What business owners need to know about tracking consent, email pixels, and ADA accessibility
Almost every piece of technology that creates legal exposure on a business website was installed by someone trying to do good work. A Meta pixel, so the ad budget can be measured. Google Analytics, so you know which pages earn their keep. Open tracking in your email platform, so sales knows who is paying attention. An accessibility widget somebody added after reading an article about lawsuits.
None of it was installed with bad intent. But over the past two years, a small number of plaintiffs' firms have gotten very good at framing these ordinary tools as violations of laws written long before the web existed — and those laws attach a dollar amount to each violation whether or not anyone was actually harmed.
That last part is what makes this different from the legal risk most owners are used to. There is no injury to argue about. A visitor loads your homepage, a pixel fires, and the statute says that is worth a set number of dollars. Multiply by the number of visitors and the math gets uncomfortable fast.
Three risks account for most of what we see hitting our clients' inboxes: website tracking consent, email open-tracking pixels, and website accessibility under the ADA. Here is what is actually happening in each, and what we would fix first. One note before we start — we are a marketing agency, not a law firm. If a demand letter shows up, your first call should be to a lawyer, not to us.
Learn How Fast Page Speed Improves SEO
-1.png)
Plaintiffs' firms in California have spent the past three years using the California Invasion of Privacy Act — a 1967 anti-wiretapping law — against websites that share visitor data with third parties. The theory is straightforward once you hear it: when your site loads a Meta pixel, that pixel reports what the visitor is doing back to Meta in real time. Under a law that requires all parties to a communication to consent, the argument goes, the visitor never agreed to have Meta on the line.
The numbers behind the theory are what drive the volume. CIPA Section 631, the wiretapping provision, carries statutory damages of $5,000 per violation. A separate provision covering "pen register and trap and trace devices," Section 638.51, carries the same figure. Firms send demand letters by the hundred, and a case that would be worth little on the merits becomes worth settling on the arithmetic.
Courts have not landed anywhere clean. Several California state courts have pushed back hard on the pen-register theory, holding that a statute about telephone surveillance was never meant to reach commercial websites — Rodriguez v. Ink America in December 2025 and Blaker v. NetScout Systems in May 2026 both went that way. Federal courts have been friendlier to plaintiffs, and settlements are real money: a federal judge approved a $3.85 million settlement with the Los Angeles Times over tracking pixels in June 2026.
There is also a legislative wildcard. California's Senate Bill 690 would strip the private right of action for pen-register claims and hand enforcement to the Attorney General, applied retroactively to claims filed in the prior two years. As of late August 2026 it has not passed, and it does not touch Section 631 — the more expensive theory — or the parallel laws in Florida, Pennsylvania, and elsewhere. It is not a reason to wait.
Who is most exposed
Any site running third-party marketing tags is in scope, but the pressure concentrates where the data is sensitive: healthcare and behavioral health, financial services, legal services, and anything where the page a visitor lands on says something private about them. Session-replay and live chat tools raise the temperature further, because they capture what people type.
What actually helps
A consent management platform that genuinely blocks scripts until a visitor agrees. That qualifier matters more than the software you pick. A banner that appears politely while your pixels have already fired is worse than no banner at all, because it documents that you knew consent was required and collected data anyway.
Look for four things: non-essential tags blocked before consent, not after; Google Consent Mode v2 support, so your ad platforms degrade gracefully instead of going dark; timestamped consent logs you can point to later; and automatic handling of Global Privacy Control browser signals.
We have deployed Enzuzo on client sites and like it for mid-market businesses — Consent Mode v2 certified, flat pricing across multiple domains, and live in an afternoon rather than a quarter. Enterprise teams with a formal privacy function often land on OneTrust or Osano; Cookiebot and Consentmanager.net are reasonable at the low end. Any of them works if it is configured to block first. None of them works if it is dropped in on default settings and never checked again.
