The State of Web Privacy: What 200 Insurance Claims Reveal About CIPA Demand Letters and Wrongful Collection

In one of the demands described in Coalition’s State of Web Privacy report, the claimant sought $5,000 in statutory damages for each third-party vendor installed on the target’s website. The site loaded at least 56 vendors. The arithmetic produced a demand of $280,000, and it was built on nothing more than a single page load. No judge had ruled on anything, no discovery had been taken, and no complaint had been filed. That is what pre-litigation leverage looks like in the web privacy economy, and it explains why a templated letter can be a rational business move for a plaintiff’s firm and an expensive problem for the company that receives it.

Coalition is a cyber insurer, and its report is useful precisely because of where its data comes from. Instead of tallying headlines, it analyzed nearly 200 data privacy claims that policyholders reported to the company and paired that claims analysis with external scans of 5,000 businesses, covering roughly 6,300 websites. The result is a rare look at both sides of the equation: what plaintiffs are alleging, and what businesses are actually running on their sites.

This guide walks through the report in depth. We recreate its key figures as original charts, explain what each finding means for a privacy, legal or marketing team, update the legal picture with developments since the data was collected (most importantly California’s SB 690, which Governor Newsom signed on September 30, 2026), and finish with a practical program for reducing your exposure. If you only have a few minutes, read the takeaways section and the seven-step program near the end.

How to Read This Report and This Article

Coalition’s report covers claim notifications received from January 2023 through July 2025, along with website scans run through its Active Data Graph. The charts in this article are our own recreations of the report’s figures. Where the report printed a chart without labeled values for every bar, we chart only the values the report states in its text and group the remainder, so nothing here is an estimate read off a graphic.

Three cautions apply before you draw conclusions from any single number.

• Allegations are not findings. The claims in the dataset are notifications of what claimants alleged. Coalition’s analysis does not extend to coverage decisions, legal outcomes, settlement amounts or any determination of fault. A claim naming a technology tells you what plaintiffs target, not what courts have held unlawful.
• The population is not the whole market. The policyholders are mostly in North America and Europe, with the majority in the United States, and Coalition has historically sold to small businesses. That partly explains why so many claims involve smaller companies, and why the claims lean heavily toward US statutes. Coalition itself notes that, adjusted for the number of customers each business has, larger organizations are more likely to face an allegation.
• The data is dated. The claims run through July 2025, and this article is published in October 2026. The legal environment has moved, so we flag the changes that matter where they apply.

Where figures differ between sections of the report (for example, the share of claims brought by the four most active firms appears as 72 percent in most places and as almost 75 percent in one), we use the more specific number.

The Ten Findings That Matter Most

• Web activity drives the category. 77 percent of wrongful collection claims Coalition received arose from activity on websites.
• Old laws do the heavy lifting. Nearly three-fourths of web privacy claims alleged violations of the California Invasion of Privacy Act (CIPA), a 1967 statute. Only a handful cited modern privacy laws.
• Four firms generate most of the volume. Four plaintiff firms represented the claimants in 72 percent of web privacy claims, typically using templated demand letters.
• Small and midsize businesses are squarely in range. 59 percent of claims came from businesses with under $100 million in revenue.
• Analytics tooling is the center of gravity. 73 percent of claims alleged misuse of analytics technologies, 34 percent alleged improper sharing with third-party vendors, and 5 percent targeted chatbots.
• The Meta Pixel is the lightning rod. It was cited in 43 percent of web privacy claims, even though it appeared on only 19 percent of the scanned websites that run any tracker.
• Statutory damages multiply. Plaintiffs frame each third-party data transfer as a separate violation, which is how one demand reached $280,000 on a single page load.
• Disclosure is thin. Only 29 percent of scanned privacy policies named the specific tracking technologies in use, while half used a generic tracking statement.
• Consent banners are concentrated at the top. 19 percent of websites showed a consent banner overall, but 61 percent of the highest-traffic sites did.
• The recommended answer is continuous, not annual. Coalition’s central argument is that web privacy risk should be monitored the way security risk is, because exposure shifts with new tools, new rulings and new marketing campaigns.

1. What “Wrongful Collection” Actually Means

The insurance industry first used the phrase “wrongful collection” for claims involving the gathering of biometric data without proper consent. Over time it has grown into a catch-all for privacy rights litigation in which the complaint is not that criminals stole data but that the business gathered, used or shared it in a way the law does not allow.

Coalition offers four illustrations that show how broad the category is. A business may be entitled to collect an IP address but not to pass it to a third party. It may be entitled to store a phone number but not to send an unsolicited text message at night. It may owe a customer deletion of data it collected earlier. Or it may have shared data with a third party on purpose and later learn that the sharing was a mistake.

That framing matters because it changes the question a business asks itself. A security program asks whether the data is protected. A wrongful collection analysis asks whether the data should have been collected, shared or retained at all, and whether the person on the other end was told and, where required, agreed.

The data shows where the action is. Of the wrongful collection claims reported to Coalition, 77 percent began with user activity on a website, which the report calls web privacy claims. Another 7 percent involved unlawful telephone advertising, 3 percent involved mobile apps or software-as-a-service platforms, and the remaining 14 percent defied easy categorization. The outliers are instructive. They include a mental health assessment that was shared with a parole officer and a technician who accessed personal photos on a customer’s phone. These are reminders that wrongful collection is not only a marketing technology problem, even if marketing technology dominates the numbers.

