What your store sends before the banner is answered.
Installing a consent banner and holding tags back until someone answers it are two separate settings, and many tools do not hold back by default. That gap is what a tracking demand letter points at. Paste a page and see what fires first.
One page, one first-time visit · We never click, scroll, or answer your banner · Takes ~20 seconds
No account. We load the page once as a first-time visitor and never answer your banner.
What a tracking demand letter points at
Each line names its source. The statute is a primary source. The counts come from law firms and vendors, and we label them that way.
A civil claim for a violation of California's Invasion of Privacy Act, section 631, can seek $5,000 per violation, under section 637.2.
Standing: The statute's text.
A claim under it needs no proof of actual harm.
Standing: Statutory damages, section 637.2.
Section 631 names no platform and no industry. Plaintiffs invoke it in website-tracking claims; whether it applies turns on the conduct alleged, and courts have read its clauses differently.
Standing: The statute's text, and the Ninth Circuit's reading in Gutierrez v. Converse (2025).
Law firms report a sharp rise in tracking claims since 2023, and most letters give 20 to 30 days to answer.
Standing: Law-firm and vendor reporting, not a court count.
SB 690 ends private pen register claims over website trackers from January 1, 2027. Wiretap claims under section 631 are untouched.
Standing: Law-firm alerts on the bill as signed, 2026-09-30.
Courts have dismissed claims against ordinary retailers on jurisdictional grounds, and one prolific claimant was declared a vexatious litigant in July 2026.
Standing: Reported by defence firms. Whether a letter you hold is weak is counsel's call, not ours.
We say what was running, what fired before consent, and when, in a dated record you can hand to counsel. What a letter means, how strong the claim is and what to do about it are counsel's questions, and we do not answer them.
Why a banner and a tracker disagree
A banner records a choice. Whether your tags wait for it is a separate setting, and often it is not set.
Google's Consent Mode in advanced mode sends traffic to Google before the banner is answered, by design. It signals consent to Google; it does not hold back other vendors' pixels, misconfigured triggers or duplicate tags.
Source: Google's Consent Mode documentation.
Shopify's default setup can fire app pixels and custom pixels before a shopper answers, even when permissions are marked required. The fix sits several menus deep.
Source: Practitioner-documented; confirmed by our scanner.
A crawl of 97,000 EU-popular sites found that 73.4% of the 48,843 sites with a cookie notice set advertising or analytics cookies before the visitor touched the notice. That study measures cookies stored on EU sites against GDPR, not requests sent and not US law. It shows the gap is ordinary, nothing more.
Source: Bouhoula et al., USENIX Security 2024.
In our own calibration run of 2026-09-27, 37 hand-picked store pages, 36 of them home pages, were read in full. 17 of them completed a request to Meta before any consent answer, and 12 one to TikTok. A sample we chose, not a rate for the web.
Source: Our scanner, tool 2.7.0.
The check above, every week, on every page we watch
Consent before tracking is one of the six areas Store Health reads on every check. A tracker that starts firing before the banner is ranked Should check the week it appears, with what fired and where. On Pro with a verified domain, you get an email the same day and a dated report you can hand to your lawyer.
Nothing goes on your pages
We read from outside, the way a shopper's browser does. No tag to add, no app to install, and no new vendor on your pages. The free check never answers the banner, so it sees what a first-time visitor's browser sends. On a store you have confirmed is yours, Store Health reads before and after an answer, so you see what waited and what did not.
From the blog
Your Cookie Banner Probably Isn't Blocking Anything. Here's How to Check in Five Minutes
Most cookie banners record a shopper's choice without holding trackers back until it is made. A plain-English way to check what your own store sends before anyone answers.
What Is a CIPA Demand Letter? A Plain-English Guide for Store Owners
What a CIPA demand letter is, what California's wiretapping law actually says, why many of these claims are weaker than they look, and what to do first.
What SB 690 Changes About Tracking Demand Letters for Your Store
California's SB 690 ends private pen register claims over website trackers from January 1, 2027. Wiretap claims stay. What it means for store owners.
Shopify Fires Your Pixels Before Consent by Default. The Fix Is Hidden.
Shopify app pixels and custom pixels send data before a shopper answers your cookie banner, even when permissions look required. How to check, and the hidden fix.
Meta Pixel, TikTok and Your Cart Page: Tracking Before Consent
Meta and TikTok's richest events are built for the cart and checkout, and many store pixels do not wait for the cookie banner. What each event carries, and how to check.
Questions merchants ask about tracking letters
A banner asks for consent. Whether your tags wait for the answer is something you can check. Consent Mode only signals consent to Google and holds nothing else back, Shopify's default setup can fire pixels before an answer, and most consent tools must be set to block, not just to ask. The free check above shows which services start collecting before your banner is answered, on any page.
CyberShield Studio monitors and reports; it does not certify compliance or replace a QSA, ASV, or legal counsel. Nothing on this page is legal advice.