Your Client Got a CIPA Demand Letter. Here's the Agency Playbook.
When a demand letter lands on your client's desk, they forward it to you — because it's about the website you built and the tags you manage. Here's how to steer them through it, what to actually do on the site and the CMP, how the "just ignore it" path really plays out, and how to protect your client and your agency at the same time.
The agency playbook
- Why the letter becomes your problem
- The first client call: what to say (and not say)
- Preserve before you touch anything
- The technical audit only you can run
- Remediation: fixing the CMP the right way
- What happens if the client ignores it
- Your agency's own exposure — head-on
- Turning the incident into a retainer
- Key takeaways
- FAQ
Why the letter becomes your problem
A CIPA demand letter alleges that a website's tracking technology — pixels, session-replay tools, chat widgets, analytics — intercepted a visitor's communications without consent, in violation of California's Invasion of Privacy Act. It cites the specific tools observed, invokes Penal Code § 631(a) or § 638.51, attaches a damages figure built on $5,000 per violation, and gives roughly 20–30 days to settle before a lawsuit. Your client receives it. But everything it describes — the tags, the pixels, the consent banner, the firing order — is your work. So the letter lands on your desk within the hour.
That is the uncomfortable position this article is written for. You are not the defendant, but you are the one who has to establish the facts, fix the site, and often manage the client's panic — frequently while wondering about your own exposure. There's a reason these letters trace back to the work agencies do. As one agency owner put it bluntly, most marketing agencies quietly dislike consent tooling and tell clients not to worry about it — and that exact mindset is what's landing businesses in trouble in 2026. The leftover Meta Pixel from an ad campaign that ended two years ago, the analytics script a developer dropped in "temporarily," the chat widget added without a second thought — these are the artifacts of ordinary agency work, and they are precisely what the plaintiff scanners find.
Most businesses have no live inventory of every cookie, pixel, tag, chat widget, and analytics tool on their site — because marketing teams add tools, agencies update tags, and developers test scripts, often without anyone tracking the cumulative result. That fragmentation is the vulnerability. As the agency of record, you are usually the only party who can reconstruct what's actually running — which is exactly why the client forwards you the letter, and why your response defines how this goes.
You're not the defendant. But you're the only one who can answer the question the whole case turns on: did the tag fire before consent?
— The agency's position in every CIPA letterThe first client call: what to say (and not say)
Your client is frightened, and how you run the first conversation sets the tone for everything after. Your job here is to be the calm, competent operator — not to speculate about fault, and not to make promises you can't keep.
What to say
Lead with steadiness and structure. A demand letter is a pre-litigation invitation to settle, not a lawsuit or a judgment — no court is involved yet, and there is a known, methodical way through it. Tell the client you will immediately preserve the site's current state, establish the technical facts, and support their counsel with hard evidence. Give them the one instruction that matters most in the first hour: do not reply to the sender, and do not let anyone start deleting tags.
What NOT to say
Do not say "that's not possible, your site is fine." Do not say "I'll strip those pixels right now and we're covered." And critically, do not put speculation about fault in writing — not in email, not in Slack, not in a ticket. Loose internal messages about who installed what and whether it was compliant can become discoverable, non-privileged evidence. Keep your written communications factual and minimal, and route legal questions to counsel.
Get the client to engage privacy-litigation counsel experienced specifically with CIPA — before anyone responds to the sender. You are the technical lead, not the legal lead, and being clear about that line protects the client and you. Your value is establishing what the site actually did; counsel's value is deciding what to do about it. Point the client to our step-by-step CIPA demand letter response guide so they understand their side of the process while you handle the technical track.
Preserve before you touch anything
This is the step agencies get catastrophically wrong, because it runs against every instinct you have. Your instinct is to fix the problem — open the tag manager, pull the offending pixels, deploy, and tell the client it's handled. Do not do this. Stripping trackers before preserving the site's current state can be characterized as spoliation — destruction of evidence — which can hurt the client's position more than the original claim, and can put your agency squarely in the frame for having caused it.
