Practical Steps to Reduce Web Tracking Litigation Risk
Key Takeaways:
- Websites can create unavoidable privacy risk
- Regulators and plaintiffs focus on governance gaps
- CIPA claims can be difficult to eliminate early
- Proactive review reduces litigation attractiveness
For most organizations in our interconnected world, the company’s website has become its virtual front door, its primary signage, and its main source of connection with the outside world. In recent months, it has also become an increasing source of risk, one that is often overlooked until the risk materializes. Specifically, plaintiffs’ attorneys, pro-se plaintiffs and regulators have been paying close attention to how organizations use web tracking technologies like cookies and pixels, given the patchwork of developing and sometimes antiquated state privacy laws that may apply. Business leaders who ignore this risk do so at their organization’s peril.
Beginning with regulators, the New York State Attorney General has issued guidance to businesses concerning how to implement proper website privacy controls, specifically in relation to website tracking technologies. According to the guidance, businesses should:
- Avoid deceptive or unclear user options, like a button accepting all web trackers without a reject option;
- Ensure that consent management platforms allowing a user to make cookie choices are properly configured; and
- Designate a qualified individual to be responsible for implementing and managing website tracking technologies.
This last part of the guidance is the primary source of risk for most organizations. Often, website development and web tracking are not directly governed within an organization. The website may be the responsibility of the marketing team, for example, but few internal marketing teams have complete visibility into or understanding of their organization’s web tracking activities. Often, cookies are used as a matter of course, chosen by the developer without detailed discussion with the website owner, or they can linger beyond a specific project for which they were implemented. Failure to properly inventory and manage web tracking technologies is an easy target for litigation and regulatory scrutiny, however, and paints a broader picture of lack of governance that can be exploited in litigation.
Case in point, the escalating wave of privacy litigation arising from use of common web tracking technologies like Google Analytics and the Meta pixel. Beginning in 2022, but exploding last year and continuing into 2026, plaintiffs’ attorneys and even pro-se litigants have been issuing countless demands for relief, and even filing actions, alleging that use of common web tracking technologies violates the 1967 California Invasion of Privacy Act (“CIPA”), which was adopted to address telephone eavesdropping. In these suits, plaintiffs seize on the same governance and disclosure gaps identified by the New York State Attorney General’s guidance to allege CIPA and other related violations, including in relation to the following common website functionalities:
- Website analytics and session-replay technologies;
- AI-enabled chatbots; and
- Search bars and search functionality, to the extent search prompts are shared with a third party, which many are for analytics purposes.
And given the worldwide reach of a website, organizations neither based nor operating in California can still find themselves in the CIPA crosshairs. Moreover, these suits are built to settle quickly, but the amounts at issue are not trivial, although they may not be material for some organizations. The problem is that few organizations can effectively turn off the tracking technologies at issue or properly limit them and maintain robust website functionality. What results is a kind of Catch-22: if you maintain a website with tracking functionality, you remain at risk of one of these suits or demands, even though you may only be using industry standard web trackers. And since a quick settlement of a web tracking suit or demand is usually done on a non-class basis, settling one case does not remove or even reduce the risk of a copy-cat suit, especially since courts are not universally rejecting these suits at the motion to dismiss stage.
Accordingly, every organization with a website using analytics, chatbots, or even a search functionality should undertake a detailed review of its web tracking activities, and position itself—through appropriate disclosures, terms and website configuration—as a less attractive target. A few key protective steps include:
- Adopting a cookie banner or consent management platform that is correctly configured and clearly links to a Privacy Policy and Terms of Use that are designed to limit web tracking litigation risk
- Adopting a class action waiver and considering alternative dispute resolution in website Terms of Use, although some pro-se plaintiffs may begin an arbitration, given the low cost of entry to certain consumer arbitration platforms
- Assessing and addressing applicable privacy laws, with currently 19 states having adopted comprehensive privacy regimes that may regulate, inter alia, web tracking technologies
Adding to the risk, some insurance carriers have been limiting coverage in relation to web-tracking claims and many are asking in the application or renewal process whether the insured has undertaken a comprehensive web tracking review with counsel. To address these issues, every organization with a website using cookies or pixels should assign a business leader with the knowledge, motivation, and experience necessary to tackle a multi-faceted project like this, and effect the relevant change and governance development needed, with appropriate legal guidance.
The Harter Secrest & Emery Privacy and Data Security Team has deep experience with web tracking compliance, risk management strategies, and how to handle web-tracking or any other data protection litigation, including data breach class action litigation, which similarly has seen a marked increase in the past 12 months. If you have any questions, please reach out to F. Paul Greene CIPP/US/E, CIPM, FIP, AIGP, at fgreene@hselaw.com to schedule a discussion.