How CIPA claims end up in arbitration
Are CIPA claims filed in arbitration or in court? Both — but arbitration is where most CIPA claims are actually resolved, and it is the channel that most businesses are completely unprepared for. While there have been many lawsuits filed alleging CIPA violations, it is likely that many more claims have proceeded to arbitration or settled before litigation commenced in response to a demand letter — neither of which would be matters of public record. The CIPA demand letters that make news are the ones that turn into class actions. The ones that resolve quietly in arbitration or settle from a demand letter never appear in any database, never generate press coverage, and leave no public record of how much was paid or why.
This has two consequences for businesses trying to assess their exposure. First, the volume of CIPA enforcement is substantially higher than court filings suggest. Second, a business that has a mandatory arbitration clause in its terms of service — believing this protects it from class actions — may actually be more exposed to a specific enforcement tactic that has been deployed specifically against arbitration-clause companies.
This post explains how CIPA arbitration works, what mass arbitration is and why it emerged, how it differs from a demand letter and from class action litigation, and what your response protocol needs to look like when an arbitration demand arrives.
Most consumer-facing websites include a terms of service with a mandatory arbitration clause and class action waiver. These clauses became standard practice after AT&T Mobility v. Concepcion (2011) and Epic Systems v. Lewis (2018) established that mandatory arbitration agreements are generally enforceable, including provisions that waive the right to participate in class actions.
The theory behind mandatory arbitration from a business's perspective: a plaintiff who cannot bring a class action has limited individual damages and limited incentive to pursue a claim. A $5,000 statutory damages claim that must be arbitrated individually is not worth a plaintiff's attorney's time to pursue, so the agreement effectively insulates the business from CIPA litigation.
This theory worked for a period. Then the plaintiffs' bar adapted.
CIPA plaintiffs altered their litigation strategy after mixed results in court. Some firms escalated their tactics by filing mass numbers of demands for arbitration — sometimes in the thousands — under the retailer's arbitration clauses within the terms and conditions of the retailer's website. The logic is the inversion of the business's original intent: if each individual claim must be arbitrated separately, and if the business must pay an arbitration filing fee for each demand, filing one thousand arbitration demands simultaneously costs the business one thousand filing fees before any merits adjudication has occurred.
How mass arbitration works in practice
The mechanics of a CIPA mass arbitration campaign follow a recognizable pattern.
A plaintiffs' firm identifies a target business with a mandatory arbitration clause, a CIPA-vulnerable website configuration, and California traffic. The firm recruits or engages a large group of claimants — sometimes through social media outreach to California residents who used the business's website, sometimes through lists of prior customers. Each claimant files a separate arbitration demand with the designated arbitration provider (typically AAA or JAMS) alleging a CIPA violation for their session on the target website.
Plaintiffs' counsel threatens to file or files these claims en masse in arbitration, hoping to force businesses to settle for a nominal value rather than face paying tens, hundreds, or thousands of arbitration fees to defend against the claims.
The filing fees matter enormously. AAA's consumer arbitration fee structure charges the business substantial per-claim fees once the number of cases crosses certain thresholds. For a thousand simultaneous demands, the filing fees alone can reach six figures before any individual case is heard. JAMS fees are similarly structured. The cost of managing the administrative burden — assigning arbitrators, coordinating scheduling, producing documents for each demand — multiplies the expense further.
Arbitration offers one characteristic that cuts both ways: the proceedings are confidential and documents submitted are not publicly available. For individual arbitrations this protects the business from public disclosure of the allegations. For mass arbitration campaigns it protects the plaintiffs' strategy — the business has no visibility into how similar demands are being resolved elsewhere, making it harder to develop a consistent defense posture.
One important characteristic of mass arbitration claimants: in many of these cases, the claimants are effectively litigation testers who only visit the website for the sole purpose of generating a claim and never purchased any goods or services. Whether your arbitration clause binds a one-time visitor who never transacted with your business requires separate legal analysis from whether it binds a registered customer.
The demand letter phase: what happens before arbitration is filed
Most CIPA exposure does not go directly to arbitration. It begins with a demand letter — often from one of a small number of plaintiffs' firms that have made CIPA demand letters their primary business model.
These claims follow a nearly identical script. A litigation tester will visit a website and use the chat feature, sometimes typing only a single word like "returns," and immediately leaving. The plaintiff's lawyer then sends a form demand letter offering to settle a threatened CIPA lawsuit for six figures on an individual basis, or for tens of millions of dollars on a class-wide basis.
