on hundreds of thousands of websites. It is also a session-replay tool that records every keystroke, click, and scroll your visitors make — and transmits that data to Microsoft’s servers in real time. Here is exactly what that means for your CIPA exposure in 2026.

Your developer installed a popup. Your tracking scripts still fire on page load. Plaintiff attorneys detect this in under 60 seconds and have the network logs to prove it. Here’s the full picture.

Hotjar is not illegal — but running it on your website without prior consent almost certainly is. Here’s the real legal picture, the actual case law, and exactly what you need to do.

A 1967 wiretapping law is quietly becoming the biggest legal threat to modern websites. Here’s what you need to know — and what to do about it.