I Got a Website Tracking Demand Letter. What Do I Do First?

What do I do first if I get a website tracking demand letter?

Call an attorney, and don't touch the website until someone has documented what it's currently doing. Those two things, in that order, before anything else.

The second one is where people go wrong. The natural reaction to a letter accusing your site of secretly recording visitors is to log in and delete everything it mentions. Understandable. It's also the worst available move, because the letter is a claim about what your site did, and you've just erased the only copy of the answer.

Why shouldn't I remove the trackers right away?

Because whether the allegation is even accurate is the first real question, and you can't answer it once the evidence is gone.

These letters are frequently sent in volume off an automated scan. That scan can be wrong. It can flag a script you removed a year ago, or misread a tool that was actually gated behind consent the whole time. If your site was configured correctly, that's your strongest position, and proving it takes a record of the configuration. Delete first and you're arguing from memory.

Preserve, then fix. Your tag manager container and its version history, your analytics configuration, your consent tool's settings and its consent logs, and a capture of what the page actually loads. Export what can be exported. Screenshot what can't.

The letter is a claim about what your site did. Deleting the trackers erases the only copy of the answer.

Is a demand letter the same as being sued?

No. It's a letter proposing you pay to avoid being sued, and the sender usually hasn't filed anything.

That's not a reason to ignore it. It is a reason not to panic-wire money on day two. Paying a demand without checking whether the technical allegation holds up has a way of producing a second letter from someone else, because you've signaled you're a business that pays.

What is this actually about, legally?

Wiretapping law, mostly, which surprises everyone.

California's Invasion of Privacy Act was written decades ago about phone calls. Plaintiffs' firms have been arguing that a session recorder or a chat widget on your site is a third party listening in on a conversation between you and your visitor. Washington's My Health My Data Act adds a separate lane, and it reads "health data" broadly enough to catch businesses that don't think of themselves as health-related at all. I wrote about who that law actually reaches and about where tracking pixels stand in Washington and Oregon.

Whether those arguments win is genuinely contested and it's your attorney's call, not mine.

Which tools get named in these letters?

Four categories come up over and over: session replay tools that record mouse movement and scrolling, chat widgets, advertising pixels like Meta's, and analytics loading before anyone consents to it.

The fourth one is the quiet killer, and it's the one most small businesses have without realizing. A tracker that fires the instant the page opens, with the consent banner appearing a beat later, is the exact pattern these claims are built on. Worse, having the banner at all can cut against you, because it's a written promise your site isn't keeping. That's covered in more detail in why your consent banner probably isn't compliant.

Who does what? Lawyer versus web person

Your attorney owns the response, the negotiation, and any decision about liability. Nobody technical should be drafting a reply.

What your attorney will need, and usually can't produce themselves, is a factual record of the site: every third-party request the page makes, the moment each one fires relative to the consent banner, what happens in each consent state, whether your privacy policy names those tools by name, and what the tag manager history shows about when things changed. That's a technical document, not a legal one, and having it ready shortens everything that follows.

Can I check my own site right now?

Yes, in about two minutes, and it's worth doing before you talk to anyone.

Open your homepage in a private window. Open your browser's developer tools, go to the Network tab, and reload without touching the banner. Anything that fires before you click is firing without consent. Then do it twice more: once clicking Accept, once clicking Reject. If the Reject run looks identical to the Accept run, your banner isn't gating anything.

I ran this on my own site before I ever ran it for a client. Banner up, everything firing underneath it. Fixed it before I sold the service, which is the only order that made sense to me.

If reading a network tab isn't how you want to spend a Tuesday, our free Exposure Scan does the same test and hands back the plain-language version, and the Website Privacy Audit produces the full documented record in the form an attorney can actually use.

FAQ

How long do I have to respond?

Reported windows run about 20 to 30 days, but the letter itself will state one. Your attorney should confirm what's real.

Should I just pay it and move on?

That's a legal and financial decision, not a technical one. What I'd say is that paying before anyone has checked whether the allegation is factually right means you never found out if you had a defense.

I'm not in California. Does this still apply?

Possibly. These claims follow where your visitors are, not where you are. A Washington business with California customers can land inside it.

Does deleting the trackers fix the problem?

It stops the ongoing exposure. It doesn't address the past conduct the letter is about, and doing it before you've documented the current state costs you the record.

What if my site was actually set up correctly?

Then you're in a good position and the evidence is the whole game. Preserve it before you change anything.

Sources and disclaimer

Sources are linked inline. This reflects the state of these laws as of mid 2026 and is not legal advice. Confirm the current rules with a qualified attorney.