If your business has a website, there’s a good chance it’s collecting user data right now through analytics tools, ad trackers, live chat, and more, without those users ever knowingly agreeing to it.

For years, this was standard practice.

Now, it’s also the basis for legal action.
 
Privacy-related lawsuits targeting business websites have surged in recent years. Arguments center on the fact that automatic data collection violates state and federal privacy laws.
 
Many of these cases target small and mid-sized businesses (SMBs) that followed the standard setups for Google Analytics or LinkedIn tracking, without realizing that this could lead to legal action.
 
In this article, you’ll learn core website privacy concepts, the laws most likely to affect your website, and the basics of compliant website tracking.

Why Website Privacy Lawsuits Are More Common In 2026

Privacy laws in the United States have historically lagged behind Europe, where General Data Protection Regulation (GDPR) established strict consent requirements in 2018.

That gap has been closing rapidly.

In the United States, California led the way with landmark state legislation, and a growing number of states have followed suit with their own frameworks.
 

At the same time, business tools have become far more sophisticated at collecting and sharing user data. These technologies are commonplace across businesses and include advertising & analytics platforms, live chat, and marketing automation.
 

Did you know? Today, a standard website may be running a dozen or more third-party scripts. Each script can send data to an external server whenever a user lands on the page.
 

The legal theory in many current cases is if data is sent before a user has agreed to data collection, the business may be violating privacy laws.
 

It doesn’t matter that the business didn’t write the scripts nor that the data goes to Google rather than to the business itself.
 

If your business controls a website, you hold responsibility for the technologies and tools that run on it.
 

Privacy Laws That US Businesses Should Know About

California Consumer Privacy Act (CCPA) and CPRA

 
The California Consumer Privacy Act, established in 2020 and strengthened by the California Privacy Rights Act (CPRA) in 2023, is the most significant US state privacy law currently in effect.

It applies to for-profit businesses that meet certain thresholds, including businesses that buy, sell, or share personal information of 100,000+ California consumers or households per year. It also applies to businesses that gain 50% or more of annual revenue from selling the personal information of California residents.

Under CCPA, “personal information” has a broad definition, including information that identifies you or relates to you and your household. This includes IP addresses, browsing history, and data collected through cookies and trackers.

This law gives California residents the right to know the data that is being collected, along with the right to opt out of the sale or sharing of their data and the right to delete said data.

The CPRA amendment introduced a new enforcement agency, the California Privacy Protection Agency (CPPA), and expanded consumer rights, including the right to correct inaccurate personal information.

California Invasion of Privacy Act (CIPA)

 
CIPA is an older wiretapping statute that has become the basis for a wave of recent lawsuits against business websites.

In these cases, the theory is that third-party tracking scripts (session replay tools, live chat, ad trackers) count as illegal wiretapping because they intercept communications between a user and a website in real time without the user’s agreement.

CIPA allows for statutory damages of $5,000 per violation, making it a magnet for attorneys filing lawsuits against businesses of all sizes.

Unlike CCPA, CIPA does not have minimum thresholds based on business size or data volume.
Any website accessible to California residents may be a target.

Other State Privacy Laws

California is not the only state with privacy laws.

As of 2025, comprehensive consumer privacy laws have been enacted in Virginia, Colorado, Connecticut, Texas, Florida, and a growing number of additional states. While the specifics vary, most share a common framework: businesses must be transparent about data collection, provide consumers with meaningful choices, and honor opt-out requests.

For most businesses, it makes sense to design websites that comply with the strictest privacy law (typically California’s). This approach is simpler than trying to apply different rules to users from different states.

GDPR (For Websites With International Users)

If your website is accessible to users in the European Union, even incidentally, the General Data Protection Regulation applies.

GDPR requires clear, informed consent before any non-essential data collection occurs. As the strictest standard currently in widespread effect, it serves as the framework for most modern Consent Management Platforms.

Did you know? If your website is already GDPR-compliant, you are well-positioned for compliance with US state privacy laws as well.

Key Website Compliance Concepts Every Business Should Understand

Cookies and Tracking Technologies

A cookie is a small file stored in a user’s browser that allows a website or a third party to recognize that user across sessions or websites.

Cookies are used for a wide range of purposes, from keeping a user logged in (a necessary function) to tracking browsing behavior across the internet for advertising purposes (a non-essential function that typically requires consent).

Beyond cookies, modern websites use a variety of other tracking technologies: pixels (tiny images that trigger data collection when loaded), scripts (code that runs in the browser and sends data to third parties), and session replay tools (used to analyze user behavior by recording mouse movements and keystrokes).

All of these technologies are subject to the same consent requirements as cookies under applicable privacy laws.

Essential vs. Non-Essential Tracking

Not all tracking requires consent; privacy frameworks generally distinguish between two categories.

