You Installed the Pixel App. You May Own the Compliance Problem.

Agencies buy pixel management apps through Shopify partner accounts and roll them out across dozens of client stores simultaneously. The clients assume the agency handled compliance. The agency assumes the app handles compliance. Nobody installs the CMP. The CIPA demand letter arrives at the client's door — but under California's aiding-and-abetting clause, the agency that deployed the configuration may be in the chain of liability too. Here's the exposure and what to do about it across your entire Shopify portfolio.

Here's the scenario playing out across hundreds of agencies managing Shopify client portfolios right now. The agency buys a pixel management app through their Shopify partner account. They roll it out across their client portfolio — 10, 20, 30 stores — because that's what a good agency does with a useful tool that improves ad performance. The clients are happy. The pixels are firing. The campaigns are running.

What nobody did: install the CMP that gates those pixels behind consent before they fire on California visitors. What nobody told the client: a pixel app and a consent management platform are completely different categories of software, and you need both. What nobody noticed: the plaintiff-side scanners that generate CIPA demand letters are looking for exactly this pattern — a Shopify store with Meta Pixel and TikTok Pixel firing before consent, California visitors, no prior consent mechanism in place.

When the demand letter arrives at the client's address, the first call is to the agency. This article covers what that call looks like, where the agency's specific legal exposure sits, and the portfolio-wide steps that convert this risk into a documented, defensible position — and a new service your agency can offer. Not legal advice throughout; consult qualified counsel for specific situations.

The compliance gap no one owns

The accountability gap in the Shopify pixel ecosystem exists because of how the tools are categorised. Pixel management apps — Trackify, Omega, CAPI-based apps, multi-pixel dashboards — live in the "advertising" or "marketing" category of the Shopify App Store. Consent management platforms live in "privacy" or "compliance." Agencies buy from the first category as a standard part of every client onboarding. The second category is treated as optional, or as something the client handles themselves.

The result is an assumption chain where nobody takes responsibility: the pixel app developer assumes the merchant has a CMP. The merchant assumes the agency handled compliance when they set up the tracking. The agency assumes the app's "Built for Shopify" certification means it's compliant. Shopify's platform provides the Customer Privacy API for pixel apps to integrate with, but doesn't mandate that they do, and doesn't require a CMP as a prerequisite for installing a pixel app.

The CIPA demand letter doesn't care about the assumption chain. It cares about one thing: did the pixel fire before the California-resident visitor consented? If yes — regardless of who is responsible for that configuration gap — there is a viable claim.

How agency CIPA aiding-and-abetting exposure works

Under California Penal Code § 631(a), liability for wiretapping extends beyond the direct interceptor to anyone who "aids, agrees with, employs, or conspires with" another to accomplish an unlawful interception. This is the fourth clause of § 631(a) — the aiding-and-abetting provision — and it is the clause that has been most frequently used to reach website operators who deploy third-party tracking tools without consent. As Debevoise's June 2025 analysis confirms: "Plaintiffs have used CIPA to target both the technology providers and the companies that utilize them."

The question for agencies is whether that liability chain can extend one step further — from the merchant who uses the pixel to the agency that deployed and configured it. The legal analysis is fact-specific, and there is no published case as of writing that has found an agency liable under this theory for a client site's pixel deployment. But the elements of the theory map onto the typical agency engagement clearly:

• The agency installed the pixel app — through the Shopify partner account, with access to the client's admin
• The agency configured the pixel — setting up events, connecting to ad accounts, determining which pages it fires on
• The agency managed the integration — typically the only party with technical understanding of what the pixel does and when
• The agency may have known CIPA applied — especially for agencies that have read any privacy coverage in the past two years
• The agency did not install a consent gate — and did not inform the client that one was needed

The aiding-and-abetting theory requires knowledge and purpose. An agency that deployed an unconsented pixel configuration knowing CIPA existed and knowing consent was expected is in a different position than one that genuinely had no awareness of the legal landscape. That said, "I didn't know CIPA applied to Shopify" is becoming an increasingly hard argument to make in 2026 — the litigation wave is widely covered, the demand letters are arriving in volume, and any agency managing Shopify stores for clients with California traffic is expected to be aware of the legal environment in which those stores operate.