Why do web claims dominate? Because almost every business has a website, almost every website runs third-party code, and almost every visitor interaction produces data. Unlike the early biometric disputes, which concerned a narrow group of companies using facial recognition or fingerprint scanning, web privacy claims reach retailers, hotels, software companies, hospitals and nonprofits alike. The pool of potential targets is effectively every organization with a domain name.

Two practical consequences follow. First, your cyber insurance program, your privacy program and your marketing operations are now connected in a way they were not five years ago. A tag added by a campaign manager on a Tuesday can become a claim notification months later. Second, you should find out how your own policy treats these claims. Some policies cover privacy regulatory and wrongful collection losses broadly, some sublimit them, and some exclude them, so the answer should be confirmed with your broker before a demand letter arrives rather than after.

2. A Short History: From Biometrics to Pixels to Small Businesses

Wrongful collection claims entered the mainstream in the late 2010s through lawsuits over biometric data. The settlements were large enough to change the economics of privacy litigation. The report cites Facebook’s $650 million settlement in 2020 over Illinois’ Biometric Information Privacy Act (BIPA), TikTok’s $92 million BIPA settlement in 2021 and Google’s $100 million BIPA settlement in 2022.

Those results had two lasting effects. Illinois lawmakers moved to curb BIPA damages, but the cases also showed class-action firms that privacy statutes could produce eight- and nine-figure outcomes. Litigation soon spread beyond biometrics. Plaintiffs alleged that healthcare providers had shared patient information with Meta through its tracking pixel, and the settlements that followed included Advocate Aurora Health at $12.25 million in 2023 and Mass General Brigham at $18.4 million in 2022. Media companies were targeted under the Video Privacy Protection Act (VPPA), a 1988 statute, with plaintiffs alleging that video-viewing histories and other data were shared through tracking technologies. Hulu and The Boston Globe were among the businesses sued.

Phase	Typical theory	Illustrative outcomes cited by Coalition	Who was targeted
Late 2010s	Collection of biometric data without proper consent	Facebook $650M (2020), TikTok $92M (2021), Google $100M (2022)	Large technology companies
Early 2020s	Tracking pixels sharing patient or viewer data; VPPA	Mass General Brigham $18.4M (2022), Advocate Aurora $12.25M (2023)	Hospital systems and media companies
2023 onward	Templated demands alleging wiretap, pen register and similar theories over everyday website tools	Pre-suit and arbitration settlements at modest amounts, at high volume	Small and midsize businesses in nearly every sector

The third phase is the one that should keep operators up at night. After collecting large settlements from big targets, plaintiff firms began replicating the playbook at scale. Instead of litigating each case through court or arbitration, they send near-identical demand letters to hundreds or thousands of businesses and aim for a moderate settlement from each. The strategy lowers the firm’s cost per matter and raises the number of targets it can pursue at once.

The technologies named in these letters are not exotic. They are embedded in routine business processes, supplied by well-known technology companies and installed on millions of websites. In effect, the same legal theories that were once reserved for Silicon Valley are now used against retailers, restaurants and regional service providers.

3. The Repeatable Formula: Four Moving Parts

Coalition summarizes the pattern in one sentence: a plaintiff law firm alleges that a target organization used a certain tracking technology in violation of a particular law. Each of the four elements does distinct work, and together they make the model repeatable.

The plaintiff firm: volume over litigation

Unlike regulatory enforcement, web privacy claims are typically advanced by private lawyers on behalf of individual clients. The report’s most striking observation is concentration. Despite more than 400,000 law firms operating in the United States, four of them represented the claimants in 72 percent of web privacy claims. Concentration is the signature of a business model: standardize the letter, automate the detection, and let settlement volume replace courtroom wins.

The target: anyone with a website

The standard assumption that only large technology companies face meaningful exposure is wrong. Most claims in Coalition’s data targeted businesses with under $100 million in revenue, with a heavy presence of healthcare and consumer-facing companies that rely on tracking tools for customer engagement. That reliance makes them attractive: they have visitors, they have tools, and they often lack a dedicated privacy team.

The technology: ubiquitous, third-party and easy to detect

Claims analyzed in the report frequently alleged misuse of analytics technologies, third-party data sharing and live chat. Detection is cheap. Anyone can open browser developer tools, load a page and watch which domains receive requests. That asymmetry is central to the model, because a plaintiff can build a theory from a few minutes of observation while the defendant must investigate its entire technology estate to respond.

The law: older statutes, fixed damages

Although compliance budgets have chased newer regulations such as the GDPR and the California Consumer Privacy Act, the claims in Coalition’s dataset mostly rested on modern readings of older laws. The 1967 California Invasion of Privacy Act and the 1988 Video Privacy Protection Act dominated the filings. Many of these statutes carry fixed statutory damages, which means a plaintiff does not have to prove financial harm to put a number on the table.

Put the four pieces together and the economics are clear. The cost of finding a target is near zero, the damages theory scales with the number of vendors or page loads, the legal ground is old enough to be contested but broad enough to survive early challenges, and the settlement ask is calibrated to be lower than the cost of defending. The report notes that some targeted businesses lean toward nuisance-value settlements precisely because a quick resolution minimizes expense for both sides. Understanding that calculus is the first step toward changing it, because the single most effective way to defuse the formula is to give the plaintiff less to find.

