Privacy Counsel for Website Ad Pixels, Retargeting Tags and Analytics Disclosures: What to Look For and What to Bring

If you run ads, retargeting or conversion tracking on your website, sooner or later someone will ask a question that your marketing team cannot answer alone: is what these tags collect and share properly disclosed, and is it lawful? When that happens, you need privacy counsel who understands how ad pixels and analytics tools actually work, not just how privacy statutes read on paper.

This guide explains what an attorney reviewing your ad pixels and analytics disclosures actually looks at, which kind of lawyer to hire, what to bring to the first meeting so you are not paying for discovery work, and how to keep your tags and your disclosures aligned afterward. If you need privacy counsel to help just contact us and we can give you a list of preferred privacy attorneys that we have spoken to or worked with that can help with the defense as we help with the software solution to avoid these ongoing litigation claims.

The short answer: who reviews retargeting tags and conversion tracking?

Retargeting tags and conversion tracking are usually reviewed by a privacy attorney with ad tech experience, often working with a litigation attorney if you have received a demand letter or a complaint. Larger companies do this through in-house privacy counsel plus outside counsel. Smaller businesses usually hire a privacy boutique or a firm with a digital advertising practice. In every case, the review goes faster and costs less when the attorney starts from a clean inventory of what your site actually loads, which is where a technical scan and monitoring tool earns its keep.

Why ad pixels became a legal problem

A marketing pixel is a small piece of code, supplied by an advertising or analytics vendor, that runs in a visitor’s browser. It can send the vendor information such as the page viewed, a device or advertising identifier, an IP address, and sometimes what the visitor clicked, searched or watched. Most of the time that is ordinary advertising measurement. The legal exposure comes from the combination of what is sent, to whom, and what visitors were told before it happened.

Plaintiffs’ firms have noticed. According to the litigation tracker Rain Intelligence, more than 1,160 pixel and website-tracking suits have been filed since 2023, including roughly 480 in the first nine months of 2026 alone, which is already more than all of 2025. That volume is why more businesses now treat a pixel review as routine legal hygiene rather than something to do after a demand letter arrives.

The legal theories a privacy attorney will check your tags against

The exact list depends on where your visitors are and what your site does. These are the main theories behind pixel and analytics claims today.

• California wiretapping claims (CIPA Section 631). Plaintiffs allege that a third-party tag intercepts communications between a visitor and your site without consent. This theory is not affected by the new California law described below.
• California pen register claims (CIPA Section 638.51). For several years, plaintiffs argued that cookies, pixels and similar tools are unlawful pen registers or trap and trace devices. On September 30, 2026, Governor Newsom signed SB 690, which removes the private right of action for these claims when they arise from a website or app, effective January 1, 2027, and leaves enforcement of that section to the California Attorney General. Law firms tracking the change are consistent on one point: it narrows the litigation wave rather than ending it, and plaintiffs are expected to shift to other theories.
• The Video Privacy Protection Act (VPPA). Sites that show video and run a pixel that can send viewing information to an ad platform have been a frequent target. The Supreme Court heard argument in Salazar v. Paramount Global on October 14, 2026, on who counts as a consumer under the statute. A decision is expected by mid-2027, and press accounts of the argument differ on which way the justices are leaning, so treat the outcome as open.
• State comprehensive privacy laws. Many states give residents the right to opt out of targeted advertising and the sale or sharing of personal data, and some require businesses to honor browser-based opt-out signals such as Global Privacy Control. An attorney will check whether your banner, your privacy policy and your actual tag behavior agree.
• Health and sensitive data laws. If your site touches health, financial, children’s or other sensitive information, pixels raise a higher bar. Laws such as Washington’s My Health My Data Act and federal rules for health information can apply, and this is the area where a pixel review should never be skipped.
• Deceptive practices. Regulators and plaintiffs both point to privacy policies that say one thing while the tags do another. An inaccurate disclosure can be a problem on its own, even when the underlying tracking would otherwise be permitted.

What an attorney reviews in an ad pixel and analytics disclosure review

A good review is a comparison exercise. The attorney compares four things and looks for gaps between them.

1. What your site actually does. Every tag, pixel, SDK, session replay tool and analytics script that loads, on which pages, and what data it sends to which domain.
2. What visitors were shown. Your cookie banner, preference center and any notice at collection, including what each choice does in practice.
3. What you said in writing. Your privacy policy, cookie policy and any vendor or partner disclosures.
4. What your contracts allow. Your agreements with advertising and analytics vendors, including limits on how they may use the data you send.

The attorney then looks at the highest-risk situations first: tags that fire before consent, opt-outs that do not stop tags from loading, pixels on logged-in, checkout, health or video pages, and policies that describe tracking more narrowly than reality.

Which type of privacy attorney do you need?

Not every privacy lawyer reviews tracking technology day to day. Match the attorney to your situation.

