Texas AG Calls CIPA Demand Letters a Scam. Does That Protect Texas Businesses?

What Did the Texas Attorney General Say?

The consumer alert describes a surge in letters sent to Texas businesses and nonprofits. The letters claim that common website technologies, including cookies, pixels, analytics tools, and search bars, amount to unlawful wiretapping under CIPA, and they demand payment to avoid a lawsuit. Many include screenshots of the recipient's website and a draft complaint.

The alert names one sender. It points out that Vivek Shah, a serial CIPA plaintiff, has been declared a vexatious litigant and cannot file new CIPA claims in the Central District of California without a judge's permission. It recommends consulting experienced privacy counsel before responding, reviewing the website's tracking technologies with counsel, and monitoring developments in privacy law. Suspected fraud can be reported to the Consumer Protection Division.

Paxton's statement was direct. "My office will do everything we can to protect Texans from fraudulent demands and other scams."

How Much Influence Does Texas Have Over CIPA Claims?

Less than the announcement implies. CIPA is a California statute, and it is enforced by private plaintiffs in California courts and, increasingly, in arbitration. The claim belongs to the website visitor, who is usually a California resident, and not to the state where the business is located. A Texas official has no authority over that visitor, that court, or that arbitrator.

Based on the Texas Attorney General's alert of September 17, 2026.

For a Texas company, the more relevant question is whether a California court has jurisdiction over it. That defense has weakened. In Briskin v. Shopify, decided in April 2025, the full Ninth Circuit held 10 to 1 that an out-of-state company could be sued in California over cookies placed on a California resident's device. The court also set aside the older requirement that the company specifically target California. Jurisdiction is still worth raising with counsel, but it can no longer be assumed to end the matter.

It is also worth noting why these letters cite California law at all. Texas is a one-party consent state for wiretapping, and the Texas Data Privacy and Security Act does not give individuals a right to sue. The plaintiffs are relying on the statute that provides statutory damages, and it follows the visitor rather than the business.

Is "Scam" the Right Word?

Partly. There are scam-like aspects to the CIPA demand letter business. Many of the letters appear to be mass-produced, in some cases with the help of AI, and the testing behind them is often poor. It is common to see claims that do not match what the website does. The senders also tend to describe themselves as privacy advocates, which is difficult to take seriously when the same letter is sent in volume with a settlement figure attached.

A scam, however, implies that there is nothing behind the demand and no risk in ignoring it. That is not the case here. The letters rest on a real statute and on real case law. Courts have split on whether common tracking tools violate CIPA, and some of these claims have survived motions to dismiss.

A business that ignores a letter may find that the next document is a complaint or an arbitration demand. The alert itself does not tell anyone to ignore a letter. It tells them to consult counsel, which is the correct instruction.

The more accurate description is that a wiretapping law from 1967 is being applied to technology it was never written for, and that CIPA needs to be updated to stop this from happening. California has started. SB 690, which Governor Newsom signed on September 30, 2026, ends private lawsuits under CIPA's pen register provision for website tracking and leaves that enforcement to the California Attorney General, starting January 1, 2027. It does not touch the wiretapping provision, Section 631, which many demand letters also cite. That change was made in California, which is the only place it can be made.

California is not alone in this. Florida, Pennsylvania, and other states have wiretapping statutes with private rights of action, and plaintiffs have brought similar website tracking claims under them with mixed results. A fix to CIPA would not reach those statutes either.

What Could Texas Do Next?

Texas may have a model for this. In 2015 the legislature prohibited bad faith patent demand letters sent to Texas businesses and gave the Attorney General the power to seek injunctions and civil penalties of up to $50,000 per violation. In theory, a similar statute for privacy demand letters could give the office authority over abusive letters sent into Texas. I have not seen such a bill, and I do not know whether one is being considered or whether it would even be possible. Even if one passed, it would not change whether a Texas company is liable under California law.

What Should a Texas Business Do With a Letter?

The alert's advice is sound, and I would add one point to it. The outcome of a CIPA claim depends on what the website does before and after a visitor makes a privacy choice, and on whether the privacy notice describes it accurately. That is true whether the sender is a serial litigant or an established plaintiff's firm, and it is true in Texas as much as anywhere else. A business that knows those facts is in a position to respond. A business that does not is poorly positioned to respond, regardless of how the letter is characterized.