CONSUMER ALERT: Attorney General Ken Paxton Warns Texans of Scam Demand Letters Alleging Website Privacy Violations

Attorney General Ken Paxton is advising businesses and nonprofit organizations to be aware of a recent surge in demand letters alleging website privacy violations under California law that are being sent to Texas businesses and organizations.  

These demand letters allege violations of the California Invasion of Privacy Act ("CIPA") based on the use of common website technologies such as cookies, pixels, analytics tools, and search bars. Senders may claim that these tools constitute unlawful "wiretapping" under California law and demand immediate payment to avoid litigation. Letters may include screenshots of the recipient entity's website and a draft complaint. 

Entities that receive such communications should exercise caution and seek legal guidance before taking action. 

"My office will do everything we can to protect Texans from fraudulent demands and other scams," said Attorney General Paxton. "We have been made aware of suspicious letters demanding payment from Texas businesses for alleged website privacy violations under California law. I urge any organization that receives such a demand to exercise caution, consult with legal counsel, and report suspected fraud or abuse to my office." 

Demand letters of this type may exaggerate or misrepresent a potential violation of law. For instance, one serial CIPA plaintiff, Vivek Shah, who is known to have sent demand letters alleging CIPA violations, has been declared a vexatious litigant and is barred from filing any new action asserting CIPA or related digital privacy claims in the U.S. District Court for the Central District of California without first obtaining the court's permission. While receiving such a letter can be concerning, entities should not respond directly to the sender or provide payment without first consulting qualified legal counsel, if possible. 

Entities that receive such a demand letter should consider taking the following steps: 

1. Consult with legal counsel experienced in privacy and website-tracking litigation before taking action. The State Bar of Texas offers resources that can help you identify and select an attorney.  
2. With the assistance of counsel, review your website's use of pixels, cookies, analytics tools, and similar technologies. 
3. Monitor evolving state and federal privacy laws and court decisions regarding website-tracking technologies. 

If a Texas business or organization received a demand letter alleging CIPA violations it believes to be fraudulent, abusive, or deceptive, report it to the Consumer Protection Division by calling toll-free 1-800-621-0508 or by filing an online complaint here.