Before you change a single line of code, capture the current state:
- Screenshot the live site, including the consent banner exactly as it appears now, across key templates (home, product, checkout, contact).
- Export the tag-manager container — the full GTM export, or the platform's equivalent — as a timestamped file.
- Record the network waterfall from a clean, cookie-free session showing what fires and when, before any banner interaction (more on this in the audit).
- Save server and deploy logs if available, and list every third-party script currently loading.
- Document the current consent setup — banner config, CMP settings, privacy policy, and terms as they stand today.
Tell your team, in writing but factually, to preserve everything and change nothing on the client's site until counsel clears it. That includes not "helpfully" cleaning up tags, not pushing queued deploys, and not editing the CMP. One well-meaning developer who "just fixed it" can convert a defensible position into a spoliation problem — and that developer works for you.
The technical audit only you can run
This is where you earn your fee. The entire case turns on one question, and you are the person best equipped to answer it: did the tracking scripts fire before the visitor consented? Counsel can argue the law; only you can establish the facts of the implementation. Run the audit in parallel with the legal track, not instead of it.
Load the client's site in a fresh, cookie-free session, open the network tab, and watch the first few hundred milliseconds — before any human could have clicked a banner. If the Meta Pixel, a session-replay tool like Hotjar or FullStory, or a chat widget fires in that window, that is the consent-timing problem at the heart of the claim. Two facts your audit might surface are strong defenses, so document them precisely and with dates: whether the tool named in the letter was even present during the alleged visit, and exactly when each tag fires relative to consent. A free scan produces this network-level evidence in about ten seconds — the same view the plaintiff's firm used to build the letter.
Run the same scan the plaintiff firm ran
Point ConsentPixel's free scanner at your client's site and see every tracker that fires before consent — the exact evidence you need for the audit — in about 10 seconds. No account required.
Scan the client site free →Remediation: fixing the CMP the right way
Once evidence is preserved and counsel has the facts, you remediate — and this is the part that's genuinely yours to own. But remediation done wrong is almost as dangerous as no remediation, so sequence matters: preserve first, fix second, and fix the root cause, not the symptom.
The symptom is "these three named pixels fired early." The root cause is "this site has no real consent gating — nothing was blocking anything." If you only pull the three tools named in the letter, you've left every other non-essential tag firing on load, and the next scanner finds the site again in a month. Real remediation means installing genuine consent enforcement:
Block, don't just banner
Non-essential tags — analytics, ad pixels, session replay, chat — must be technically prevented from executing until the visitor affirmatively consents. A banner that appears while tags already fire is the exact failure the letter targets.
Make "Reject" actually reject
When a visitor declines, the tags must genuinely not fire — test it, don't assume it. In 2026, a cosmetic reject button is evidence against the client, not a defense. This is the single most common thing agencies get wrong.
Honor GPC in real time
Since January 1, 2026, businesses must confirm a Global Privacy Control opt-out was processed. Wire GPC signals through to every connected vendor — it's an active enforcement priority and the next litigation trigger.
Keep an immutable consent log
Timestamped, page-scoped records of what was shown, what was blocked, and what the visitor chose. If another letter comes, this log is the client's strongest single piece of evidence — and proof your remediation held.
The distinction that matters to your client — and to your defense of the work — is between a cosmetic banner and real enforcement. Most deployed banners, including many an agency installed in good faith, record a preference without ever blocking a tag. That gap is what the entire plaintiff industry scans for. Closing it properly, once, is worth more than pulling named pixels reactively every time a letter arrives. For the deeper explanation of why a compliant-looking banner still draws letters, point the client to our breakdown of why CCPA compliance doesn't stop a CIPA letter.
What happens if the client ignores it
Some clients — especially ones who've decided the letter is a "scam" or a nuisance — will want to do nothing. Part of your job is making the consequences concrete, because "ignore it" is the single most expensive choice on the table. Here is how that path actually unfolds, based on how the high-volume firms operate.
