You Received a CIPA Demand Letter. What Now?

If you’re reading this because a letter just arrived citing California Penal Code §631 or §632.7 and demanding a response, the most important thing to know first: this is a common, somewhat mechanical part of how CIPA litigation is currently pursued, not a sign that your business is uniquely at fault. That doesn’t make it something to ignore. It does mean the right first moves are procedural, not panicked.

What a demand letter actually is

A demand letter is a pre-litigation communication, typically from a plaintiff’s attorney, asserting that your website violated CIPA by running a specific tracker (often a chat widget, session replay tool, or ad pixel) without proper consent, and proposing a settlement to resolve the claim before a lawsuit is filed. It’s not a court filing, and receiving one doesn’t mean you’ve been sued. It does mean someone has reviewed your site’s tracking setup and believes it matches a pattern they’ve pursued before. We describe how that pattern gets identified in our piece on how these letters typically get generated.

The first thing to do: don’t respond immediately, and don’t ignore it

Two mistakes we see are opposite extremes. One is ignoring the letter entirely, on the theory that CIPA claims are legally shaky, which may be true in your specific case, but isn’t something to decide without counsel, and non-response can remove your leverage in any eventual negotiation. The other is responding immediately and directly to the sender without legal advice, which can create statements that are used against you later.

What to actually do in the first few days

1. Don’t destroy or alter anything. Preserve your website’s tracking configuration as it currently exists, along with logs if you have them. Changing things immediately can look like an admission and can complicate a factual record you may need later.
2. Contact a California-licensed attorney with CIPA/privacy litigation experience specifically. General business counsel can help, but this is a specialized enough area that experience with these exact claims matters for evaluating strength and typical resolution ranges. See our piece on what these cases have actually cost for context on the range you might discuss with counsel.
3. Check whether your business insurance applies. Some cyber or general liability policies have language relevant to statutory privacy claims, though many also exclude them. Our piece on the insurance exclusion problem covers what to check.
4. Separately, fix the underlying issue. Whatever the outcome of this specific letter, if your tracking setup is genuinely firing before consent, that’s worth correcting regardless, it reduces the odds of a repeat letter from a different firm.

What usually happens next

Most demand letters lead to a negotiation, not a filed lawsuit, but that outcome depends heavily on how the initial response is handled, which is exactly why involving counsel early matters more than moving fast. Some resolve quickly for a modest amount; others escalate if no response is made or if the underlying claim is contested without a clear factual basis to push back on.

This is educational information, not legal advice, and does not create an attorney-client relationship. If you have received a CIPA demand letter, contact a California-licensed attorney before responding.