California wineries, along with wineries elsewhere that sell to or attract visitors from California, are receiving a new category of demand letter. The claims are built on the California Invasion of Privacy Act, a 1967 wiretapping statute that plaintiffs’ firms have spent the last two years reshaping into a tool aimed at website tracking. The theory is aggressive, the statutory damages are substantial, and the tracking configurations most wineries are running were never set up with any of this in mind.
We’re not lawyers, and nothing here is legal advice. If you have privacy counsel, this article is something to send them alongside a current inventory of what your site actually loads. If you don’t have counsel, the second half of this article will tell you what to bring to the first conversation.
What we can do is describe what’s happening on the technical side and what a defensible setup looks like in practice.
The pen register theory, and why it matters for winery websites
The specific mechanism behind many of these letters is CIPA §638.51, which prohibits the installation or use of a “pen register” or “trap and trace device” without a court order. We’ve also seen §631, particularly where session replay, chat tools, form inputs, or communication contents are involved. Those terms originally described physical hardware attached to a phone line to record outgoing or incoming numbers. Plaintiffs’ firms have argued — and some California courts have allowed the argument to proceed — that a third-party tracking script on a website performs the same function when it captures a visitor’s IP address, device fingerprint, and browsing activity, then transmits that data to another company.
Under this theory, Meta Pixel, certain Google tags, session replay tools, and some chat widgets are the modern pen register. Plaintiffs seek statutory damages under CIPA’s civil-remedy provision of $5,000 per alleged violation, even without proving actual damages. “Violation” is being argued as per visitor rather than per site, which is how a mid-size winery gets to a five- or six-figure exposure number quickly.
Whether these claims ultimately hold up in California appellate courts is unsettled. What’s already happening, and what matters operationally, is that demand letters are arriving and businesses are incurring legal costs or considering settlement, and the plaintiffs’ firms appear to be using repeatable or automated scanning methods.
A site running Meta Pixel before consent, while serving California visitors, may be readily discoverable through automated scanning regardless of where the winery itself is located. Shipping DTC to California may provide plaintiffs with an argument for applying California law, although jurisdiction and the statute’s reach depend on the particular facts. Being physically based in Oregon or Washington doesn’t automatically protect you. Talk to your attorney about the specifics of your situation, but the “we’re not a California winery” reflex isn’t a defense.
What a CIPA demand letter actually looks like
The letters follow a recognizable pattern. They arrive from a small number of plaintiffs’ firms concentrated in California, addressed to the winery entity or the registrant on the WHOIS record. They identify the winery’s website by URL, list the specific tracking technologies detected — usually with screenshots from browser developer tools — and cite the CIPA sections in play.
They typically offer to resolve the matter for a sum that’s high enough to hurt and low enough to feel like the rational business decision compared to litigation. In the examples we have seen, the requested settlement has often been in the low five figures for a small operation, higher for wineries with obvious revenue signals like an active club or high-priced allocation lists.
How to audit third-party scripts on a Commerce7 winery site
The first defensible step is knowing what your site actually loads. Most wineries can’t produce this list, because it’s been assembled over years by different agencies, freelancers, ad platforms, and email tools, and nobody has ever gone back to reconcile it.
Open your homepage in a fresh incognito window. Press F12 to open Chrome DevTools, refresh the page, and go to the Network tab. Look for requests sent to domains other than your own, paying particular attention to scripts, analytics endpoints, pixels, and beacon requests. Not every third-party request is tracking, but this gives you the inventory you need to investigate what each service receives. Then switch to the Application tab and check which cookies were set before you interacted with anything. Repeat this review across a product detail page, the cart, checkout, and any reservation or club signup flow.
The list will usually include some combination of Google Analytics 4, Google Tag Manager, Google Ads conversion tags, Meta Pixel, Klaviyo or Mailchimp scripts, Commerce7’s own analytics, a reservation platform like Tock or Cellarpass, a chat widget, and — often — orphaned pixels from campaigns or agencies that ended two years ago. (Be sure to flag that last category as it’s the easiest exposure to eliminate because it provides no ongoing value.)
Removing unused tracking scripts and legacy pixels
For every script in the inventory, the question is whether it’s still doing work you value. If nobody has logged into the associated platform in six months, if no campaign is running against it, if no report is being read, it should come off the site. The cleanest tracking stack is the one where every script is tied to a person, a purpose, and a report someone actually looks at.
Old Meta pixels, retired Google Ads tags, heatmap tools that stopped being interesting after the last redesign, duplicate analytics installs, and popup builders from a previous email platform — this is where most wineries can cut third-party requests substantially without losing any operational signal. Fewer scripts also mean faster load times, cleaner analytics, and less to keep track of when the next law changes.
