The Importance of a Cookie Consent Solution
Website owners are receiving legal demand letters for thousands of dollars simply because they are using Google Analytics.
One of our clients recently received one of these demand letters in January, 2026. They were not doing anything unusual or aggressive. They are a small local business based in Birmingham, Alabama and do not market to California customers.
The demand came because they use Google Analytics on their website. As ridiculous as this may sound, these demands are based on a real California law, and some courts have sided with the people sending them.
We strongly dislike these tactics. Unfortunately, they are part of the reality of operating a website today and seem to be on the rise.
Why does a California law apply to my website?
The law referenced in these demand letters is the California Invasion of Privacy Act (CIPA). It was created in the 1960s to address phone wiretapping and interception. It provides for harsh penalties ($5000 per infraction) and has no concept of websites, cookies, or analytics.
However, in recent years, some California courts have allowed this law to be applied to web tracking pixels for advertising and analytics. This interpretation has opened the door for aggressive legal tactics targeting websites like yours.
Since your website can be viewed by someone in California, these opportunistic law firms can make demands against you that are far beyond what the law was originally designed to cover.
If you want deeper legal context, this article provides a good overview of how this law is being interpreted today.
What steps should I take to make sure I'm protected?
First, we are not attorneys and this is not legal advice.
As we understand the laws, because your website uses Google Analytics, CIPA and potentially other global privacy laws apply to you.
We recommend a solution called Termageddon which provides a package of legal documents (including a Terms of Service, Privacy Policy, Cookie Policy) as well as a cookie consent solution that will block tracking cookies unless the visitor agrees to accept them. What's more, this solution will only appear for visitors coming from the areas where these laws apply.
We have personally known the founders of Termageddon for many years, and they are uniquely qualified to provide this solution. The President, Donata Stroink-Skillrud, is an attorney and the Chair of the ePrivacy Committee of the American Bar Association.
The cost for Termageddon is $119/yr. As a certified Data Privacy agency with Termageddon, we can handle the entire billing and setup process for you.
In addition to the annual subscription, we charge a one-time $200 set up fee that covers setting up the policies, embedding them on your website, installing the cookie consent solution, and testing to make sure it works properly.
Update: October 2026
California Governor Newsom signed SB 690 on September 30, 2026, changing who can sue under part of the California Invasion of Privacy Act. However, the new law affects only one section of CIPA. Wiretap claims under Section 631 are still open to private plaintiffs, and those are the claims most often aimed at advertising pixels, session recording tools, and chat widgets.
Our recommendation has not changed. A cookie consent solution that blocks tracking until a visitor agrees is still the best protection we know of.
Let us know how you'd like to proceed.