4. The Players: Four Firms, 72 Percent of Claims

The most operationally useful part of Coalition’s report is its breakdown of who sends the letters and how each firm tends to work. The figures below describe allegations as reported to an insurer, not conclusions about any firm’s conduct or the merit of any claim. They are valuable because they show that demand letters are not random. They follow templates, and templates can be recognized.

Tauler Smith: 27 percent of claims

According to the report, this firm’s playbook appears to involve sending the same demand letter to many businesses while slow-rolling the formal filing of a lawsuit. The letters often outline allegations of CIPA violations based on tracking technologies supplied by TikTok, LinkedIn, X and data brokers, among others. Coalition observed that targeted businesses were sometimes inclined to pay a nuisance-value settlement rather than go to court, because the threat of statutory damages and public exposure makes a quick resolution attractive.

Swigart Law: 25 percent of claims

The second most active firm also relied on a templated demand letter, but its matters centered on arbitration demands. The allegations focused on CIPA violations tied to tracking technologies and use of the Meta Pixel, among others. The distinguishing feature, in Coalition’s description, was the framing that every third-party data-sharing instance on a website could be a separate violation, each carrying $5,000 in statutory damages. A single $5,000 figure looks small. Multiplied across many individual arbitration demands, the report notes, the aggregate can be very costly.

Pacific Trial Attorneys: 10 percent of claims

This firm often sent one-page demand letters alleging CIPA violations without naming any specific tracking technology. The more detailed allegations arrived only after the recipient responded. For a business, that sequence creates an awkward choice: respond and invite the detailed version, or stay silent and risk escalation. Either way, the right first move is to understand what your site actually did on the dates in question.

Gutride Safier: 10 percent of claims

The firm’s letters generally focused on misconfigured privacy controls, in which users were allegedly tracked even after opting out. The legal theories included CIPA and other California statutory and common-law claims. This is the profile most relevant to companies that already run a consent banner, and we return to it below because it highlights a hard truth: having a banner is not the same as having a banner that works.

The long tail: bespoke actions

The remaining 28 percent of claims were represented by many different firms, and Coalition found that 67 percent of those firms appeared in only one claim. These matters were less likely to rely on mass-produced letters or boilerplate allegations and more likely to proceed to formal lawsuits with discovery, depositions and trial. One illustrative theory involved the Michigan Library Privacy Act of 1982, under which a plaintiff would first have to establish that an online bookstore qualifies as a library. Bespoke theories like that apply to niche groups rather than whole sectors, but they are more complex and resource-intensive to defend.

A small number of matters did not start with a law firm at all. Two insurance claims arose from GDPR investigations opened by regulators in the United Kingdom and the Netherlands. Regulatory inquiries call for a different defense posture than a demand letter, because fines can often be reduced or avoided when a business is responsive and cooperative.

What to do when a demand letter arrives

A demand letter is a deadline-driven event, and the first few days shape the outcome. A reasonable internal protocol looks like this:

1. Preserve and route. Do not delete anything. Send the letter to legal counsel immediately and preserve tag manager histories, consent logs and website change records.
2. Notify your insurer. Policies typically require prompt notice of a claim or circumstance. Late notice can jeopardize coverage, so involve your broker the same day.
3. Capture the site as it was. Document which tags, cookies and vendors loaded on the pages and dates the letter references, including the state of your consent banner at that time.
4. Read the letter closely. Note which statute it cites, whether it names a technology, how it counts violations, whether an arbitration clause is referenced and what deadline it sets.
5. Fix forward with counsel. Remediate the underlying configuration problem so the exposure does not keep accruing, and coordinate the timing and documentation of changes with your attorneys.

5. The Targets: It Is Not Just Big Tech

Contrary to a persistent assumption, wrongful collection claims are not limited to large technology companies. The data shows they reach nearly every size and sector.

Across all web privacy claims, 59 percent targeted businesses with under $100 million in revenue. Coalition is careful to explain that this is partly a function of its own book of business, which skews toward small companies. Even so, the sheer number of claims dispels the myth that small businesses are not exposed. When Coalition accounted for the number of customers per business, larger organizations remained more likely to face an allegation, which tells us that exposure grows with scale, but that scale is not what makes a business a target.

Industry patterns are equally revealing. Consumer discretionary businesses accounted for 43 percent of all web privacy claims, with retailers (particularly clothing and specialty stores) especially likely to be targeted and hospitality businesses such as restaurants, hotels and resorts also well represented. Information technology firms accounted for 20 percent, spanning applications and systems software companies that tend to collect large amounts of user data. Healthcare businesses represented 17 percent, which is notable given how sensitive health-related data is and how unsettled the questions are about how hospitals can, and should, use tracking technologies.

The remaining claims came from industries that are not typically thought of as consumer-facing, including industrials such as transportation and construction, nonprofits and materials companies. Their volume was smaller, but they reinforce the point that every industry carries exposure regardless of how directly it deals with consumers.

