Free tools Windows power users keep installed
One-click scans. No signup required.
If you receive a CIPA demand letter about website tracking, preserve the letter and the relevant site configuration, then work with counsel to reconstruct what the visitor’s browser actually did. A demand is an allegation, not a finding of liability: an installed tag does not by itself show that it ran in the alleged session, what data it sent, when it sent it, or whether the conduct violates a statute.
What should you establish before deciding what the letter means?
Keep four questions separate. They concern different evidence, and none alone answers whether the claim is legally valid:
As an Amazon Associate I earn from qualifying purchases.
- What code was present? Identify the scripts, tag-manager configuration, consent settings, and versions that applied to the relevant site and period.
- What code ran in the alleged visit? A script on a page, a scan result, or a screenshot does not establish that the script executed in the claimant’s browser session.
- What left the browser, and when? Determine the actual request fields, recipient, sequence, and relationship to the visitor’s actions and consent choice.
- How does the law characterize those facts? That is a legal question for counsel, based on the particular statute, allegations, evidence, forum, and current law—not a conclusion a technical scan can supply.
As Christopher D. Lee, Esq., reviewer of Elpis Law’s September 2026 overview, puts it: “A demand letter is not a finding of liability. What matters is which statute is asserted, what was transmitted, when, and to whom.”
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat should you preserve first?
Preserve the demand and the site evidence before making changes that could erase or obscure the configuration relevant to the allegation. This is an evidence-preservation step, not a reason to leave a potentially problematic setup running. Ask counsel promptly about response deadlines, preservation duties, and whether any testing or mitigation should happen immediately.
#1 Best Overall
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notaries Public' confidential information
- GLBA and HIPAA require strict confidentiality policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
- Keep the original letter, envelope or delivery record, attachments, and any follow-up communications. Record the date received.
- Note the sender, statutes cited, requested response date, settlement terms, URLs, screenshots, and any supplied scan or network recording.
- Capture the site’s current version, relevant deployments, tag-manager container and version, consent-management configuration, and vendor settings.
- Preserve available logs and configuration histories that may help establish what was active at the time alleged.
- Keep preserved originals access-controlled. Use redacted working copies when they contain visitor data, credentials, or other sensitive information.
Do not assume that today’s website state matches the state in the alleged visit. If a change is needed, keep a dated record of the before-and-after configuration and coordinate the decision with counsel and the technical owner.
How can you reconstruct what a browser did?
Use a controlled reproduction to document observable behavior, while keeping its limits clear: a visit you reproduce today is not proof of what happened in a historical session. Record the conditions closely enough that another person can understand what was tested.
- Set the test conditions. Record the date, time and timezone, browser and version, URL, relevant geographic context, whether the user is logged in, and the site version or configuration being tested.
- Record the visitor’s actions. Note when the page loads, when a banner appears, which choice is made, and the sequence of clicks or other interactions.
- Capture network activity. In the browser’s developer tools, use the Network panel or equivalent to save a HAR or other suitable network record. Preserve screenshots that show relevant settings or activity.
- Inspect individual requests. Where observable, record the destination, timestamp or sequence, initiator, headers, query parameters, cookies, referrer or URL values, and payload. Describe the actual values or categories observed rather than labeling all traffic “content.”
- Repeat only with a clear purpose. If appropriate and counsel-directed, compare a fresh session before a consent choice with sessions after accepting or rejecting. Note whether a request was blocked, delayed, or sent in a reduced mode.
Network records can contain sensitive information. Preserve originals securely, restrict access, and redact working copies before sharing them more broadly. A HAR may show that a request occurred and what it carried as captured; it does not, by itself, resolve the legal significance of that request or establish the full history of a claimant’s visit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which request details matter when several tracking tools are alleged?
Build a factual comparison rather than treating every tag or vendor as equivalent. These distinctions help counsel assess the evidence; they are not a legal test.
| Question | What to document |
|---|---|
| What data was involved? | Whether the observable request included typed or searched content, full URLs or referrers, cookies or identifiers, IP or other routing information, or other fields. Distinguish what the record shows from what is inferred. |
| When did it happen? | Request sequence relative to page load, banner display, consent choice, and user action. |
| Who received it? | The request destination and whether the recipient appears to be a site endpoint, a service provider acting for the site, or a vendor that may use data for independent purposes. |
| What configuration applied? | Product or script version, tag settings, consent mode, masking or suppression options, and deployment history. |
| What claim and forum are involved? | The statute or statutes named in the letter, any federal theories, the claimant’s alleged location, and the forum facts counsel considers relevant. |
Contents and routing or addressing information are not interchangeable descriptions. The federal Wiretap Act defines “contents” in terms of the substance, purport, or meaning of a communication; CIPA section 631 also uses “contents or meaning” language. By contrast, disputes under CIPA sections 638.50–638.51 concern whether software collecting IP addresses, browser or device identifiers, or related routing information falls within pen-register or trap-and-trace provisions. Identify the fields actually observed and let counsel assess the legal characterization.
What legal theories might the letter assert?
