This article was published in the Sept./Oct. edition of Wisconsin Independent Agent

Practically every website uses some form of tracking or third-party technology that records or transmits information about how visitors use a website. The tools that help record this information—like cookies, pixels, session-replay tools, and, increasingly, AI-powered chat widgets—are everywhere. And there’s good reason for this: the technologies have legitimate value. They can help your business understand website traffic, advertise more effectively, and connect with current and prospective clients.

But they also create legal risk.

Over the last few years, plaintiffs’ class-action attorneys have increasingly targeted businesses that use these technologies. They argue that certain website tools violate wiretapping and similar privacy laws because they collect or transmit information about website visitors without their consent.

Many claims rely on the California Invasion of Privacy Act (or “CIPA”)—a 1960s-era law originally intended to limit the use of wiretapping, pen-register, and trap-and-trace devices on landline phones. Plaintiffs have also brought claims under similar state laws and the federal Electronic Communications Privacy Act (or “ECPA”) too. The developing case law is muddy about when—if ever—use of these technologies is a violation of one of these laws. Plaintiffs’ attorneys doing this work often wield this uncertainty as leverage. Moving to dismiss a case, even when the defendant has strong arguments, is expensive and not guaranteed to be successful. So, plaintiffs’ attorneys know that businesses often find it more economical to settle than to litigate.

No solution eliminates all risk, but agencies can take several practical steps to reduce it:

1. Require website visitors to opt in before using nonessential tracking technologies.

Those annoying cookie banners you’re seeing on every website you visit now? Much of the thanks for those goes to the plaintiffs’ attorneys doing this work. Their theory is that a website visitor must affirmatively consent (or “opt in”) before allowing tracking technologies to collect or transmit information. A properly configured consent-management platform—the software behind many cookie banners—has become the primary solution for obtaining that consent from users.

Most consent-management software is able to display key disclosures and block tracking technologies unless and until a user clicks “Accept.” Getting that affirmative consent from website visitors and maintaining a record of their consent is one of the strongest arguments against liability. Using consent-management software typically provides a verifiable factual defense and may even deter a plaintiffs’ attorney from threatening to file a claim altogether. When a plaintiffs’ attorney sees the cookie opt-in banner on your website, they may very well move on to those websites without one.

2. Know what is running on your website and make sure your cookie banner actually works.

Simply adding a consent banner is not enough. You also need to ensure the tool is configured correctly.

This typically requires that you first identify all your tracking technologies (like your Google, Meta, LinkedIn, HubSpot, and similar cookies, pixels, and beacons) and then correctly categorize them in the system your website uses to manage those technologies, such as Google Tag Manager. After that, you need to set the software to block all these various tracking technologies when a user lands on the page and continue to block them unless and until they click the “Accept” button. This can often be a complicated process, so you also need to test your banner to make sure it’s actually working as intended.

A banner that says “Reject” but allows tracking anyway does little to reduce your risk.

3. Pay special attention to pages that may reveal sensitive information, including quote and contact tools.

For any page that could collect sensitive information, consider not using any tracking technologies. This includes sensitive information that could be inferred simply from the pages a user visits or the topics they click on, even if the user never enters that information into a web form.

For example, merely visiting a page about a particular medical condition or insurance need could reveal sensitive information about that user.

This type of information creates an even greater risk, and not just because it may attract greater scrutiny; plaintiffs’ attorneys are also using novel theories to argue that additional laws, like the federal ECPA, apply.

4. Don’t forget chatbots and other third-party plug-ins.

Chat tools and other website plug-ins may send information to outside companies. That creates some of the same consent concerns as cookies and other tracking technologies. Chat tools may require separate disclosures and getting standalone affirmative consent from a user before they start a chat or interact with the tool.

5. Keep your website privacy policy accurate.

The disclosures you make in your website’s privacy notice should match what the website actually does, including accurately describing third-party sharing and available privacy choices.

6. Honor browser settings that tell websites not to track the user.

A growing number of states are also requiring that websites limit the placement of tracking technology by honoring third-party “browser signals” (a setting in a user’s browser that automatically tells websites not to sell, share or use certain data for tracking). Most consent-management platforms have settings that enable websites to recognize and honor these signals. Turning this on will reduce overall risk exposure.

7. Review your website at least annually and whenever you make significant changes.

New marketing campaigns, website redesigns, and new vendor tools or features often introduce new tracking technology and, with it, new risk. Have your web developer or vendor review your websites often to make sure your consent-management platform is still working as intended, that your privacy policy is still accurate, and that you’ve captured all the technologies on your site. Communication between your various departments is the key to avoiding increased risk.

By making appropriate design and configuration choices now, you can substantially reduce the risk that your agency is the target of one of these demand letters.

If you receive a demand letter or complaint involving cookies, pixels, or other website-tracking or third-party-plug-in technology, involve counsel promptly before responding.