Every privacy demand letter has a client behind it. For a single CIPA letter, that client might be one serial tester. For a mass arbitration, a firm needs hundreds or thousands of real customers of one specific company, and it has to find them.
So it advertises. The ad below ran as a sponsored post on Instagram. It's aimed at people who shopped on OtterBox.com, the phone case brand.
The ad
A sponsored post from ClassAction.org. The caption says attorneys believe the site may use tracking software to share browsing and shopping habits with PayPal.
The creative is built to stop a scroll: the brand's own name in its own yellow, an otter fleeing with a box marked "YOUR DATA," and "Customers Could Be Owed $$$." The caption sets the eligibility bar low. If you have an OtterBox.com account and added an item to your cart in the past two years, you "could have a legal claim worth $100s."
The ad says nothing about whether OtterBox did anything wrong. It says attorneys "believe" the site "may" use tracking software. It doesn't need to say more. Its job is to collect sign-ups.
Where the ad leads
The "Learn more" button goes to ClassAction.org's online shopping investigations page↗. The OtterBox entry says attorneys are investigating whether the site uses tracking software to share users' activity, including what they add to their cart, with PayPal without their knowledge or consent. It says the investigation is sponsored by Milberg, and it limits eligibility to PayPal account holders in California, Pennsylvania, Washington, Florida, or Massachusetts. All five have wiretap laws that require every party's consent.
OtterBox isn't alone on that page. It lists more than 40 retailers, from Aeropostale and Lowe's to Zappos, and when we checked, 16 of the entries, OtterBox's included, described data allegedly flowing to PayPal, several of them in nearly the same words. That's the tell. This isn't an investigation of one company. It's a theory about one widely installed script, applied to every site where the script was found.
Why the ads exist: the economics of mass arbitration
Most ecommerce terms of service include an arbitration clause and a class action waiver. They were written to keep customers out of court class actions. Plaintiffs' firms have turned them around.
If every customer must arbitrate individually, then 2,000 sign-ups means 2,000 separate arbitrations. Under many arbitration providers' rules, the business pays most of the filing and administrative fees for each one. The fees alone can reach seven figures before an arbitrator hears a single claim, which is why these campaigns often settle on a per-claimant basis. We covered the mechanics in our post on CIPA arbitration.
That model only works with volume, and volume takes advertising. The funnel is simple:
- Scan many sites for the same third-party script.
- Publish an investigation page listing every match.
- Run social ads using each brand's name to find its customers.
- Collect sign-ups that include proof of purchase or account.
- Send a notice of dispute for each claimant under the brand's own arbitration clause.
By the time the first letter arrives, the business is facing a list of claimants, not one plaintiff.
What the business may be missing
We don't know what OtterBox.com runs, and the investigation page makes no finding. The general lesson applies to any store, though: payment scripts are third-party scripts too.
Payment providers increasingly ship more than a checkout button. Pay-later messaging, express checkout widgets, and fraud tools load on product and cart pages, often installed through a platform app by a marketing or payments team rather than whoever owns privacy. Because they feel like part of checkout, they tend to be classified as "strictly necessary" and left out of the consent banner entirely.
The question plaintiffs ask is narrower: does the script send the provider information about what a shopper browsed or put in their cart, before checkout, without consent? If the answer is yes, the "necessary for payment" label is hard to defend on a product page the shopper never paid from.
Find every script that fires before consent
The free CIPA scan records every pixel, widget, and third-party script that loads on your site before a visitor consents, including payment and pay-later tags.
Scan my site →How PieEye closes the gap
An inventory that includes payment tags. The free CIPA scan lists every third-party script that fires before consent. That's the same list an investigator builds before a brand ends up on a page like this one.
Scripts that wait for consent. PieEye's Trap and Trace Shield holds third-party scripts until the visitor consents, so tracking that isn't needed to complete a payment doesn't run on browse and cart pages by default.
Categories that hold up. PieEye's consent management ties each banner category to the scripts in it, so a payment provider's marketing and analytics features aren't hidden under "strictly necessary."
If your brand's name is the hook in an ad like this, the claimant list is already being built. The time to check what your checkout scripts send is before your store shows up on an investigation page.
This post is for general information and is not legal advice. The ad and investigation described here are allegations by plaintiffs' attorneys, not findings of wrongdoing.