What your website sends before anyone says yes.
This library shows what your pixels and tags send before a visitor makes a choice, how to see it in your own browser, and how I set them up to send less. It's written for law firms, medical practices and Shopify stores.
I'm a marketer, not a lawyer, and nothing in this library is legal advice. Whether a law applies to your business, and what your consent text should say, is a question for a licensed attorney in your state. The answers here describe what tags do, so that conversation starts from facts.
Last verified October 27, 2026 · 2 answers, plus 7 related answers elsewhere on the site
Can a pixel get
a business sued?
Yes, and it isn't only large companies. Before SB 690 was signed, Akin Gump wrote in September 2026 that California had seen thousands of website tracking claims, and the cyber insurer Coalition wrote in September 2025 that most wrongful-collection claims it receives involve businesses under $100 million in revenue. Many arrive as demand letters rather than lawsuits. The claims describe what a site sent: which tag fired, on which page, carrying what, and whether it fired before the visitor answered the banner or after they said no.
That's a measurement question before it's a legal one, and you can answer the measurement part yourself in five minutes. On October 27, 2026 I opened 131 well-known sites and logged every Microsoft Ads and Clarity request with no consent choice made. On 4 of the 32 running the Microsoft Ads tag, that tag was the only thing on the page requesting Microsoft's session recorder. That's the study. On a store I audited, visitors accepted the banner and the Google beacons still went out as if they'd said no.
Four tests you can run
in five minutes.
-
TEST 01
What fires before any choice
Open a private window, open the network panel, load a page and touch nothing. Every request to Meta, Google, Microsoft or a session recorder went out before the visitor chose anything.
-
TEST 02
Whether Reject all stops anything
Click Reject all and open two more pages. A banner that records the choice and lets the tags keep firing has changed nothing.
-
TEST 03
Whether the browser signal is honored
Global Privacy Control is a browser setting that says "don't sell or share." Haynes Boone counted 12 states whose laws require businesses to honor signals like it (July 2026). The full test links the source. Turn it on and test again.
-
TEST 04
Where your search box and forms send their contents
Type a made-up word into your site search and search the network panel for it. If it shows up on a third-party host, your visitors' searches do too.
The full test, with the filter to paste and what each code means
The laws in these claims,
as of October 27, 2026.
What courts and legislatures have said, with a source for each. It doesn't tell you whether your site is exposed. That depends on what your site does and where your visitors are, which is your attorney's call.
| Where | Law | Where it stands | Source |
|---|---|---|---|
| California | Invasion of Privacy Act §631, §632, §632.7 (wiretapping, eavesdropping, call recording) | Private suits continue. Section 637.2 lets a private plaintiff seek the greater of $5,000 per violation or three times actual damages. | Cal. Penal Code §637.2 |
| California | Invasion of Privacy Act §638.51 (pen register and trap and trace) | SB 690, signed September 30, 2026, ends private claims over websites and apps from January 1, 2027. The Attorney General can still sue. | WilmerHale, Oct 2026 |
| Florida | Security of Communications Act | Plaintiffs are using the Act against pixels and session replay, theories once concentrated in California. | Fisher Phillips, Jan 2026 |
| Pennsylvania | Wiretapping and Electronic Surveillance Control Act | Suits are filed. In August 2025 a federal appeals court (3d Cir.) affirmed dismissal of a claim over non-sensitive browsing for lack of standing. | Duane Morris, Sep 2025 |
| Massachusetts | Wiretap Act | The Supreme Judicial Court held in October 2024 that the statute does not clearly reach website browsing. | Justia, 2024 opinion |
| Washington | Privacy Act | On October 8, 2026 the state Supreme Court held that an exchange with an automated website is not a communication between two individuals under the Act, and affirmed dismissal of a claim over a hospital's Meta Pixel. | Helsell, Oct 2026 |
| Washington | My Health My Data Act | A private right of action over consumer health data, including data from advertising tools. No merits ruling found yet. | Holland & Knight, Aug 2026 |
| Federal | Wiretap Act | One party's consent is enough, so claims rely on an exception for interceptions made to commit a crime or tort. Plaintiffs are moving here from California. | Jeffer Mangels, Sep 2026 |
| Federal | Video Privacy Protection Act | Claims pair embedded video with a pixel. The Supreme Court heard argument on who counts as a "consumer" on October 14, 2026, with no decision as of October 27. | SCOTUSblog, Oct 2026 |
The dated log of
what changed.