A client might have heard that California's SB 690 would gut CIPA's private right of action. As of July 2026 it was amended to do exactly that — and to cover pen-register claims — but it is not law. The Legislature reconvenes August 3, 2026 and must pass it before August 31 to enact it this year, and the proposed retroactive relief is untested. Advising a client to sit on a live demand letter because a bill might pass is a bet with their money and, potentially, your reputation. Treat the letter as fully enforceable, because today it is.
There's a defensible version of "not paying," and it's not the same as ignoring: engaging counsel, responding on the record, and contesting a weak claim is a legitimate strategy — the law is genuinely unsettled, and many claims have real defenses. Silence is not that strategy. Silence just forfeits the client's options and speeds up the filing.
Your agency's own exposure — head-on
Let's address the question you've been sitting with since the letter arrived: can the agency be on the hook? The honest answer is that it depends on your contracts and your conduct — but it's a real enough risk that you should understand it clearly rather than hope it away.
The client is the website operator and the named target. But when the alleged violation stems from tags you installed and a CMP you configured, a client facing a five- or six-figure settlement will look at their contract with you and ask whether you're responsible. Whether that goes anywhere depends on things you control now:
Practically, protect the agency on four fronts. Contracts: your master service agreement and SOWs should state who is responsible for privacy compliance, include a limitation-of-liability cap, and ideally an indemnification structure appropriate to your role. Documentation: keep a written record every time you recommend consent gating or flag a compliance gap — a client who declined your recommendation is a very different situation from a client you advised to ignore the issue. Insurance: confirm your own professional-liability / E&O policy and understand whether it responds to privacy claims arising from your work; encourage the client to check their cyber-liability coverage too. Conduct: from the moment the letter arrives, behave like a party whose work is under scrutiny — because it is. Preserve, don't destroy; document facts, not speculation.
The agencies most exposed are the ones who treated consent as an annoyance and said so. The agencies best protected are the ones who made genuine consent enforcement a standard part of every build and kept the receipts. You cannot retroactively change what you said last year — but starting today, every client you move onto real consent gating is a client who won't generate one of these letters, and a documented decision that protects you if they do.
Turning the incident into a retainer
Handled well, a demand letter is not just a fire to put out — it's the moment a client finally understands that compliance is ongoing, technical work they can't do themselves. That's a service, and it's one of the cleaner recurring-revenue lines an agency can add in 2026.
The pitch writes itself once you've lived through one letter with a client: compliance isn't a one-time banner install, it's continuous. New campaigns add pixels, theme and plugin updates re-introduce tags, new tools connect — each a chance to fall back out of compliance, none of it visible without ongoing monitoring. Package that reality:
- Initial remediation project — the audit, the CMP install, the consent-gating configuration, and a documented before/after. This is the immediate, scoped engagement the letter justifies.
- Ongoing compliance retainer — monthly scanning, tag-change monitoring, consent-log review, and a standing report the client can hand to counsel or insurers. Priced per site, it scales across your whole book.
- Portfolio protection — if one client drew a letter, the rest of your client base has the same exposure. A proactive audit across every site you manage is both genuine risk reduction for them and a natural expansion for you.
This is where a tool built for agencies matters: a single pixel that blocks trackers until consent, honors GPC, keeps immutable per-site consent logs, and lets you monitor an entire client portfolio from one dashboard turns "compliance" from a scary favor into a productized, recurring service. That's the difference between absorbing these incidents as cost and running them as a practice area.
Key takeaways
The letter targets your client, but the facts are yours. You built the site and manage the tags, so you're the one who can answer the question the case turns on — did tracking fire before consent — and that makes your response decisive.
Preserve before you fix. The instinct to strip pixels immediately can create a spoliation problem and put your agency in the frame. Screenshot, export the container, capture the network waterfall, issue a litigation hold — then remediate.
Fix the root cause, not the named tools. Real consent gating that blocks tags until opt-in, makes reject genuine, honors GPC, and logs every decision — not just pulling the three pixels the letter mentioned.
Ignoring it is the expensive path. Missed deadline → filing within weeks → stacked claims → larger settlement. "Waiting for SB 690" is a bet with the client's money on a bill that isn't law.
