Website tracking lawsuits, explained for the person who has to deal with one
If a demand letter arrived this week, start at the first seven days. If you are trying to understand why everyone is suddenly talking about this, start here.
What is happening
The companies receiving demand letters already have cookie banners. That is the point. The dominant claim is that the banner itself is the misrepresentation: somebody clicks Reject All, the pixels carry on firing, and the site did the opposite of what it said.
That gets pled as a wiretapping claim under the California Invasion of Privacy Act (CIPA), California Penal Code section 631, often with common-law fraud attached.
None of this is a knock on any consent platform. The tools do what they say. The gap is between deployed and working, and that gap is configuration.
What is not on this page yet
The filing volumes, the named matters and the plain reading of section 631 belong here, and every one of them needs a citation and a review date before it goes up. We would rather this page were short than have it be the kind of page it is warning you about.
What is above is what we can state without one. If you are dealing with a letter now, your counsel is the right reader for the rest of this page.
If you received a letter: the first seven days
- 1 Your counsel leads. The letter is a legal matter and every decision about responding to it belongs to your lawyer. If you do not have privacy counsel, your general counsel or your usual firm is the right first call, and this page is written so you can forward it to them.
- 2 Do not change your site yet. What your site does, and when it changed, may matter to your counsel. Let them tell you when the fix should happen, not the other way round.
- 3 Find out what is actually firing. Run the Consent Signal Checker on your own site. It runs locally and we never see the results. If counsel wants a full picture rather than a browser check, they can commission the OneTrust Audit directly, so the findings arrive through them. Run the Consent Signal Checkerthe OneTrust Audit
- 4 When counsel says fix it, the fix is fast. Cookie Consent is a fixed-price package, live two weeks from design approval, built in staging with test results shown before anything ships, and a confirmatory test after go-live. You get dated evidence of what changed and what was tested.
What we do, and what stays with your counsel
We do the technical work: the configuration, the testing, and the evidence of what changed. Your counsel owns every legal position: how to respond to the letter, what the claim is worth, whether the fix changes anything about it, and every strategic call. We will never tell you a configuration change makes a claim go away, and you should not trust anyone who does.
Common questions
Does fixing the banner make the claim go away?
That is your counsel’s question, and we do not answer it. What we provide is a configuration that does what the banner says, and dated evidence of the change and the testing.
We have not received a letter. Should we do anything?
Check your banner. It takes two minutes, runs locally, and we never see the results. Check your banner.
What does this cost?
What a claim is worth is your counsel’s territory, and we do not have a view we would ask you to rely on. Our fix is a fixed price. see the package.