Newest first. When a ruling or a statute changes what an answer here says, the change lands in this log and the answer's date moves.
-
October 23, 2026
The Fifth Circuit revived a Meta Pixel class action against an optical retailer. It held the plaintiffs had standing, and treated browsing and eye-exam scheduling data as plausibly health information. Privacy World
-
October 14, 2026
The Supreme Court heard argument on who counts as a "consumer" under the Video Privacy Protection Act. No decision as of October 27, 2026. SCOTUSblog
-
October 8, 2026
The Washington Supreme Court held that an exchange with an automated website is not a communication between two individuals under the state Privacy Act, and affirmed dismissal of a claim over a hospital's Meta Pixel. Helsell
-
September 30, 2026
California SB 690 was signed. From January 1, 2027 only the Attorney General can bring pen-register claims over websites and apps, and the change reaches pending claims in suits filed since January 1, 2025. The wiretapping, eavesdropping and recording sections are unchanged. Mayer Brown
Each question gets
its own page.
Each links to a self-contained answer you can read without an email.
Check your own site
1 question
-
How do I check what my website sends before a visitor consents?
A browser test anyone can run: what your pixels send before the banner, after Reject all, with Global Privacy Control on, and from your site search.
Law firms
1 question
-
Can a law firm use the Meta Pixel and Google tags on practice-area and intake pages?
What the Meta Pixel, GA4 and Google Ads tags send from a law firm's practice-area and intake pages, and how I set them up to send less.
Related answers
Already in the tracking, law firm and medical libraries
-
What is Google Consent Mode and how does it work?
A plain explanation of Google Consent Mode v2: the consent signals, basic versus advanced mode, modeling, and the mistakes that break tracking.
-
Server-side tracking sends conversion data from your own server to ad platforms instead of the browser. How it works, and when to use it.
-
Can a law firm record and score intake calls for marketing?
Call-recording consent by state, what Google records on its own, confidentiality duties to prospective clients, and what a marketing call score measures.
-
How do you track which ads produce booked patients without sending PHI?
Form fills are not patients. How offline conversion import closes the gap using hashed identifiers, a value, and nothing that says why they called.
-
Can a medical practice use Google Ads conversion tracking without violating HIPAA?
A practice can run conversion tracking under HIPAA, but not the default install. Which vendors need a BAA, what may leave, and which audiences stay off.
-
Do I need a BAA with my call tracking provider?
Call tracking hands a vendor patient identifiers. What a business associate agreement covers, why the plan tier matters, and what recording adds on top.
-
Can I record and score patient phone calls for marketing?
Call scoring shows which keywords produce real appointments. What recording requires, why the transcript beats the audio, and where the model should run.
I send less and
keep the record.
I'm Conner Crowe. I've managed more than $15M in ad spend, and I fix tracking before I touch a bid. On a law firm or medical site that usually means sending less: no ad pixels or session replay on intake and booking pages, Google tags held until the visitor chooses on the pages that name a matter or a condition, a banner whose Reject all stops the tags, and conversions reported as a call or a booked appointment with no case or patient details attached.
You get the setup and a dated before-and-after record of what the site sends, with the network captures, which your attorney can keep. What I won't give you is a verdict that your site is "compliant." That's a legal conclusion, and it isn't mine to make. See how I fix conversion tracking, including what it costs.
If you book a call
-
Before. I look at your site first, so the call starts on your business, not an intro.
-
The call. Thirty minutes on what’s working, what’s leaking and whether this fits.
-
After. If it isn’t the right fit, you leave with two or three fixes you can ship without me.
- The Tracking Stack: the eight-layer architecture these fixes sit inside.
- The law firm library and the medical practice library, for the measurement side.
Same test,
run on your site.
Add me as a read-only user and I'll write the audit myself: what your account counts as a conversion, plus the four browser tests run on your live site, and what to fix first. 5 to 7 pages, back within 24 hours of access. It's a technical read, not a legal opinion. No call needed.