You got a “tracking technology” demand letter. Here’s what’s actually going on.
What I’ve learned from collecting data on CIPA and “tracking pixel” demands sent to startups — who’s sending them, why, what actually drives your exposure, and how to think about responding.
I started paying attention to this after what was arguably the worst-written demand letter of my legal career landed on a founder’s desk — followed by completely baseless lawsuits. Since then I’ve been collecting data on which plaintiffs’ firms are sending which kinds of demands, why I think it’s happening, and what can be done about it.
This article combines and updates a series of posts I wrote for the YC community. It reflects a limited data set — letters that founders shared with me and consented to have analyzed in aggregate — but the trends in it are meaningful and, frankly, alarming.
Two things to set expectations before you read further.
First
The financial risk to your company is not proportional to whether you did anything wrong. That is the single most important thing to understand about this wave. Demands are going to companies that do not use the alleged “tracking” technology at all, and to companies that had no idea they were using anything of the kind. The cost curve here is driven by the cost of proving you’re clean, not by the odds that you’re dirty.
Second
This is not legal advice to you or your company. It’s a description of a pattern. Whether any particular letter is a real threat to you, and whether you have actual liability to worry about, depends on your business, your practices, and the specific demand. I only give legal advice to clients who have signed a formal engagement letter.
What these demands say
The bulk of these letters allege that “tracking technology” on your website — sometimes named specifically, often not — violates California law, usually the California Invasion of Privacy Act (CIPA) and its wiretap provisions. Under that statute, senders sometimes claim a $5,000 statutory violation per use, per plaintiff. (They claim it. They are not necessarily correct.)
Much less frequently, I see demands about:
A chatbot sending data to third parties
A website failing to meet accessibility criteria
Insufficient cookie notices or opt-outs
Illegal early termination fees
Subscription auto-renewals without adequate notice
I can trace each of these back to a decision similar to the one described below, where the cost of defense jumped because a court held that the question was a fact-specific inquiry. But I do not have data suggesting these are mass mailers sent without anyone looking at your website — which is exactly what the “tracking technology” demands appear to be.
Why this is happening
Two things happened in the summer of 2024 that I think are driving this wave.
A California judge held that a certain technology might violate the California Wiretap Act, and let a case proceed past a motion to dismiss. Other cases have explored the same theory. What that ruling means is not that the technology does violate the statute. It means that in every case, you now have to run an expensive fact-finding exercise to determine whether it does.
That is a much bigger deal than it sounds. The expected cost of defending one of these suits went up by something like 100x. When proving you did nothing wrong costs that much beyond the motion-to-dismiss stage, settling early to make it go away can present as the rational choice — even for a defendant who believes it has no real liability.
There was a conference in Las Vegas for the plaintiffs’ bar where, I surmise, someone gave a talk about using generative AI tools to produce demand letters — and making real money from a very large number of small “go away” settlements. I suspect that talk created a handful of copycats who took a demand format that had worked for them and simply multiplied it.
I believe what’s behind most of these demands is a mass-mailing campaign that has little or nothing to do with you.
When these letters arrive
Most of the people who have shared their letters with me — and consented to the aggregate analysis here — received them after some kind of public success:
They announced a fundraising round
They started advertising on television in the sending lawyer’s market
They put out a press release about FDA clearance or a similar business milestone
Some firms may genuinely be crawling websites looking for the Meta Pixel and cross-referencing that list against what I’ll call “success news.” But in general, success news alone appears to be enough. Your name, your website, and whatever public address is available get plugged into a form generator and a letter goes out by email.
I have now also seen multiple lawsuits — actually filed, not just threatened — that go on at length about a wiretapping tracking technology the company does not use. Some of these were filed where the alleged “tracking technology” at issue was nothing more than Google Analytics and Google Search Console.
Who is sending them
Across the data set as a whole, Pacific Trial Lawyers and Swigart Law Group are by far the most common senders — though Tauler Smith became the highest-volume sender I was seeing by the time of my April 2025 update.
Pacific Trial Lawyers
Among the most common senders overall
What they cite: A vague, purported “tracking technology” that violates CIPA
Sends the same short-form demand to everyone. They don’t name a specific plaintiff or user. When they have followed up with actual lawsuits, the plaintiff is described as a “professional privacy researcher.” I am 99% sure that is code for “hired a plaintiff to sue you with.”
Their letters appear to go out regardless of whether your site uses any tracking technology at all — I’ve talked to multiple founders who used nothing beyond Google Analytics and still got letters, and some of them got lawsuits too. The complaints appear to be the same document with the names and the website swapped out.
Swigart Law Group
Among the most common senders overall
What they cite: Use of a Meta Pixel
Sends a longer letter — still, as far as I can tell, the same form every time. In these cases, the recipients generally do use a Meta Pixel, or used one previously and haven’t yet removed the notice of it.