Protect the agency deliberately. Clear contracts, documented recommendations, E&O coverage, and careful conduct. And convert the incident into an ongoing compliance retainer — genuine protection for the client, recurring revenue for you.
Handle the letter — and protect every other client site
ConsentPixel — Privacy · Verified blocks trackers before consent, makes reject real, honors GPC, and keeps immutable per-site consent logs — managed across your whole client portfolio from one dashboard. Scan a client site free to see what fires before consent, then start a 14-day free trial.
Start 14-day free trial → Scan a client site freeNo credit card required · agency plans from $99.99/mo · see our agency program
Frequently asked questions
Can my agency be sued if a client gets a CIPA demand letter?
The client is the website operator and the named target of the letter, not the agency. But your exposure is real and depends on your contracts and conduct. When the alleged violation comes from tags you installed and a CMP you configured, a client facing a large settlement may look to your service agreement to determine responsibility. Whether that goes anywhere turns on whether your contract defines who owns compliance, whether you have a limitation-of-liability cap, and whether you documented recommending consent gating versus advising the client to skip it. Clear contracts, a record of good-faith recommendations, and E&O coverage are your primary protections. Consult your own counsel about agency-liability specifics.
What's the first thing an agency should do when a client forwards a CIPA letter?
Two things, in order. First, tell the client not to reply to the sender and not to let anyone delete tags yet — then get them to engage privacy-litigation counsel experienced with CIPA before responding. Second, preserve the site's current state before you touch anything: screenshot the live site and banner, export the tag-manager container, and capture a network recording of what fires before consent. Only after evidence is preserved do you remediate. Rushing to strip pixels first can create a spoliation problem that hurts the client and implicates your agency in destroying evidence.
Should we remove the tracking pixels immediately to fix it?
Not before preserving evidence, and not as your only fix. Stripping the named tools before documenting the site's current state can be characterized as spoliation. And pulling only the pixels named in the letter treats the symptom, not the cause — every other non-essential tag is still firing on load, so the next scanner finds the site again. After preservation, the real remediation is installing genuine consent gating: block all non-essential tags until affirmative consent, make sure "reject" actually stops them, honor GPC signals, and keep a timestamped consent log. Fix the gating once, properly, rather than reacting to each letter.
What actually happens if my client ignores the letter?
Ignoring is the most expensive option. The deadline passes, the client's negotiating leverage disappears, and the firm typically files a formal complaint — in California state court, often removable to federal, or an arbitration demand under the client's own Terms of Service — within weeks of the missed deadline. Once filed, defense costs rise sharply, and firms often stack CIPA with the federal ECPA and California's CDAFA to inflate damages and resist early dismissal. Reported per-claim settlements run roughly $10,000 to $200,000, with class matters much higher. There is a legitimate version of contesting a weak claim through counsel; silence is not it.
Should we advise the client to wait for SB 690 to pass?
No. As of July 2026, SB 690 was amended to eliminate CIPA's private right of action and to cover pen-register claims — which would significantly change the landscape — but it is not law. The California Legislature reconvenes on August 3, 2026 and must pass it before the August 31 adjournment to enact it this year, and its proposed retroactive relief is untested. Advising a client to sit on a live demand letter because a bill might pass gambles with their money on an uncertain outcome. Treat the letter as fully enforceable today, because it is, and let counsel weigh any pending-legislation strategy.
How do I turn this into ongoing work rather than a one-off fix?
Frame compliance as the continuous, technical work it actually is. New campaigns add pixels, theme and plugin updates re-introduce tags, and new tools connect over time — each a chance to fall back out of compliance, none of it visible without monitoring. Package that into an initial remediation project (audit, CMP install, consent-gating config, documented before/after) plus an ongoing retainer (monthly scanning, tag-change monitoring, consent-log review, a report the client can hand to counsel or insurers). And because one client's letter means your whole portfolio shares the exposure, a proactive audit across every site you manage is both real risk reduction and a natural expansion. A tool that manages consent across a client portfolio from one dashboard is what makes this productizable.