Why Small Businesses Are Suddenly Getting Sued Over Their Websites (and the 2 Things Every Site Needs in 2026)

Imagine opening the mail and finding a letter that says your business website — the one that just sits there quietly generating leads — has been “wiretapping” its visitors. That’s not a hypothetical. A marketing agency we partner with recently had several of its clients, including medical and orthodontic practices, named in a privacy complaint. The alleged violation? The analytics and call-tracking scripts on their websites loaded before visitors consented to them. That’s it. No hack, no data breach, no shady behavior — just a normal small-business website running the same tools almost every website in America runs.

These letters are landing on desks across the country right now, and the businesses receiving them are almost never doing anything unusual. In this guide we’ll break down exactly what’s happening, why a business in North Carolina (or anywhere else) can get pulled into a California lawsuit, the two things every website needs in 2026, and how to check your own site in about two minutes.

The lawsuit wave nobody saw coming

Here’s the short version: plaintiffs’ law firms have discovered that a 1967 California anti-wiretapping law — the California Invasion of Privacy Act (CIPA) — can be aimed at modern website tracking tools. The theory goes like this: when a tracking pixel or analytics script captures a visitor’s IP address, device identifiers, and browsing behavior and sends it to a third party (Google, Meta, a call-tracking vendor) without the visitor’s consent, that’s an illegal “wiretap” or an unauthorized “pen register” device under California law.

Whether you find that theory reasonable or absurd, the numbers are real:

• More than 800 CIPA claims were filed in 2025 alone, and legal-industry trackers count tens of thousands of claims and demand letters since 2022.
• The Los Angeles Times paid a $3.85 million class-action settlement over trackers on its own website.
• Courts have allowed claims to proceed over tools as ordinary as the TikTok Pixel and Bing tracking scripts.
• Session-recording tools, chat widgets, and even call-tracking software have all been named in complaints — the complaint that hit our partner agency’s clients specifically called out call-tracking scripts transmitting identifiers the moment the page loads.

The business model behind the wave is blunt: a demand letter asks for a settlement calibrated to be cheaper than hiring a defense attorney. As defense firms have documented, that math is exactly what makes the model work at volume — and why small and mid-size businesses, not just Fortune 500s, are receiving them. California legislators have been debating a fix (Senate Bill 690 would exempt ordinary commercial website tools), but it stalled in 2025 and remains pending — which means the letters keep coming.

“But I’m not in California” — why that doesn’t protect you

This is the part that surprises every North Carolina business owner we talk to. North Carolina has no law requiring your website to have a privacy policy or a cookie banner. So you’re fine, right?

Not quite. Your website doesn’t stop at the state line — and California law follows California residents, not California businesses:

• CalOPPA (California’s Online Privacy Protection Act) requires any website that collects personal information from California residents to conspicuously post a privacy policy. Since you can’t stop Californians from visiting your site, this effectively applies to every commercial website in the country.
• The CCPA/CPRA adds disclosure and opt-out obligations for businesses over certain size thresholds.
• CIPA — the wiretapping law fueling the lawsuit wave — has no size threshold at all. A plaintiff just has to be a Californian who visited your website while your trackers were running. As Termly’s analysis notes, claims carry statutory damages of $5,000 per violation, which is what gives a demand letter its teeth.

And California is just the loudest voice. More than 20 states now have their own comprehensive privacy laws, and if you ever serve European visitors, the GDPR’s cookie-consent rules are stricter still. The direction of travel is one-way: more consent requirements, not fewer.

The 2 things every website needs

Strip away the legal jargon and the protection comes down to two items. It’s genuinely weird that neither is “required” by North Carolina — and both are still effectively mandatory because of who can visit your site.

1. A real privacy policy

Not a copy-pasted template from 2014. A privacy policy that actually describes your site needs to disclose:

• What personal information you collect (including what your forms, analytics, and call tracking collect automatically)
• Which third parties receive it — Google, Meta, your review platform, your call-tracking vendor
• How visitors can exercise their rights (access, deletion, opt-out)
• An effective date, and a process for updating it

If your business is in a health-related field, generic language isn’t enough — your policy needs healthcare-specific provisions (more on that below).

