Free 15-second scan. We load your site like a first-time U.S. visitor — without touching your cookie banner — and show every pixel and tracker that fires.
No signup needed. Home page scan, about 15 seconds.
In recent years, plaintiff law firms have sent a wave of demand letters and filed lawsuits against businesses under the California Invasion of Privacy Act (CIPA). The typical claim is simple: the website sent visitor data to Meta, Google, TikTok, a chat vendor or a session-recording tool before the visitor agreed to it. The plaintiff doesn't need to prove any actual harm — the law sets a fixed amount per violation.
Claims that a third party (e.g. a chat vendor, session-replay tool or ad pixel) "listened in" on a visitor's communication with your site without consent. Private lawsuits are still allowed.
Lets a person sue for $5,000 per violation or three times actual damages, whichever is greater. No proof of actual harm is required.
Claims that trackers capturing IP addresses act as a "pen register." SB 690, signed September 30, 2026, provides that from January 1, 2027 only the California Attorney General — not private plaintiffs — can bring these claims over website or app tracking. Wiretapping claims are not affected.
Similar claims are brought under Pennsylvania's wiretap law (WESCA) — especially for session replay — and under the federal Video Privacy Protection Act (VPPA) when pages with video share viewing data through a pixel.
| Case | What was alleged | Outcome |
|---|---|---|
| Sutter Health California, 2026 | Google Analytics and Meta Pixel on its websites sent patient browsing data to third parties. | $21.5 million class settlement (no admission of wrongdoing). |
| Los Angeles Times California, 2026 | Website trackers acted as a "pen register" under CIPA. | $3.85 million settlement reported (approved June 2026). |
| Popa v. Harriet Carter Gifts 3rd Circuit, 2022 | Session-replay software on an online store recorded visitors' activity. | Court allowed the wiretapping claim to proceed, triggering a wave of session-replay suits. |
| VPPA "Meta Pixel" cases Federal courts, 2025–2026 | Pixels shared which videos a visitor watched, linked to their Facebook ID. | Courts are split; the U.S. Supreme Court agreed to review a related case. |
Pre-lawsuit settlement demands are commonly reported in the $10,000 – $40,000 range, usually with a 20–30 day deadline.
Defending a case in court has been reported to cost well over $100,000 in legal fees — even when the business wins.
Statutory damages multiply per visitor. Reported website-tracking class settlements range from about $1 million to over $20 million.
Time lost, emergency developer fees, insurance deductibles, and the reputational hit of a public privacy lawsuit.
Figures are ranges reported by law firms and industry sources; actual outcomes vary widely. This is general information, not legal advice.
We review every tracker your site loads and how it's installed.
We install and configure a consent manager that fits your platform.
Pixels, chat and replay tools wait until the visitor accepts. Google Consent Mode is set up.
We re-scan your site and send you a before/after report.
We reduce the most common technical risk. We are not a law firm and cannot guarantee you won't receive a claim.
No. This is a technical scan and a technical fix. It is not legal advice and not a guarantee against claims or lawsuits. If you received a demand letter, talk to a licensed attorney.
Partly. SB 690 removes private lawsuits for one theory ("pen register" claims over website tracking) starting January 1, 2027. Wiretapping claims under CIPA § 631 — the ones usually aimed at chat widgets, session replay and ad pixels — are still allowed, and other states have similar laws.
Not necessarily. Many sites show a banner (or have one installed but hidden for U.S. visitors) while pixels fire anyway in the background. What matters is what loads before the visitor says yes — that's exactly what the scan checks.
Network requests and cookies created during the first seconds of a fresh visit to your home page, compared against a list of 50+ advertising, analytics, chat, session-replay and visitor-identification tools. We also check whether a consent banner appears.
Yes. It's automated and checks only the home page from one location. Some tools load later or only on other pages. Use it as a first check, not a final verdict.
We use the address you enter to run the scan and may keep the result briefly so repeated scans are fast. We don't use any trackers or analytics cookies on this site.