That old pixel could cost you $50k

Run a 30-Minute Pixel Audit

We’ve talked about this topic before and this is your reminder to think about it again!

Do you know every tracking pixel running on your website right now?

If you hesitated, you're not alone. And that hesitation is exactly what a growing number of "privacy trolls" are counting on.

Attorneys are using the California Invasion of Privacy Act (CIPA), a 30+ year old law originally written to stop phone wiretapping, to go after websites with tracking scripts. Unlike most privacy laws, CIPA lets individuals sue for damages directly. Some firms are sending a dozen letters a day

Here's how to get ahead of it this week:

🔍 Inventory every tag. Open Google Tag Manager, then double-check with a browser extension like Meta Pixel Helper or Google Tag Assistant. List every pixel: Meta, LinkedIn, TikTok, Google Ads, Hotjar all of it.

🧹 Kill the zombies. If a pixel belongs to a campaign you haven't run in 6+ months, remove it. Old tracking gives you zero value and all of the risk.

🌎 Check whose data you're collecting. Your business location doesn't decide which laws apply. Your visitors' locations do. Pull your GA4 country and region report. Seeing California or EU traffic? Those laws likely apply to you.

🚦 Gate what's left behind real consent. A banner that just says "we use cookies" isn't enough. Under laws like CIPA and GDPR, a proper consent tool blocks pixels from firing until the visitor clicks accept.

📅 Set a quarterly reminder. New state privacy laws keep coming. A policy you set up once and forgot is basically a copy-pasted template with extra steps.

The good news for marketers is that consent doesn't kill your data. Visitors who opt in still send conversion data back to your ad platforms. You just stop collecting from people who never said yes.

This is not legal advice. When in doubt, talk to your attorney.

We sat down with Hans Skillrud, co-founder of Termageddon earlier this year to talk about this issue and his tool, which can help you get on track. Tune in below.

In this episode, Chris sits down with Hans Skillrud, co-founder of Termageddon, to talk about one of the fastest-growing legal threats facing small business owners right now. Privacy trolls, working in the same vein as copyright trolls, are visiting websites, identifying CIPA (California Invasion of Privacy Act) violations, and sending demand letters for tens of thousands of dollars. The kicker? The law was written in 1967 to stop phone wiretapping, and your forgotten ad pixel might technically qualify.

Hans breaks down why your website is likely out of compliance, what a proper privacy policy actually needs to say, and how a cookie consent tool can block tracking pixels from firing until a visitor gives explicit consent, which is your best defense against these kinds of shakedown letters.

Termageddon

Termageddon is a privacy policy and consent tool built by an attorney-founded team that tracks 120+ website laws and regulations, including GDPR, CIPA and state laws as they roll out.

Here's how it works:

• Answer a guided questionnaire (plan on 30 to 60 minutes). Your answers determine which laws apply, then it writes the exact disclosures you need.

• Policies auto-update when laws change, so you're not scrambling every January.

• The cookie consent banner is included and blocks tracking scripts until visitors opt in.

• Built by humans, not AI. Every law is read and QA'd by their team.

• Attorney friendly. If you have a lawyer, they can review and customize everything inside the platform.

Marketers, agencies managing client sites and small businesses, this is your affordable option with pricing just $119/year for a full set of policies plus the consent tool.

Please Advise readers get 10% off their first month with code BUSINESS.

Some products and services we mention are ones we personally use and love. Occasionally, we may earn a small affiliate commission if you purchase through our links. It helps support the work that goes into Please Advise.

TRY IT NOW