• A privacy attorney with ad tech experience for a proactive review, new campaign launches, or a policy and banner overhaul.
• A privacy litigation defense attorney if you have received a demand letter or a complaint about a pixel. Do not respond to a demand letter before you have spoken with counsel.
• A regulatory or health privacy attorney if your site handles protected health information, financial data, or children’s data.
• Your insurance broker or carrier contact, early, if you have cyber or privacy liability coverage. Notice requirements can be strict.

Questions to ask a prospective attorney

• How many pixel, analytics or session replay matters have you handled in the last two years, on the review side and on the defense side?
• Will you review the live tag behavior, or only the policy documents? Who does the technical testing?
• How do you handle state differences, and do you test Global Privacy Control and opt-out behavior?
• What will you need from us on day one, and what does the review deliver at the end: a memo, a remediation list, redlines of our policy?
• How do you price it: fixed fee for the review, hourly, or a retainer for ongoing monitoring?

What to bring to the first meeting

Arriving with the right materials shortens the engagement and puts the attorney’s hours toward legal judgment instead of fact gathering.

• A current inventory of every tag, pixel and SDK on your site and app, with the owner of each (marketing, product, an agency).
• A record of what data each tag receives, including whether any form fields, search terms, video titles or logged-in data are included.
• Screenshots and configuration records of your consent banner and preference center, and the dates they changed.
• The current and prior versions of your privacy policy and cookie policy.
• Your contracts and data processing terms with advertising and analytics vendors.
• Test results showing how your site behaves when a visitor declines cookies or sends a Global Privacy Control signal.
• Any demand letters, complaints, regulator inquiries or customer complaints about tracking.

What your ad pixel and analytics disclosures should cover

Your attorney will tailor this, but a disclosure that holds up generally does the following.

• Names the categories of tracking technology you use, and the purposes, in plain language.
• Says what categories of personal information are collected through them and which third parties receive it.
• Explains whether your use counts as sharing or selling for targeted advertising under the laws that apply to you, and how a visitor can opt out.
• Describes how you respond to opt-out preference signals such as Global Privacy Control.
• Matches what the banner and tags really do. If a vendor is added, removed or reconfigured, the disclosure changes with it.

That last point is where most problems start. Marketing teams add tags continuously, and a privacy policy written once a year goes stale within weeks.

Where Captain Compliance fits

Captain Compliance is a privacy compliance software and consulting company, not a law firm, and nothing here replaces advice from your own attorney. What we do is produce the facts your attorney needs and keep them current after the review is done.

• Cookie consent management that controls which tags load based on the visitor’s choices, including Global Privacy Control signals. Our consent platform is used on more than 8,000 websites and processes over 50 million consent choices a month.
• Continuous website monitoring that detects new and changed trackers, so your inventory stays accurate between reviews.
• Patrol, our privacy risk monitoring tool, which surfaces tracking behavior that does not match your stated disclosures.
• Dynamic privacy policies and vendor disclosures that update as your technology changes, so your written statements keep matching your site.

Teams that arrive at counsel with a scan, a tag inventory and test evidence usually get a faster, narrower and less expensive review. If you want to see what your own site is loading before you speak with an attorney, start with a website scan.

Frequently asked questions

Do I need an attorney to review my ad pixels?

If your tags send personal information to ad platforms, if you operate in states with privacy laws, or if your site handles video, health or other sensitive data, a legal review is prudent. A technical scan tells you what your tags do. An attorney tells you what the law says about it.

Does SB 690 mean I no longer have to worry about pixel lawsuits in California?

No. SB 690 removes private lawsuits under one CIPA provision, the pen register and trap and trace section, for website and app tracking. Wiretapping claims under Section 631, the VPPA, state health data laws and consumer protection claims are not affected, and the Attorney General can still enforce. Ask your attorney how the law applies to any claim you already face.

What is the difference between a privacy attorney and a privacy compliance platform?

An attorney gives legal advice and represents you. A compliance platform gives you the technical controls, monitoring and documentation. The two work best together: the platform produces the evidence, and the attorney interprets it.

How often should ad pixels and analytics disclosures be reviewed?

Review them whenever you add or change a tag, launch a campaign, or enter a new market, and run a full legal review at least annually. Continuous monitoring covers the gaps in between.

Should I remove my pixels?

Not necessarily. Many businesses keep their advertising and analytics tools and make them lawful by gating tags on consent, limiting the data they send, honoring opt-outs and keeping disclosures accurate. Which approach fits your site is a decision to make with counsel.

Key takeaways

• Hire a privacy attorney with ad tech experience, and a litigation defense attorney if you have received a claim. We have a list of privacy attorneys that we work with and are glad to make a referral. Just ask us.
• Go in with a tag inventory, consent records, policy history, vendor contracts and opt-out test results.
• Treat SB 690 as a narrowing of California risk, not an end to it, and watch for the Supreme Court’s VPPA decision in Salazar v. Paramount Global.
• Keep your disclosures tied to what your site really does, and monitor continuously instead of reviewing once.