This demand letter doesn't threaten to sue in court. It invokes the arbitration clause in the business's own terms and conditions. It doesn't estimate damages loosely either. It counts network requests, multiplies by $5,000, and arrives at $210,000 for a single claimant.
Below is a real example, sent on January 23, 2026, on the joint letterhead of the Law Office of Kevin Lemieux and Swigart Law Group, which share a San Diego suite. It's redacted to remove the business, the claimant, and the screenshots of the site's network traffic.
What the letter looks like
The first page of the demand: a "Notice of Dispute and Demand" sent under the pre-arbitration notice section of the business's terms and conditions.
The packet opens with a proof of service by mail, then the demand itself. It runs seven pages and follows a fixed structure: claimant information, governing law, basis for demand, settlement demand, and a signed authorization from the claimant.
The legal theories
The letter cites three bodies of law, and each one is doing a different job.
The federal Wiretap Act. The letter argues that installing the Meta Pixel "procured" Meta to intercept the claimant's communications for a criminal or tortious purpose, then lists twelve state and federal laws it says supply that purpose. The point is to unlock the federal civil remedy in 18 U.S.C. § 2520↗: the greater of $100 a day or $10,000, plus punitive damages and attorney's fees.
CIPA § 631(a), wiretapping. Under California's wiretapping provision, anyone who aids a third party in reading communications in transit without consent is liable for $5,000 per violation under Penal Code § 637.2↗.
CIPA § 638.51, pen register and trap and trace. Penal Code § 638.51↗ bars installing a pen register or trap and trace device without a court order. The letter applies it to the pixel's collection of routing and identifying data.
The letter also leans on timing. It says the pixel became active "within milliseconds" of the page loading, before the claimant could consent, and cites the Ninth Circuit's memorandum in Javier v. Assurance IQ↗, which rejected retroactive consent under § 631(a).
The evidence
The HAR file sample (redacted): 232 GET requests captured on one visit, with data going to Meta and other third parties including Google and Datadog.
Two pieces of evidence carry the letter:
- A HAR file. The firm loaded the site and saved the browser's full network log. One page visit produced 232 GET requests, many of them to third parties. The letter says the full URL of each page viewed, including folder paths, was sent to Meta.
- The claimant's own Meta data. Meta lets users see the off-platform activity businesses report about them. The claimant's log shows their visits to the site, with a timestamp, a personal ID, and the event type ("Page View"). That ties a specific person to specific pixel events on specific days.
Neither requires access to your systems. Anyone can capture a HAR file from your public site, and every claimant who uses Meta can download the second one.
How the math works
Page six: the damages calculation.
The letter builds its number like this:
| Theory | Count | Per violation | Claimed |
|---|---|---|---|
| CIPA § 631(a), Meta interceptions | 2 | $5,000 | $10,000 |
| CIPA § 631(a), 38 other third parties | 38 | $5,000 | $190,000 |
| CIPA § 638.51, pen register / trap and trace | 40 | $5,000 | $200,000 |
| Wiretap Act, 18 U.S.C. § 2520 | 1 | $10,000 | $10,000 |
The letter states the total as $210,000. Its own line items add up to more than that, and it says the claimant was tracked on "at least three" occasions while showing two. Templated letters often have seams like these. The total matters less than the method: every third-party domain in your HAR file is a multiplier.
What the business was missing
Consent before the pixel. The Meta Pixel loaded on page view. Under Javier, consent collected after recording starts doesn't cure it, so a banner that appears a second later doesn't help.
An inventory of what loads. The letter counts 38 third parties beyond Meta. Most businesses couldn't name half of the third parties their own site calls on a single page view, which is why they can't evaluate a demand like this when it arrives.
An arbitration clause written for this. The business's terms required a pre-arbitration notice, and the claimant's lawyers used it. In a mass arbitration campaign the business can owe filing fees on every claim. Our post on CIPA arbitration covers why a clause that looked protective can become leverage for the other side.
One part of this letter is changing. SB 690 removes private claims under § 638.51 for website conduct starting January 1, 2027, which would take out the largest line in the table. The § 631(a) and Wiretap Act theories are untouched.
Count your own third parties first
The free CIPA scan records every pixel and script that fires on your site before consent: the same list this letter multiplied by $5,000.
Scan my site for CIPA exposure →How PieEye closes the gap
Nothing loads until the visitor consents. PieEye's Trap and Trace Shield holds the Meta Pixel and every other third-party script until consent. If the pixel never fires before consent, there's nothing for a HAR file to capture.
A known list of third parties. The free CIPA scan shows which trackers fire before consent, and PieEye's data mapping keeps an inventory of where customer data goes across your stack. When a letter claims 38 third parties, you can check the claim instead of guessing.
Consent that controls the tags. PieEye's consent management ties each category in the banner to the scripts it governs, so a visitor's choice decides what loads.
For more on the pixel itself, see our explainer on the Meta Pixel and CIPA.
This post is for general information and is not legal advice. Talk to counsel about any demand you receive, especially one that invokes your arbitration clause.