Is Your Website Breaking CIPA? Cookie Consent Rules Every Business Should Know

Businesses across the country are getting sued over their websites. Not over anything on the page, but over the tracking tools running behind it, the same analytics and pixels almost every site uses. The lawsuits claim those tools are illegal wiretapping under CIPA, the California Invasion of Privacy Act, a law written in 1967 for telephone calls that plaintiffs have retrofitted for the web.

The issue

• When your tracking tools (Google Analytics, the Facebook pixel, a chat widget) collect data on a visitor before that visitor agrees to it, that's treated as secretly recording someone.
• CIPA allows statutory damages of $5,000 per violation, even without proof of actual harm, which is what keeps the filings coming.
• You don't have to operate in California to be exposed. As one law firm put it: "If your website is accessible to California residents (which is to say, every website), you are within reach." Courts in North Carolina, Florida, and other states have already ruled under the federal version of the law.

The fix

Same idea as GDPR in Europe: block tracking until a visitor opts in. The difference is enforcement. GDPR brings government fines. CIPA lets private individuals sue you directly.

A good consent setup:

• Check whether tracking cookies fire before a visitor clicks accept. That timing is the whole case. One court held that a banner shown after tracking has already begun works only as a disclosure notice, not as valid consent.
• If you have a consent banner, make sure tracking is actually blocked until the visitor clicks accept. Many banners pop up while the tracking already runs.
• If you have no consent banner, add one with a service like CookieYes or Cookiebot.
• Recheck it after any redesign, CMS migration, or new marketing tool. These break consent setups constantly, and even a proper platform creates risk if it's misconfigured and fails to block the trackers.

Better fix: drop the tracking that needs consent

A lot of the exposure comes from one tool. Google Analytics uses cookies and collects data that can identify individuals, which is why it needs a consent banner at all.

Privacy-first analytics tools like Plausible measure traffic without cookies and without collecting personal data. No personal data means nothing to consent to, so no consent banner is required, and every visitor gets counted instead of just the ones who accept.

How it works: instead of planting a cookie to follow a person, Plausible counts visits using anonymous, aggregated data that resets daily. You still get visitors, page views, top pages, referral sources, countries, and devices on one dashboard. You give up individual tracking, cross-day retention, and deep Google Ads integration.

It also:

• Gives you more accurate data. Every visitor who declines a banner vanishes from GA4. An independent study found GA4 captured only 55.6% of actual traffic, mostly from consent declines. Cookieless tools count everyone.
• Loads faster. Plausible's script is roughly 45x smaller than Google Analytics', which helps page speed and Core Web Vitals.

Switching analytics doesn't cover everything (ad pixels and chat widgets still need consent handling), but it removes one of the biggest risks and shrinks what your banner has to manage.

Test your own site

You can check this yourself in a few minutes. Open your site in a fresh browser session and open the network tab before the page loads.

1. Confirm only essential scripts fire before you click anything. If a Meta pixel, Google tag, or analytics script fires on load, that's the exposure.
2. Click reject and confirm the non-essential trackers stay blocked.
3. In a new session, click accept and confirm they fire only then.
4. Check that no pixel is hard-coded in the page head, since anything hard-coded there fires before a consent tool can block it.

If you're not comfortable in the network tab, that's fine, send it our way.

One honest caveat

The law here is unsettled and recent rulings have gone both directions. Several 2025 decisions were dismissed on standing or merit when the plaintiff couldn't show real privacy harm, and one federal judge questioned whether the wiretapping provision even applies to internet communications at all. California's SB 690 could also narrow CIPA down the road. None of that makes the demand letters stop landing, and fixing your setup still costs far less than answering one.

Not sure where you stand?

If you're an SDH client, we'll audit your consent setup, tell you straight whether it's working, and either get you on a properly configured tool or move you to cookieless analytics. Reach out and we'll add it to the list.

‍