Updating your winery’s privacy policy and cookie policy
Your privacy policy needs to describe what your site actually does with visitor data. If your site collects names, email addresses, phone numbers, IP addresses, order history, club membership data, reservation information, or advertising identifiers, the policy has to say so, and it has to name the categories of third parties receiving that information.
The pattern we see most often is a policy pasted into the footer during the original site build and then untouched for three or four years, during which the marketing stack has been rebuilt twice and the law has changed materially. An outdated policy may create an additional problem by making representations that no longer match the site’s actual behavior.
This is one of the reasons we distribute Termageddon through our Commerce7 app store. Termageddon generates and maintains policies based on the laws that apply to your business, updates them when those laws change, and gives you a defensible audit trail for when they were last reviewed. It doesn’t replace an attorney reviewing your specific situation. For wineries without a privacy lawyer actively maintaining these documents, it’s a workable floor.
Setting up a real cookie consent solution on Commerce7
A consent banner is only useful if it controls the scripts on your site. A banner that announces a choice while allowing every pixel to fire beforehand may provide little practical protection and could create evidence that the business recognized the tracking without actually controlling it.
A functional consent setup does three things. It presents the visitor with a genuine choice on first arrival, before non-essential tracking runs. It holds non-essential scripts in a suspended state until the visitor makes that choice. And it stores the choice in a way that persists across the session and can be changed later.
As a conservative risk-management approach, advertising pixels, heatmaps, session-replay tools, and other non-essential third-party tracking can be suspended until consent. Analytics configurations should be reviewed based on what they collect, where the data is sent, and whether any requests are transmitted before consent.
Cookies and requests that are strictly necessary for cart persistence, authentication, checkout, or requested account functionality may need to remain available. Commerce7 analytics or other non-essential data collection should be evaluated separately rather than treating everything from Commerce7 as essential.
The Termageddon app includes a consent management platform by default, which is why we bundle them. The consent tool and the policy generator need to be reading from the same source of truth about what your site is doing. Buying them separately and hoping they align is a common failure pattern.
Configuring Google Tag Manager with Google Consent Mode
Google Tag Manager is where most winery tracking actually lives, whether or not the winery knows it. It’s also where most consent configurations quietly fail. Installing a banner on the front end without updating GTM leaves every tag inside the container firing on page load, which is the exact behavior the consent banner is supposed to prevent.
Google Consent Mode is Google’s mechanism for making tags consent-aware. Consent Mode communicates a visitor’s consent choices to compatible Google tags and changes how those tags behave. In a basic implementation, Google tags remain blocked until consent is granted. In an advanced implementation, Google may still receive cookieless measurements while consent is denied, which can support modeled reporting for eligible properties. Consent Mode is a technical control, not a guarantee that no data is transmitted or that a particular configuration satisfies CIPA.
Our Commerce7 GTM app is built with Consent Mode support, because the pattern of “install GTM, install banner, ignore the interaction between them” is common enough that we’d rather ship the fix than write another article about the problem. The goal is a setup where a visitor who accepts all cookies gets the full tracking experience the winery has always relied on, and a visitor who declines gets a site that respects that choice without breaking commerce functionality.
Testing what your site loads before and after consent
Once the consent setup is live, test it the way a plaintiff’s firm would. Open the site in a fresh incognito window and record what fires before you touch the banner. Then decline, and record what fires. Then accept, and record what fires.
If Meta Pixel or other blocked marketing tools report data before the accept click, the configuration isn’t working as intended. For GA4 and Google Ads, compare the network activity with the Consent Mode implementation you selected: basic mode should send nothing before consent, while advanced mode may send cookieless measurements with consent set to denied.
Check the same behavior across your product detail pages, the cart, checkout, and reservation flows. Consent states can leak or reset in ways that aren’t obvious from the homepage alone. Confirm that the visitor can withdraw consent later, and that withdrawal actually stops the tracking.
This testing pass is the difference between a compliant-looking setup and a defensible one.
Maintaining winery website privacy compliance over time
None of this is a one-time project. Commerce7 releases new features. New pixels get added for campaigns. A new agency installs a tool without documenting it. Someone approves a chat widget on a Friday. The law changes again.
Build a quarterly review into your operating calendar. Re-run the DevTools audit. Confirm the policy still describes the site’s actual behavior. Test the consent banner against a real visit. Remove anything that shouldn’t be there anymore. The wineries that stay out of trouble are the ones that treat this as ongoing maintenance rather than a checkbox.
Received a CIPA demand letter? You may have grounds to fight back
A demand letter is not a judgment, and paying it is not the only available response. In May 2026, a Los Angeles Superior Court dismissed CIPA pen register claims against NetScout Systems with prejudice, finding that §638.51 applies to telephone communications, not software operating on commercial websites. The court rejected the argument that ordinary website data collection technology should be treated as a modern pen register.
