Got a Trap-and-Trace Demand Letter? Get Compliant Now.

Exhibea is a privacy compliance provider for ecommerce brands targeted by CIPA lawsuits and demand letters. Law firms like Tauler Smith are sending thousands of demand letters to ecommerce businesses, claiming the tracking code on their websites is an illegal "trap and trace" device under the California Invasion of Privacy Act (CIPA). The claims cite damages of $5,000 per violation. The trackers they point to — Meta Pixel, Google Analytics, LinkedIn Insight Tag, Hotjar, TikTok Pixel, session replay — run on almost every Shopify store by default.

We handle both sides of the problem. The technical side: we audit every tracker on your store, remove what you don't need, configure real consent, and document everything. The legal side: we work alongside privacy counsel, including attorney Gil Peles, so the letter gets answered properly while the website gets fixed. One coordinated response instead of a compliance-software subscription and a lawyer who's never seen your stack.

Why ecommerce brands are getting these letters

Plaintiffs' firms scan websites for tracking pixels, then send demand letters to the businesses running them. The theory: trackers that capture visitor data before consent act like trap-and-trace devices under CIPA (Cal. Penal Code §§ 638.50–638.51), alongside wiretapping and related claims. You don't have to be based in California — you just need California visitors. If your store runs Meta Pixel, Google Analytics, Klaviyo, Hotjar, or any ad pixel without a working consent banner, you look like a target.

What our compliance service includes

• Full tracker audit. Every pixel, tag, app script, and session-replay tool on your store — including the ones apps injected that you forgot about. You get a plain-English inventory.
• Remove and consolidate. Dead pixels, duplicate tags, and apps you stopped using get stripped out. Less code, less exposure, faster site.
• Consent management done right. Shopify's Customer Privacy API wired to a real consent banner, so pixels stay off until the visitor agrees — region-aware for California and the EU.
• Pixel re-configuration. Meta, Google, TikTok, Klaviyo, and LinkedIn set up to respect consent state instead of firing on page load.
• Privacy notice and cookie disclosure. A clear privacy policy, cookie table, and data-request process on your store that matches what's actually running.
• Documentation for counsel. A record of what was found, what was removed, and what was fixed.
• Legal response. Through our partner privacy counsel — including attorney Gil Peles — the demand letter itself gets handled by someone who deals with these firms, not ignored and not reflexively paid.

Don't wait for the letter

Most merchants find out about CIPA when the demand letter arrives. The audit costs a fraction of one claimed violation. If you sell to California — and every store does — cleaning up your tracking now is cheap insurance, and your site gets faster in the bargain.

Why Exhibea over a compliance software vendor

Compliance platforms sell you a banner and a scanner, then leave you to implement it. We're a Shopify agency with about 10 years of platform expertise: we know where apps hide their scripts, how Shopify's Customer Privacy API actually behaves, and how to keep marketing data flowing from consented visitors so compliance doesn't kill your ads. And when the issue is legal, you talk to a real attorney — not a chatbot. See our work and retained services.

Frequently asked questions

I got a Tauler Smith demand letter. What should I do?

Don't ignore it and don't pay reflexively. Get privacy counsel on the letter — we can connect you with attorney Gil Peles — and get your tracking cleaned up in parallel: audit the trackers, turn on real consent management, and document the fixes.

What is a "trap and trace" claim against a website?

It's a legal theory that tracking code capturing visitor information — pixels, analytics, session replay — functions like a trap-and-trace device under California's CIPA. Firms send demand letters citing statutory damages of $5,000 per violation. Courts are still sorting out these theories, which is why the letters push for fast settlements.

Which trackers trigger these claims?

The ones named most often: Meta Pixel, Google Analytics, LinkedIn Insight Tag, Hotjar, TikTok Pixel, and session-replay tools. Standard ecommerce marketing stack, in other words. The issue isn't having them — it's running them without consent.

Does Shopify have built-in cookie consent?

Shopify has a Customer Privacy API and a basic banner, but out of the box most stores' pixels still fire before consent. Apps add their own scripts that ignore it entirely. Making consent actually gate the tracking takes configuration — that's the work we do.

Will consent banners hurt my marketing?

Less than a lawsuit will. Configured well — clear banner, consent-aware pixels, server-side where appropriate — most stores keep the large majority of their tracking data while cutting their legal exposure.

Are you lawyers?

Exhibea is a Shopify agency, not a law firm, and nothing on this page is legal advice. For the legal response we work with partner privacy counsel, including attorney Gil Peles. You get the technical fix and the legal answer, coordinated.

Get your store audited

Book a call or email hello@exhibea.com.