The demand letter typically arrives via email or certified mail. It identifies the specific tracking tool alleged to have violated CIPA, the CIPA provision at issue (§ 631(a) wiretapping, § 638.51 pen register, or both), the period of alleged violations, and a settlement demand. The settlement demand is almost always calibrated to be painful enough to motivate settlement but rational enough to be taken seriously: for individual demand letters, $25,000 to $75,000 is common; for demands threatening class action, the demand may be in the millions.
The key decisions that must be made within days of receiving a demand letter are whether to engage, whether to investigate the technical allegations, whether to involve counsel, and whether the arbitration clause in your terms of service is enforceable against this claimant. Many businesses make the mistake of ignoring demand letters because they arrive by email and look like spam. They are not spam. The 30-day response window in most demand letters is real, and missing it without a response can affect your negotiating position in settlement discussions.
What arbitration demands require that demand letters don't
Once a demand letter escalates to a filed arbitration, the procedural stakes change. An arbitration demand is a formal legal filing with the arbitration provider. It triggers the arbitration provider's case management process, fee obligations, and procedural deadlines. A business that treats an arbitration demand the way it treats a demand letter — as an opening negotiating position requiring no immediate action — will find itself in default or facing adverse procedural consequences.
Identify your arbitration forum. The first obligation is to identify which arbitration forum is designated in your terms of service. AAA and JAMS have different consumer arbitration rules, different fee structures, and different mass arbitration protocols that can affect your options. The designated forum's rules govern the proceeding, not California state court procedures.
Assess clause enforceability. Not every arbitration clause is enforceable against every claimant. Courts have found arbitration clauses unenforceable where the agreement was not adequately disclosed, the claimant did not meaningfully assent (a browsewrap agreement where terms are not clearly presented may not bind a user who never saw them), the agreement contains unconscionable terms, or the claimant is a litigation tester who visited the website solely to generate a claim. Whether your clause binds this specific visitor requires legal analysis.
Pull your consent records. The same emergency technology audit described in the CIPA demand letter guide applies: pull the consent records for the period of the alleged violation, audit what your tracking tools were doing during that period, and assess whether the specific conduct alleged actually occurred. In arbitration, this audit must happen before the response deadline — which is why server-side consent records queryable without engineering involvement are not a nice-to-have but a compliance necessity.
What determines whether you fight or settle
The decision to contest a CIPA arbitration demand or settle it is driven by four factors.
Technical merit: did the alleged violation actually occur? If your consent records show that tracking tools were correctly gated behind prior consent during the period at issue, you have a factual defense. If your tracking configuration was non-compliant — pre-consent firing, GPC failures, false positives after decline — the technical record may not support a defense.
Arbitration clause validity: is the claimant bound by your arbitration clause? A website visitor who never checked an acknowledgment box, never saw a clear link to terms of service, and never created an account may not be bound. A registered customer who clicked "I agree" to terms containing a mandatory arbitration clause is in a different position.
Settlement economics: what does it cost to contest versus settle? For a single demand threatening individual arbitration with a $5,000 CIPA claim, the defense costs may exceed the settlement value. For a mass arbitration campaign of one thousand demands, the economics change depending on per-claim filing fees, defense cost per claim, and whether a global settlement can be negotiated at a per-claim rate below the per-claim defense cost.
Precedent risk: does settling create a signal to other plaintiffs' firms that your business is a viable target? Quiet individual settlements typically do not create public signals. Mass arbitration settlements structured as global resolutions may be more visible. Your litigation counsel will have views on this dynamic.
Protecting yourself before a demand arrives
The compliance program that reduces CIPA arbitration exposure is identical to the program that reduces CIPA class action exposure: prior consent before tracking, GPC detection, vendor contracts with independent-use restrictions, accurate privacy policies. A business with technically correct consent architecture and documented consent records is in a fundamentally different position when a demand arrives than a business with no consent infrastructure and no records.
Three additional steps specifically address the arbitration context.
Ensure your arbitration clause is enforceable and disclosed. A mandatory arbitration clause buried in a browsewrap agreement — a link to terms of service somewhere on the page that users can ignore — may not bind users who never saw it. A clickwrap agreement where users must affirmatively check a box or click "I agree" before completing a transaction is more defensible. For any redesign of your registration flow or checkout process, consult counsel on structuring the agreement disclosure to maximize enforceability.