The client conversation when a demand letter arrives

When a client receives a CIPA demand letter, the immediate practical issue for the agency is usually the client's first question: "You set all this up — why is it creating legal problems?" That question arrives before any lawsuit is filed, in an emotionally charged context where the client is looking at a letter demanding $25,000–$75,000 and doesn't fully understand why.

The agencies that handle this call well are the ones that have answers ready — and ideally, the answers are "here's what we changed six months ago and here's the documentation showing your site was consent-gated before this claim." The agencies that handle it poorly are the ones who haven't done the audit and have to scramble to figure out what was actually running, when, and whether a consent mechanism was in place.

The practical steps when a client receives a demand letter:

1. Preserve everything first. Before changing any site configuration, capture the current state — screenshot every page with DevTools network tab open, export the pixel app configuration, document what's running. Changing the configuration before preserving evidence is a spoliation risk.
2. Do not respond directly to the demand. CIPA demand letters have specific response windows. Anything said in response is on the record. Refer the client to CIPA-experienced counsel immediately.
3. Gather your agency's documentation. When did the pixel app get installed? Was there any CMP in place at the time? Did the agency brief the client on CIPA consent requirements? Written documentation of any compliance conversations you had with the client becomes important.
4. Implement the consent gate — after preserving evidence. Once the current state is documented, implement a CMP across the affected store. This doesn't undo historical exposure but demonstrates current remediation.

Why Briskin v. Shopify makes every client store in scope

The Ninth Circuit's en banc ruling in Briskin v. Shopify, Inc. (April 2025) eliminated the "differential targeting" requirement for CIPA jurisdiction. Under prior precedent, a defendant had to specifically target California for California courts to have jurisdiction. After Briskin, collecting data from California residents as part of normal platform operations — which any Shopify store does — is sufficient. There's no geographic shield for out-of-state merchants.

For agencies, this means that "my client isn't in California" is no longer a reason to deprioritise consent compliance on their Shopify store. Every client store accessible to California residents — which is every client store on the open internet — is in scope for CIPA after Briskin. An agency managing 25 Shopify stores for clients in London, Sydney, Toronto, and Dallas has 25 stores with California CIPA exposure if pixels are firing before consent on any of them.

What pixel apps don't do that you think they do

The specific false assumptions that create the gap:

"The pixel app integrates with Shopify's Customer Privacy API, so consent is handled."

Some pixel apps integrate with Shopify's Customer Privacy API and check for consent before firing. Many don't, or implement it incorrectly. And even for apps that do integrate correctly, the API only has a consent state to read if a CMP has written one. Without a CMP generating a genuine visitor consent event, the Customer Privacy API may default to "allow all processing" — the pixel fires regardless. The API is a pipe, not a gate. Something must fill it with real consent data.

"The Shopify store has a cookie banner, so it's covered."

Shopify's built-in cookie banner activates by default only for UK and EEA visitors. California visitors get no banner unless you've specifically configured it to appear for US regions. And even when configured, the Shopify banner requires individual pixel apps to respect it — which depends on their Customer Privacy API integration. A banner that displays but doesn't technically block a pixel that isn't integrated with the API doesn't satisfy CIPA's prior-consent standard. As Kukie.io's March 2026 compliance guide confirmed: "Shopify's default banner only activates for UK and EEA visitors. Every other region requires either a third-party CMP or a custom implementation using the Customer Privacy API."

"CAPI (server-side) means we don't have browser-side pixel exposure."

Conversions API (CAPI) is a server-side alternative to browser pixels that sends event data from your server to Meta, Google, or TikTok rather than from the visitor's browser. It's meaningfully better for both data accuracy and privacy — but it doesn't automatically eliminate browser-side pixel exposure. Many agencies run CAPI alongside browser pixels ("redundant tracking"), and the browser pixel still fires before consent even when CAPI is the primary signal. If your pixel management app is running browser-side pixels alongside CAPI, the browser-side pixels still need consent gating.

The portfolio audit: finding your highest-risk client stores

The immediate practical step for any agency managing Shopify clients is a portfolio-level audit. This doesn't require sophisticated tools — it requires systematically running the network tab test on each client store and documenting what you find.

Any client store scoring "High risk" on three or more factors should be the immediate priority for CMP implementation. Any store with Advanced Matching enabled and pixels firing on checkout pages without consent is your most urgent remediation target — that specific combination generates the largest demand amounts.

The compliance service opportunity agencies are missing

Per-client Shopify compliance checklist

Frequently asked questions