Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you receive a CIPA demand letter about website tracking, preserve the letter and the relevant website evidence, then work with counsel to reconstruct what the browser actually did. A demand is an allegation, not a court finding. An installed tag or a scan alone does not establish what ran during the claimant’s visit, what data was sent, or whether the conduct violates a particular statute.
Keep four questions separate: what code was present, what executed during the alleged session, what information left the browser and when, and how the law applies to those facts. This evidence-first approach helps your lawyer assess the actual claim without treating a technical observation as a legal conclusion.
What should you do first?
- Preserve the demand and its attachments. Save the original letter, envelope or delivery record, emails, screenshots, scans, and any attached network files. Record when it arrived, who sent it, the response date requested, the URLs identified, the statutes asserted, and any proposed settlement terms. Ask counsel promptly about deadlines and preservation duties.
- Document the website as it is now. Before making changes, record the relevant site version, tag-manager container and version, consent-management settings, vendors, and recent deployment dates. Preserve configuration histories, logs, and other records that could help establish what was active at the time alleged.
- Coordinate evidence handling with counsel. Keep preserved originals access-controlled. If you make working copies for review, redact sensitive visitor information from those copies where appropriate, and record what was redacted. A network capture may contain personal data or other sensitive values.
- Do not delay necessary mitigation just to keep a configuration running. Counsel and the technical owner can weigh immediate changes against the need to preserve evidence. Document the relevant before-and-after states and the timing of any changes.
This is a practical evidence workflow, not a statutory checklist or a legal test. It does not determine whether the claim is valid.
How do you find out what the browser actually did?
A tag being installed shows that code was available to run; it does not, by itself, show that it executed during a particular visit. Likewise, a present-day reproduction can show current behavior, but cannot prove what happened in an earlier session. Treat historical evidence and controlled reproductions as different records.
#1 Best Overall
Record the conditions of a reproduction
For each controlled visit, record the date and time with timezone, browser and version, URL, relevant geographic context, whether the visitor was logged in, and the sequence of actions—including the consent choice. Preserve screenshots and a HAR file or equivalent network record when appropriate. Note whether the session began fresh or reused existing browser state.
Inspect requests, not just scripts
For each relevant request, capture what is observable: destination, initiator, timestamp or sequence, headers, query parameters, cookies, referrer or URL values, and payload. Identify which fields were actually transmitted; do not describe all browser traffic as communication “content.” A script listing or a scan can help locate code, but does not alone establish the request sequence or the contents of a particular person’s session.
Compare consent states
If appropriate and counsel-directed, test a fresh session before a choice, after accepting, and after rejecting. Check whether scripts are blocked, delayed, or placed in a reduced mode, and note what requests still occur. A visible banner does not establish that consent preceded a request; the browser’s actual sequence matters.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhich facts matter when several tracking tools are named?
Build a factual comparison for each tool or request mentioned in the letter. These distinctions help counsel assess the allegations; they are not a legal test.
Rank #2
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notaries Public' confidential information
- GLBA and HIPAA require strict confidentiality policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
| Question | What to record |
|---|---|
| What data? | Content typed or searched; full URLs or referrers; cookies or identifiers; IP addresses or other routing information; and the specific fields visible in the request. |
| When? | Whether the request occurred before the banner appeared, before or after a choice, or in relation to a particular user action. |
| Who received it? | The request endpoint and the vendor’s role: site-hosted code, a service provider acting for the site, or a vendor that may use data for its own purposes. |
| How was it configured? | Product and version, tag settings, consent mode, masking or suppression settings, and relevant deployment history. |
| What claim and forum? | The statute or statutes actually pleaded, the claimant’s location, the forum, and facts about business contacts or targeting that counsel considers relevant. |
Review vendor contracts, product settings, and privacy disclosures with counsel when assessing a vendor’s role. The California Lawyers Association’s Privacy Law Section article by Jennifer M. Oliver, published May 2, 2024, describes session-replay software as capable of recording mouse movements, keystrokes, search information, and viewed pages or content. That description does not establish what any particular product captured in a particular configuration.
