If your business recently received a demand letter accusing your website of violating California’s wiretapping law, you’re not alone. On September 17, 2026, Texas Attorney General Ken Paxton issued a consumer alert warning Texas businesses and nonprofits about a surge in demand letters alleging violations of the California Invasion of Privacy Act (CIPA). The letters target ordinary website tools — cookies, pixels, analytics software, and search bars — claiming they amount to illegal surveillance.

How a 1960s Wiretapping Law Became a Website Litigation Tool

CIPA was enacted in 1967, long before cookies, chat widgets, session-replay tools, or website search bars existed. But plaintiffs have increasingly stretched the statute to cover modern website technologies, arguing that these tools amount to unlawful “wiretapping” or tracking when deployed without adequate consent.

As discussed in Bradley’s prior Online and OnPoint coverage, many companies aren’t being sued right away — they’re receiving demand letters first. These letters typically include screenshots of routine website functionality and a demand for payment to avoid litigation.

Texas AG to Businesses: Slow Down Before You Pay Up

Paxton’s message is straightforward: Some of these letters may be fraudulent, deceptive, or at least overstated. His office cautions businesses not to respond directly or make any payment without first consulting qualified counsel.

The alert also names Vivek Shah, a serial pro se litigant closely associated with the CIPA demand-letter wave. Shah has reportedly sent thousands of pre-litigation demand letters to businesses and nonprofits nationwide, alleging that common website technologies violate California law.

That campaign has hit a speed bump. In July 2026, a federal judge in the Central District of California declared Shah a vexatious litigant, requiring him to obtain court permission before filing new CIPA-related cases in that district.

The ruling gives businesses useful leverage, but it isn’t a complete shield. It applies only in that federal district and does not prevent Shah — or others — from sending demand letters or pursuing claims in other forums.

For Out-of-State Businesses, Jurisdiction May Be the First Question

For Texas businesses and other out-of-state companies, one threshold issue is whether a California court even has personal jurisdiction. A California resident’s visit to a company’s website does not automatically mean the company can be forced to litigate in California. Depending on the facts, jurisdictional defenses — or proactive declaratory judgment strategies — may be part of the response plan.

What Businesses Should Do Now

• Don’t panic — but do not ignore the letter. The demand may be overstated, but CIPA website-tracking claims remain an active litigation risk.
• Don’t pay or respond without counsel. The Texas AG specifically recommends seeking legal guidance before engaging with the sender or making any payment.
• Review your website technologies. Work with counsel to evaluate cookies, pixels, analytics tools, chat widgets, search bars, and consent mechanisms.
• Preserve your defenses. Evaluate whether the claims are legally viable, whether California has jurisdiction, and whether a proactive response strategy makes sense.
• Report suspected abuse. If a letter appears fraudulent or deceptive, consider reporting it to the Texas Attorney General’s Consumer Protection Division.

The Bottom Line

The Texas AG’s alert is a helpful reality check for businesses caught in the CIPA demand-letter storm. It does not eliminate the risk, but it does reinforce an important point: A demand letter is not the same thing as liability. Businesses should use this moment to evaluate their website-tracking practices, confirm that consent and disclosures are appropriately calibrated, and develop a thoughtful response strategy before reacting to aggressive payment demands.