What Happens When You Receive a CIPA Demand Letter — A Step-by-Step Response Guide

A demand letter just landed: formal letterhead, a 1967 statute you've never heard of, and a damages figure that made your stomach drop. Here's exactly what it means, what to do in the first 72 hours, what not to do, and a checklist you can act on immediately.

If a CIPA demand letter has arrived in your inbox or by FedEx, take a breath before you do anything else. First, don't panic. These letters are engineered to make your stomach drop — the formal letterhead, the unfamiliar 1967 statute, the damages figure with a lot of zeros — but the most useful first fact is this: you are not being singled out, and the letter is not a lawsuit. Online tracking claims exploded from roughly 200 in 2023 to nearly 4,000 in 2024, with demand letters and arbitration filings stacked on top — and a large share of them trace to a handful of firms running a volume model designed to convert mass mailings into mass settlements. You are one of thousands who received a near-identical letter. That doesn't make it harmless — the deadline is real and ignoring it has consequences — but it does mean there's a known, methodical way through this, and that the panic the letter is designed to produce is exactly the thing to set aside.

This guide walks the response end to end: what the letter is, what to do in the critical early days, the defenses your lawyer will weigh, how to think about settling versus fighting, and how to fix the underlying problem so you're not back here in six months. There's a checklist near the end you can use the moment a letter lands. One thing up front, and it runs through everything below: this article is informational and is not legal advice. CIPA outcomes are fact-specific and the law is genuinely unsettled — the steps here are about helping you act sensibly and engage the right counsel, not about replacing them.

What a CIPA demand letter actually is

A CIPA demand letter is a pre-litigation notice. It alleges that your website's tracking technologies — pixels, cookies, session-replay tools, chat widgets, or similar — illegally intercepted a user's communications under the California Invasion of Privacy Act, and it invites you to settle before a lawsuit is filed, typically within 20 to 30 days. No complaint has been filed and no court is yet involved. That last point is the one to hold onto: a demand letter is an invitation to settle, not a judgment, and how you respond is still entirely within your control.

The legal theory usually rests on one of two provisions: California Penal Code § 631(a), the older "wiretapping/interception" clause, or § 638.51, the "pen register / trap and trace" provision that plaintiffs increasingly favor as courts grow skeptical of the wiretapping framing. Many letters also invoke federal and related statutes such as ECPA or California's CDAFA alongside CIPA.

The first instinct to resist

The natural reaction to a demand letter is one of two extremes: pay quickly to make it disappear, or ignore it and hope it does. Both are mistakes. Paying on your own, without counsel and without fixing the underlying issue, can mark you as a willing payer and leaves you exposed to the next letter. Ignoring it forfeits your chance to evaluate or negotiate the claim, and firms commonly file within weeks of a missed deadline. The right posture is in between: move deliberately, preserve your position, and get advice before you say anything on the record.

What's inside the letter

Demand letters from the high-volume firms follow a recognizable script. Knowing the parts helps you read one calmly:

• The allegation — who allegedly visited your site and when, which specific tracking tool is said to have fired, and what data it transmitted to a third party.
• The legal hook — the CIPA provision invoked (§ 631(a) or § 638.51), often with companion statutes.
• The damages math — CIPA's $5,000 per violation (or three times actual damages, whichever is greater, with no proof of harm required), multiplied across many alleged interactions to produce an alarming on-paper total.
• The settlement demand — a number, with a deadline of roughly 20–30 days, frequently sized to sit below what mounting a defense would cost.
• Sometimes, an arbitration framing — invoking the arbitration clause in your own terms of service to push the matter into confidential individual arbitration rather than court.

A growing subset of these don't threaten court at all — they threaten arbitration, which offers plaintiffs lower costs, speed, and confidentiality. The class-action threat, where present, is often posturing at the demand stage (individual settlements are what the model is built to harvest), but "often posturing" is not "always empty," and some firms do file.

Here's what those pieces look like assembled. The mock-up below is an illustrative example with fictional details — not a real letter from any firm — annotated to show the standard parts:

Before anything else, find the response deadline in the letter and put it on a calendar with a reminder several days ahead. Everything else happens inside that window. Note the date the letter arrived and how it was delivered (email, FedEx, certified mail), and keep the envelope or delivery confirmation. If the deadline is alarmingly close, that itself is a reason to engage counsel quickly rather than to rush a response yourself.

