Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
California’s Consumer Legal Remedies Act was written for people who buy goods and services and are misled about what they bought. It was not written as a general website-tracking statute. A recent Meta Pixel demand letter, like others sent to e-commerce and website operators, still lists the CLRA as claim (e), usually on the theory that a privacy policy or a quiet pixel misrepresented the transaction. We have already published a broader guide to how plaintiff firms use the CLRA in data-privacy suits. This piece focuses on a narrower use: the way Meta Pixel letters fold the statute into an ECPA stack and treat it as another crime-tort predicate.
TL;DR
- The CLRA prohibits specified unfair or deceptive acts in transactions for goods or services intended for personal use. It is a consumer-transaction statute, not a general browsing statute.
- Damages claims generally require a 30-day pre-suit notice that identifies the alleged violations and gives the business a chance to remedy them.
- In pixel demand letters the CLRA is often doing support work for a federal wiretap theory. It is stronger when the claimant actually bought something and can point to a specific false statement, and weaker when the only event is a page view.
What the CLRA actually covers
The Consumers Legal Remedies Act, Civil Code section 1750 and the sections that follow, lists prohibited practices in Civil Code section 1770. Typical theories in a privacy letter are that the business represented goods or services as having characteristics they did not have, or advertised them with intent not to sell them as advertised, by implying that a purchase or a site visit would not involve sharing information with Meta. The statute is aimed at consumers, meaning people who engage in a transaction for personal, family, or household purposes.
That transaction element is doing real work. A person who only loaded a page and never bought anything may have trouble showing they were a “consumer” in a CLRA sense. Even a purchaser has to connect the alleged misrepresentation to the goods or services bought, not merely to the existence of an advertising tag somewhere on the site. Courts have been unwilling to let every website visit ripen into a CLRA case without that consumer relationship.
The statute also has a notice rule that demand letters sometimes glide past. Civil Code section 1782 generally requires a consumer who wants damages to notify the business at least 30 days before filing suit, identify the particular section 1770 violations, and give the business a chance to correct, repair, replace, or otherwise rectify the goods or services. Injunctive relief has a different posture, and plaintiffs sometimes plead around the notice requirement by seeking only an injunction at first. A letter that demands a large statutory figure “under the CLRA” without showing that this process was followed is getting ahead of the statute.
How the CLRA shows up in Meta Pixel letters
In the stacked Meta Pixel letters we are seeing, the CLRA is rarely the centerpiece. The centerpiece is CIPA damages plus an ECPA procurement theory. The CLRA is listed as one of the supposed unlawful purposes of the interception: the business, the letter says, deceived consumers about how their information would be handled and therefore intercepted communications in order to commit a CLRA violation.
The factual allegations are familiar. The pixel fired before any banner could be read. The privacy policy did not clearly say that Meta would receive page URLs or event data. The visitor later found the business in an off-Facebook activity report. From those facts counsel infer a misrepresentation about the “service” of using the website, or about a product the person purchased on a later visit. The same facts are then reused for California’s Unfair Competition Law and for CalOPPA disclosure theories. One set of screenshots is asked to prove three consumer-protection statutes at once.
That overlap is not accidental. Consumer statutes are attractive because they sound like they were written for ordinary shoppers and because some of them authorize attorney’s fees. They are less attractive once the elements are unpacked. If the claimant never bought goods or services, the CLRA may not attach. If the claimant did buy something, counsel still has to identify a representation about that transaction, not a generalized complaint that advertising technology exists.
How strong is the theory in a pixel dispute?
The CLRA is a genuine statute with genuine remedies, including actual damages, injunctive relief, restitution, and, in some cases, punitive damages and fees. It is not a bluff in the abstract. In pixel demand letters, though, it is often overextended.
The claim is relatively stronger when three things line up: the claimant purchased from the site, the privacy policy or checkout flow made a specific promise about sharing or selling information, and the Meta Pixel sent data that contradicted that promise. It is weaker when the letter treats a homepage visit as the consumer transaction, when the policy disclosed advertising partners in general terms, or when the only alleged harm is the existence of a page-view event. It is also a clumsy crime-tort predicate if the supposed CLRA violation is simply the interception itself. Courts have required the criminal or tortious purpose to be independent of the recording.
Businesses should still take the consumer-facing statements seriously. A banner that does not control tags, or a policy that says “we do not share personal information” while advanced matching sends hashed emails, is the raw material of a section 1770 theory and of the broader wave of cookie-consent lawsuits. Cleaning up those statements is worthwhile whether or not a particular claimant has CLRA standing.
Practical steps if the CLRA is in the letter
- Determine whether the claimant was actually a customer. Order records, account logs, and the dates of any purchases matter more here than they do for a pure CIPA page-view theory.
- Preserve every consumer-facing representation from the relevant period. That includes privacy policies, checkout text, email footers, and banner copy, not just the current website.
- Check whether the letter is trying to skip section 1782. If the sender wants CLRA damages, counsel can evaluate whether the required notice and opportunity to cure were given.
- Align the pixel with the words on the site. If you say you share data only after a choice, the Meta Pixel cannot run first. If you say you do not sell or share, you need to know whether your configuration contradicts that sentence.
How Captain Compliance supports the consumer-facing side
CLRA exposure in these letters is usually a mismatch between what shoppers are told and what tags do. Captain Compliance’s consent manager is built to present a clear choice and to block marketing pixels until that choice is recorded. Privacy-notice execution and signed consent receipts give you a contemporaneous record of what the banner said. The scanner can show whether the Meta Pixel still behaves like the old, contradicting version of the site. On eligible plans, Compliance Shield can cover qualifying claims arising from consent and disclosure functions when the platform is properly deployed. Those tools do not decide whether a particular buyer has CLRA standing. They reduce the chance that your own website copy will supply the misrepresentation.
Frequently asked questions
Does visiting a website count as a CLRA transaction?
Not by itself. The statute is built around consumer transactions for goods or services. A letter that treats mere browsing as enough is taking a position many courts have not accepted. A completed purchase is a different fact.
If we receive a CLRA notice, do we have to pay the demand to “cure”?
No. The statute gives the business an opportunity to rectify the alleged goods or services. What an appropriate correction looks like is a question for counsel. Paying an opening settlement number is not the only possible response, and it is not required merely because a letter mentioned section 1782.
Is the CLRA the same as the UCL?
No. The CLRA is limited to specified practices in consumer transactions and has its own notice and remedy rules. The UCL is broader, covers unlawful, unfair, or fraudulent business acts, and generally authorizes restitution and injunctive relief rather than damages. Letters list both because they overlap, not because they are identical.
A shopping statute is not a wiretap statute
The CLRA belongs in a privacy conversation when a business told customers one thing about their information and did another. It does not belong there as an automatic extra count for every Meta Pixel page view. In the demand letters we are seeing, claim (e) is often a supporting actor: another statute to name so the crime-tort exception has a longer list. Read it for what it is. If the claimant never bought anything, say so. If the claimant did, compare the exact promises made at checkout and in your policy with the exact events the pixel sent. That comparison, not the heading “CLRA,” is what decides whether the statute has any work to do.
This article is for educational purposes and is not legal advice.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
