Received a CIPA Demand Letter? What to Do Before You Respond

What Does a CIPA Demand Letter Claim?

Many CIPA demand letters allege that the tracking tools on the recipient's website violated the California Invasion of Privacy Act. One common theory is wiretapping under Section 631(a), which covers the contents of communications. Another is Section 638.51, the pen register provision, which covers IP addresses and other device details.

Starting January 1, 2027, a new law, SB 690, allows only California's Attorney General to bring pen register claims over website tracking, including in pending lawsuits filed since 2025. It does not affect Section 631(a) wiretapping claims.

Letters often cite CIPA's statutory damages of $5,000 per violation and propose a confidential settlement to avoid a lawsuit or arbitration. As the Texas Attorney General noted in September 2026, many also include screenshots of the recipient's website and a draft complaint.

Senders tend to count on a fast payment, so the first step is to slow down and to avoid making rushed decisions. The letter should go to privacy litigation counsel, ideally attorneys who know both the CIPA case law and the technology involved.

What Should Be Preserved Before the Website Changes?

A CIPA claim depends on what the website did on the dates in the letter. The instinct is often to fix the website right away. However, changing a tag, a consent category, or the banner before recording the earlier setup can erase the record of what visitors saw. Remediation is usually appropriate, but it should come after the record is preserved.

A useful record includes the consent logs for the period the letter describes, dated copies of each version of the banner and the privacy notice, and the change histories of the consent platform and the tag manager. Some of these histories may sit with agencies or vendors, so the business may need to request copies.

One risk to preservation is the fact that routine deletion tasks may be active in the background. Several consent platforms delete log entries after about 12 months by default, which is close to the one-year limit that defendants often argue applies to CIPA claims. Whether to suspend any log deletion in response to a demand letter is a question to raise with counsel right away.

The letter itself may help with documentation. Screenshots or network recordings attached to it sometimes show the consent cookie from the claimant's browser. Matching that cookie's identifier to the consent log can show what the claimant chose and when.

What Makes a CIPA Claim Strong or Weak?

Once the record is preserved, a few questions tend to determine how strong a claim is:

• Was the data captured in transit? Section 631(a) of the statute covers communications read "while the same is in transit," meaning on their way between the visitor and the website. Data that a vendor pulled from storage later may not count as an interception.
• Which theory does the letter rely on? Claims about search terms, form entries, and other contents of communications rely on Section 631(a), which SB 690 does not change. A claim that relies only on the pen register provision likely carries less weight, because only the Attorney General can bring that claim over website tracking starting in 2027.
• When was consent given? In Javier v. Assurance IQ, the Ninth Circuit held that consent under CIPA must exist before recording begins. The question is whether each tool ran before or after the visitor's choice.
• What can the vendors do with the data? Contracts that limit vendors to processing data on the website's behalf may support treating them as an extension of the website, which cannot eavesdrop on its own conversations. However, some courts ask only whether a vendor was capable of using the information for its own purposes.
• Was anyone harmed? Some claims trace back to a claimant's own test rather than an ordinary visit. At least one court has dismissed such a claim for lack of standing, because the search terms revealed nothing private about the claimant.

What Mistakes Are Common?

Businesses often make avoidable mistakes in the first few days after a letter arrives. Some settle quickly without understanding the claim. Others reply to the sender directly, before counsel is involved. A well-intentioned email from marketing or IT can read as an admission of fault.

Insurance is also easy to overlook. Cyber liability policies sometimes cover CIPA claims through their privacy or media liability coverage. However, many insurers have added exclusions for the wrongful collection of data, which can apply to tracking claims. Some policies pay only defense costs, or cap these claims below the full policy limit.

Cyber policies tend to require prompt notice of a claim. A demand letter may count as one, so the policy terms are worth reviewing early with counsel and the broker.

What Does This Mean for Businesses?

A business can respond to a letter in several ways, including contesting the claim, fixing the website and responding, negotiating, arbitrating, or reporting the claim to its insurer. The optimal path depends on the strength of the claim, the business's resources, and how much risk it is willing to accept. It is a decision to make with privacy litigation counsel.

These claims tend to be weakest when the claimant's only visit was a test, the privacy notice was accurate, and the consent tools did what the banner described. They are hardest to defend when banners record choices that websites do not follow. Before deciding how to respond, I recommend confirming what the website sent on the dates in the letter and whether its consent tools honored visitors' choices.