Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
The California Online Privacy Protection Act is one of the country’s older website-privacy rules, and it is easy to forget because newer laws get more attention. It is not obsolete. CalOPPA still requires many commercial sites that collect personal information from California residents to post a privacy policy and to describe certain collection and sharing practices. A recent Meta Pixel demand letter, like others sent to e-commerce and website operators, lists the statute as claim (i) and argues that a policy which never mentions Meta, or which describes sharing too vaguely, violated that duty. We already maintain a general explainer, CalOPPA: What Is It and How to Comply. This article is about a more specific problem: how those disclosure rules are being used inside Meta Pixel demand letters.
TL;DR
- CalOPPA requires covered commercial websites to post a privacy policy that, among other things, identifies categories of personal information collected and categories of third parties with whom the operator may share that information.
- The statute is enforced by the California Attorney General and does not itself create a private right of action. Private letters typically borrow it through the Unfair Competition Law or as a crime-tort predicate.
- A policy that never names advertising platforms, or that contradicts a live Meta Pixel, is still a genuine compliance failure even if CalOPPA is not the statute that will produce a damages award.
What CalOPPA actually requires
California Business and Professions Code section 22575 tells an operator of a commercial website or online service that collects personally identifiable information about California consumers to conspicuously post a privacy policy. The policy must, among other items, identify the categories of information collected through the site and the categories of third-party persons or entities with whom the operator may share that information. It must also describe how the operator notifies consumers of material changes and, since later amendments, how the site responds to “do not track” signals or other browser mechanisms.
Personally identifiable information, for CalOPPA’s purposes, includes obvious identifiers such as name, email address, and other data that can identify a particular consumer. A Meta Pixel configuration that sends hashed emails, or that ties a browser to an advertising identifier, is squarely in the statute’s neighborhood. Even a pixel that sends only URLs and a cookie ID raises the question whether the operator is sharing information about a consumer with a third party and, if so, whether the policy said so.
CalOPPA does not say that every third party must be listed by legal entity name, but “categories” is not a license to be meaningless. “Service providers” or “partners” may be too thin if the actual practice is to send browsing events to a social-media advertising platform. The safer reading, especially after California’s later privacy statutes trained consumers to expect more detail, is to describe advertising, analytics, and social-media partners in terms a reader can understand. Our privacy policy compliance audit guide and our notes on drafting a CPRA privacy policy cover that drafting work in more depth than CalOPPA alone requires. In a demand-letter fight, the older statute is still the one counsel has numbered as claim (i).
How letters use a missing Meta disclosure
In the stacked Meta Pixel letters, CalOPPA is usually offered as evidence that the business failed to tell the truth about sharing. Counsel compare the policy that was posted on the alleged visit dates with a HAR file showing requests to Meta. If the policy is silent, or if it says the business does not share personal information, the letter calls that a CalOPPA violation. The same comparison supports CLRA misrepresentation theories and, when the letter turns to notice after an alleged “breach,” Civil Code section 1798.82.
Because CalOPPA has no private damages action, the letter needs somewhere else to take the alleged violation. Two destinations are common. One is California’s Unfair Competition Law, which can borrow another statute as the “unlawful” act if the plaintiff also has UCL standing. The other is the ECPA crime-tort exception: the interception was supposedly carried out in order to violate CalOPPA. The second use is especially awkward. A disclosure statute is about what you say on your website, not about a hidden purpose for intercepting a communication. Using an omitted paragraph in a privacy policy as the criminal or tortious purpose of a pixel can look like the circular restatement courts have warned against.
Still, the factual point is often fair. Plenty of sites installed the Meta Pixel through a tag manager and left up a policy written before anyone in marketing thought about events, advanced matching, or off-Facebook activity reports. That gap is what makes claim (i) easy to type.
How strong is the theory?
As a standalone private lawsuit, CalOPPA is weak because the Legislature did not create a private right of action. The Attorney General can enforce it. Private plaintiffs generally have to borrow it. As a borrowed UCL predicate, it still requires economic injury under Proposition 64, which is a separate and often difficult showing in a pixel case. As a crime-tort predicate, it is one of the thinner theories in the stack unless the plaintiff can explain how an incomplete policy was the purpose of the interception rather than a parallel compliance failure.
None of that is a reason to leave the policy inaccurate. CalOPPA’s core demand is modest and old: tell people what you collect and whom you may share it with. A business that cannot satisfy that demand will have a harder time with newer California rules as well, including notice and “share” concepts under the CCPA and CPRA. Demand letters like to treat CalOPPA as if it were CIPA. It is closer to a homework assignment the site should have completed years ago.
Practical steps if CalOPPA is claim (i)
- Retrieve the policy that was live on the alleged dates, not only the current draft. Letters will attach screenshots. You should have the official historical version.
- Make a two-column list: what the Meta Pixel (and other advertising tags) actually send, and what the policy said about collection and sharing. Any cell that does not match is a drafting task and, if the letter proceeds, an exhibit.
- Name advertising and social-media platforms in category language a shopper can understand. If you use Meta, say that you share information with social-media and advertising partners for measurement and ads, and describe the kinds of events involved.
- Keep the policy and the tag manager on the same update cycle. A new pixel without a policy edit is how this claim gets written.
How Captain Compliance supports the disclosure side
CalOPPA is a notice statute, so the useful tools are the ones that inventory tags and keep notices aligned with them. Captain Compliance’s scanner is built to show which pixels and cookies are present, including Meta’s. The consent manager can prevent those tags from running until a recorded choice exists, which is more than CalOPPA requires but is what later laws and these letters both focus on. Privacy-notice execution is part of the platform’s compliance functions, and Compliance Shield can cover qualifying claims connected to notice and consent when the software is properly deployed. A scanner will not draft every sentence of your policy for you. It will make it harder to claim you did not know Meta was on the site.
Frequently asked questions
Does naming “analytics providers” satisfy CalOPPA if we also use Meta for ads?
It may not. Meta’s advertising pixel is not only analytics. If you share events with a social-media advertising platform, the category language should cover advertising and social-media partners, not only internal site measurement.
Did the CCPA replace CalOPPA?
No. The CCPA and CPRA added a much larger set of rights and duties. They did not erase the older requirement to post a privacy policy that describes collection and sharing. Many businesses now write one notice that tries to satisfy both, which is sensible, but the older statute can still be cited on its own.
If we update the policy tomorrow, does that cure the letter?
It helps going forward and it is the right thing to do. It does not automatically erase what the policy said on the date the claimant visited. Preserve the old version before you replace it, then fix the current one so the next visit matches the notice.
Tell people what the pixel already tells Meta
CalOPPA is not the statute that usually drives the dollar figure in a Meta Pixel letter. It is the statute that asks whether your public words kept up with your public code. That is a fair question even when the private right of action is missing. If claim (i) appears in a stack, read it as a drafting audit with a litigation caption. Compare the policy to the HAR file, say plainly that advertising partners such as Meta may receive event data, and make sure the pixel no longer does work the policy cannot describe. The citation becomes much less useful to the sender once those two documents agree.
This article is for educational purposes and is not legal advice.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
