How Plaintiff Firms Use Meta Pixel Demand Letters: ECPA Procurement, the Crime-Tort Exception, and Twelve Add-On Claims

Demand letters built around the Meta Pixel are no longer limited to a single California wiretap statute. A recent Meta Pixel demand letter, and others like it that we are seeing sent to e-commerce and website operators, argues that installing the pixel means the business procured Meta to intercept a visitor’s communications. The federal hook is the Electronic Communications Privacy Act. To get around ordinary one-party consent, the letter invokes the statute’s crime-tort exception and then lists a dozen California and federal theories as the supposed unlawful purpose of that interception. The same packet typically attaches HAR files, screenshots of off-Facebook activity, and a statutory-damages calculation that multiplies every third-party request by thousands of dollars.

The technical story the letter is trying to tell

The Meta Pixel is a snippet of JavaScript a business places on its site so Meta can record events such as page views, content views, and purchases. When the script runs, the visitor’s browser typically sends Meta a request that can include the page URL, event names, cookie identifiers such as _fbp, and, if the business has turned on advanced matching, hashed contact details. We have separately catalogued the types of data the Meta Pixel can collect.

Plaintiff firms describe that request as a second, hidden copy of the visitor’s communication with the website. In their telling, the pixel causes the browser to duplicate page details and send them to Meta at the same time as the intended visit. Counsel then download a HAR file to list every third-party domain that received a request, and they ask the visitor to export “activity off Meta technologies,” which can show page-view events attributed to the business. That package becomes the factual backbone of a pre-arbitration notice of dispute.

Timing is the other constant. Letters allege the pixel becomes active within milliseconds of a page load, before anyone could read a banner or privacy policy. The Ninth Circuit’s unpublished memorandum in Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022), rejected the idea that later consent can authorize a prior interception under California’s Invasion of Privacy Act. Plaintiff firms treat that as confirmation that a banner appearing after the pixel has already fired is too late, a problem we covered in why the millisecond matters once a cookie banner becomes exhibit A. They also argue that the business cannot hide behind being a party to the visit, because it turned ordinary website tracking into a wiretap theory by inviting Meta to receive a simultaneous copy.

How the ECPA procurement theory is supposed to work

18 U.S.C. § 2511(1)(a) makes it unlawful to intentionally intercept an electronic communication or to procure another person to intercept one. Civil damages are available under 18 U.S.C. § 2520. For electronic communications, a court may award the greater of actual damages plus any profits, or statutory damages of $100 a day or $10,000, whichever of those statutory figures is greater, plus possible punitive damages and fees. Demand letters commonly claim the $10,000 figure as a floor.

The statute also contains a consent rule that would, on its face, protect many website operators. Section 2511(2)(d) says it is not unlawful for a person who is not acting under color of law to intercept a communication if that person is a party to it, or if a party has given prior consent, “unless such communication is intercepted for the purpose of committing any criminal or tortious act” in violation of federal or state law. That closing clause is the crime-tort exception.

Plaintiff firms use the exception as a hinge. They concede, or at least anticipate, that a business is a party to communications with people who visit its site. They then argue that the interception was carried out in order to commit other unlawful acts, so the consent defense disappears. The “other unlawful acts” are the stacked claims labeled (a) through (l) in recent letters. We have already seen a related version of this expansion in an expanded CIPA and ECPA demand playbook used by a pro se claimant. The Meta Pixel letters aimed at website operators press the same structure into a pre-arbitration demand.

Courts have not treated the exception as a blank check. In Sussman v. American Broadcasting Cos., 186 F.3d 1200 (9th Cir. 1999), the Ninth Circuit focused on the interceptor’s intended use of the recording, not on whether the recording itself was unlawful. If the recording supplied the tortious purpose, the consent rule would collapse. The Second Circuit said the same in Caro v. Weintraub, 618 F.3d 94 (2d Cir. 2010): the defendant must intend, at the time of interception, to commit a separate crime or tort. A letter that merely relabels the interception as twelve other wrongs is trying to do what those cases caution against, unless it identifies an independent purpose such as an alleged HIPAA violation.

