Prelitigation Demand for Privacy Rights Violations: Legal Grounds, Settlement Demands, and How Businesses Should Respond

A prelitigation demand for privacy rights violations can arrive without a court filing, a regulator’s investigation or even a complaint from an actual customer. The letter may allege that a website’s search field, advertising pixel, chat widget or session-replay software unlawfully intercepted a visitor’s communications. It may cite several privacy statutes, attach screenshots from browser developer tools and offer to resolve the matter confidentially before litigation begins.

Some of these demands identify real privacy failures. Others rest on contested interpretations of decades-old wiretapping laws or on technical evidence that does not establish every element of the asserted claim. The distinction matters. A company that ignores a credible disclosure of sensitive data risks litigation and further exposure; a company that automatically pays every demand may spend money without establishing whether a violation occurred or whether the claimant had standing to sue.

Website privacy disputes have become a sizeable litigation category. Reuters reported in October 2026 that more than 4,700 digital wiretapping lawsuits invoking California law had been filed since 2022, with approximately two-thirds involving the pen-register provision addressed by new legislation. That figure counts filed litigation, not every private demand letter, so the full volume of pre-suit correspondence is harder to measure.

What is a prelitigation demand for privacy rights violations?

A prelitigation demand letter is a written assertion that a business has violated someone’s legal rights and should take specified action before a lawsuit is filed. In website privacy matters, the requested action is often payment of a settlement, preservation of records, changes to tracking practices, or a combination. The letter may be written by a law firm or by a claimant representing themselves.

Businesses and attorneys should separate three questions immediately: What did the technology actually transmit? Which statute applies to that transmission? What remedy, if any, may this particular claimant seek? Demand letters frequently compress those questions into a single accusation, even though each requires different evidence.

Why ordinary website tools appear in privacy demands

Modern websites exchange data with more companies than their operators sometimes realize. An analytics tag can transmit a page URL, IP address, device information and event identifiers. An advertising pixel may receive events associated with a particular visitor or account. A chat provider can receive typed messages. Session-replay software can reconstruct clicks, scrolling and form interactions, depending on its configuration. A search box may place the entered phrase into a URL or request that a third-party integration subsequently receives.

Those transmissions are not legally interchangeable. A page-view event containing a generic product URL raises different questions from a chat transcript describing a medical condition or a logged-in video-viewing event linked to a persistent Facebook identifier. Similarly, proof that a browser contacted a third-party domain does not, by itself, establish that the vendor acquired the contents of a protected communication, that the acquisition happened contemporaneously, or that the visitor did not consent.

The technical investigation should identify the actual request payload, the receiving domain, the script or tag that generated it, the user’s consent state, and the vendor’s role. It should also determine whether a tracker executed before a choice was presented, after a rejection, or only after affirmative permission. A screenshot showing a request is useful evidence, but it is a starting point rather than a complete legal finding.

California’s Invasion of Privacy Act: Sections 631, 632 and 638.51

The California Invasion of Privacy Act (CIPA), Penal Code Section 631, addresses certain interception and use of communications, as well as assistance with prohibited interception. Plaintiffs have invoked it against chat features, search fields, session-replay scripts and marketing tools that allegedly transmit the contents of communications to third parties without consent. Whether the website operator is a party to the communication, whether a vendor acts as an independent eavesdropper rather than a service provider, and what was actually acquired are often central disputes.

Section 632 concerns intentional recording or eavesdropping on confidential communications under specified conditions. It is not enough to describe every website interaction as confidential. Attorneys must evaluate whether the communication falls within the provision and whether the circumstances support a reasonable expectation that it was not being overheard or recorded in the relevant legal sense.

Section 638.51 governs pen registers and trap-and-trace devices. Plaintiffs argued that tools collecting IP addresses, device identifiers and routing or request metadata should qualify. Defendants challenged the application of telephone-era definitions to ordinary web operations, and courts did not uniformly resolve that dispute. Holland & Knight surveyed the disagreement in February 2026.

As of October 2026, Section 637.2 provides a civil damages framework of $5,000 per violation or three times actual damages, whichever is greater, for qualifying claims. A quoted statutory figure is not an automatic settlement entitlement. The plaintiff still must establish the applicable statutory violation, satisfy procedural requirements and defend the proposed measure and number of violations. Federal cases also require Article III standing when filed in federal court.

