The EIA has spent the past two years tracking the growing wave of litigation under the California Invasion of Privacy Act (CIPA) and fighting to curb this abuse, particularly claims targeting the routine website technologies ecommerce businesses use every day.
Now, the issue is drawing attention well beyond California.
On September 17, Texas Attorney General Ken Paxton issued a consumer alert warning Texas businesses and nonprofit organizations about a recent surge in demand letters alleging CIPA violations based on common website tools such as cookies, pixels, analytics platforms and search bars. The letters may include screenshots of a company’s website, a draft complaint and demands for payment to avoid litigation.
The Texas Attorney General cautioned that some of these demands may exaggerate or misrepresent potential legal violations and urged recipients to consult legal counsel before responding or making any payment.
A California Law With Consequences Beyond California
That a Texas attorney general is now warning Texas businesses about claims brought under a California privacy law underscores a problem EIA has been raising for some time: ecommerce does not stop at state borders.
A business can operate from Texas, Virginia, Florida or anywhere else in the country while serving customers in California. Its website may use the same analytics, advertising, chat, search and customer-experience technologies used by thousands of other online businesses.
Yet those routine interactions can expose businesses to claims under a California statute enacted in 1967, decades before ecommerce or modern website technology existed.
For small and midsize ecommerce businesses, that uncertainty carries a real cost. Even when a company believes a claim lacks merit, responding to demand letters and defending litigation can require significant legal resources.
EIA Has Been Following This Problem Closely
EIA has repeatedly highlighted the growing use of CIPA against ecommerce businesses, including claims targeting standard website tools like cookies, pixels, analytics, chat features and other technologies that are part of everyday online commerce.
We have written about the broader CIPA litigation problem and the pressure these claims can place on small and midsize businesses. More recently, we covered a federal court decision rejecting a CIPA pixel lawsuit where the plaintiff failed to show genuine privacy harm — an example of courts beginning to scrutinize these claims more closely.
EIA has also strongly supported California Senate Bill 690. We joined a broad coalition advocating for the legislation and continued following it as it moved through the Legislature. On September 30th, Governor Gavin Newsom signed SB 690 into law, marking a major step toward curbing certain CIPA claims that have targeted businesses over routine website technologies.
The reform does not eliminate every type of CIPA website claim, but it significantly narrows one of the theories that has fueled demand letters and litigation against ecommerce businesses. EIA’s latest update breaks down what the new law changes and what businesses should still watch for.
What Ecommerce Businesses Should Do
The Texas Attorney General recommends that businesses receiving a CIPA demand consult experienced legal counsel before responding, review the website technologies identified in the demand and continue monitoring developments in privacy law and website-tracking litigation. Texas businesses that believe a demand is fraudulent, abusive or deceptive can also report it to the Attorney General’s Consumer Protection Division.
Join the EIA today to help strengthen and shape policies that affect all ecommerce businesses. Together, we can continue to create the future of ecommerce. Subscribe to EIA email updates to stay informed on key developments and their impact on your business.
Ecommerce Innovation Alliance provides members with analysis of litigation and regulatory developments affecting online commerce and digital marketing. This post is for informational purposes only and does not constitute legal advice. Members with questions about their specific practices should consult counsel.