Essential or strictly necessary cookies are required for a website to function. You can think of these like session cookies that keep a user logged in or remember items in a shopping cart. Under most frameworks, these do not require consent.

Non-essential cookies and tracking are not required for a website to function and include analytics, advertising, social media, and marketing tools. These require user consent before they can be used.

A compliant website can still run and function normally for a user who declines cookies. However, it can’t send a user’s data to Google Ads, LinkedIn, or any other third-party platform until that user has agreed.

Prior Consent vs. Opt-Out

There are two fundamentally different models for cookie consent, opt-out and opt-in.

Opt-out (notice model): In this model, the website notifies users that cookies are in use, collects data immediately, and allows users to opt out if they choose.

Once common in the US, this model is increasingly insufficient under state privacy laws and the CIPA-based legal basis for current lawsuits.

Opt-in (prior consent model): In this model, no non-essential tracking executes until the user clicks “Accept.”

This is the standard required by GDPR and most likely to hold up under US state laws as well.

If your cookie banner has only an “OK” or “Got it” button with no clear decline option, you are likely operating an opt-out model, not a genuine opt-in.

What “Prior Consent” Actually Means

A compliant opt-in setup is not simply displaying a banner; tracking scripts themselves must be technically blocked from executing until a user grants consent.

Banners that announce cookie use while scripts execute in the background are not compliant; this is notification, not consent.

This distinction is at the center of most current CIPA-based lawsuits. The argument isn’t that businesses failed to notify users. Instead, the lawsuits are based on the idea that third-party scripts collected and transmitted data, including IP addresses, before users could give consent.

The only technically sound fix is to prevent those scripts from running at all until the user clicks Accept.

What a Compliant Website Setup Looks Like

A Consent Management Platform (CMP)

The standard solution for website compliance is a Consent Management Platform, a software that manages the consent process, controls the scripts allowed to run, and maintains records of user consent.

Leading CMPs include Cookiebot by Usercentrics, OneTrust, Osano, and others.

A properly configured CMP accomplishes three goals:

• Presents users with a clear consent choice before any non-essential tracking occurs
• Physically blocks non-essential scripts until a user grants consent
• Logs each consent decision with a timestamp and record of the user’s choices

Integration with Tag Management

Most business websites use a tag management system, with Google Tag Manager being the most common.

A compliant setup connects the CMP to the tag manager, so that consent choices can determine allowed tags.

This is more reliable than trying to manage individual scripts. It also provides a centralized place to audit the tools and technologies running on your site.

Cookie Audit

A cookie audit inventories every script and tracking technology running on your website.

From there, it categorizes each as essential or non-essential and identifies any scripts that may have been installed directly in page headers or theme files rather than through the tag manager. These are a common source of compliance gaps that are easy to overlook.

Consent Records

 A CMP should log each consent decision: the date and time it was given, the version of the consent banner shown, and the user’s choices. These records provide evidence of compliance if a lawsuit ever challenges your practices.

Common Website Compliance Mistakes Businesses Make

• Treating “I have a cookie banner” as equivalent to “I am compliant.” A banner that notifies without blocking is not compliant. The scripts must actually be held from executing until a user grants consent.
• Installing tracking scripts directly in page code outside the tag manager. Scripts coded into a theme header or added via a plugin fire on page load, regardless of the consent banner, are frequently overlooked during compliance reviews. However, they represent gaps that can be used against your business in a lawsuit.
• Using a banner with only an Accept option. A genuine opt-in requires a real choice. Banners that offer only “Accept” or bury the decline option in a multi-step menu don’t meet the spirit of privacy laws.
• Assuming the problem only affects large companies. Privacy lawsuits, particularly under CIPA, can target businesses of every size. The statutory damages structure means that SMBs are potential targets.
• Not updating your website’s consent management after adding new tools. Every new marketing or analytics tool added to a website needs to be reviewed for consent compliance. A site that was compliant six months ago may not be compliant today if new tracking scripts have been added.

Moving Forward

Website privacy laws are changing quickly. What counted as standard compliance practice two years ago may not hold up today.

The good news?

With a properly configured consent management platform, you can ensure your website complies with the strictest state privacy laws.

Take action today to protect your consumers and business. A compliant website is an achievable goal for businesses of any size.

Resources and Further Reading

• California Office of the Attorney General: CCPA Overview
• California Privacy Protection Agency
• GDPR.eu: Plain-language GDPR guidance
• International Association of Privacy Professionals (IAPP)
• FTC: Privacy and Security guidance for businesses
• Google Consent Mode documentation
• Cookiebot: Cookie compliance guides

A note on this article: Miles IT is a technology company, not a law firm. This article is intended to help business owners understand the technical basics of website privacy compliance and appropriate steps to take. It is not legal advice. If you have received a legal demand or need specific guidance, we recommend consulting a qualified attorney.