When the Demand Letter Arrives: A Guide to Pixel-Tracking Privacy Claims, Defense Strategy, and Insurance Coverage

If your business operates a consumer-facing website, the odds you receive a privacy-related demand letter from a plaintiff’s law firm in the next year are higher than you think.

What is Pixel Tracking?

A tracking pixel is a small piece of code, historically a single transparent 1×1 image, embedded in a web page. When a visitor loads the page, the code causes the visitor’s browser to send a request directly to a third party’s server, such as Meta, Google, TikTok, or LinkedIn.

That request typically carries the visitor’s IP address, the URL of the page viewed, the referring page, browser and device identifiers, and cookie values. It can also carry actions taken on the page, such as clicks, form submissions, and purchases. Businesses use pixels to measure advertising conversions, build retargeting audiences, and analyze site traffic. Because the transmission to the third party happens at the same moment the visitor communicates with the website, plaintiffs characterize it as interception of the visitor’s communications. That characterization is the foundation of the claims discussed below.

The numbers:

• In 2022, fewer than 60 lawsuits were filed nationally targeting website tracking technologies under the California Invasion of Privacy Act. By 2024, that number was nearly 700.
• Industry projections for 2026 anticipate more than 3,500 CIPA-related filings, with pixel tracking and AI profiling as the dominant targets.
• Online tracking claims have been filed in 315 courts across 45 states against more than 3,500 unique defendants over the past three years.

The plaintiffs’ bar has built a profitable, repeatable practice around these claims. The demand letters follow a predictable template. Most cyber insurance policies provide narrower coverage than companies expect — many now contain specific exclusions for “wrongful collection” or pixel-tracking claims. And the underlying technology issue at the center of most of these matters — the gap between a consent banner that displays and one that actually gates third-party tracking — exists on a surprisingly large percentage of consumer-facing websites.

I have written a practical guide for businesses and insurers on how to respond when one of these demand letters arrives, what the available defenses look like, how to evaluate cyber insurance coverage for pixel-tracking claims, and what to do before any demand arrives.

If your business has received a demand letter, or if you would like to review your website tracking practices and cyber insurance coverage before one arrives, please reach out.