Tracking, Pixels, and Privacy Claims Against Corporate Websites

What Is Actually Running on a Corporate Website

The legal argument is built entirely on technical facts. A typical corporate marketing site loads third-party JavaScript from more sources than anyone inside the company can name. Advertising pixels — Meta, Google Ads and GA4, the LinkedIn Insight Tag, Microsoft UET — fire on page load and on conversion events. Session-replay scripts record mouse movement, scrolling, keystrokes and form-field entry, reconstructing the visit as something close to a video. A chat widget passes the conversation to a vendor, which may pass it on again to a model provider.

Above all of that sits a tag manager, which is where the inventory problem begins. A container can load tags that load other tags. Developers hard-code tags into templates that never enter the container. Server-side tagging and conversions APIs transmit from the company's own infrastructure and never appear in a browser network log at all. The result is a site whose actual behaviour differs from what anybody believes it to be.

The Shape of the Claim

Nearly every one of these claims has the same structure. The website loads a third party's script. When the visitor interacts with the page, that script causes data to be transmitted to the third party, often at the moment the visitor is communicating with the company. The plaintiff pleads that the company is a party to that communication but the vendor is not, and that the vendor therefore intercepted the communication, with the company's assistance, without the visitor's consent.

The plaintiff-side framing is the third-party eavesdropper theory: an outsider listening in on a conversation between two parties. The defence framing is that the vendor is a tool or extension of the site operator, processing data on the operator's behalf rather than listening independently. Because the statutes carry fixed statutory damages, the claim is viable as a class action without demonstrable harm to anyone, and that is what drives the volume of demand letters.

The Statutes Being Used

The dominant vehicle is the California Invasion of Privacy Act. Cal. Penal Code 631(a) has four clauses pleaded in combination: tapping or making an unauthorised connection with a line; reading the contents or meaning of a message while in transit, without the consent of all parties; using information so obtained; and aiding, employing or conspiring with any person to do those things. The fourth clause is how the website operator is pulled in alongside the vendor. Section 638.51, the pen register and trap-and-trace provision, supports a newer variant arguing that a tracking script captures dialing, routing, addressing or signaling information, sidestepping the argument about contents. The private right of action at section 637.2 provides the greater of five thousand dollars per violation or three times actual damages, and says expressly that actual damages are not a prerequisite.

The federal Wiretap Act, 18 U.S.C. 2510 to 2523, is pleaded alongside it; section 2511(1)(a) prohibits intentional interception and section 2520 supplies the civil remedy. The structural difference matters: the federal statute is a one-party consent regime, so the operator's own participation generally engages the party exception, whereas CIPA 631 requires the consent of all parties. That asymmetry is why California is the centre of gravity.

The Defences, and Why None Is a Clean Answer

These are the arguments raised, stated as arguments. Courts have gone in different directions on each.

• The party exception. The vendor is not a separate person intercepting anything; it is the operator's tool. Under 18 U.S.C. 2511(2)(d) a party may intercept its own communication, unless the interception is for the purpose of committing a criminal or tortious act — the proviso plaintiffs invoke to get around it.
• Consent. Actual or implied consent through a banner, a consent platform, a privacy policy or terms of use. This defence is unforgiving, because consent has to be technically enforced rather than merely described. A banner that fires the tags before the visitor clicks anything is functionally not consent, and a privacy policy stating that data is not shared with advertising third parties while the pixel does exactly that undermines the argument.
• No contents. URL data, referrer strings and device identifiers are argued to be addressing information rather than the substance of a communication. That is why plaintiffs pivoted to the pen register theory, which concerns non-content routing data — the mirror image of the same fight.
• Standing, scope, and arbitration. Whether a bare statutory violation supports federal standing, whether the pen register provisions were meant to reach commercial analytics, and whether an arbitration clause was formed at all.

Why This Stays Unsettled, and What Health Enforcement Shows

Outcomes vary by statute, by state, by federal district, and between state and federal courts applying the same statute. There is no settled answer about how a CIPA, pen register or federal Wiretap Act claim comes out, and anyone offering one overstates what is known. California legislative reform has not delivered what many expected: Senate Bill 690 passed the state Senate in June 2025, stalled in the Assembly, and was amended on 2 July 2026 in a way that removed the broad commercial business purpose exemption that had been its centrepiece. The narrower version limits private enforcement of the pen register theory to the Attorney General. The bill remains pending, and CIPA as written remains fully in force.

Health-adjacent enforcement is the clearest worked example, and it transfers. The concern was never the pixel; it was the inference that a URL combined with an identifier reveals something a person did not choose to disclose. One federal agency's guidance on that point was challenged and partly withdrawn following litigation in 2024, which changed a guidance document without removing exposure; the FTC has pursued health-data-sharing matters under Section 5 and the Health Breach Notification Rule against companies outside health privacy law. Now consider what your own URLs disclose: a page about bankruptcy services, layoff planning or a whistleblower portal says something about the visitor's employer that the employer would not have volunteered.

The Inventory Nobody Has, and the Question Everyone Asks

The first question counsel, a regulator, or an enterprise customer's security reviewer asks is what is on the site and what does it send. Most companies cannot answer it, and producing the answer is the one deliverable that actually reduces risk.

Do not treat the tag manager container as the inventory. The container shows intent; the network log shows ground truth. Load the site with browser developer tools open and record the full network request log, cookies and storage — home page, pricing page, gated form, form submission, chat interaction, and any logged-in page. Then repeat having declined the consent banner, and compare. That is how you learn whether consent state is honoured in fact.

Record, for every destination: what it is, who owns it, what it receives, when it fires relative to consent, and whether anyone reviewed it. Pay attention to session replay and whether input masking actually masks, to chat transcripts, to visitor-identification tools, and to server-side tagging, the most common blind spot. Then reconcile the inventory against the privacy policy and cookie notice, the data processing agreement with each vendor, and any security questionnaire answers already given to customers. Mismatches are the priority finding: a statement in your own privacy policy contradicted by your own network log is the most damaging single document in this category of case.

Consent, Contracts, and the Exposure B2B Companies Overlook

A company with no consumer product is not outside this. California's temporary exemption for business-to-business contact data expired on 1 January 2023, so the work email and job title of a California business contact is ordinary personal information under the CCPA. Texas and Nebraska reach any non-small business that processes or sells personal data, with no volume threshold. And the wiretap theories depend on who is visiting the site, not on who the customer is.

Consent management should be scoped to what the law actually requires rather than to the vendor's default template. Regulators have repeatedly acted on the gap between a control and its effect: an opt-out that exists in the interface but does not stop the data flow, an opt-out preference signal that is ignored, an accept button materially easier than the reject button. On the contract side, what matters is whether the vendor is restricted to acting as a service provider or processor, whether it may use the data for its own purposes, and whether the company keeps a change history for its consent configuration.

If It Becomes a Dispute

When a demand letter or complaint arrives, counsel needs facts only a technical examination produces: what scripts loaded on the pages at issue, in what order and on what dates; what each transmitted and to which host; whether the consent banner fired before or after the tags; whether the consent platform's configuration on the relevant date matches what the company says it was; and whether the privacy policy then in force described what the site actually did. Measuring what a website did, and reconstructing what it did months ago, is what an expert witness is engaged to examine and explain.

The evidence is fragile: tags change weekly, consent configurations are overwritten rather than versioned by many vendors, and consent records are retained only briefly. Tag manager container versions, consent configuration and records, network captures, and dated versions of the privacy policy are the core set. Preserving them at the moment of a trigger — while changing no settings — is worth more than any argument made later.

Frequently Asked Questions