CIPA Tracker Audit

Scan a website for CIPA §631 wiretap exposure and get a defensibility report in minutes. Built for general counsel and outside counsel weighing litigation posture, not for general privacy compliance.

What it covers

A single-purpose §631 exposure scan. Point it at a URL and it runs two passes, a pre-consent baseline and then a reload that clicks "Reject all," so any tracker that fires identically in both states is flagged as one the banner does not actually gate. That single fact is what most strengthens a plaintiff theory.

Every detected tracker is sorted into one of three risk tiers, mapped to the CIPA legal theory it fits, not to filing volume:

• HIGH: session replay and chat. Microsoft Clarity, Hotjar, FullStory, Quantum Metric, Glassbox, Drift, Intercom. They capture keystrokes, form input, chat messages, and full-session DOM, and fit the Javier eavesdropper theory, the strongest fact pattern in the docket.
• MEDIUM: ad and marketing pixels. Meta Pixel, Google Analytics, Google Ads, TikTok Pixel, LinkedIn Insight Tag. They exfiltrate URL parameters, clicks, and conversions, and fit the wiretap interception theory, the highest filing volume but more contested case law.
• LOW: pen register only. Pinterest Tag, Snap Pixel, Reddit Pixel, X Pixel. They capture metadata without content or identifiers under §638.51, with lower per-violation exposure and a weaker class posture.

Each tracker is also fingerprinted against the active plaintiff-firm filing pattern of the last 12 months. Kind Law, Swigart Law Group, and Pacific Trial Attorneys drive most of the volume.

What you get back

A one-to-two-page defensibility report, copy-paste ready into a Word document or an email to the CEO:

• Headline exposure. The dollar figure at statutory damages, monthly visitors times pre-consent fires times $5,000 per violation, with the assumption set stated inline so counsel can challenge or refine it.
• Per-tracker table. Vendor, category, pre-consent fire status, §631 theory fit, plaintiff-firm filing pattern, and HIGH / MEDIUM / LOW risk tier.
• Defensibility scorecard. Three working defenses, CMP-gating, banner-consent, and not-a-communication, each scored High / Medium / Low / None with a one-sentence rationale.
• Prioritized remediations. Ranked by exposure reduction rather than severity, each one quantified in dollars of monthly exposure removed.
• Case-law caveats. Current 9th Circuit posture on the wiretap, pen register, and Javier theories, with pending appeals flagged.
• Required disclosures. A defensibility assessment, not legal advice.

The number is the statutory ceiling, not a settlement projection. A synthetic URL scan also misses trackers behind logins, checkout, or form submissions, which the report flags with the follow-up pages worth scanning.

The skill

This skill ships as a folder — a core file plus reference and output templates that work together.

What’s in the folder

cipa-tracker-audit/
  SKILL.md                        # Skill entry point Claude reads first
  README.md                       # How to run it (Claude Code or claude.ai)
  references/
    cipa-litigation-context.md    # §631 theory, plaintiff firms, defenses
    tracker-taxonomy.md           # Trackers by HIGH / MEDIUM / LOW tier
    report-template.md            # The exact report structure
    case-law-tracker.md           # Living reference of CIPA decisions

Critical disclosures (must appear in every report)

This analysis is a pre-litigation defensibility assessment generated by an AI skill from a single-page synthetic browser visit. It is not legal advice and does not create an attorney-client relationship. CIPA §631 jurisprudence is unsettled and varies by district within the 9th Circuit. Verify current case-law posture with outside counsel before relying on this analysis to set strategy. The exposure figure is calculated at statutory maximum under Cal. Penal Code §631(a) and does not predict settlement value, class certification likelihood, or trial outcome. The scan inspected the URL provided; trackers that fire only on logged-in pages, checkout flows, or behind form submissions are not captured. Counsel should commission a forensic scan covering the full site map before responding to any demand letter.