Some demand letters build a long record: screenshots of a cookie banner, a HAR file, a list of 40 third parties. This one doesn't need to. It's three pages long, names one script, and cites one statute. The script is the TikTok pixel.
Below is a real example from Tauler Smith LLP, a Los Angeles firm, redacted to remove the business, the plaintiff, the website, and the pixel ID. It shows the cheapest version of the CIPA playbook, and the one that changes the most on January 1, 2027.
What the letter looks like
Page one: a California consumer visited the website, and the firm's "investigation" found trap and trace software. The letter says the plaintiff intends to pursue a class action.
The letter has three short sections:
- "Trap and Trace Processes." A general description of how tracking identifies the source of a communication, plus a quote from a 2022 Office of the Director of National Intelligence report on commercially available data.
- "California's Trap and Trace Law." The statute, the finding, and a redacted screenshot.
- The business's "Liability." Statutory damages, a case citation, and an invitation to resolve the matter before a deadline.
The entire factual basis: one pixel ID
Page two: the website "has embedded a TikTok web beacon, ID: [redacted]," followed by a screenshot of the beacon sending data to TikTok.
The letter says the TikTok beacon captures page views, searches, and purchases, identifies each visitor's device, and learns each user's identity and geolocation. It cites the trap and trace definition in Penal Code § 638.50(c) and the prohibition in § 638.51↗, which bars installing a trap and trace device without a court order.
That's the whole evidentiary record: a pixel ID and a network screenshot. Nobody had to read the site's privacy policy, test the cookie banner, or show what any particular visitor did. A plaintiff's firm can find a TikTok pixel ID on thousands of sites with an automated crawler, which is exactly why this theory became the highest-volume CIPA claim.
The legal hook
Page three: one case citation, $5,000 per violation for every user "subjected to a trap and trace process," and a pre-litigation offer with a deadline (redacted).
The letter rests on one court decision, Moody v. C2 Educational Systems↗. In July 2024, a federal court in Los Angeles denied a motion to dismiss a § 638.51 claim against an online tutoring company over the TikTok pixel, finding the software may qualify as a trap and trace device at the pleading stage. That ruling didn't hold that the pixel is a trap and trace device. It held the question couldn't be thrown out on the pleadings.
Courts haven't agreed since. As of late 2024, a Proskauer review of the TikTok cases↗ found that some courts had let the theory proceed while others had dismissed similar claims on standing, consent, or what information was collected, and none had actually ruled that TikTok's software is a trap and trace device.
The damages math is the same as in other CIPA letters. Penal Code § 637.2↗ allows $5,000 per violation without proof of actual damages, and the letter applies that to "all users of your website" as a putative class.
What changes on January 1, 2027
This is the letter SB 690 was written for. Starting January 1, 2027, private plaintiffs can no longer bring § 638.51 claims over website conduct, and the change reaches pending cases filed on or after January 1, 2025. Because this letter cites no other statute, it loses most of its force once the law takes effect.
That doesn't make the underlying setup safe. The same pixel firing before consent is the starting point for § 631 wiretapping claims, which SB 690 doesn't touch, and for wiretap claims under other states' laws, like the Florida FSCA. A firm that sends § 638.51 letters today can send § 631 letters about the same sites next year, using the same crawl. The firm's history is also worth knowing: a federal jury returned a civil RICO verdict against Tauler Smith over an earlier mass demand-letter campaign, which we covered in When Demand-Letter Mills Lose.
What the business was missing
The TikTok pixel loaded before consent. The letter turns on the beacon firing on page load for an anonymous California visitor. If the pixel had waited for consent, the screenshot on page two would have been empty.
Nobody owned the pixel. TikTok pixels are usually added by a paid social team or an agency, often through a platform app, and often long after the privacy review. Many sites still run pixels for campaigns that ended years ago.
No record of when it was fixed. CIPA damages accrue per violation. A business that can show the date the pixel stopped firing before consent can limit exposure, and it gives counsel something concrete to negotiate with.
Is your TikTok pixel firing before consent?
The free CIPA scan loads your site as a California visitor and records every pixel and script that fires before consent, including TikTok.
Scan my site for CIPA exposure →How PieEye closes the gap
Pixels wait for consent. PieEye's Trap and Trace Shield holds third-party scripts, including the TikTok pixel, until the visitor consents. That removes the network request this whole letter is built on.
You see what the crawler sees. The free CIPA scan shows which trackers fire on your site before consent, so you find a stray TikTok pixel before a plaintiff's firm does.
Consent that controls the tags. PieEye's consent management ties each banner category to its scripts, so the advertising category actually controls the advertising pixels.
If one of these lands on your desk
Check whether the pixel ID in the letter matches one on your site, confirm whether it fires before consent, and fix it so exposure stops accruing. Then take the letter to defense counsel, who can weigh the pleading-stage case law and the SB 690 timeline against the settlement demand. Our CIPA demand letter guide covers the first 48 hours.
This post is for general information and is not legal advice. Talk to counsel about any letter you receive.