Geography is not a shield

One of the report’s most practical findings is that location offers little protection. Only 20 percent of web privacy claims alleging violations of California law were brought against companies located in California. State privacy laws attach to the residents of the state, and a business anywhere in the country that has visitors from California can be pulled into the dispute. If your marketing team targets a national audience, assume that the laws of the states where your visitors live are potentially in play, whatever your headquarters address says.

What the target profile tells you

Retailers and hospitality companies share a few traits: they run heavy advertising and retargeting, they rely on third-party commerce and booking tools, and they usually have lean legal and privacy staffing. Healthcare organizations carry the additional burden of sensitive data and a patchwork of rules. Software companies deploy multiple analytics, chat and customer-data tools. In every case the common denominator is not the industry. It is the combination of high digital engagement and low visibility into what the website is actually doing.

6. The Tools: Pixels, Vendors and Chatbots

Three classes of web technology appeared repeatedly in the claims: analytics technologies, third-party vendors embedded in websites and chatbots. Most are supplied by familiar names such as Meta, Google, X, TikTok and Microsoft.

Analytics and advertising pixels

73 percent of web privacy claims alleged misuse of analytics technologies. Businesses typically install these tools to target advertising or find prospective customers, which is why they sit so close to revenue and are so hard to remove.

The Meta Pixel was the most frequently cited technology, appearing in 43 percent of web privacy claims. The X Pixel was next at 13 percent, followed by the TikTok Pixel and Google Analytics at 12 percent each. The LinkedIn Insight Tag, session replay tools and the Pinterest Tag also appeared, at lower rates. For a marketing team, the message is blunt: pixels that send behavioral data to advertising platforms are the plaintiffs’ first stop.

Embedded third-party vendors

34 percent of web privacy claims alleged that a business wrongfully shared data with third-party vendors. These allegations concern what happens to data after collection and are often paired with allegations about a specific analytics tool. They also serve a strategic purpose. Because statutory damages are generally a fixed amount per violation, counting each vendor as a violation inflates the demand. The $280,000 demand described at the top of this article came from exactly this arithmetic: $5,000 multiplied by 56 vendors.

Google was the most frequently named vendor, appearing in 14 percent of claims. Microsoft’s properties (Bing, Clarity and LinkedIn), TikTok, Pinterest, Amazon and Klaviyo also appeared. The long tail is just as telling: 57 percent of the vendors named were mentioned only once or twice. Some of the “vendors” in demand letters looked like random strings of letters and numbers, which suggests automation without close human review. In other words, some letters are generated by scanning software and sent to whatever the scan finds.

When your compliance stack shows up in the letter

Perhaps the oddest detail in the report is that some demand letters referenced vendors that provide privacy compliance solutions, including consent banner providers. That is a reminder that an automated scan cannot tell the difference between a script that collects data for advertising and a script that exists to manage consent. The practical takeaways are to understand how your own consent tooling appears in network logs, to make sure your vendor disclosures account for it, and to configure the platform so that it loads before, and gates, the tags that matter.

Chatbots

Chatbots were named in 5 percent of web privacy claims. These allegations were that chatbot providers intercepted the conversation between the customer and the website owner without consent. Every chatbot claim in the dataset followed the same template: the opening message of the chat should have disclosed that the conversation was being recorded, and the failure to do so violated the Florida Security of Communications Act, a statute dating to 1969 and amended in 1988.

The template nature of these claims makes them preventable. A short, clear notice at the start of a chat session, combined with a vendor agreement that limits how transcripts can be used, addresses the exact allegation. As more businesses adopt AI-powered chat, the pattern is likely to extend beyond human-staffed live chat to automated assistants that record, summarize and sometimes train on conversations.

Data brokers

Data brokers appeared in 4 percent of claims naming a third party. These are companies that collect, aggregate and sell personal information from online and offline sources, often without the individual’s awareness. Lawmakers have turned growing attention to the sector, including at the federal level through an executive order restricting access to Americans’ sensitive data by countries of concern. For website operators, the implication is that any integration that routes visitor data to an audience-matching or identity-resolution vendor should be reviewed as a data broker relationship.

7. The Laws: How Decades-Old Statutes Became Web Privacy Weapons

Web privacy claims rest on a diverse array of legal grounds: US state and federal privacy laws, European regulations, criminal statutes and common-law causes of action such as breach of implied contract, invasion of privacy and unjust enrichment. Coalition counted more than 50 distinct laws and causes of action across the claims it reviewed.

Among them, one dominates. Almost three-fourths of web privacy claims alleged violations of CIPA, a California statute passed in 1967 to address the unauthorized interception of telephone communications. The lawmakers who wrote it could not have imagined that it would be routinely invoked over cookies and pixels more than half a century later. The same can be said of the Video Privacy Protection Act (1988), the Florida Security of Communications Act (1969, amended 1988) and the Massachusetts Wiretap Act (1968), all of which now ground claims against modern digital tools.