SB 690 changes pen-register demands beginning January 2027

California Governor Gavin Newsom signed Senate Bill 690 on September 30, 2026. Effective January 1, 2027, it restricts private actions for Section 638.51 violations arising from conduct on an internet website, online application or mobile application, reserving those actions to the California attorney general. The measure also reaches specified pending lawsuits commenced on or after January 1, 2025. The precise applicability to a particular dispute, including procedural and retroactivity questions, requires legal analysis.

This is a material change to the settlement economics of website pen-register claims. It does not erase Section 631 or Section 632, does not supply a universal immunity for tracking and does not mean every pre-2027 demand is automatically invalid. Defense counsel should examine whether the letter relies solely on Section 638.51 or also states an independent interception, confidentiality or federal claim. DLA Piper’s October analysis explains the operative date and remaining causes of action.

Federal Electronic Communications Privacy Act and Wiretap Act demands

Some demand letters invoke the federal Wiretap Act, 18 U.S.C. Section 2511, part of the Electronic Communications Privacy Act (ECPA). These claims often allege intentional interception of electronic communications by third-party scripts. The law contains a party-consent exception, including where a party to the communication consents to interception, subject to a statutory exception involving a criminal or tortious purpose. Plaintiffs and defendants disagree over when that exception applies to commercial tracking practices.

Timing also matters. A claim about interception during transmission differs from a claim about later access to stored information. Lawyers must identify which statute and legal theory fit the actual sequence of events, rather than using the word ‘wiretap’ to describe any collection of internet data.

Under 18 U.S.C. Section 2520, qualifying civil remedies can include damages, appropriate equitable relief and attorneys’ fees. The statutory damages calculation for certain violations involves the greater of $100 per day of violation or $10,000, with important statutory qualifications and case-law questions. A demand that simply multiplies $10,000 by every visitor or network call, without addressing the law’s requirements, should not be treated as a verified exposure calculation.

Video Privacy Protection Act demands involving pixels and online videos

The Video Privacy Protection Act (VPPA), 18 U.S.C. Section 2710, restricts certain disclosures by video tape service providers of personally identifiable information concerning consumers. Though enacted in 1988, it has become central to disputes about online video players and tracking pixels that allegedly share video titles or viewing activity alongside identifiers connecting an event to a person.

A VPPA demand requires more than proof that a website contains a video and uses Meta Pixel. The analysis includes whether the defendant is a qualifying provider, whether the claimant is a protected consumer, whether personally identifiable video information was knowingly disclosed, and whether a statutory exception or valid consent applies. Section 2710 permits a civil action and provides for actual damages subject to a $2,500 liquidated-damages minimum, alongside other possible relief. That figure is not an automatic payment for every video play.

The scope of ‘consumer’ is before the U.S. Supreme Court in Salazar v. Paramount Global, No. 25-459. The case concerns a 247Sports newsletter subscriber who alleged that viewing information and a Facebook identifier were disclosed through a tracking pixel. The Sixth Circuit adopted a narrower understanding of what kind of subscription qualifies under the VPPA; the Supreme Court heard oral argument on October 14, 2026. The case remains pending as of this article’s publication date. A demand relying on broad newsletter-subscriber theories should acknowledge that unsettled issue rather than describe it as resolved law.

Publishers, streaming services, sports sites, media businesses and companies with substantial video libraries should inspect precisely which events fire on video pages and what identifiers accompany them. General disclosures buried in a privacy policy should not be presumed sufficient without considering the VPPA’s consent requirements.

What courts have actually said about consent, tracking and standing

There is no single judicial rule that all cookies are unlawful or that routine website analytics are categorically protected. The decisions turn on the statute, allegations, technology and procedural posture.

In Javier v. Assurance IQ, LLC, the Ninth Circuit vacated a dismissal and returned a CIPA dispute for further proceedings where the district court had relied on a theory of retroactive consent. The May 31, 2022 memorandum is a reminder that presenting consent after a disputed interception may not resolve an earlier collection event. It is not a judgment that every recording technology violates CIPA.

In Popa v. Microsoft Corp., No. 24-14, the Ninth Circuit affirmed dismissal for lack of Article III standing on August 26, 2025. The plaintiff alleged that session-replay technology captured her interactions with a pet-supply website. The court found the alleged collection, involving ordinary shopping preferences and limited address information, insufficiently analogous to the concrete harms traditionally recognized by privacy torts. The court expressly distinguished circumstances involving more sensitive information.

That holding is valuable for defendants evaluating federal jurisdiction and actual injury, but it does not extinguish every statutory privacy claim, establish a universal immunity for session replay or necessarily control state-court standing standards. A sensitive health inquiry, a detailed chat transcript and a generic pet-product browsing event require different assessments.