Tauler Smith
Highest volume as of the April 2025 update
What they cite: The TikTok Pixel
A minority sender when I first wrote about this. As of my April 2025 update, they were sending the majority of the demands I was seeing, and most of theirs focused on the TikTok Pixel.
Other firms that have sent something to my clients that might have been a mass demand: Teller, and Carlson Lynch.
Because these firms are pumping out complaints at near-zero marginal cost, it costs them almost nothing to cost us an enormous amount in legal fees. Volume has been increasing materially — at the point of my last update, noticeably month over month.
One myth worth killing
It is tempting to assume follow-up demands only go to people who responded to the first letter. At present, the data does not support that. I have seen companies with no tracking technologies at all, who never responded, get sued by Pacific Trial Lawyers. Lawyers in our alliance network tell me Swigart also files cases against non-responders.
The copycats who aren’t even lawyers
A number of founders have been in touch about letters from an individual named Vivek Shah, who is not a lawyer. He appears to be a copycat, using complaints filed by actual lawyers in this space and representing himself.
The good news: a court in the Central District of California found Shah to be a vexatious litigant based on his copious garbage filings. The court was, unsurprisingly, unimpressed with how much docket time he was consuming with what — in my non-legal opinion — was total nonsense. As a result, he needs court approval before filing further claims. If he has threatened you, you probably want to know that.
Why “just ignore it” got more dangerous
A while back, I might have told a client who did nothing wrong and got a frivolous demand letter to ignore it. We are now seeing actual lawsuits filed, so the calculus has changed and the distinction matters a great deal.
Ignoring a demand letter and ignoring a filed complaint are completely different acts with completely different consequences.
Once a complaint is filed and you are served
You generally have 30 days to answer or otherwise respond — or to settle such that the complaint is withdrawn. If you don’t participate, the firm may be able to win a default judgment: essentially, the court assumes you did the thing because you didn’t show up to say otherwise. After a default judgment, they can put on a damages presentation that you are not there to dispute. If they establish damages, the court can order you to pay — regardless of whether you actually did anything wrong.
All of this over a purported harm to a purported website visitor that is arguably unquantifiable and, if quantified, probably worth less than $10 — while the lawyers sometimes claim a California statute entitling them to $5,000 per incident.
Claimed per incident, per plaintiff
$5,000The purported harm, if quantified
under $10Drawn to scale. That gap is the whole business case for a “go away” settlement.
So, to be as clear as I can be: I am not telling you to ignore demand letters. I am telling you that the two documents are not the same, and that the downside of guessing wrong about which one you’re holding is severe.
Related reading: The demand letter — what one is, what it costs to answer properly, and where it sits on our interactive map of American civil litigation.
What actually drives your exposure
Having now talked with a few dozen founders who received one of these letters, here are the patterns that separate the cheap outcomes from the painful ones. This is low-hanging fruit: preventing or limiting these problems generally costs less than the minimum settlement I have seen anyone accept.
“I settled with ___ firm and the next day they sent me a new demand.”
A claim is not settled unless a legally binding release is in place. Getting the firm to agree that they cannot simply go find another plaintiff and hit you again is a separate, deliberate step in the settlement — it does not happen by default. Ideally, your lawyers draft the settlement agreement before you send any cash.
“I used a template generator to draft my terms of service.”
You are probably missing techniques that would prevent most class actions, require informal dispute resolution first, and generally nip this category of claim in the bud. These techniques also have to be updated as new cases come down — the most recent applicable decision when I last wrote about this was March 2025.
“I had a lawyer draft my terms of service three years ago.”
See above. And if your privacy policy is three years old, it is unlikely to still be accurate. My non-legal opinion: in a privacy policy, a misrepresentation is much worse than an omission — though several states require the disclosures either way.
“Someone on my team must have signed up for ___ without my realizing it.”
This is the big one. Most of the cases I see that produce higher settlements involve a technology the company wasn’t knowingly using at all. Common versions:
Someone signed up for a free trial at some point that installed something nobody knew about
The tech was used intentionally by a former team member, and nobody else knew it was there after they left
The company stopped using a tool but never removed the cookie
Nobody has cleared unused cookies off the site in a long time
Nobody has gotten around to putting up cookie notices
What you can do about it
I have not identified anything that reliably stops the demands short of not having a website in California. But there are things that can limit your actual liability and improve your negotiating position if litigation happens.
Find out what is actually on your site. You can check for free, in about two minutes, using Blacklight. Confirm that your understanding of what runs on your site matches reality.
Remove what you don’t use and don’t need. Not legal advice, but at this point it seems worth doing.
Consider a cookie notice. Secret alleged tracking technology is not secret when it is disclosed in a cookie notice.