Build a rapid-response protocol. When a demand letter or arbitration filing arrives, the people who need to know — legal, engineering, compliance — should know within 24 hours. The consent records for the alleged violation period need to be pulled within 48 hours. The tracking configuration for that period needs to be audited before the response window closes. These responses are impossible to execute if the protocol doesn't exist before the letter arrives.
Know your consent record retention. The most important evidence in a CIPA arbitration is what your tracking tools were doing on the specific dates at issue. Server-side consent records retained for at least three years and queryable by date range without engineering involvement are the foundation of any technical defense. If your consent records are client-side only, erasable by users, or not queryable without an engineering ticket, you cannot retrieve the evidence you need within the time constraints an arbitration response requires.
Frequently asked questions
Are CIPA claims more likely to be filed in court or in arbitration?
Both are common, but arbitration is where the majority of CIPA claims are actually resolved — quietly, confidentially, and without public record. A business with a mandatory arbitration clause may receive arbitration demands rather than court filings, but that clause can also make it a target for mass arbitration tactics specifically designed to overwhelm businesses that rely on individual arbitration to avoid class actions.
What is mass arbitration and how is it different from a class action?
In a class action, plaintiffs pool their claims into a single proceeding with one set of legal fees. In mass arbitration, each claimant files a separate individual demand, each requiring a separate arbitration filing fee and separate case management from the business. A mandatory arbitration clause with a class action waiver prevents the class action but not the mass arbitration. The economic pressure in mass arbitration is the cumulative cost of fees and administration across hundreds or thousands of individual proceedings filed simultaneously.
Does having an arbitration clause in my terms of service protect me from CIPA claims?
It routes claims to arbitration rather than court, which offers some procedural advantages including confidentiality. It does not eliminate the underlying CIPA liability. And it can make you a specific target for mass arbitration if your clause is seen as vulnerable to the filing-fee pressure tactic. The most effective protection remains compliant tracking architecture, not contractual routing of claims.
What should I do in the first 48 hours after receiving a CIPA arbitration demand?
Notify legal counsel immediately. Do not respond to the claimant directly without counsel. Pull your consent records for the alleged violation period from your server-side consent management system. Audit your tracking configuration for that period against what the demand alleges. Identify which arbitration forum is designated in your terms of service and review their consumer rules for initial response deadlines. Do not miss the response deadline without a communication to the arbitration provider.
Can the arbitration demand be challenged without going to arbitration?
Potentially, on several grounds: the arbitration clause may not bind this claimant, the claimant may be a litigation tester without standing, the alleged conduct may not have occurred based on your technical records, or the arbitration clause may be unconscionable. Each of these is a threshold defense that can be raised before the merits are arbitrated. Counsel familiar with CIPA arbitration will evaluate which defenses apply to your specific situation.
Is CIPA arbitration confidential?
Yes — arbitration proceedings are confidential and documents submitted during arbitration are not publicly available. This is an important distinction from court litigation, where CIPA complaints and settlements may appear in public court records. The confidentiality of arbitration protects the business from public exposure of the allegations, but it also means that how similar claims are being resolved elsewhere is not visible to you — making it harder to assess your negotiating position without counsel who has experience across multiple CIPA arbitration matters.
The bottom line
CIPA arbitration is not a lesser version of CIPA litigation. It is a different enforcement channel with its own economics, its own procedural rules, and its own tactical dynamics — including a mass arbitration tactic designed specifically to exploit mandatory arbitration clauses. The businesses best positioned to handle an arbitration demand are those that have done the technical compliance work that makes the demand factually unsupportable, have the consent records to demonstrate it, and have a rapid-response protocol that treats the arrival of a demand letter as a compliance event requiring immediate action.
The infrastructure answer
The free PieEye compliance scan identifies the specific technical vulnerabilities — pre-consent tracking, GPC failures, false positives after decline — that demand letters and arbitration filings are built around. Running it before a demand arrives is the difference between having evidence of compliance and having to explain why you don't.
For the full demand letter response framework — covering both pre-arbitration demand letters and the escalation to formal arbitration — the CIPA demand letter guide covers the complete response process in detail.
Run a free PieEye compliance scan — it takes minutes, requires no code changes to initiate, and tells you exactly what a plaintiffs' attorney's scanning tool would find if it looked at your website today.