Statute	Year	Original focus	How it shows up in web claims	Commonly cited remedy
California Invasion of Privacy Act	1967	Interception and recording of telephone communications	Tracking pixels, session replay, chat tools and pen register theories	$5,000 per violation
Video Privacy Protection Act	1988	Video rental records	Sharing viewing histories through tracking tools	Liquidated damages of $2,500
Florida Security of Communications Act	1969, amended 1988	Interception of communications	Chatbot transcripts recorded without disclosure	Statutory damages and fees
Massachusetts Wiretap Act	1968	Secret recording and interception	Cited alongside other wiretap theories	Varies
Michigan Library Privacy Act	1982	Library borrowing records	Bespoke theories against online retailers	Varies
Federal Wiretap Act (ECPA Title I)	1968, expanded 1986	Interception of wire, oral and electronic communications	Healthcare and other pixel cases	Greater of $100 per day or $10,000

The remedies column is illustrative and simplified. Statutory damages, procedural requirements and defenses differ by statute, court and fact pattern, so counsel should evaluate any specific matter.

The common-law add-ons

Claims that cite CIPA frequently add common-law counts as well. Coalition observed that these often focus on a website that failed to follow its own privacy policy, producing claims for breach of contract, breach of the covenant of good faith and fair dealing, intrusion upon seclusion and unjust enrichment. The implication is easy to miss: your privacy policy is not just a compliance artifact. It is a statement that plaintiffs will compare against what your website actually does. A policy that overpromises, or one that has not been updated since the last marketing platform change, can create liability on its own.

The compliance spending mismatch

The report raises a pointed question about where compliance money goes. Survey and academic data suggest that baseline GDPR compliance can cost from about $1.7 million for smaller businesses to as much as $70 million for large enterprises, and CCPA compliance can run from $50,000 to $100,000 in upfront costs for small businesses and up to $2 million for large ones. Yet of all the claims Coalition handled in this area, only three related to GDPR or the CCPA. Two were regulatory inquiries from European data protection authorities, and one CCPA allegation was listed alongside other claimed violations.

This is not an argument for ignoring modern privacy laws. Regulators enforce them, they create real obligations and, in the case of the GDPR, they carry significant fines. It is an argument for widening the lens. A program built only around the newest statutes can leave a business exposed to claims under older laws that have no compliance checklist and no regulator, only a plaintiff with a screenshot of your network traffic.

Lawmakers have noticed: BIPA and SB 690

Legislatures are beginning to respond to the unintended incentives. Illinois revised BIPA in August 2024 to limit the damages companies face and to clarify consent requirements. California has now acted on CIPA as well, though more narrowly than originally proposed.

When Coalition’s report was written, SB 690 was under consideration as a broad reform that would have created a “commercial business purpose” exemption across several CIPA provisions. The bill stalled in the Assembly in 2025 and returned in 2026 in much narrower form. According to law firm analyses published after passage, the Legislature approved it on August 28, 2026 without a recorded vote against it, and the governor signed it on September 30, 2026. The final law removes the private right of action under CIPA’s pen register and trap-and-trace provision (Section 638.51) for conduct on websites, online applications and mobile applications, by adding a new subdivision to Penal Code Section 637.2. It takes effect January 1, 2027, and at least one major firm’s analysis indicates it reaches back two years from that date, which could affect many pending claims. The bill’s sponsor said that matters under the pen register theory had grown from roughly 600 to more than 4,000.

The change is real, but it is narrow, and it is important not to overread it.

• The wiretap provisions remain. Sections 631 and 632, which govern interception and recording, are untouched, and plaintiffs have long pleaded those theories as well. Commentators widely expect attention to shift there.
• Only the private right of action is removed. The conduct is not made lawful, and California’s Attorney General retains enforcement authority.
• Other states and statutes are unaffected. The VPPA, the Florida chatbot theory, the federal Wiretap Act and state wiretap laws elsewhere are outside the bill.
• Common-law claims are untouched. Breach of contract, privacy and unjust enrichment counts based on privacy policy promises remain available.

Coalition’s data does not break out which CIPA section each claim invoked, so it is not possible to say from the report how much of the 73 percent CIPA share was pen register based. What the law firm commentary suggests is that roughly a third of CIPA website cases rested on a pen register theory alone and another third paired it with another count. That makes SB 690 meaningful but far from a cure. For a deeper look at the signing, see our analysis, California Closes the CIPA Pen Register Loophole. The Wiretap Cases Are Still Coming.

The strategic lesson is the one Coalition emphasizes: legal exposure shifts with statutes, rulings and tools. A compliance approach that is built around a single theory will be outdated the next time a legislature or court changes it.

8. What 6,300 Websites Reveal: The Web Privacy Snapshot

To see what businesses are actually running, Coalition conducted permissive external scans of 5,000 global businesses, identifying each company’s web domains with open-source methods. About 10 percent of businesses had more than one domain, which brought the total to 6,300 websites. The scans looked for tracking technologies, third-party vendors, chatbot integrations and privacy controls such as consent banners and privacy policies.

Tracking technology prevalence

The first finding is a reassuring one. For most websites assessed, no tracking technologies were detected, and the safest way to avoid a web privacy claim is not to collect any user data. Tracker use tracks traffic and engagement. 38 percent of very low traffic sites deployed some form of tracking, typically sites that publish basic information like hours or product listings. Among very high traffic sites, the figure was 77 percent, presumably reflecting an effort to monetize visits.

The most common trackers

Among websites that deploy at least one tracker, Google Analytics was detected on 87 percent. Many sites use it to power advertising through Google’s network or to monitor user experience, often without realizing that visitor data may be held by Google on the business’s behalf, which can be the basis of allegations under CIPA and similar laws.