Refresh your terms of service and privacy policy — with the specific defensive provisions in mind, not just the boilerplate, and with attention to what’s been decided recently.
Where Story fits: the step between “I got a letter” and “I hired a lawyer”
Most founders who get one of these letters face the same problem, and it isn’t a legal problem yet. It’s a decision problem: how should my business respond here?
A company with a general counsel already knows what happens next. The letter goes to the GC, who reads it, recognizes the form, checks a few facts, and comes back within a day or two with a recommendation: this one is noise, here’s what we do; or this one is real, here’s what it will cost, and here’s who should handle it. The founder doesn’t have to become an expert in CIPA to make a good decision — the GC absorbs that, and the founder gets a business answer.
Startups without a GC usually get offered two options, and both are bad. Option one is to guess, and the guesses tend to be either “ignore it” (which was defensible before these firms started actually filing) or “pay whatever makes it stop” (which, without a real release, sometimes buys you nothing). Option two is to retain litigation counsel to respond on your behalf — which is the right call for some of these letters, and enormous overkill for others.
Story is the step in between. We do what a general counsel would do for a larger company:
Triage the letter against the pattern. We’ve read a lot of these. We can usually tell you quickly whether what you’re holding is a form mailer from a known sender, or something narrower and more serious that names a real plaintiff and real facts.
Establish what’s actually on your site, so you know whether you have the exposure alleged, no exposure, or exposure the letter didn’t even find.
Give you the range. What this typically costs to make go away, what it costs to fight, what happens if you do nothing, and how each of those changes if a complaint gets filed. Founders make good decisions when they can see the numbers.
Fix the things that make the next one worse — the release language in any settlement, the terms of service provisions that block class actions and route disputes to informal resolution first, the privacy policy that no longer describes your business, the tracking you didn’t know you had.
Bring in litigation counsel when litigation counsel is warranted, and not before — and help you compare what that will actually cost.
The goal is that you spend a small, certain amount to understand a large, uncertain risk. That is usually the highest-return legal spend available to a company in this situation, whichever way you end up going.
If you’d like a free estimate on what a solid terms of service and privacy policy with these preventative measures would cost from various potential sources and lawyers, email me at j@storyllp.com and I’ll send you a short questionnaire so I can put together a detailed comparative estimate. For most people it could come in under the cost of a single settlement — and few of these settle under $5,000.
What could actually stop this
I can think of at least three structural responses. All of them require clients who knowingly consent to participate, and all of them require legal fees — though it’s possible those could be crowdfunded.
File and argue an excellent motion to dismiss these complaints, aiming for a ruling that the claims are bogus that everyone else can then use.
Use aggregated data about the bad-faith claims and malicious prosecution to bring bar complaints against the firms, and try to get licenses pulled.
Bring a civil or class action against the worst-offending firms for civil extortion and malicious prosecution — potentially on contingency, so nobody fronts fees.
An important caveat on all three
Every lawyer owes a duty to their individual client to do what is best for that client. What is best for you may well be paying a firm off to go away as early as possible rather than participating in any of the above. I would rather say that plainly than pretend otherwise.
Help me keep the data set honest
Everything here is built on a limited data set. If you received one of these demands, I would be glad to have it: send it to me at j@storyllp.com and I’ll fold it into the analysis. I share findings back with the community, and I do not and never will share individual company or case details.
If you’re dealing with one of these right now — including anything from Vivek Shah — reach out and I’ll tell you what I know.
Disclaimer: I’m a lawyer, but this is not legal advice for you or any particular company, and no attorney-client relationship is created by reading it. I only give legal advice to clients who have signed a formal engagement letter. Given the risk and cost of getting sued even when you did absolutely nothing wrong, I am explicitly not advising anyone to ignore a demand letter. I still suggest consulting your lawyer — even briefly — to understand the risks specific to you from any given demand. That small certain cost may help you avoid a much larger uncertain one.
We're lawyers, remember? Please read this important note:
Story LLP is a law firm, and Story's lawyers built Aegis to deliver better, standard legal services at scale so founders can choose between top-tier specialized lawyers and standardized process automations that replicate those lawyers according to their needs and budget. By definition, a standardized process may not be perfect for you. Please review our Policies page to better understand the difference, as well as how we use AI and how we manage conflicts, privilege, etc.
As a law firm, we must screen clients for conflicts of interest, and we treat all correspondence with clients seeking legal advice as privileged and confidential to the maximum extent possible in consideration of any conflicts. However, Story's law firm or our Attorney Allies do not represent you or your company as your lawyer, do not have an attorney-client relationship with you or your company, and do not provide you with legal advice absent a formal Engagement Letter signed between you and the Story LLP law firm. Please don't confuse the free knowledge we offer on this site with legal advice for you.