That distinction appeared in Doe v. Tenet Healthcare Corp., 789 F. Supp. 3d 814 (E.D. Cal. 2025). The court denied Tenet’s motion to dismiss certain ECPA claims after plaintiffs alleged that tracking tools sent identifiable protected health information to Meta for a purpose that would violate HIPAA, and it allowed some CIPA and unfair-competition allegations to proceed. The same order dismissed computer-access claims under Penal Code section 502, a Consumer Records Act theory under Civil Code section 1798.82, and trespass to chattels for lack of device impairment. The surviving ECPA theory was tied to health information, not to an ordinary product-page view. A Central District of California decision we covered in Rodriguez v. Sacramento CDJR LLC went the other way, holding that ECPA one-party consent applied and narrowing the crime-tort exception on the facts alleged there. Letters that cite only the cases that survived, and skip the claims those same courts dismissed, are doing advocacy.

The twelve add-on claims, and why the list is longer than the liability

Recent letters present the add-on theories as a numbered list. Each one gets its own article in this cluster because the elements, defenses, and practical fixes are not the same.

• California Constitution, Article I, section 1, the state’s inalienable privacy right.
• The FTC Act, 15 U.S.C. § 45, which prohibits unfair or deceptive acts in commerce but is enforced by the Commission, not by private damages suits.
• Intrusion upon seclusion, the common-law privacy tort that asks whether a reasonable expectation of privacy was invaded in a highly offensive way.
• Trespass to chattels, usually aimed at the _fbp cookie placed on a visitor’s browser.
• The Consumer Legal Remedies Act, California’s consumer-transaction statute.
• Statutory larceny under Penal Code section 484, recasting data collection as theft.
• Federal wire fraud, 18 U.S.C. §§ 1343 and 1349, which is a criminal statute without a private right of action.
• The Comprehensive Computer Data Access and Fraud Act, Penal Code section 502.
• The California Online Privacy Protection Act, which requires a privacy policy to disclose certain collection and sharing practices.
• Civil Code section 1798.82, California’s data-breach notification rule.
• The Unfair Competition Law, Business and Professions Code section 17200.
• CIPA sections 631 and 638.51, the state wiretap and pen-register provisions that usually carry the largest statutory-damages numbers in the letter.

Some of those theories have real traction in the right case. CIPA section 631 and the newer pen-register theory under section 638.51 are the ones most likely to drive settlement math, because California Penal Code section 637.2 allows $5,000 per violation without proof of actual damages. The Ninth Circuit’s decision in In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), allowed constitutional-privacy and intrusion claims, and certain computer-access claims, to proceed against Facebook itself for tracking logged-out users. Other theories on the list are much weaker when the only facts are an advertising pixel on an ordinary website: there is generally no private right of action under the FTC Act, wire fraud is a crime rather than a consumer claim, and courts have been skeptical that placing a cookie is a trespass or that sharing data with a vendor the business itself installed is a “breach of the security of the system.”

Letters also cite newer tracking decisions for atmosphere, including DellaSala v. Samba TV, Inc., No. 3:25-cv-03470-JSC (N.D. Cal. Apr. 21, 2026), Harris v. iHeartMedia, Inc., 2026 WL 247875 (N.D. Cal. Jan. 29, 2026), and the vehicle-telematics order in In re Consumer Vehicle Driving Data Tracking Collection, MDL No. 3115 (N.D. Ga. Apr. 22, 2026). Those decisions allowed some pen-register or wiretap theories to proceed at the pleading stage in disputes about smart-television viewing data, site trackers, and driving data. They are not rulings that every commercial use of the Meta Pixel is unlawful, and some of the same orders dismissed other claims in the stack. Demand letters often present them as if they closed the debate.

