The evidence behind this demand fits in one small box: a single line in the claimant's Meta account showing that a business's website reported a "View Content" event about them. From that one entry, the letter claims three violations of each of two California statutes plus the federal Wiretap Act, and asks for $40,000 before attorney's fees.
Below is a real example, sent this fall on the joint letterhead of Swigart Law Group and Shay Legal. It's redacted to remove the business, the claimant, and the screenshots taken from the business's website.
What the letter looks like
Page one: a "Notice of Dispute and Demand," sent under the pre-arbitration notice section of the business's own terms and conditions.
The letter runs eleven pages with a fixed structure: claimant information, governing law, basis for demand, settlement demand, and a signed statement from the claimant authorizing the business to share their information with the law firm. It goes by email, with a paper copy "when required." The closing notice calls it "a written notice of dispute and impending arbitration," so the next step it threatens is an arbitration filing, not a lawsuit.
The legal theories
The federal Wiretap Act, with a twelve-item list attached. The federal statute only requires one party to a communication to consent, and a website is a party to its own traffic. The exception is 18 U.S.C. § 2511(2)(d)↗: consent doesn't protect an interception made "for the purpose of committing any criminal or tortious act." That's why the letter lists twelve state and federal laws, from the California Constitution's privacy clause to federal wire fraud, that it says the pixel was used to violate. If any one of them holds up, the letter can claim the civil remedy in 18 U.S.C. § 2520↗: the greater of $100 a day or $10,000, plus punitive damages and attorney's fees.
CIPA § 631(a), wiretapping. California's Penal Code § 631↗ reaches anyone who "aids, agrees with, employs, or conspires with" someone to read a communication in transit without everyone's consent. The letter's theory is that by installing the pixel, the business aided Meta. Penal Code § 637.2↗ sets statutory damages at $5,000 per violation.
CIPA § 638.51, pen register and trap and trace. Penal Code § 638.51↗ bars installing a device that captures routing and addressing information without a court order. The letter applies it to the same pixel and claims another $5,000 per violation on top of § 631.
The arguments aimed at your likely defenses
Page three: the basis for the demand, built on a HAR file and the claimant's off-Facebook activity.
The letter anticipates two defenses and argues against each.
"The visitor consented." The letter says the pixel fired "within milliseconds" of the page loading, before any consent could be given. It cites the Ninth Circuit's memorandum in Javier v. Assurance IQ↗, which held that consent obtained after recording starts doesn't cover what was already captured.
"We were a party to the communication." A website can't wiretap its own conversation, so businesses often argue the pixel is just their own analytics tool. The letter responds that the browser sends Meta a second, simultaneous copy of the request, which the visitor doesn't know about, and that Meta uses the data for its own purposes. The Ninth Circuit accepted a version of that argument against Meta itself in In re Facebook, Inc. Internet Tracking Litigation↗, and the letter says the First and Seventh Circuits agree.
The evidence
The letter relies on two sources, and neither requires access to the business's systems:
- The claimant's own Meta data. Meta lets every user review their activity off Meta technologies↗: the list of businesses that have reported their visits through tools like the pixel. Here, the log shows the business's pixel ID, a "View Content" event, and a date. That links a named person to a pixel event on a specific day.
- A HAR file. The firm loaded the business's homepage and saved the browser's full network log. One visit produced 224 requests, and the letter names Google, Bing and TikTok among the third parties that received data. The letter acknowledges this capture isn't from the claimant's own visits, but alleges the same thing happened when they visited.
How the math works
Page ten: the damages calculation and the claimant's signed statement.
| Theory | Count | Per violation | Claimed |
|---|---|---|---|
| CIPA § 631(a), Meta interception | 1 | $5,000 | $5,000 |
| CIPA § 631(a), two other third parties | 2 | $5,000 | $10,000 |
| CIPA § 638.51, pen register / trap and trace | 3 | $5,000 | $15,000 |
| Wiretap Act, 18 U.S.C. § 2520 | 1 | $10,000 | $10,000 |
| Total | $40,000 |
The seams are visible if you read closely. The settlement section says the business intercepted the claimant's communications on "at least three (3) occasions," then says the activity log "confirms the one (1) interception." The § 631 subtotal is typed as "$15,0000." The HAR file names three third parties, but the math counts two. None of that makes the letter safe to ignore. It shows the letter is a template, and the template's method is what matters: each confirmed tracking event and each third party is a multiplier, and the Wiretap Act adds a flat $10,000.
Page eight: the settlement demand claims three occasions in the last year, then offers one activity log entry as proof.
What the business was missing
Consent before the pixel fires. The letter's whole case depends on the pixel sending data on page load. If the Meta Pixel doesn't fire until a California visitor opts in, there's no "View Content" event in that person's Meta log to put in a letter.
Control over the full list of third parties. Meta gets top billing, but the damages table also charges for Google, Bing and TikTok. Each tag you can't account for is another $5,000 line under § 631 and another under § 638.51.
A plan for the arbitration clause. The letter is served under the business's own pre-arbitration notice requirement. In a mass arbitration campaign the business can owe filing fees on every claim, so a clause meant to protect the business becomes pressure to settle. Our post on CIPA arbitration explains how that happens.
One part of this letter has an expiration date. SB 690 removes private claims under § 638.51 for website conduct starting January 1, 2027, which takes $15,000 out of this table. The § 631(a) and Wiretap Act claims are unaffected, and they make up the rest of the $40,000.
See what your pixels send before consent
The free CIPA scan records every pixel and script that fires on your site before a visitor opts in, which is the evidence a letter like this one is built on.
Scan my site for CIPA exposure →How PieEye closes the gap
The pixel waits for consent. PieEye's Trap and Trace Shield blocks the Meta Pixel and other third-party scripts until the visitor consents. If the pixel never fires before consent, there's no early event in a HAR file and no "View Content" entry from a visitor who didn't opt in.
You know what loads. The free CIPA scan shows which trackers fire before consent, and PieEye's data mapping keeps an inventory of where customer data goes. When a letter says Google, Bing and TikTok received data, you can check that against your own records.
Banner choices control the tags. PieEye's consent management connects each category in the banner to the scripts it governs, so a visitor who declines marketing cookies doesn't get the Meta Pixel.
For background on why the pixel draws these claims, see our explainer on the Meta Pixel and CIPA.
This post is for general information and is not legal advice. Talk to counsel about any demand you receive, especially one that invokes your arbitration clause.