Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
California’s breach-notification statute is meant for a specific emergency: computerized personal information has been acquired without authorization because the security of a system was breached, and people need to be told so they can protect themselves. A recent Meta Pixel demand letter, and others sent to e-commerce and website operators, tries to use that statute as claim (j). The argument is that sending page-view data to Meta was an unauthorized acquisition and therefore a breach the business failed to announce. It is one of the least convincing translations in the stack, and courts have already said so in a pixel case that the same letters cite for other propositions.
TL;DR
- Civil Code section 1798.82 requires notice after a “breach of the security of the system,” meaning unauthorized acquisition of computerized personal information that compromises security, confidentiality, or integrity.
- A business that deliberately installs the Meta Pixel is usually authorizing Meta to receive the events that pixel is designed to send. That is a vendor relationship, not a hack.
- In Doe v. Tenet Healthcare, the court dismissed a Consumer Records Act theory under section 1798.82 because the plaintiffs had not alleged a system breach.
What section 1798.82 actually requires
California Civil Code section 1798.82 applies to a person or business that conducts business in California and owns or licenses computerized data that includes personal information. If the business discovers a breach of the security of the system, it must notify affected California residents in the most expedient time possible and without unreasonable delay, subject to legitimate law-enforcement needs. The statute defines a breach as unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the business.
Personal information, for this section, is a defined list. It includes an individual’s name together with items such as a Social Security number, driver’s-license number, financial-account number plus access code, medical information, health-insurance information, and certain credentials. A Meta Pixel page-view event that contains a URL and a browser cookie is often outside that list entirely. Even when a pixel is configured to send an email address or other identifiers, the harder question remains: was there unauthorized acquisition after a security breach, or did the business configure a tool that sent data to a company it chose?
Section 1798.82 is also easy to confuse with a different California number. Civil Code section 1798.150, part of the CCPA, creates a limited private right of action after certain breaches involving nonencrypted and nonredacted personal information and a failure to maintain reasonable security. That is not the section these letters are numbering as claim (j), and it has its own elements. Mixing the two statutes makes a pixel look more like a ransomware incident than it is.
How letters recast a pixel as a breach
In the Meta Pixel letters built on ECPA procurement, section 1798.82 is used in two ways at once. First, counsel say the transmission to Meta was itself a breach because the visitor did not authorize it. Second, they say the business violated the statute by failing to send breach notices. The missing notice then becomes another unlawful act that can be offered as a crime-tort predicate or borrowed by other consumer statutes. The same packet may also allege that the privacy policy failed CalOPPA’s disclosure rules, as if every incomplete notice were evidence that something extra, and unreported, had gone wrong.
The exhibit is still a HAR file or an off-Facebook activity export, not a forensic image of a ransomed server. That is a tracking-and-disclosure problem of the kind we describe in our overview of pixel litigation risks, not a ransomed-system problem. Nobody has to allege that an attacker bypassed a firewall. The “unauthorized” part is said to come from the visitor’s perspective: the visitor did not agree, therefore Meta’s receipt was unauthorized. That reading quietly deletes the statute’s focus on a breach of the security of the system. A company can share data in ways that raise consent and disclosure problems without having suffered a security incident.
How courts have treated the theory
The Eastern District of California addressed this directly in Doe v. Tenet Healthcare Corp., 789 F. Supp. 3d 814 (E.D. Cal. 2025). Plaintiffs alleged that tracking technologies sent patient information to companies such as Meta. They also alleged a Consumer Records Act claim based on section 1798.82. The court dismissed that claim because the complaint did not plead a security breach or unauthorized acquisition of the kind the statute describes. Leave to amend was granted, which means the court did not say no plaintiff could ever plead a breach in a tracking case. It did say that merely describing pixel transmissions was not enough. The order is public, and it is the same decision many letters cite as proof that ECPA claims can survive. Recipients should read both halves.
That result tracks the statute’s words. If a hospital, retailer, or publisher chooses to install a pixel, Meta’s receipt of the configured events is authorized by the business even if it is a surprise to the visitor. The visitor may have other claims about consent or secrecy. Those claims live under other headings in the letter. They do not automatically turn the marketing department’s tag into a notifiable breach.
There are hypotheticals that would look more like section 1798.82. A stolen laptop, an exposed backup, or a vendor account that was hijacked could involve tracking data and still be a breach. A demand letter about an intentionally installed pixel on a functioning website is not describing those facts. If your company actually had a security incident, that is a different file and should be handled under your incident-response plan, not analogized away because some pixel letters misuse the statute.
Practical steps if claim (j) appears
- Do not send a breach notice just because a letter used the word “breach.” Notice to residents, the Attorney General, and sometimes the press has legal consequences of its own. Counsel should decide whether section 1798.82 was actually triggered.
- Separate consent problems from security incidents. If the pixel sent too much data too soon, that is a tracking and disclosure issue. Document it that way.
- Confirm whether any data on the statutory personal-information list was involved. Name-plus-financial-account or medical information is a different analysis from a marketing page view.
- If you do have an unrelated security incident, do not let this letter distract you from it. Follow the statute that actually applies to that incident. A tag audit is still worth doing, but it is not a substitute for incident response.
How Captain Compliance helps without calling a pixel a hack
Captain Compliance is not a breach-coaching service for ransomware, and it should not be described as one. What it can do is reduce the chance that advertising tags will send information a visitor never chose to share, which is the conduct these letters are mislabeling as a breach. The consent manager can block the Meta Pixel until a choice is recorded. The cookie scanner can show what leaves the browser. A DSAR portal gives people a lawful way to ask what you hold, which is a more appropriate response than a breach notice no statute required. Compliance Shield can cover qualifying consent and notice claims when the platform is properly configured; it does not convert an ordinary pixel into a notifiable incident, and it does not replace cybersecurity controls for actual intrusions.
Frequently asked questions
Do we have to notify the California Attorney General because we use the Meta Pixel?
Not under section 1798.82 merely because the pixel exists. That statute is triggered by a breach of the security of the system involving covered personal information. Using a vendor tool you installed is not, without more, that event.
Is this the same as a CCPA breach lawsuit?
No. Section 1798.150 is a different provision with a private right of action tied to certain unencrypted personal information and reasonable-security failures. Letters that blur 1798.82 and 1798.150 are stacking numbers. Ask which section they mean and which elements they think they can prove.
Why would a letter cite a statute that Tenet already dismissed on similar facts?
Because the letter is building a long list of unlawful purposes, and because not every recipient will read the rest of the Tenet order. A dismissed theory can still appear in a template. That is a reason to read citations against the opinions, not a reason to assume every listed statute is a live claim.
A vendor you hired is not an intruder in your system
Breach-notification law exists so people can freeze credit, reset passwords, and watch for medical-identity theft after someone breaks in or a system fails. It is a poor description of a marketing tag the business pasted into its own pages. In Meta Pixel demand letters, claim (j) takes a statute about unauthorized acquisition and applies it to an acquisition the business authorized. Courts have been willing to say so. Recipients should not send a breach notice out of panic, should not ignore a real security incident if one exists, and should handle the pixel itself as a consent and disclosure problem. That is the box it actually belongs in.
This article is for educational purposes and is not legal advice.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