2. A cookie consent banner that actually blocks things

Here’s the trap most businesses fall into: they install a free “we use cookies 🍪 OK” notice bar and believe they’re covered. They are not. A decorative banner that announces tracking while the tracking runs anyway arguably makes things worse — it proves you knew.

What the current wave of claims targets is timing. The standard that holds up is called prior consent:

A proper consent management platform (we deploy Cookiebot for most clients) scans your site, inventories every third-party script, blocks the non-essential ones until opt-in, and keeps the consent records automatically.

Medical & dental practices: the #1 target

If you run a dental office, orthodontic practice, med spa, therapy practice, or any health-adjacent business, everything above applies to you twice.

In 2022, an investigation by The Markup found that a third of America’s top hospitals were sending visitor data to Facebook through the Meta Pixel — including appointment details and health conditions. The fallout reshaped the legal landscape for every healthcare website:

• HHS issued guidance warning that tracking technologies on healthcare websites can disclose protected health information — meaning an ordinary analytics setup can become a HIPAA problem.
• The FTC and HHS jointly warned about 130 hospital systems and telehealth providers about the risks of online tracking.
• The FTC banned BetterHelp from sharing health data for advertising and ordered $7.8 million in consumer refunds; GoodRx got similar treatment.
• Advocate Aurora Health settled pixel-related litigation for $12.25 million, part of over $100 million in healthcare tracking settlements. (Hospital groups are fighting the HHS guidance in court, but the litigation risk hasn’t waited for the outcome.)

Why does a visitor’s page view matter under HIPAA? Because on a healthcare site, the pages someone visits can themselves reveal health information. A visitor reading “Invisalign for adults” or “root canal recovery” three times this week is telling Google and Meta something about their health — and if your site transmits that alongside their identifiers without consent or a business associate agreement, regulators consider that a disclosure.

This is exactly why consent management is now a standard part of our healthcare builds. When we launched the new site for Lane & Associates Family Dentistry, our post-launch privacy review flagged the same thing we find on almost every practice website in the country: tag management loading for every visitor on page one — completely standard practice for years, and precisely the pattern today’s claims target on healthcare sites. Catching it proactively, before a demand letter does, is the entire game.

What we found auditing real client sites

After our partner agency’s clients were targeted, we started running privacy scans across the sites we manage. The results were consistent — and worth sharing, because your website almost certainly looks the same.

Take Clegg’s Termite & Pest Control, a longtime client and one of North Carolina’s best-known pest control companies. Their site runs the exact toolkit a well-marketed local business should run: Google tag management, analytics, call tracking to attribute phone leads, and a review platform widget. Every one of those tools fires on page load — which was simply how these tools are installed by default. Nothing malicious, nothing unusual, nothing that even a diligent business owner would have thought to question. And every one of them is now a named category in privacy complaints; the complaint involving our partner’s clients specifically cited call-tracking software transmitting identifiers on page load.

That’s the uncomfortable takeaway: the risk isn’t bad behavior — it’s default behavior. The tools were all installed correctly by the standards of two years ago. The standards moved. We’re now rolling out prior-consent setups across managed client sites so the tools keep working, just politely — after the visitor says yes.

What a compliant setup actually looks like

Having now implemented this for healthcare practices under the direction of in-house counsel, here’s the standard we hold a site to. This is the same checklist their legal team signed off on:

1. True prior consent. No analytics, ad pixels, session recording, heatmaps, chat widgets, or call tracking load until the visitor affirmatively opts in. The banner comes first; everything else waits.
2. Google Consent Mode v2, configured correctly. All consent signals default to “denied” and only update after acceptance. GA4 does not fire on implied consent.
3. Gate Google Tag Manager itself. This is the mistake we see most: the consent tool blocks individual cookies but GTM still loads and fires its tags on page one. Either every tag inside GTM is individually consent-gated, or GTM itself doesn’t load until opt-in.
4. A full third-party script inventory. You can’t gate what you don’t know about. Fonts, embedded videos, maps, review widgets, and chat tools all phone home too — embedded content gets privacy-enhanced or click-to-load treatment.
5. Consent records. Timestamp, consent categories, banner version — stored automatically. If a letter ever arrives, this log is your defense.
6. An updated privacy policy and terms of use that reflect what the site actually does, linked in the footer, with healthcare-specific language where it applies — plus a cookie-management link so visitors can change their mind later.

