A Website Owner's Checklist for Tracking Scripts and Privacy Lawsuits

A few years ago, adding a marketing pixel to a website was a five-minute job: you pasted the snippet into the header and published. Today that same snippet is one of the most common reasons companies get sued over privacy.

These lawsuits rarely claim a hack or a breach. They argue that a website sent visitor activity to a third party, usually an ad platform, without the consent the law requires. Big brands are the usual defendants, but the legal theories apply to any site running the same scripts.

Why ordinary websites get sued

Most of these cases rely on old laws written for older technology.

Start with state wiretapping laws. The California Invasion of Privacy Act was passed in 1967 to stop phone tapping. Plaintiffs now use it against chat widgets, session replay tools and pixels, arguing that a third party listened in on a conversation between a visitor and a website. The law allows $5,000 in damages per violation, which is why the numbers in these cases grow quickly.

Then there’s the Video Privacy Protection Act, a 1988 federal law that bars video providers from sharing what someone watched without consent. If a page with video sends the video title and a user ID to an ad platform, plaintiffs argue that’s a violation worth $2,500 in damages.

Health pages carry extra risk. Tracking on pages about medical conditions, prescriptions or appointments draws scrutiny from both plaintiffs and regulators.

Recent settlements show the stakes

Two settlements open in fall 2026 show how this plays out:

• CVS agreed to a proposed $20.5 million settlement over data shared through its app and website. Users can claim up to $5 each without proof.
• Forbes agreed to a $10 million settlement over trackers on its sites, covering visitors from December 20, 2023 to June 11, 2026.

Per-person payouts are small, but the total cost to the company, including legal fees and the engineering work that follows, is much larger. For a smaller site, answering a single demand letter can cost more than the analytics were ever worth.

A checklist for your site

You can keep your analytics as long as you know what runs on your pages and get consent where it’s needed.

1. Inventory every script. Open your tag manager and your theme’s header and footer files. List each pixel, analytics tag, chat widget, session recorder and embedded player. Plugins often add scripts you never set up yourself.
2. Check what each one sends. Open your browser’s developer tools and watch the network tab while you click around your own site. Look for page URLs with search terms, form values, video titles or email addresses going to third parties.
3. Gate marketing tags behind consent. Load advertising pixels only after a visitor opts in. A banner that loads everything first and asks later doesn’t help.
4. Honor browser privacy signals. California’s privacy regulations require covered businesses to treat the Global Privacy Control signal as a request to opt out of selling or sharing data. Most consent platforms can detect it.
5. Be careful with video and health pages. Remove ad pixels from pages that play video tied to user accounts, and from any page about health, unless you have clear consent and legal advice.
6. Disclose chat and session replay. If a chat vendor or recording tool captures what visitors type, say so before they type it.
7. Match your privacy policy to reality. A policy that says you don’t share data while your pixels do is worse than no promise at all.
8. Recheck after every redesign. New themes, plugins and page builders bring their own scripts. Run the audit again whenever the site changes.

Tools that make this easier

You don’t have to build consent handling from scratch.

• A consent management platform can hold tags until a visitor agrees and log each choice, which helps if you ever need to show what a visitor saw.
• Tag manager triggers can fire marketing tags only after consent is granted, instead of on every page view.
• Google Consent Mode changes how Google tags behave based on a visitor’s choice. It doesn’t replace asking for consent.
• Server-side tagging gives you more control over what leaves your site, but it doesn’t remove the need for consent. It only changes where the data is sent from.

Whatever you use, test it the same way: decline consent, browse the site, and confirm in the network tab that nothing marketing-related fires.

If you’re on the other side of the screen

Most people reading about these cases are visitors, not site owners. If you used a site or app that later settled over tracking, you may be entitled to a payment, usually with no receipt required. A list of data privacy class action settlements shows which ones are open and what they pay.

Filing usually takes a few minutes online, and a class action settlement app can match you to open cases and keep track of the claims you file.

When to run the audit

Most of the fixes are housekeeping, so the main risk is letting them slide. Run the checklist once a year and again after any redesign or new plugin. An afternoon of auditing costs far less than answering a demand letter.