Texas AG Warns Businesses About Surge in Website Privacy Demand Scam Letters

AUSTIN, Texas - Texas Attorney General Ken Paxton is warning businesses and nonprofit organizations about a recent increase in demand letters accusing them of violating California privacy law through common website features such as cookies, tracking pixels, analytics tools and search bars.

The Texas Attorney General's Office issued the consumer alert Sept. 17, saying some letters allege violations of the California Invasion of Privacy Act, or CIPA. Senders may contend that website tracking technologies amount to unlawful "wiretapping" and demand payment to avoid a lawsuit.

Some of the letters include screenshots of the recipient's website and a draft lawsuit, according to the Attorney General's Office.

Paxton's office cautioned that such demands may exaggerate or misrepresent potential violations and advised recipients to consult an attorney before responding or making a payment. The warning does not mean every CIPA demand is fraudulent or that use of website-tracking technology can never create legal exposure.

"My office will do everything we can to protect Texans from fraudulent demands and other scams," Paxton said. He urged organizations receiving suspicious demands to seek legal advice and report suspected fraud or abuse.

The Attorney General's Office specifically cited demand letters sent by Vivek Shah, whom it described as a serial CIPA plaintiff. According to the state's alert, Shah has been declared a vexatious litigant and cannot file new CIPA or related digital privacy cases in the U.S. District Court for the Central District of California without first receiving court permission. The federal court's rules allow judges to impose filing restrictions on litigants found to have abused the court process.

Businesses that receive one of the letters are advised to have an attorney review both the demand and the website's use of cookies, pixels, analytics software and similar technologies. The Attorney General's Office also recommends monitoring changes in state and federal privacy laws and court decisions involving website tracking.

Texas businesses and nonprofits that believe they received a fraudulent, abusive or deceptive CIPA demand can report it to the Attorney General's Consumer Protection Division at 1-800-621-0508.

Texas Attorney General's consumer alert and complaint information