Got a CIPA demand letter? Start here.
A demand letter under California's Invasion of Privacy Act claims the tags on your site wiretapped or tracked a visitor without consent. Here's what to do in the first 48 hours, which claims SB 690 ends on January 1, 2027, and the evidence that matters.
Free. No account. Results in about a minute.
Scan the page named in the letter to see what runs after a visitor opts out.
The first 48 hours
- Preserve before you change anything. Put a hold on tag manager and consent platform settings, change logs, your privacy policy, and vendor contracts. Fixing the site first can erase the record you need to show what it actually did. Source
- Capture what the site does today. Record a page load before and after consent: every request, cookie and identifier, and how the banner behaves. Counsel will ask for this before anything else. Source
- Tell your insurer. Cyber and general liability policies can cover defense costs, and many require early notice. Source
- Talk to privacy counsel before you reply. Don't respond to the claimant or describe your technology until a lawyer has reviewed the letter. Don't ignore it, and don't pay it without an assessment. Source
- Find the section the letter cites. SB 690 treats the claims differently, so the section number changes how much leverage you have. See the table below. Source
Which claim is it?
Most letters cite one or more of three sections of the California Penal Code. SB 690, signed September 30, 2026, treats them very differently.
| Section | What plaintiffs claim | After SB 690 |
|---|---|---|
| § 631(a)Wiretapping | Reading the contents of a communication in transit without every party's consent. Plaintiffs point to chat, search terms, form inputs and session replay. | Not affected. Private suits continue. |
| § 632Recording a confidential communication | Recording a confidential communication without consent. | Not affected. |
| § 638.51Pen register / trap and trace | Tags and pixels that capture routing or addressing data such as IP addresses and identifiers. Easier to plead, and behind most recent filings. | From January 1, 2027, only the Attorney General can bring claims about websites and apps. Applies to pending claims in actions filed on or after January 1, 2025. |
Sources: Jeffer Mangels Butler & Mitchell, Website Privacy Lawsuits Under CIPA (Aug 28, 2026); Covington, Inside Privacy: Governor Signs SB 690 (Oct 5, 2026); K&L Gates, SB 690 Ends Pen Register and Trap-and-Trace Claims (Oct 8, 2026).
The evidence that decides it
Almost every claim comes down to the same three questions, and each needs a record from the date the letter names.
- What ran on the site. Which tags fired, and whether they waited for consent or kept going after the visitor said no.
- What your privacy policy said. Whether it disclosed the vendors that were running at the time.
- When each one changed. When a tag was added, when it was fixed, and when the policy was updated.
Consentinel keeps all three: sealed daily scans, every version of your policy, and a demand letter pack that pulls the records around the dates a letter claims.
Questions
How much can a CIPA claim cost?
Section 637.2 allows the greater of $5,000 per violation or three times actual damages, with no need to prove actual harm. Whether a violation is each visit, each transmission or each person is contested, which is what makes class claims expensive.
My letter cites section 638.51. Is it dead?
Not automatically. SB 690 takes effect January 1, 2027 and applies to pending claims in actions filed on or after January 1, 2025. Plaintiffs may challenge the retroactive part, and a letter can be reframed as a wiretap claim under section 631, which SB 690 doesn't touch. Ask counsel how it applies to yours.
Doesn't my cookie banner protect me?
Only if the tags actually wait for it. The pattern behind most claims, and behind California's $1.55 million Healthline settlement, is a banner that works while some trackers keep running after the visitor says no.
Does SB 690 change my obligations under the CCPA?
No. It narrows private CIPA lawsuits. The Attorney General and the California Privacy Protection Agency still enforce opt-out rights, including honoring Global Privacy Control, which every browser has to offer from January 1, 2027.
Can Consentinel show what my site did on the date in the letter?
Only for dates we were already scanning. Monitoring keeps a sealed, dated record of every scan and every version of your privacy policy, and the demand letter pack pulls the ones around the claimed dates. If the letter comes first, a scan today still shows what runs now and starts the record that proves when a fix took effect.
Last reviewed October 26, 2026. This is general information, not legal advice. Talk to a lawyer about your letter. See also Global Privacy Control and state law.
See what a plaintiff's scanner sees.
Consentinel loads your page in clean browsers: once rejecting cookies, once accepting, and once with Global Privacy Control on. It lists every tag that ran when it shouldn't have, with the request that proves it.
Free. No account. Results in about a minute.