The Meta Pixel was detected on 19 percent of tracker-using sites, and LinkedIn’s Insight Tag on 11 percent. The X and TikTok pixels were far less common on sites than their prevalence in claims would suggest. Cookies were detected on 71 percent of websites. Some used only necessary cookies, such as session cookies that keep users logged in, but 63 percent of websites also installed cookies used for analytics, marketing or other business reasons, with an average of six non-necessary cookies per site that deploys them.

Litigation share is not deployment share

One of the most useful comparisons in the data is between how often a technology is deployed and how often it is named in claims. Google Analytics appears on most tracker-using sites yet shows up in only a modest share of claims, while the Meta Pixel is far more common in claims than on sites. The two measures use different denominators (claims on one side, scanned sites with trackers on the other), so treat the comparison as directional rather than exact.

The takeaway is that plaintiffs choose technologies based on what supports the strongest theory and the cleanest evidence, not on market share. A tool that sends granular behavioral and identifying data to an advertising platform is a better fit for a wiretap or pen register allegation than a tool whose primary purpose is aggregate measurement.

Chatbot adoption

About 5 percent of websites deployed chatbot technologies, the same percentage as the share of claims that focused on chatbots. Chatbot use was most common in information technology. More than 50 chatbot vendors appeared across the scans, and the three most common, Re:amaze, LiveChat and HubSpot Chat, accounted for only 35 percent of detected chatbot deployments, which points to a fragmented, fast-moving market.

Privacy-preserving analytics exist

Coalition notes that businesses can retain essential oversight of website performance without sharing data with third parties by moving to privacy-preserving analytics. These platforms provide aggregate insights without transmitting personal data to the wider advertising technology ecosystem. Matomo Analytics, a free, open-source and cookie-less alternative to Google Analytics, appeared on 3 percent of sites using tracking technology. For organizations whose analytics needs are modest, switching can eliminate an entire category of exposure.

Privacy policies: present, but often stale and vague

The vast majority of websites that deployed trackers also published a privacy policy, and 55 percent of the policies disclosed the date they were last updated, which the report notes is required under the CCPA. But freshness varied with traffic. Among very high traffic sites, 71 percent had updated their policies within the last year. Among very low traffic sites, only 37 percent had.

The content of the policies is the more important gap. Half included only a generic disclosure that users would be tracked, and just 29 percent identified the specific tracking technologies used on the site. Opt-out mechanisms appeared in 65 percent of policies, and 59 percent described advanced rights such as access, correction and deletion, though the rights offered were not consistent, likely reflecting variation in state laws. Only 38 percent included a COPPA statement, and fewer than 1 percent of scanned websites used age verification.

Why does specificity matter? Because wrongful collection claims hinge on how data is collected, disclosed and shared. A policy that says “we may use cookies and similar technologies” does not tell a visitor that a behavioral advertising pixel is sending their activity to a social platform. A plaintiff will argue the visitor never consented to that, and a defendant who relied on the policy for consent will be arguing from a weak document.

Consent banners: adoption follows traffic

Only 19 percent of scanned websites displayed a consent banner, though adoption climbed to 61 percent among the highest-traffic sites and fell to 14 percent among the lowest. Coalition suggests the pattern reflects the age of low-traffic sites’ policies, many of which predate the laws that drove mass adoption of banners.

Two more details deserve attention. First, 9 percent of scanned websites had a consent banner but no matching explanation in the privacy policy about how to opt out, a mismatch that creates both a user experience problem and a potential evidentiary one. Second, the cookie compliance market is crowded. OneTrust was detected on 36 percent of all websites in the report’s sample, followed by CookieYes at 14 percent, with many other vendors splitting the remainder. A crowded market means that businesses have choices, but it also means that simply deploying a vendor’s banner says nothing about whether it is configured to block tags before consent, respect opt-outs and keep records.

9. Where Privacy Programs Quietly Fail

Reading the claims data alongside the scan data points to a handful of recurring failure modes. Most are not exotic. They are the ordinary result of websites changing faster than the processes meant to govern them.

1. The banner that does not block. A consent banner that appears while advertising tags fire in the background is the profile behind the misconfigured-control letters Coalition describes, in which users were allegedly tracked even after opting out. A banner proves intent only if the technology behind it enforces the choice.
2. Policy and practice drift. A privacy policy written for the stack of two years ago does not describe the stack that exists today. Because common-law claims often rest on the argument that a business violated its own policy, drift is not just stale paperwork. It is a ready-made allegation.
3. Estate blindness. Coalition points to subsidiary sites, campaign landing pages and microsites that operate beyond centralized oversight. A company can have a disciplined main website and a forgotten promotional domain carrying a pixel nobody remembers approving.
4. Vendor chains. One tag often loads others. A business with 56 visible vendors may have approved a handful, with the rest arriving through tag managers, plugins, embedded widgets and the vendors’ own dependencies. When plaintiffs multiply per vendor, the length of the chain is the size of the demand.
5. The chat and replay blind spot. Chat tools and session replay products record content, not just clicks, and they are frequently adopted by customer service or product teams without privacy review. The templated chatbot claim exists because the disclosure was missing.
6. The annual review trap. Coalition’s sharpest critique is of static checklists and yearly audits. When the legal landscape and the technology both move monthly, a point-in-time review is out of date on the day it is signed.