Serial plaintiffs, standardized letters and the economics of settlement pressure

One feature of this market is the repeated use of similar technical exhibits and legal theories against many unrelated businesses. Harris Beach Murtha described demand letters associated with self-represented claimant Vivek Shah and with Tauler Smith LLP in a July 2026 article. The letters discussed common website tools, transmission of browser and device information, and threatened lawsuits seeking relief under CIPA.

Jeffer Mangels & Mitchell documented how Shah’s letters commonly relied on browser developer-tool captures showing search terms or form inputs in requests to external domains. The dispute is not whether a screenshot can be created; it is what legal conclusions follow from the transmission, the visitor’s circumstances and the statute invoked. Captain Compliance’s own IAPP presentation on serial privacy plaintiffs discusses the recurring response problems facing privacy teams.

Describing a plaintiff as a frequent filer is a factual observation, not proof that an individual allegation is false or brought in bad faith. Nor does a private settlement proposal establish extortion. A properly supported claim may be settled to avoid the cost of litigation; a weak claim may still impose enough defense expense to create payment pressure. Businesses should evaluate the evidence rather than relying on labels applied to the sender.

How to evaluate whether a privacy demand has merit

Begin with the letter itself. Identify the sender, represented person, proposed cause of action, visit date, relevant URLs, alleged disclosures, settlement sum, response deadline and threatened forum. Confirm that the sender can be identified and that any named legal representative is authorized to act. Check whether the letter describes the claimant’s actual interaction or only a hypothetical browser test.

Next, independently replicate the alleged event under controlled conditions. Use a clean browser session, document the location and applicable consent configuration, record timestamps and preserve the relevant network requests. Compare tests before any consent choice, after rejection, after acceptance and after subsequent withdrawal. Inspect tag-manager triggers, third-party scripts, server-side tags and vendor configuration. If the letter asserts the disclosure of a search phrase, determine whether the phrase appeared in the request URL, headers, body or merely in a local interface.

Then map technical facts to statutory elements. Which alleged communication was intercepted? Was the recipient a party, an agent or an independent third party? Was consent obtained before collection? Did the claimant encounter the disputed code? Does the transmission disclose contents or only metadata? Does the statute require a confidential communication or qualifying consumer relationship? Is there a jurisdictional nexus? For a federal filing, is the pleaded injury concrete under applicable standing law?

Finally, check whether the demanded relief matches the applicable statute. Confirm the operative dates of amendments, who has a private right of action, the permissible damages methodology, limitations periods, and any procedural prerequisites. The most expensive number in the letter may be a theoretical ceiling built from assumptions that have not been established.

How businesses should respond to a prelitigation privacy demand

Preserve first, investigate promptly. Route the demand to legal counsel and the responsible privacy or security team. Preserve the original letter, attachments, website configuration, tag-manager version history, consent logs, vendor contracts and available technical records. Counsel should determine whether a litigation hold is appropriate. Avoid silently deleting logs or making undocumented changes that prevent reconstruction of the relevant site behavior.

Separate remediation from settlement. If investigation reveals a marketing tag transmitting sensitive form content without appropriate controls, address that practice on its own merits. Preserve evidence before making technical changes. Stopping a problematic data flow does not necessarily resolve an earlier alleged violation, and making a fix is not itself an admission of liability.

Use counsel to assess defenses and exposure. Legal analysis should cover statutory elements, consent, third-party status, standing, jurisdiction, possible arbitration agreements, limitations, damages and the impact of SB 690 where relevant. A company should not admit a statutory violation merely because a tool is installed. Equally, it should not claim that a privacy policy or generic cookie banner conclusively authorizes every downstream data transfer.

Respond on a controlled timetable. Acknowledgment can be appropriate without accepting the claimant’s description. Counsel may ask for the exact visit dates, tested pages, alleged intercepted content, complete technical exhibits, supporting legal authorities and calculation of requested damages. Whether to disclose the company’s own findings is a strategic decision shaped by privilege, preservation duties and the prospect of litigation.

Examine settlement terms carefully. If resolution is appropriate, evaluate the scope of release, identity of releasing parties, covered time periods, confidentiality, non-disparagement provisions, representations, dismissal obligations if litigation exists, and any effect on other individuals’ claims. A one-person release ordinarily does not bind unidentified website visitors or regulators. Settlement does not replace remediation.

Review insurance and contractual obligations. Cyber, technology errors-and-omissions and other policies may contain different notice requirements, exclusions, defense provisions and definitions of privacy claims. Review contractual indemnities and vendor obligations, but do not assume an insurer or vendor will cover a tracking-related demand. Prompt reporting may matter even before a lawsuit is filed.

