Many CIPA demand letters accuse a website of tracking visitors before they had a chance to consent. This one makes a sharper claim. The plaintiff opened the cookie settings, turned off every optional category, saved the choice, and the trackers kept firing anyway.
That is a much harder allegation to argue with, because the evidence is the website's own consent banner. Below is a real example, sent by the Law Office of Ali Fesh to an ecommerce business and redacted to remove the business, the plaintiff, and the screenshots of the site.
What the letter looks like
Page one: a California consumer visits the site, opens "Cookie Settings" from the footer, disables every category except Strictly Necessary, and clicks "Allow Selection."
The letter tells a short story and then documents it:
- The opt-out. The plaintiff rejected Targeting/Advertising, Preferences, Performance, and Functionality cookies, consenting to strictly necessary cookies only.
- The network traffic. Screenshots (redacted here) show the browser sending cookie and tracking data to TikTok, Pinterest, Google, and Microsoft Bing after the rejection.
- The site's own words. The letter quotes the business's cookie policy back to it.
- The claims and the offer. Statutory damages under the California Invasion of Privacy Act, a list of related claims, a threatened class action, and an invitation to settle before a deadline.
The cookie policy became Exhibit A
Page five: the letter lists three cookies that the site's own policy labels as advertising or performance cookies, then shows them still collecting data after the opt-out.
This is the most instructive page in the letter. The business had done the paperwork. It had a cookie policy that correctly classified tuid, _lc2_fpi, and LinkedIn's _li_ss as targeting or performance cookies. It had a preference center with the right categories.
What it didn't have was a connection between the preference center and the tags. The banner recorded the visitor's choice, and nothing on the page acted on it. An accurate cookie policy paired with a banner that doesn't enforce it is worse than no policy at all. It proves the business knew what the cookies did.
The letter makes a second point in a footnote: TikTok's script "begins to collect information the moment a user lands on the Website." Even a visitor who rejects everything has already been tracked by the time the banner renders, because the pixel loaded first.
What the letter claims
Page seven: $5,000 per violation, no actual damages required, a list of additional claims, and a settlement deadline (redacted).
The lead claim is under CIPA's wiretapping provisions. Penal Code § 637.2↗ lets anyone injured by a violation recover the greater of $5,000 per violation or three times actual damages, and says plainly that actual damages are not a prerequisite. The letter quotes that line.
It then stacks on the California Consumer Privacy Act as amended by the CPRA, the Unfair Competition Law, the False Advertising Law, intrusion upon seclusion, and breach of contract, with the business's cookie disclosures and privacy policy cast as the contract that was breached.
The stacking matters for one reason in particular. California's SB 690 removes private suits under CIPA's pen register provision starting January 1, 2027. This letter leads with § 631, CIPA's wiretapping section, which SB 690 leaves alone. A misrepresentation theory built on a broken opt-out doesn't depend on CIPA at all.
What the business was missing
Enforcement, not just a banner. The consent tool collected a choice and stored it. The tags were installed somewhere else, such as directly in the theme, through a tag manager without consent triggers, or through an app integration, and they never checked that choice.
Blocking before the banner. TikTok, Pinterest, and Bing tags were allowed to load on page view. Whatever the visitor chose afterward, data had already left the browser.
Anyone who tested the reject path. Most teams test that tags fire when a visitor accepts, because that's what breaks attribution. Almost nobody tests that tags stop when a visitor rejects. Plaintiffs' firms test exactly that.
You can run the same test in five minutes. Open your site in a private window, open DevTools to the Network tab, reject everything in your banner, then reload and click through a few pages. Filter for analytics.tiktok.com, ct.pinterest.com, bat.bing.com, facebook.com/tr, and google-analytics.com. Anything that still appears is what a letter like this will screenshot.
See which trackers fire on your site
The free CIPA scan loads your site as a California visitor and records every pixel, cookie, and script that fires before consent.
Scan my site for CIPA exposure →How PieEye closes the gap
Blocking at the source. PieEye's Trap and Trace Shield holds third-party scripts until the visitor consents. Tags that aren't allowed to load can't send data, whether a visitor rejects them, ignores the banner, or never sees it.
A banner that controls the tags. PieEye's consent management ties each cookie category to the scripts in it, so turning off "Targeting/Advertising" turns off the TikTok, Pinterest, and Bing tags, not just a checkbox.
Evidence of what actually fires. The free CIPA scan shows which trackers load on your site before consent, the same picture a plaintiff's tooling captures. Running it before and after a fix gives counsel a dated record.
If one of these lands on your desk
Don't ignore it, and don't pay it on day one. Run the reject-all test above to learn whether the allegation is accurate, fix what you find so new violations stop accruing, and take the letter and your evidence to defense counsel. Our CIPA demand letter guide covers the first 48 hours in more detail.
This post is for general information and is not legal advice. Talk to counsel about any letter you receive.