Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
California’s Unfair Competition Law is the state’s catch-all business statute. It can reach acts that are unlawful, unfair, or fraudulent, and it can borrow violations of other laws even when those laws have no private right of action. A recent Meta Pixel demand letter, like others sent to e-commerce and website operators, lists Business and Professions Code section 17200 as claim (k) and treats it as a net that holds the rest of the stack together. We already published a wider explainer on UCL data-privacy lawsuits. This article focuses on how the statute is used in Meta Pixel demand letters, including as support for an ECPA crime-tort theory.
TL;DR
- Section 17200 prohibits unlawful, unfair, or fraudulent business acts or practices. Private plaintiffs must have lost money or property because of the conduct.
- The UCL generally authorizes injunctions and restitution, not compensatory or statutory damages of the CIPA variety.
- Pixel letters use the UCL to recycle every other theory in the packet. Some healthcare tracking cases have allowed UCL claims to proceed at the pleading stage; many ordinary tracking cases struggle on standing.
What the UCL actually allows
California Business and Professions Code section 17200 defines unfair competition to include any unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or misleading advertising. The unlawful prong borrows other laws. The fraudulent prong asks whether members of the public are likely to be deceived. The unfair prong has several judicial formulations and is often the most elastic.
Proposition 64 changed who may sue. A private plaintiff must have suffered injury in fact and lost money or property as a result of the unfair competition. The California Supreme Court explained that standing requirement in Kwikset Corp. v. Superior Court, 51 Cal. 4th 310 (2011). A plaintiff who cannot point to a lost dollar, a lost property interest, or a comparable economic injury does not get to use the UCL as a private attorney general. Public officials still can.
Remedies are also narrower than a demand letter’s tone suggests. The UCL is equitable. Successful private plaintiffs may obtain an injunction and restitution of money or property in which they have an ownership interest. They do not obtain $5,000 per visit just because section 17200 appears in the caption. If a letter’s number is built from CIPA’s statutory damages, the UCL is not what produces that arithmetic.
How Meta Pixel letters use section 17200
In the stacked letters built on ECPA procurement, the UCL is the cleanup count. Anything that might be unlawful under CIPA, CalOPPA, the CLRA, CDAFA, or the FTC Act is restated as an unlawful business practice. Anything that might deceive a consumer about tracking is restated as a fraudulent practice. Anything that seems aggressive about data collection is restated as unfair. One HAR file is asked to travel under all three prongs.
The statute also appears as a purpose for the crime-tort exception, which is a strained use. The UCL is a remedial business statute. Saying that a business intercepted communications in order to violate the UCL often means only that the business intercepted communications and the plaintiff would like that interception declared unlawful. That is the kind of restatement the independent-purpose cases caution against.
Letters further lean on the UCL to rescue statutes that have no private right of action, especially the FTC Act and CalOPPA. Borrowing is a real UCL feature. It is not a free pass. The plaintiff still needs UCL standing, and a court can decline to let a private party use the UCL to enforce a statute that the Legislature or Congress assigned to an agency. Pairing the UCL with the CLRA and with Section 5 of the FTC Act makes the consumer-protection theme louder without solving those problems.
How the claim holds up in tracking cases
Results depend on the injury story. In Doe v. Tenet Healthcare Corp., 789 F. Supp. 3d 814 (E.D. Cal. 2025), the court allowed UCL allegations to proceed at the pleading stage where plaintiffs claimed they lost the benefit of the bargain for confidential health care and that the defendants received value from patient information. That is a healthcare-specific standing theory. It does not automatically transfer to a shopper who viewed a product page and paid nothing extra because a pixel fired.
In more ordinary tracking disputes, defendants often argue that the plaintiff lost no money: the website was free to browse, the prices did not change, and any value in the data was not something the plaintiff otherwise would have sold. Plaintiffs answer that they overpaid, that they would not have used the site, or that their information itself was taken property. Courts have gone both ways, which is why standing memos in these cases run long. Recipients should not assume the UCL is toothless, and they should not assume it is a damages statute. Compare that posture with the sharper private risk under CIPA as opposed to the CCPA: one statute supplies statutory damages, the other often does not.
The fraudulent prong can be more straightforward when the privacy policy or banner clearly contradicted the tags. “Likely to deceive” is an easier sentence to write if the site said it did not share personal information and the Meta Pixel sent hashed emails. It is a harder sentence if the policy described advertising partners and the pixel did only what that policy described, even if a particular visitor never read it.
Practical steps if the UCL is claim (k)
- Identify the economic-injury theory in the letter. If there is none, standing is the first defense for counsel to evaluate.
- Do not treat a UCL heading as extra statutory damages. Ask what restitution the sender thinks is available and what money moved from the claimant to the business because of the pixel.
- Fix deceptive mismatches anyway. A policy or banner that does not match the Meta Pixel is a problem under the fraudulent prong and under several other statutes in the stack.
- Keep healthcare, financial, and children’s facts separate. Benefit-of-the-bargain theories have had more room to breathe when the underlying service was confidential care rather than ordinary retail browsing.
How Captain Compliance reduces UCL facts without promising a standing win
UCL exposure in these letters is mostly about practices that can be called unlawful because another statute was allegedly broken, or deceptive because the site’s words and tags disagreed. Captain Compliance’s consent manager is designed to make the tags follow the words: marketing pixels wait, Global Privacy Control is honored, and a receipt records the choice. The scanner tests whether that is actually happening. A DSAR portal and current notices support the “what we told people and what control they had” half of the story. Compliance Shield can financially back qualifying consent and disclosure claims when the platform is properly deployed. None of that decides whether a particular plaintiff lost money. It does reduce the underlying practice the UCL would borrow.
Frequently asked questions
Can the UCL revive a statute that has no private right of action?
Sometimes it can borrow another law as the “unlawful” act, but the plaintiff still needs UCL standing and a court may hesitate when the borrowed statute was assigned to a public enforcer. Borrowing is not automatic private enforcement of the FTC Act or CalOPPA.
If we lose a UCL claim, do we owe $5,000 per visit?
Not under the UCL itself. That figure comes from CIPA’s civil-penalty provision, not from section 17200. UCL remedies are injunctions and restitution.
Is “benefit of the bargain” enough for standing?
It was enough to survive a motion to dismiss in at least one healthcare pixel case, where plaintiffs said they paid for confidential care. Whether a similar story works for an ordinary retail visit is a different question and should not be assumed from the healthcare ruling.
A catch-all is not a second damages statute
The UCL is in these letters because it is always in California consumer complaints. It can matter, especially if the site’s disclosures were misleading or if another statute in the stack is a clean borrow. It cannot, by itself, turn a page view into a $5,000 invoice, and it cannot proceed in private hands without an economic injury. When claim (k) appears, read it last, after you have tested the statutes it is trying to recycle. If those statutes are weak and the claimant lost no money, the net may be empty. If those statutes describe a real mismatch between your promises and your pixel, the UCL is one more reason to fix the mismatch rather than to argue about labels.
This article is for educational purposes and is not legal advice.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
