Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
California’s Comprehensive Computer Data Access and Fraud Act is the state’s main computer-crime statute. It reaches a long list of acts involving access to computers, data, and networks without permission, and it includes a private right of action. A recent Meta Pixel demand letter, like others sent to e-commerce and website operators, lists Penal Code section 502 as claim (h) and treats the pixel’s cookies and scripts as an intrusion into the visitor’s machine. We have already written at length about the broader CDAFA web-tracking litigation wave and about the statute’s structure and case law. This article looks at a more specific use: how Meta Pixel demand letters deploy section 502 as part of an ECPA claim stack.
TL;DR
- CDAFA prohibits various kinds of unauthorized access to computers and data and allows certain victims to sue for damages and, in some circumstances, attorney’s fees.
- Pixel letters argue that placing cookies or running scripts on a visitor’s browser is access “without permission,” and sometimes that a cookie is a “contaminant.”
- Results vary. The Ninth Circuit allowed CDAFA claims to proceed in the Facebook tracking litigation, while the Eastern District of California dismissed a CDAFA claim in Doe v. Tenet Healthcare for lack of alleged damage.
What section 502 actually prohibits
California Penal Code section 502 is long because it was written to cover many forms of computer misuse. The subdivisions most often borrowed in tracking complaints include taking, copying, or using data without permission; accessing a computer or network without permission; and introducing a computer contaminant. Section 502(e) creates a civil action for owners or lessees of the computer, system, or data who suffer damage or loss, with the details depending on which prohibition is invoked.
“Without permission” is the hinge. In Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), the Ninth Circuit held that a defendant who continued to access Facebook after a cease-and-desist letter revoked permission could be liable. Permission can exist and then be taken away. It can also be implied by the design of a public website that invites a browser to connect. The awkwardness in a pixel case is immediate: the visitor asked the website to send a page, and the website responded with HTML that included a script. Who accessed whose computer without permission, the visitor or the business?
Plaintiffs answer that Meta, procured by the business, accessed the visitor’s browser by writing cookies and reading identifiers the visitor did not agree to share. That is a more coherent story than saying the website trespassed on a machine that had just requested its homepage, but it still has to satisfy the statute’s permission and injury language. We discussed a similar expansion in our piece on how unauthorized-access theories have been aimed at ad pixels.
How demand letters use CDAFA in a Meta Pixel stack
In the letters built around ECPA procurement, section 502 is both a standalone civil claim and another unlawful purpose for the crime-tort exception. Counsel point to the _fbp cookie, to JavaScript executing in the browser, and to data sent to Meta. They argue that this was access to the visitor’s computer without permission, copying of data without permission, and sometimes introduction of a contaminant. The same facts support the companion trespass-to-chattels theory.
The contaminant theory is particularly sweeping. If an ordinary advertising cookie is a contaminant, then a large share of the commercial web is a computer crime. Courts have been reluctant to read the statute that broadly, because the contaminant provisions were aimed at malware and similar unwanted code, not at every script a website sends in response to a page request. Letters still include the word because it sounds like an infection.
Injury language gets less attention in the letters than it should. Some CDAFA theories require damage or loss. Plaintiffs may allege that their device’s resources were used, that their data has value, or that they spent time investigating. How much of that a court will accept is one of the live questions in tracking cases.
How the claim has fared
The case law does not point in a single direction. In In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), the Ninth Circuit allowed CDAFA claims to proceed and treated alleged unjust enrichment from valuable browsing data as enough, at that stage, to satisfy the statute’s standing-style injury requirement. That decision is a legitimate plaintiff-side citation when the alleged access is hidden, extensive, and inconsistent with what users were led to expect.
In Doe v. Tenet Healthcare Corp., 789 F. Supp. 3d 814 (E.D. Cal. 2025), the court went the other way on CDAFA. It dismissed the claim because the plaintiffs had not plausibly alleged damage or loss to a computer system or data of the kind the statute requires. The same order, which letters cite for its ECPA discussion, is therefore also a citation for the defense on claim (h). A complete reading of the Tenet order is more useful than a sentence that mentions only the claims that survived.
Those two results can coexist because the complaints, the data involved, and the injury allegations were not the same. A letter that cites only Facebook tracking, and not Tenet’s CDAFA dismissal, is choosing the half of the picture that helps the sender.
Practical steps if section 502 is in the letter
- Map every script that writes to the browser before consent. Cookies, local storage, and fingerprinting scripts are what counsel will call the access or the contaminant.
- Preserve permission evidence. Banner copy, click records, and privacy-policy versions speak directly to whether any access was “without permission.”
- Do not rely on “the visitor came to our site” as a complete theory of permission for third-party tags. Permission to load a page is not obviously permission for Meta to set a long-lived identifier.
- Gate third-party marketing tags. The cleanest way to reduce a CDAFA story is to stop the code from running until there is a documented choice.
How Captain Compliance addresses the access story
CDAFA letters are, at bottom, arguments about what code ran on someone else’s device and whether that person agreed to it. Captain Compliance’s consent manager is built to stop marketing pixels and their cookies from running until a choice is recorded, and to honor Global Privacy Control. The scanner is designed to show whether those controls hold after a rejection. Consent receipts help counsel show what permission existed and when. On eligible plans, Compliance Shield can financially back qualifying claims tied to consent execution when the platform is properly deployed and not bypassed. Those measures do not rewrite section 502. They change the permission facts the statute asks about.
Frequently asked questions
If we invited the visitor to our website, didn’t they give permission?
They gave permission to load the page you offered. Whether that invitation also authorized a third-party advertising company to write identifiers on their device is the disputed question. Do not assume a homepage visit is a blanket grant of permission for every tag in your manager.
Is a cookie a “contaminant” under CDAFA?
Plaintiffs sometimes say so. The contaminant provisions were aimed at unwanted code that modifies or damages systems, not at every text file a browser is designed to store. Courts have not treated ordinary advertising cookies as malware by default, and a letter that relies heavily on that label is taking an aggressive reading.
Does a CDAFA claim require the same kind of harm as trespass to chattels?
Not exactly, but both theories have pushed courts to look for something more concrete than the mere existence of a tag. Tenet dismissed CDAFA for lack of alleged damage and dismissed trespass for lack of device impairment. Other courts have accepted broader allegations of data value or unjust enrichment, at least at the pleading stage.
Unauthorized access is a specific statutory idea
CDAFA is a real statute, and it has been used in real tracking cases. It is also easy to over-read. Not every script that runs in a browser is an unauthorized intrusion, and not every cookie is a contaminant. In Meta Pixel demand letters, claim (h) is part of a larger effort to describe advertising technology as a computer crime so that federal consent defenses fall away. Read the permission facts, read the injury facts, and read the cases that cut both ways. Then look at your tag manager. If marketing code is writing to devices before anyone has said yes, you do not need a philosophy of section 502 to know that the configuration should change.
This article is for educational purposes and is not legal advice.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