10. A Seven-Step Program to Reduce Web Privacy Exposure

Coalition frames its recommendations as four moves: avoid unnecessary risks, mitigate essential risks, accept remaining risks and transfer insurable risks. We find it helpful to translate that into a seven-step operating program that a privacy lead, a general counsel and a marketing operations manager can actually run together.

Step 1: Discover everything that runs on every domain

Build and maintain an inventory of every tag, pixel, cookie, SDK, chat widget and embedded vendor across all domains, including microsites and campaign pages. Record what each one collects, where it sends data, who approved it and why. Continuous scanning matters more than the first inventory, because the value is in catching the next change.

Step 2: Remove what the business does not need

The report’s first recommendation is the simplest: stop collecting data you do not need. Review the pixels that show up disproportionately in claims, particularly advertising pixels on pages where they produce little value, and remove them. Where analytics is genuinely needed, consider whether a privacy-preserving platform can meet the requirement without sending data to advertising networks.

Step 3: Gate tracking behind working consent

For the technologies that remain, make sure consent is real. That means advertising and analytics tags are blocked until the visitor opts in, opt-outs and Global Privacy Control signals are honored across the site, and the experience is tested end to end rather than assumed. Keep timestamped records of consent and opt-out choices. In a dispute, a record that shows what the visitor saw and chose is among the most useful pieces of evidence a business can have.

Step 4: Disclose specifically and keep disclosures current

Replace generic tracking language with named technologies, categories of data and purposes. Include a clear opt-out path that matches the banner. Update the policy whenever the stack changes, and make the last-updated date meaningful. Add a recording notice at the start of chat sessions. Provide a privacy contact that actually reaches someone.

Step 5: Govern vendors and contracts

Require vendors to commit to purpose limitation, no secondary use and notice of subprocessors. Identify which vendors act as service providers and which operate as independent parties, because the distinction affects both your disclosures and your arguments. Run new vendors and new features, especially AI assistants, through a privacy review before they go live.

Step 6: Prepare to respond quickly and consistently

Coalition advises being ready for customer questions about data use and responding to every inquiry rapidly and thoughtfully. Build a data subject request workflow, an intake path for privacy complaints and a demand letter protocol that routes to counsel and the insurer on the same day. Speed and consistency reduce both legal risk and the odds that a customer question becomes a claim.

Step 7: Transfer what you can, and prove what you did

Review cyber and general liability policies for privacy and wrongful collection coverage, sublimits and exclusions. Confirm notice requirements. Then maintain the evidence package that supports your defense: scan histories, consent logs, policy versions, vendor contracts and remediation records.

Coalition roadmap	Seven-step program	Output you can show
Avoid unnecessary risks	Steps 1 and 2	Tag inventory, removal log, privacy-preserving analytics decision
Mitigate essential risks	Steps 3, 4 and 5	Consent configuration tests, current policy, vendor agreements
Accept remaining risks	Step 6	Request workflow, privacy contact, demand letter protocol
Transfer insurable risks	Step 7	Coverage review, notice procedures, evidence file

Score your own exposure: ten questions

Use the questions below as a quick internal diagnostic. Count the number of honest “no” answers.

1. Can you list every third-party tag and vendor on every domain you own, including microsites?
2. Do you have an automated alert when a new tracker appears?
3. Do advertising and analytics tags stay blocked until a visitor opts in?
4. Have you tested, within the last quarter, that opt-out and Global Privacy Control signals actually stop the tags?
5. Does your privacy policy name the specific tracking technologies in use?
6. Was your privacy policy updated after the last change to your marketing stack?
7. Do your chat tools disclose recording at the start of a session?
8. Do your vendor contracts limit secondary use of visitor data?
9. Do you keep timestamped consent records you could produce in a dispute?
10. Have you confirmed how your insurance responds to a privacy demand letter, including notice deadlines?

Zero to two “no” answers suggests a mature program. Three to five suggests material gaps worth closing in the next quarter. Six or more suggests that your site could be generating exposure today, and a scan of your actual configuration should be the next step.

A 30, 60 and 90 day plan

Window	Focus	Concrete actions
Days 1 to 30	See and cut	Scan every domain, build the tag and vendor inventory, remove pixels with no business owner, confirm insurance notice terms
Days 31 to 60	Gate and disclose	Configure consent blocking and opt-out handling, test Global Privacy Control, rewrite the policy with named technologies, add chat recording notices
Days 61 to 90	Govern and rehearse	Update vendor contracts, set up change alerts, run a tabletop exercise for a demand letter, assemble the evidence file

11. The Insurance Angle

Because this report comes from an insurer, it is worth saying plainly how insurance fits and where it does not. Coverage can help pay for defense costs and some settlements, and a good claims team can help craft a response strategy. But coverage is not a substitute for controls. Policies differ in how they treat privacy violations and wrongful collection, many carry sublimits or exclusions, and a poorly managed website can make underwriting harder and more expensive. The questions to ask your broker are specific: Does the policy cover claims alleging unlawful interception or tracking through website technologies? Is there a sublimit? Does a pre-suit demand letter count as a claim? What are the notice deadlines? What happens if the demand cites a statute that the policy excludes?

