CIPA Demand Letter: What to Do First and Which Records to Gather for Your Lawyer

The Texas Attorney General described the letters in a consumer alert on 17 September 2026. They allege violations of the California Invasion of Privacy Act 'based on the use of common website technologies such as cookies, pixels, analytics tools, and search bars'. Senders may claim the tools are unlawful wiretapping and demand immediate payment to avoid litigation. The alert adds that letters may include screenshots of the recipient's website and a draft complaint.

The letters go well beyond California. The Texas alert was issued because Texas businesses and nonprofits were receiving them. The alert is addressed to businesses and to nonprofit organizations alike.

There is no count of how many letters are sent. ConsentStack, a consent-software vendor that tracks the lawsuits, found no figure for letters and notes that the sponsor of California's reform bill spoke of tens of thousands.

Section 631 covers a person who 'willfully and without the consent of all parties to the communication' reads or attempts to learn the contents of a communication while it is in transit, and anyone who aids that. Letters use it where a tool captured what a visitor typed or did.

Section 638.51 says a person may not install or use a pen register or a trap and trace device without a court order. Section 638.50 defines those as devices or processes that record or capture dialing, routing, addressing or signaling information, but not the contents of a communication. Letters argue that an advertising or analytics tag fits that definition because it collects address information about a visit.

Section 637.2 supplies the money. It allows a person injured by a violation to sue for the greater of $5,000 per violation or three times actual damages, and says the plaintiff need not have suffered actual damages. ConsentStack read 58 federal complaints filed from April to June 2025 and found section 631 in 69%, section 638.51 in 53% and the federal Wiretap Act in 64%. Those are one vendor's figures for one sample of lawsuits. Letters may differ.

Which section the letter cites matters a great deal after the 2026 reform, and that is one reason the letter needs a lawyer's reading.

The Texas Attorney General's alert lists steps for recipients. Consult legal counsel experienced in privacy and website-tracking litigation before taking action. With counsel's assistance, review the site's use of pixels, cookies, analytics tools and similar technologies. Report a letter believed to be fraudulent, abusive or deceptive to the Consumer Protection Division. Those steps are addressed to Texas businesses. A recipient elsewhere can check whether its own Attorney General has said anything similar.

The steps below are administrative. They do not involve contacting the sender.

• Write down the date the letter arrived and how: post, courier, email or a web form. Keep the envelope and every attachment.
• Note the deadline in the letter and put it in a calendar that more than one person sees.
• Do not reply, call or pay. Tell staff who might be contacted not to discuss it.
• Tell whoever manages the website and tags not to change or remove anything until the current state has been recorded.
• Check whether you hold a cyber or media liability policy and read its notice clause, so that your lawyer or broker can tell you whether the letter has to be reported.
• Send the letter and attachments to a lawyer who handles privacy litigation. If you have none, a state bar referral service is one place to start.

A lawyer cannot assess the letter from the letter alone. The claims are about what software on the site did on a particular date to a particular visitor. Most of that evidence is in your systems and your vendors' systems.

The table lists the records and where they usually live. Gather copies. Do not edit the originals.

The natural reaction to a letter is to strip every tag off the site that afternoon. The problem is that the removed configuration is the record of what was actually running. Without it you may be unable to show that a tag named in the letter was never installed, or that it loaded only after consent.

Federal Rule of Civil Procedure 37(e) deals with electronically stored information 'that should have been preserved in the anticipation or conduct of litigation' and is lost because a party failed to take reasonable steps to preserve it. Where another party is prejudiced, a court may order measures to cure the prejudice. Where a party acted with intent to deprive another of the information, the rule allows a court to presume the lost information was unfavorable. That is a federal rule. State courts have their own. When the duty starts in your situation is a question for your lawyer.

The practical order is to record first and change second. Export the tag manager container. Save the consent tool settings. Capture the network requests on the main pages with a dated screen recording or an archive file. Then ask counsel what to change and when. Suspending log rotation for the relevant systems is part of the same step.

WilmerHale reports that Governor Newsom signed SB 690 on 30 September 2026. The bill removes the private right of action under section 637.2 for alleged violations of section 638.51 arising from conduct on websites, online applications and mobile applications. The Attorney General can still enforce that section. WilmerHale adds that the bill does not legalize the underlying use of pen registers.

Privacy World gives the operative date as 1 January 2027 and reads the retroactive clause, which covers pending claims in actions started within two years before that date, as reaching cases filed on or after 1 January 2025. The same article expects plaintiffs to challenge that reach. The research behind this article could not open the legislature's own bill page, so these points rest on the two law-firm summaries.

The result is that two letters that look alike can stand in different positions. One that cites only section 638.51 is aimed at a claim the legislature has moved to the Attorney General. One that cites section 631 or the federal Wiretap Act is not touched by the bill, according to WilmerHale. Sorting a letter into those categories, and judging what the retroactive clause means for a claim made before 2027, is legal analysis.

The Texas alert is titled as a warning about scam demand letters. It says letters of this type 'may exaggerate or misrepresent a potential violation of law'. It names one serial sender, Vivek Shah, and notes that a federal court has declared him a vexatious litigant.

Duane Morris reports the detail of that order. On 20 July 2026 Judge R. Gary Klausner of the Central District of California, in Shah v. Crain Communications, required Shah to obtain leave of court before filing any new privacy case of this kind in that district, after reviewing at least 29 proceedings he had started since 2021. The order applies in that one federal district. It does not cover other districts or California state court, and it does not stop letters.

Other letters come from law firms that do file. ConsentStack reports that a law-firm litigation map counted 1,556 California filings in 2025, while its own search of California federal dockets found 402. The two counts use different scopes. Either way, some senders sue. Whether a particular sender is likely to is something an experienced lawyer may know from other matters, and it is one more thing the letter alone will not tell you.

The questions a lawyer works through show why the records matter. Did the sender visit the site at all, and from where? Which tags loaded on that visit, and before or after any consent choice? Did any tool capture the contents of what the visitor typed? What did the policy and terms say that day? Does the claim rest on a section affected by SB 690? Each answer comes from the file you assemble.

Costs are reported only by people who sell the service. One lawyer-publisher, terms.law, advertised a fixed-fee response package starting at $2,500 in an article dated October 2025 and described demands in the low to mid five figures with deadlines of 10 to 20 days. Captain Compliance, a consent vendor, described a letter to an online store that demanded $70,000 and gave 30 days. These are single examples from interested sources. They are not typical figures.

This article does not suggest what the response should say, whether to dispute, negotiate or ignore, or what a claim is worth. Those choices depend on facts and law that differ by letter, and they belong to you and your lawyer.

A letter is a reason to learn what the site actually sends. Many owners have never looked. The Texas alert's second step is to review the site's use of pixels, cookies and analytics with the assistance of counsel.

The review has two parts. The first is an inventory: every tag, who put it there and what it is for. The second is a behavior test: what loads before any choice, what loads after a visitor rejects or opts out, and what loads when the browser sends an opt-out signal. Keep the dated results. A record that tags stopped on a given date after an opt-out is a fact about that date. It says nothing about an earlier visit, and it does not answer a claim by itself.