A letter shows up from a law firm you’ve never heard of. It says your website “wiretapped” a visitor, cites a California law from 1967, and offers to make it go away for a few thousand dollars. Your website is a five-page brochure for a plumbing company or a hair salon. What happened?
This is happening to businesses of every size across California, and it’s the reason you keep hearing that you “need a cookie banner.” The truth is a little more specific than that, and the fix is not just slapping a pop-up on your site.
What these lawsuits are actually about
The lawsuits are mostly filed under the California Invasion of Privacy Act (CIPA), a law written to stop phone wiretapping. Plaintiffs’ lawyers argue that common website tools do the modern equivalent: they send what a visitor does on your site to a third party (Google, Facebook/Meta, a chat vendor, an ad network) without the visitor agreeing to it.
The tools that get named in these cases are ordinary ones:
- Google Analytics and Google Ads tags
- The Meta (Facebook) Pixel
- Chat widgets that send conversations to an outside company
- “Session replay” tools that record mouse movements and clicks
- Ad and marketing scripts added by plugins, page builders or a past web designer
Why it’s worth a lawyer’s time: the law allows statutory damages of $5,000 per violation, with no proof that anyone was actually harmed, and plaintiffs argue every visit counts as a separate violation. Most of these never reach a courtroom. They end as demand letters priced just low enough that paying feels cheaper than fighting.
“But I’m a small local business”
That’s the part that catches people off guard. California’s big consumer privacy law, the CCPA, mostly applies to companies with more than about $25 million in annual revenue, so most Humboldt County businesses are outside it. CIPA has no size threshold. If your site runs a tracker and a Californian visits it, you can get a letter.
Why a cookie banner alone doesn’t fix it
Here’s the inconvenient part. Many sites already have a banner that says “This site uses cookies” with an OK button. On a lot of those sites, the tracking scripts load the moment the page opens, before anyone clicks anything. The banner is just a notice sitting on top of tracking that has already happened.
Attorneys who defend these cases put it plainly: a banner shown after tracking has begun is disclosure, not consent. What actually protects you is a consent setup that blocks trackers until the visitor says yes, and a privacy policy that matches what your site really does.
Didn’t California just change the law?
Partly. Governor Newsom signed SB 690 on September 30, 2026. Starting January 1, 2027, private plaintiffs can no longer sue over one type of claim, the “pen register / trap and trace” theory, for things that happen on a website or app. Only the state Attorney General can bring those. That theory had become the most common one, so this is real relief.
It is not a free pass:
- The tracking itself is still covered by the law. SB 690 changed who can enforce that one section, not whether it applies.
- The wiretapping and eavesdropping sections of CIPA, which are the ones used against chat widgets and session replay, are untouched. Private lawsuits under those are still allowed.
- Demand letters already sent are not covered by the change.
- The Governor’s signing message called for more CIPA reform in 2027, so the rules are still moving.
What to do about it
- Find out what your site actually runs. Not what you think it runs. Old pixels from an ad campaign you stopped years ago, a plugin’s built-in analytics, a chat tool someone installed and forgot. These are usually invisible to the owner.
- Remove what you don’t use. The safest tracker is the one that isn’t there. If nobody looks at the data, take it off.
- Block the rest until consent. Use a consent tool that actually holds back Google, Meta and similar scripts until the visitor agrees, not just one that shows a message.
- Make your privacy policy match reality. A policy copied from a template that doesn’t mention the tools you use can work against you.
- If you get a letter, don’t pay it on reflex. Talk to an attorney. Many claims depend on exactly how your site was set up, and that’s worth checking before you write a check.
We’ll check your site for free
HumWebit builds and maintains websites for businesses across Humboldt County, and we’ve been looking at exactly this on local sites. We’ll tell you what trackers your website loads, whether they fire before a visitor agrees, and whether your privacy policy lines up, in plain language and with no obligation.
Call (707) 854-3369 for a free website check.
This article is general information, not legal advice. HumWebit is a web design and IT company, not a law firm. If you’ve received a demand letter or lawsuit, contact an attorney.