What legal theories might the letter assert?
Read the letter rather than assuming every website-tracking demand makes the same claim. Elpis Law’s September 2026 overview discusses California Invasion of Privacy Act (CIPA) section 631, CIPA sections 638.50–638.51, and federal Wiretap Act/ECPA allegations. Those are distinct theories with different statutory elements; a demand may assert more than one.
CIPA section 631 and alleged interception
Website plaintiffs have alleged that a third party obtained communications contemporaneously through tools such as pixels, chat, or session replay. The legal questions can involve what was communicated, what a third party obtained, and when. Elpis Law’s September 2026 overview discusses section 631’s “contents or meaning” language and the federal Wiretap Act’s description of contents as information concerning the substance, purport, or meaning of a communication. Do not turn those allegations into a finding that a particular site intercepted a communication.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #3
- Published by National Notary Association
- Record full details of 488 notarizations in this notary journal
- Heavyweight ledger paper with special area for a thumbprint
- 122 pages
- 10-7/8" wide x 8-7/16" high
CIPA sections 638.50–638.51 and routing information
Some disputes concern whether software capturing IP addresses, browser or device identifiers, or related routing information falls within the pen-register provisions. The legal alerts from Elpis Law (September 2026) and Harris Beach Murtha (July 1, 2026) describe fact-sensitive review and judicial skepticism in some cases. They do not establish a universal rule that the theory always applies or never applies to ordinary website tracking.
Consent timing and a vendor’s role
In Javier v. Assurance IQ, LLC, the Ninth Circuit concluded that consent obtained after an alleged interception could not retroactively authorize the earlier conduct under section 631. That timing rule does not by itself answer every question about consent, disclosures, or a particular tracker.
The California Lawyers Association article discusses arguments that a service provider limited to analyzing site functionality for the site’s benefit may be treated differently from a third party using data for its own purposes. It also discusses Saleh v. Nike and other case-specific outcomes. These are litigation arguments and examples, not a safe harbor for any vendor or configuration.
Jurisdiction and potential remedies
Harris Beach Murtha’s July 1, 2026 legal alert reports that personal jurisdiction has become a significant defense issue in some cases and that outcomes vary. The claimant’s location, a business’s contacts, targeting, and the particular forum may matter; counsel should evaluate the facts of the case rather than assuming that one court’s outcome controls everywhere.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Elpis Law’s September 2026 overview describes CIPA’s civil remedy as potentially including $5,000 per violation or three times actual damages, and notes a separate federal Wiretap Act civil remedy. These are the law firm’s descriptions, not a calculation of exposure in your case. Have counsel verify the current statute, the asserted claim, and how any remedy could apply to the facts.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you give your lawyer?
Provide the complete demand and a factual record that distinguishes what is known from what remains uncertain. Useful materials may include:
- The letter, attachments, receipt date, and any response deadline or settlement proposal.
- The site and tag-manager versions, consent settings, vendor list, deployment history, and relevant logs for the period at issue.
- Preserved network captures and screenshots, with reproduction conditions recorded separately from evidence of the alleged historical visit.
- A request-by-request account of observable fields, destinations, timing, and consent state.
- Relevant contracts, product settings, and privacy disclosures that may help explain the vendor’s role.
Label observations precisely. For example, distinguish “the current test sent this request before a choice” from “the claimant’s earlier visit sent this request”; the first does not establish the second. Ask counsel to assess both the technical record and the exact statutes and forum identified in the letter.
What is known about SB 690?
Elpis Law’s September 2026 overview reported that SB 690 had passed the Legislature and been sent to the Governor, but had not yet been signed at the time of that review. That dated report does not establish the bill’s later status or the law in force when a demand is received. Do not rely on it to conclude that the bill was signed, vetoed, or changed CIPA; have counsel check the official bill history and enacted text for the relevant date.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