What a business should do after a letter arrives

1. Read the contractual clock. Many of these letters are styled as a notice of dispute under the business’s own terms. Missing a contractual pre-arbitration window can create a separate problem even if the privacy theories are thin.
2. Send the letter to counsel and stop informal contact. If the person is represented, communications should go through counsel. A marketing reply or an apology emailed to the claimant is not a legal strategy.
3. Preserve the site as it existed. Screenshot the banner, export the privacy policy then in force, and save tag-manager versions, pixel settings, consent logs, and a HAR file from the relevant pages. The urge to “just rip the pixel out” is understandable, but changing the configuration without a snapshot can look like spoliation even when the change is the right operational move.
4. Reconstruct what actually fired. Counsel and a technical reviewer should determine which events the Meta Pixel sent, whether advanced matching was on, whether form fields or search terms traveled with the request, and whether any of that happened before a consent signal was recorded. The difference between a page-view URL and a health questionnaire, checkout field, or search term is often the difference between a weak contents theory and a stronger one.
5. Compare the disclosures to the facts. A privacy policy that never mentions Meta, “sharing,” or advertising pixels is a gift to a misrepresentation theory even when other claims are weak.
6. Treat the damages chart as advocacy. Letters commonly claim $5,000 under section 631 for each third party in the HAR file, another $5,000 under section 638.51 for the same requests, and $10,000 under ECPA. Whether a court would count each vendor, each page view, or each session as a separate “violation” is contested. The chart is there to set an opening number, not to invoice a proven debt.
7. Fix the site going forward. Block marketing and advertising pixels until there is a recorded choice that matches the jurisdiction, honor Global Privacy Control, and keep signed records of what the banner showed and what the visitor chose.

How Captain Compliance can help without turning a letter into a marketing pitch

Most of the operational work these letters expose is ordinary privacy hygiene. A website tracker scan should show whether the Meta Pixel fires before consent, after a rejection, or despite a Global Privacy Control signal. A consent management platform should gate those scripts by purpose and keep a receipt of the choice. Businesses also need a working path for access, deletion, and opt-out requests; Captain Compliance’s DSAR portal is built for that workflow. On eligible plans, Compliance Shield financially backs qualifying privacy claims tied to consent, cookie disclosures, GPC handling, consumer-rights workflows, and privacy-notice execution when the platform is properly deployed and recommended settings are not bypassed. It does not cover intentional violations, unsupported trackers running outside the platform, or configurations that materially depart from those settings. None of that replaces a lawyer’s advice about a particular demand. It does address the facts that make these letters easy to write: a pixel that runs too early, a banner that does not control the tags behind it, and a privacy policy that does not match the network log.

Frequently asked questions

If we already have a cookie banner, does that end the dispute?

No. The question in these letters is not whether a banner appeared on the screen. It is whether the Meta Pixel, and other tags, sent information before a valid choice was recorded, and whether later consent can excuse that earlier transmission. A banner that is not wired to a tag manager or a consent mode is often the first exhibit, not a complete defense. See our guide to using consent management to reduce CIPA and related tracking claims.

The letter cites a case that denied a motion to dismiss. Have we already lost?

No. Surviving a motion to dismiss means the judge concluded the complaint alleged enough to continue, accepting the pleaded facts as true. It is not a finding that a pixel was unlawful, and it is not a finding about your site. Read the rest of the order. In Tenet, several of the same theories these letters list were dismissed.

Should we remove the Meta Pixel the day the letter arrives?

Often the pixel should be blocked until consent is handled correctly, or removed if the business does not need it. Do that after preserving the current configuration. Counsel can help you decide whether a complete removal, a consent-gated pixel, or a more limited server-side setup is the right operational response. Changing the site is not the same thing as erasing the past, and it should not be done in a way that destroys evidence of how the site behaved on the dates alleged.

The letter is a map of theories, not a scoreboard

The Meta Pixel can create genuine privacy risk, especially when it captures form fields, search terms, health-related URLs, or hashed identifiers before anyone has made a choice. That is why Meta Pixel lawsuits have multiplied and why a demand letter can unsettle a company that thought a banner was enough. The responsible reading is narrower than the claim list suggests. Separate the federal procurement theory from the crime-tort hinge, then test each add-on statute on its own elements. Some deserve a hard look. Others are there to make a $10,000 federal figure and a $5,000 state figure look like a much larger invoice.

This article is for educational purposes and is not legal advice.