Your agency built a contact form, a slick chatbot or a streamlined lead capture magnet for a client’s website.
These features can qualify leads, answer FAQs, and work around the clock. Efficient. Great for conversions.
And now they could also be the reason your client, or your agency, gets a demand letter or named in a class action lawsuit.
The law behind these actions isn’t some brand-new data privacy regulation. It’s the California Invasion of Privacy Act (CIPA), passed in 1967 as a wiretapping prevention law. And we’ve addressed it for agencies in the past.
Plaintiffs’ attorneys have found a new use for this old law, and website features like chatbots, session replay tools, and tracking pixels are squarely in the crosshairs. And many of your clients are now receiving CIPA demands, which they then expect your agency to address.
What does your agency need to understand about CIPA now? And what should it do if it receives a demand?
What CIPA Actually Says
CIPA requires all parties to a communication to consent before it’s recorded or intercepted. Simple enough when the “communication” is a phone call. Less simple when the “communication” is a visitor typing into your client’s chatbot, and the “interception” is a third party vendor’s software processing that conversation in real time to make the bot work.
Plaintiffs are arguing that CIPA means that using a third-party chatbot, session replay tool, or tracking pixel, without getting the visitor’s explicit consent first, is the modern equivalent of an unauthorized third party listening in on a phone call.
Why This Is Suddenly Everywhere
2025 saw more CIPA filings than every prior year combined, and the pace hasn’t slowed in 2026. A few reasons this is hitting agencies and their clients so hard right now:
- Courts are increasingly applying what’s known as the “capability test:” if the vendor could technically use the collected data for its own purposes (say, training its AI model), a CIPA rule might be violated, whether or not the vendor actually did anything with the data.
- No actual harm to an individual consumer has to occur for someone to make a claim. CIPA allows statutory damages of $5,000 per violation, and class action exposure scales directly with your client’s website traffic.
- Generic protections, like a privacy policy link in the footer, a standard cookie banner, are increasingly not sufficient on their own to fight a CIPA claim.
It’s Not Just Chatbots
Chatbots are getting a lot of the CIPA headlines, but the same theory is being applied to session replay software, tracking pixels, SDKs, and cloud contact center tools — basically any technology on a client’s site that captures a visitor’s activity or communications and routes it through a third-party vendor.
If your agency has recommended, installed, or manages any of these tools for a client, this is relevant to you, not just to your client.
What Should Agencies Do About It? Or NOT Do About It?
- DO audit every tracking and AI tool currently deployed on your clients’ websites. Know what’s collecting data, what it’s collecting, and where that data goes. If you can, do this proactively before a client gets a demand.
- DO get real consent, not just a cookie banner. Explicit, specific, before-the-fact consent — through means like a clickwrap or a clear pre-chat disclosure — is what courts are looking for, not a passive footer link.
- DO review your vendor contracts and policies. Understand what your chatbot, analytics, or session replay vendors are contractually allowed to do with the data they collect, and push for technical and contractual limits on reuse.
- DO update your client conversations and contracts. Make sure your MSA and SOWs address who’s responsible for compliance with tracking technology and loop your clients in before you launch new features on their site that capture customer data. Spoiler alert: well-drafted contract language with strong liability limits and indemnification provisions protecting your agency are very helpful proactive steps.
- DON’T ignore a CIPA demand letter OR panic about it. If you or your client receives a CIPA demand, there’s no need to immediately escalate to a panic response. Many of these demands are spurious and most of them aren’t yet lawsuits. So, don’t panic but also don’t ignore the correspondence. Acknowledge your client’s concern and start assembling the information you’ll need to help the client (or your legal counsel) address the demand. Encourage the client to work with their own counsel to strategize their response to the demand as well while you confer with agency counsel.
- DON’T start making unilateral changes to a site after your client reports a CIPA demand. While an understandable reaction, knee-jerk unilateral changes to a site’s features upon receipt of a CIPA demand isn’t a good response strategy until AFTER you’ve sought legal guidance about the merits of the demand. The site may require absolutely no changes. Or some changes might be advisable but making them before settling a claim may limit your settlement leverage if settlement is your response strategy.
This is a fast-moving area, and the legal theories plaintiffs are using are evolving frequently. Also, the California legislature just passed SB 690 on August 28, 2026, and that legislation – if signed by the governor – will impact some private actions under CIPA and possibly work retroactively to impact claims filed within the past two years.
The tools and features your agency recommend for client sites today could be the subject of a demand letter or lawsuit tomorrow. But agencies that get ahead of consent, vendor management, and client contract language now will be in a much stronger position than those scrambling to respond to a CIPA demand.
Curious about how to proactively plan to address a CIPA demand, or how to react to one you (or a client) have received? That’s exactly the kind of question we like to help answer. Reach out: info@legalandcreative.com