Most e-Commerce brands think privacy is handled. Consent banner added. CCPA box checked. Move on. That was enough, it isn’t anymore.
A growing wave of lawsuits is targeting that exact setup, using CIPA, a 1967 wiretapping law now being applied to websites.
What’s changed
The focus isn’t what you collect. It’s when it starts.
If tracking tools (pixels, analytics, third-party scripts) fire on page load before user consent, plaintiffs argue that’s an unauthorized interception. Even basic data like IP or URL can trigger claims. Courts aren’t fully aligned, but enough cases are moving forward to make this real.
Where brands get it wrong
The misconception is assuming CCPA compliance covers this. CCPA is largely built around opt-out rights. CIPA claims, as currently argued, focus on something earlier: when that data collection begins. That gap is everything. Most teams haven’t audited:
- What fires on page load
- What runs before interaction
- Whether consent actually blocks anything
Why Shopify brands get caught
Platform scripts and integrations often fire automatically. Even if data sharing is limited, observable behavior, like requests firing, is enough to trigger claims. A merchant can believe their setup is correct, while an external scan suggests otherwise. And in this environment, perception alone can trigger a demand.
Geography doesn’t save you
It’s easy to assume this is only a U.S. problem. It’s not.
CIPA protections extend to California residents, regardless of where the business is based. If California users can access your site, you’re in scope. Fragmented setups (different regions, configs, tools) are easy targets for automated scans.
What actually matters
This isn’t about rewriting policy language or tweaking banner copy. It’s about changing how, and when, tracking executes. A proper audit often reveals multiple third-party scripts initiating requests before any user interaction. And critically, this has to be verified, not assumed.
If you get a letter
If you receive a demand letter, ignoring it is the worst move. But responding without legal guidance isn’t much better. The most effective path is to engage counsel quickly and respond through them.
The shift
CCPA lets you collect, then stop. CIPA challenges collecting at all before consent. Most stacks were built for the first. Litigation is now testing the second. That gap is the risk.
Disclaimer:
This article is for informational purposes only and does not constitute legal advice. If you’ve received a demand letter or have concerns about potential exposure under CIPA, consult qualified privacy counsel.