One honest caveat: this setup involves tradeoffs. Blocking trackers until consent means your analytics will report fewer visitors and your ad platforms will see fewer conversions. That’s not the consent tool being broken — that’s the data you were never entitled to quietly disappearing. A good implementation (Consent Mode’s modeling helps here) minimizes the loss without cheating the timing.

The 2-minute self-check

Want to know where your site stands right now? Here’s the same test a plaintiff’s firm runs:

1. Open your website in Chrome in an Incognito window — but don’t click anything yet.
2. Press F12 (or right-click → Inspect) and open the Network tab, then reload the page.
3. In the filter box, type each of these, one at a time: google-analytics, googletagmanager, doubleclick, facebook, clarity, hotjar, plus the name of your call-tracking or chat vendor.

If requests to those domains appear before you’ve clicked Accept on anything — or if no consent banner exists at all — your site is doing exactly what the current wave of demand letters describes. If your website also serves a medical, dental, or health audience, move this to the top of the to-do list.

FAQ

Is a cookie banner legally required for my small business?

No single U.S. law says “you must have a cookie banner.” But the combination of CalOPPA (privacy policy required), CCPA (disclosure and opt-out), CIPA (consent before tracking, enforced through private lawsuits), 20+ state privacy laws, and GDPR for European visitors adds up to the same practical answer: if your site runs any third-party tracking, you need consent management. The banner is just what consent management looks like.

My site is a 5-page brochure site. Does this really apply to me?

If it runs Google Analytics, a Meta Pixel, call tracking, or an embedded chat widget — yes. The claims aren’t about the size of your business; they’re about what loads in a visitor’s browser. If your site truly runs zero third-party scripts, your exposure is minimal (but you still need the privacy policy).

What’s the realistic risk? Am I actually going to get sued?

Most businesses will never hear anything. But the demand letters are real, they’re arriving at ordinary local businesses — we’ve now watched it happen to businesses we work with — and the settlement demands are typically five figures because that’s cheaper than a defense. The fix costs a small fraction of one demand letter. That’s the whole risk calculation.

Is a free privacy-policy generator enough?

It’s better than nothing, and far better than copying a competitor’s policy (which describes their data practices, not yours). But a generated policy that says you don’t share data with third parties — while your site loads eight third-party scripts — is a liability dressed up as protection. The policy has to match what the site actually does.

We’re a healthcare practice. Can we even use Google Analytics?

Carefully, yes — but not the way it’s installed by default. Between the HHS guidance and the pixel litigation, healthcare sites need consent-gated analytics, no ad pixels on pages that reveal health conditions, and policies with healthcare-specific language. This is one area where “we’ll just leave it as is” is genuinely the riskiest option.

Find out where you stand — free privacy exposure audit

Here’s the honest truth about fixing this: the setup is tricky. Done wrong, a consent tool breaks your conversion tracking, tanks your analytics, or — worst of all — gets installed as decoration while every tracker keeps firing underneath it, giving you the liability and a false sense of security. We’ve already done this the right way for agencies, medical practices, and local businesses, working alongside their legal counsel.

We’ll scan your website the same way we scanned the sites above: every third-party script, what fires before consent, whether your privacy policy matches reality, and where your exposure is. You’ll get a plain-English report of what we found — no scare tactics, no obligation.

One important note: we’re web designers and developers, not attorneys, and nothing in this article is legal advice. What we do is make the technical side of your website match what privacy counsel requires — and we’re glad to work directly with your attorney, the same way we do for our agency and healthcare partners.