Yes, and enforcement is increasing. California's privacy regulator has issued fines and settlements against businesses of all sizes. Several other states are ramping up enforcement activity as their laws mature. Regulatory action isn't the only risk. Private lawsuits under laws like the CCPA are also on the rise, and legal costs can be significant even when cases don't go to court.

The California Invasion of Privacy Act (CIPA) prohibits the unauthorized interception of electronic communications. Plaintiffs' attorneys have applied this to websites that use third-party chat widgets, session replay scripts, and tracking technologies. They argue that these tools intercept visitor communications without consent. Any website accessible to California residents may be exposed.

Most demand letters allege a specific violation — usually the presence of a named third-party script or tracker — and propose a settlement, typically within 20 to 30 days. They are generally sent by plaintiffs' attorneys rather than a regulator. You should share any letter with legal counsel before responding.

Cookiebot supports the technical side of remediation. It scans your site to document what trackers and scripts are running, and can deploy a consent banner the same day, giving you a record of action to share with your attorney. 

CIPA claims typically turn on whether interception occurred, and your legal counsel is best placed to advise on whether technical remediation addresses the specific allegation in your letter.

That depends on the claim. In many cases, being able to show your attorney that you have identified the relevant scripts, deployed a consent mechanism, and have ongoing monitoring in place gives them more to work with.