Treat the answers as part of the program, not an afterthought. A claim reported late or a gap discovered after a demand letter arrives is far harder to fix than one discovered in a quarterly review.

12. What the Report Cannot Tell You

Responsible use of any dataset means understanding its edges. The Coalition report cannot tell you how many web privacy claims exist across the market, which claims succeed in court or how courts will rule on theories that remain unsettled. It does not report settlement amounts for the claims it analyzed. Its insured population is not representative of every company, and it describes allegations rather than adjudicated outcomes. The report is also produced by a company that sells cyber insurance and a risk monitoring product, so its recommendations should be read with that in mind, even though the underlying data is valuable.

None of this undermines the central lessons. The patterns it documents, templated letters at scale, concentration in a few firms, reliance on old statutes, fixed damages multiplied across vendors and thin disclosures on real websites, are consistent with what privacy practitioners see in the field. The right response is to take the patterns seriously while confirming the legal specifics for your own situation with counsel.

13. How Captain Compliance Helps

Captain Compliance was built for the problem this report describes: websites that change constantly, a legal landscape that changes faster and teams that cannot afford to find out about a gap from a demand letter.

• Consent management that enforces the choice. Our consent management platform holds non-essential tags until a visitor opts in, honors Global Privacy Control signals and records each choice, so the banner on your site matches the behavior of your site.
• Continuous monitoring. Our Patrol privacy risk monitoring tool scans for new trackers, vendors and data flows so that a pixel added by a campaign team does not sit unnoticed for months.
• Disclosures that stay current. Dynamic privacy policies and vendor disclosures help keep your public statements aligned with the technologies actually running on your sites.
• Rights request handling. DSAR workflows route access, deletion and opt-out requests consistently and leave an auditable trail.
• Global coverage. Our consent platform is used on more than 8,000 websites and processes over 50 million consent choices per month. It is part of the Google CMP Program and carries IAB TCF validator certification, and our partnership with EU Presence supports Article 27 EU representation for organizations that need it.

If you want to know what your website is sending to third parties today, we can scan it with you and walk through the results. Book a demo with Captain Compliance and we will review your tracker footprint, consent configuration and privacy disclosures against the patterns in this article.

Frequently Asked Questions

What is a wrongful collection claim?

A wrongful collection claim alleges that a business gathered, used or shared personal data without proper consent, disclosure or legal justification. It differs from a data breach claim because no outside attacker is involved. In Coalition’s data, 77 percent of such claims arose from website activity.

Why are small businesses receiving web privacy demand letters?

Plaintiff firms use templated demand letters that cost little to send and are calibrated to settle for less than the cost of a defense. Technologies such as pixels, analytics tags and chatbots are installed on millions of sites, so the pool of targets is enormous. Coalition found that 59 percent of web privacy claims it received involved businesses with under $100 million in revenue.

Which tracking technologies appear most often in web privacy claims?

Analytics technologies were alleged in 73 percent of claims. The Meta Pixel was the most commonly cited, in 43 percent of claims, followed by the X Pixel at 13 percent and the TikTok Pixel and Google Analytics at 12 percent each. Third-party data sharing appeared in 34 percent of claims and chatbots in 5 percent.

How can one demand letter reach $280,000?

When statutory damages are a fixed amount per violation, a plaintiff can count each third-party vendor loaded on a page as a separate violation. In the example Coalition describes, a demand of $5,000 per vendor on a site with at least 56 vendors totaled $280,000 for a single page load.

Did California SB 690 end CIPA lawsuits?

No. SB 690, signed on September 30, 2026, removes the private right of action under CIPA’s pen register and trap-and-trace provision for website, online application and mobile application conduct, effective January 1, 2027. It leaves CIPA’s wiretapping and recording provisions, other state laws, federal statutes and common-law claims in place, and the Attorney General can still enforce.

Does having a cookie consent banner protect my website?

A banner helps only if it works. If tags fire before consent or continue after an opt-out, the banner can become evidence against you. A properly configured platform blocks non-essential tags until consent, honors opt-outs and Global Privacy Control signals, and keeps records of each choice.

What should I do if I receive a privacy demand letter?

Preserve your records, notify your legal counsel and your insurer immediately, document the state of your website on the dates in question, read the letter closely for the statute, technology and damages theory it relies on, and remediate the underlying configuration with counsel’s guidance. Do not ignore the letter.

How often should I review my website’s tracking technologies?

Continuously, not annually. Websites change whenever marketing launches a campaign or a vendor updates its code, and the legal environment changes as courts and legislatures act. Automated monitoring that alerts you to new trackers is the practical way to keep pace.

Sources and Notes

This article draws on Coalition’s report, The State of Web Privacy (2025), which analyzes data privacy insurance claims reported to Coalition Insurance Solutions, Inc. and website scans of 5,000 businesses. All charts are original recreations of the report’s published figures by Captain Compliance. Statements about SB 690 reflect law firm and press analyses published through October 2026 and should be confirmed against the enacted text. Coalition’s settlement references are as cited in its report.

This article is general information and not legal advice. Privacy and wiretap law varies by jurisdiction, changes quickly and depends on specific facts, so consult qualified counsel about your own situation. We highly recommend reaching out to Daniel Woods at Coalition whom we highly respect and recommend when it comes to Cyber Insurance and Wrongful Collection insurance needs.