This is the step people get wrong, and getting it wrong can be worse than the original claim. Before you change a single line of code, preserve the current state of your website: take screenshots, export your tag-manager configuration, save server logs if available, and document your existing consent mechanisms (banner, privacy policy, terms). Note every third-party script currently running.

Equally important: be careful how you communicate internally about the matter. Loose emails speculating about liability can become non-privileged evidence. Keep substantive analysis under the umbrella of counsel where possible, and keep internal chatter factual and minimal.

Do not draft or send a response without advice from a lawyer experienced specifically in California privacy litigation. Your response creates a record that can be used against you, and the analysis here is genuinely fact-intensive. CIPA-experienced counsel can read the specific letter, assess your specific site, and tell you quickly whether the claim is strong, weak, or somewhere in between — and what to say (and not say) to the sender.

If you carry cyber-liability or media-liability insurance, notify your carrier promptly; some policies cover these claims and may have their own notice deadlines and panel-counsel requirements. The IAPP's resources are one starting point for finding qualified privacy counsel if you don't already have a relationship.

Alongside the legal track, establish the facts about what your site was actually doing. The single most important question in almost every CIPA pixel claim is: did the tracking script fire before the user consented? To check, load your site in a fresh browser session with no prior cookies and watch the network requests in developer tools. If the Meta Pixel, a session-replay tool, or a chat widget fires in the first fraction of a second — before any human could have responded to a banner — that's the consent-timing problem at the heart of the claim.

Two facts your audit might surface can be strong defenses, so document them carefully: whether the tool named in the letter was actually running on your site at all (sometimes it wasn't, or was removed months earlier), and exactly when each tag fires relative to the consent interaction. Remember Step 2 — capture this evidence before you remediate.

Despite the confident tone of a demand letter, the issues are rarely clear-cut, and the sender often lacks key facts about your specific technology and site. Courts in the same district have reached opposite conclusions on similar facts. Your counsel will weigh defenses that have succeeded for other defendants, including:

• The "party exception." A line of cases holds that a party to a communication can't "wiretap" it, and that a vendor acting solely as a tool for the website (not using the data for its own purposes) is more like a tape recorder than a third-party eavesdropper.
• Consent. If a properly configured consent mechanism obtained affirmative consent before any tracking fired, that directly answers the core allegation.
• The "in transit" requirement. § 631(a) requires interception of a communication in transit; some courts have dismissed claims that don't meet this threshold.
• Standing. Some courts have dismissed CIPA claims where the plaintiff couldn't show a concrete injury.
• Statute of limitations and whether the named technology was even present during the relevant period.

The unsettled state of the law cuts both ways. It means many claims are genuinely weak — but also that prediction is hard, which is exactly why specialized counsel evaluating your facts is worth far more than any general guide.

With the audit and the legal assessment in hand, you can make an informed decision rather than a fear-driven one. There's no universal right answer; it's a business judgment your counsel will help frame:

If you do settle, counsel should insist on a full release and no admission of liability — and you should still complete Step 7, because a settlement that leaves the technical problem in place simply invites the next letter.

Whether you settle or defend, fix the underlying issue: trackers firing before consent. Settling without remediating leaves you exposed to the next demand. After preserving evidence (Step 2), implement genuine consent gating so that non-essential pixels, analytics, session replay, and chat tools do not execute until the visitor affirmatively consents — and keep verifiable records proving what fired and when for each visitor.

This is the difference between a cosmetic banner and real enforcement. A banner that appears after tracking has already started does not satisfy CIPA's prior-consent requirement; a mechanism that technically prevents tags from firing until consent is received is a meaningful defense. Most deployed banners do not meet that standard without careful configuration — which is precisely the gap the plaintiff firms scan for.

The first-72-hours checklist

Print this or copy it into your incident doc. It's organized in the order you should act. (Reminder: this supports, and does not replace, advice from your own counsel.)

Frequently asked questions