This is a trial court decision, not binding statewide precedent, and it does not eliminate every possible CIPA claim. But it gives businesses and their attorneys meaningful persuasive authority against demand letters built on the theory that pixels, web beacons, analytics tools, or similar website technologies automatically violate CIPA’s pen register provisions. Mintz, the firm that represented NetScout, describes the decision as both a roadmap for challenging these claims and authority that companies can use in response to similar lawsuits.
If you receive a letter, do not ignore it, but do not assume the settlement demand reflects an established violation either. Preserve the letter and technical evidence, avoid making admissions or immediately changing the site in ways that destroy useful evidence, and have qualified California privacy counsel compare the allegations with what your website actually collected and transmitted. A documented script inventory, consent history, privacy policies, and network logs can help counsel determine whether the claim matches the theory the NetScout court rejected.
The ruling does not make preventative compliance unnecessary. It does, however, mean businesses facing aggressive or formulaic §638.51 demands may now be better equipped to challenge them rather than treating settlement as the only practical option.
Because this is a trial-court ruling, other courts are not required to follow it, and it does not automatically dispose of separate claims involving interception of communication contents under CIPA §631.
Working with counsel from a position of preparation
If you’re taking this to an attorney — and you should — bring the DevTools inventory, the current privacy and cookie policies, screenshots of the consent banner in its pre-consent and post-consent states, and a list of the third-party platforms receiving data from your site. That’s the packet that lets counsel give you a real assessment instead of a generic one.
We can help Commerce7 wineries with the technical side of this work: the script audit, the removal of orphaned tracking, the Termageddon setup, the GTM configuration with Consent Mode, and the pre- and post-consent testing that verifies the whole thing actually works. We don’t provide legal advice, and no technical setup can guarantee that a demand letter won’t arrive. What we can do is help ensure that if one does, your site is describable, defensible, and doing what your policies say it’s doing.
That’s the position worth being in.
Frequently asked questions about CIPA and winery websites
Does CIPA apply to my winery if I’m not based in California?
Possibly. Selling to California residents or knowingly serving the California market may give a plaintiff an argument for applying California law, but it does not automatically establish jurisdiction or liability. The plaintiffs’ theory is that a California visitor triggers the alleged violation when tracking technology loads during the website visit. Being located outside California is therefore not a defense to rely on by itself, but your actual exposure depends on the specific facts and should be assessed by qualified counsel.
What is a pen register claim under CIPA?
It’s the argument driving most of the current demand letters. CIPA §638.51 prohibits the use of a pen register or trap and trace device without a court order. Those terms originally described phone-line hardware. Plaintiffs’ firms are now arguing that third-party tracking scripts like Meta Pixel and session replay tools perform the same function on a website by capturing IP addresses, device identifiers, and browsing activity, then sending that data to another company. The statutory damages sought are $5,000 per violation, with “violation” argued as per visitor.
Is Google Analytics illegal under CIPA?
Not inherently. The legal and technical questions depend on how Analytics is configured, what information is transmitted, when transmission begins, and whether the visitor gave legally effective consent. A conservative setup blocks Google Analytics until consent, accurately discloses the collection in current policies, and verifies that no unintended requests are sent beforehand. Google Consent Mode helps communicate consent choices to Google tags, but it is a technical control rather than a guarantee of CIPA compliance.
Will a cookie banner protect my winery from a CIPA demand letter?
Only if the banner actually controls what fires on the page. Many banners are notices, not gates — they announce that cookies exist while every pixel loads anyway. That configuration may provide little practical protection and could create evidence that the website disclosed tracking without actually honoring the visitor’s choice. A defensible banner suspends non-essential scripts until the visitor makes a choice, stores that choice, and honors it across the session.
What’s the difference between a privacy policy and a cookie policy?
The privacy policy describes what personal data your site collects, how you use it, who you share it with, and what rights the visitor has. The cookie policy is more specific: it names the cookies and tracking technologies on the site and explains what each category does. Depending on the laws that apply, cookie disclosures may appear in a separate cookie policy, within the privacy policy, or through both documents. The important requirement is that the disclosures are complete, current, and consistent with what the site actually does.
How often should I review my winery’s website tracking setup?
Quarterly at minimum, and after any material change: a website redesign, a new agency engagement, a new marketing platform, a campaign that involved adding pixels, or a Commerce7 feature release that affects tracking. Re-run the DevTools audit, confirm your policies still match the site’s actual behavior, and test the consent banner against a real visit. The wineries in the strongest position are the ones treating this as ongoing maintenance.