Read the letter to identify the exact statute and theory alleged. A demand may raise more than one theory, and CIPA allegations should not be conflated with federal Wiretap Act or Electronic Communications Privacy Act allegations, which have distinct statutory elements.
CIPA section 631
Website plaintiffs have alleged that third parties obtained communications contemporaneously through technologies such as pixels, chat tools, or session-replay software. Those are allegations that require analysis of the specific conduct and evidence. The California Lawyers Association’s Privacy Law Section article by Jennifer M. Oliver, published May 2, 2024, describes session-replay software as capable of recording mouse movements, keystrokes, search information, and viewed pages or content; that description is not a finding about every product or configuration.
CIPA sections 638.50–638.51
These provisions concern pen registers and trap-and-trace devices. The legal overviews available in 2026 describe disputes about applying them to software that captures IP addresses, identifiers, or related routing information. Harris Beach Murtha’s July 1, 2026 alert reports judicial skepticism in some cases as well as fact-sensitive review; it does not establish a universal rule that such claims always succeed or always fail.
Consent timing and vendor role
In Javier v. Assurance IQ, LLC, the Ninth Circuit concluded that consent obtained after an alleged interception could not retroactively authorize the earlier conduct under section 631. That timing point does not resolve every question about a particular tracker, disclosure, consent mechanism, or alleged event.
The California Lawyers Association article also discusses arguments that a service provider limited to analyzing site functionality for the site’s benefit may be treated differently from a third party using data for its own purposes. It discusses Saleh v. Nike and other outcomes as case-specific examples. A vendor’s label or contract alone should not be treated as a safe harbor; counsel should review the actual service, configuration, data use, and agreements.
Jurisdiction and remedies
Harris Beach Murtha’s July 2026 alert identifies personal jurisdiction as a significant defense issue in some cases. The claimant’s location, a business’s contacts and targeting, and forum-specific facts may matter, so counsel should evaluate the actual forum rather than assume that a California-related allegation settles jurisdiction.
Recommended Free Tools
Elpis Law’s September 2026 overview describes CIPA’s civil remedy as potentially including $5,000 per violation or three times actual damages, and notes a separate civil remedy under the federal Wiretap Act. These are the source’s descriptions, not a prediction of damages in an individual matter. Counsel should verify the current statute, the remedy applicable to the pleaded claim, and how any alleged violations are counted.
Best Value
- HEALTHCARE FORM: Under the HIPAA regulations, all healthcare providers are required to adopt certain policies and procedures to maintain the privacy of patients’ health information and provide patients with a written notice on how they may use or disclose their protected information. This attorney-approved HIPAA Patient Ack. of Receipt of Notice of Privacy Practices form satisfies all required HIPAA obligations by documenting compliance.
- MEDICAL FORM: This HIPAA privacy notice ack. form includes all HIPAA required elements that must be included in order to validate an acknowledgment sheet. It acknowledges that the patient has received a Notice of Privacy Practices from their healthcare provider.
- HIPAA: The patient acknowledgment form for receipt of HIPAA notice privacy practices acknowledges that the patient's information to be released to an authorized third party is under HIPAA compliance. Healthcare providers can provide this form to the patients for a clear and concise valid patient acknowledgment under HIPAA.
- PACKAGING/DIMENSIONS: The HIPAA medical form is sold in a pack of 200 sheets in English. Each white medical sheet with blue ink print measures 8-1/2” wide and 11” long.
- COMPLYRIGHT: At ComplyRight, our mission is to free employers from the burden of tracking and complying with the complex web of federal, state, and local employment laws. ComplyRight is the market leader in government compliant products such as tax forms, tax software, HR products and services, labor law solutions, and health insurance claim forms.
When should you change the code?
“Debug before you change the code” means documenting the state relevant to the allegation before altering it; it does not mean continuing a configuration that may create risk. There is no one technical response appropriate for every letter. With counsel and the technical owner, weigh the need for prompt mitigation against preserving reliable evidence of the prior state.
- Record the existing tags, consent settings, deployment state, and available logs before changing them where practicable.
- Document what was changed, when, by whom, and why; keep the resulting configuration and test record.
- Separate any mitigation decision from the legal conclusion. Changing a tag may alter future behavior, but does not determine what happened previously or resolve the claims.
- Do not characterize a banner as proof of consent or a blocked request as proof about every browser state without evidence of the sequence tested.
What should you give counsel?
Provide an organized factual packet rather than a conclusion such as “the site wiretapped someone” or “the scan proves nothing.” Include the letter, timeline, site and tag configuration records, controlled test conditions, network artifacts, request-by-request observations, vendor documentation, and a clear list of what remains unknown. Distinguish historical records from present-day reproductions, and observations from interpretations.
Current-law questions can change. Elpis Law’s September 2026 overview reported that SB 690 had passed the Legislature and been sent to the Governor but had not yet been signed at the time of that overview. That dated report does not establish the bill’s status on October 11, 2026. Counsel should verify the official bill history and enacted text before relying on any claim about SB 690’s current effect.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