Why a cookie banner alone may not solve the problem

Consent interfaces are only as effective as the technical behavior behind them. A website can display a professionally designed banner while its analytics or advertising scripts fire before the visitor chooses. It can offer a reject button that leaves a tracker active, or suppress browser-side tags while server-side connections continue to transmit the same events. A consent-management platform cannot cure an implementation that ignores its signals.

A defensible deployment starts with an inventory of scripts, cookies, pixels, embedded media, chat services, session-replay tools and server-to-server transfers. Each should have a documented purpose, lawful basis where required and consent or opt-out behavior appropriate to the governing law. The privacy notice must align with what actually runs. Sensitive pages and forms deserve special attention because seemingly small event payloads can reveal information a business never intended to share.

Global Privacy Control signals, jurisdiction-specific opt-out rules and federal wiretap consent questions are related but distinct. Honoring an opt-out is not always the same as obtaining prior consent to an interception, and neither question is resolved solely by the existence of a privacy policy. Technical testing should verify the relevant behavior for each jurisdiction and consent state.

What plaintiffs’ attorneys should establish before sending a demand

Attorneys also need to distinguish a person’s rights from a software-generated hypothetical. Proof that a test string is visible in a developer-tool panel may substantiate a data-flow concern. It does not necessarily show that the claimant suffered the required injury, that an actionable communication was intercepted, or that the statute governs the defendant. Those elements depend on the statute and forum.

Accurate demand letters should also address legislative changes. As 2027 approaches, reliance on website-based Section 638.51 claims without acknowledging SB 690 invites obvious objections. Conversely, defense counsel should not portray the reform as an answer to a separately supported Section 631, Section 632, ECPA or VPPA allegation.

Frequently asked questions about privacy prelitigation demands

Is a prelitigation demand letter the same as a lawsuit?

No. A demand letter proposes or threatens a legal claim; a lawsuit begins when a complaint is filed in court. A letter can still trigger important preservation, response, insurance-notice and business decisions. If formal legal process has been served, court deadlines must be handled separately.

Can a claimant demand $5,000 for a tracking pixel?

A qualifying private CIPA claim may implicate Section 637.2’s $5,000 statutory figure, but proving that a pixel existed does not automatically establish liability. The plaintiff must satisfy the relevant statutory elements and procedural requirements. For website and app Section 638.51 claims, California’s SB 690 significantly changes private enforcement beginning January 1, 2027.

Should a company pay to make the demand go away?

Payment is a legal and commercial decision, not the default response. Some substantiated claims warrant negotiation; others can be challenged. Compare the merits, evidence, likely defense cost, insurance position, release terms and risk of repeat claims. Investigate and correct any actual tracking defect regardless of whether settlement is reached.

Does consent in a privacy policy defeat a CIPA or ECPA claim?

Not necessarily. The applicable law may turn on whether consent was informed, sufficiently specific and obtained before the challenged interception. A linked policy, a displayed banner and a working consent mechanism are different facts. The timing and content of any user choice matter.

Does SB 690 end California website privacy lawsuits?

No. The enacted measure limits private enforcement of one specific CIPA provision for specified website and application conduct. Claims under Sections 631 and 632, federal laws and other applicable legal theories remain possible. The new restriction becomes operative January 1, 2027, with specified retroactive application to pending actions.

What evidence should a company save?

Preserve the letter and exhibits, network records where available, consent logs and versions, relevant webpage and script configurations, tag-manager changes, vendor agreements and communications about the incident. Counsel should coordinate preservation and determine what additional material is legally required.

Reducing the next demand’s factual basis

Prelitigation privacy demands expose a gap between what businesses think their websites collect and what the deployed technology actually sends. Litigation over old wiretapping statutes has made that gap more expensive, but the underlying problem is practical: many companies cannot produce a reliable inventory of their scripts or show what happened when an individual declined tracking.

Captain Compliance provides cookie scanning, consent management, privacy notices and related controls designed to help organizations identify tracking technologies, manage consent choices and document their privacy operations. Those tools can support a defensible implementation, but no vendor can guarantee immunity from a legal claim or replace counsel’s analysis of an actual demand.

For companies receiving a letter now, the immediate priority is evidence: what ran, what data moved, what the visitor agreed to, and what the law requires. For companies that have not received one, answering those questions before a claimant does is a more useful investment than relying on a website banner whose real behavior has never been tested.