What to do about a wiretap demand letter

What the letter usually claims

Most letters say that a script on your website let a third party, usually an ad platform, receive what a visitor viewed or typed without consent. They cite a federal or state wiretap statute, name a statutory damages figure, and offer to settle before a suit is filed.

The facts they rely on are usually observable from the outside: which scripts load on which pages, and whether they load before the visitor makes a choice.

Don’t ignore it, and don’t reply alone

Letters often carry a short deadline. Send it to your counsel the day it arrives. If you carry cyber or privacy liability insurance, your policy may require prompt notice to the carrier.

Preserve before you change anything

The instinct is to rip out every pixel. Ask your counsel first. Changes to your site may need to be documented, and records of what ran and when may need to be kept.

• Save the letter and its envelope or email headers.
• Export your tag manager’s version history.
• Keep your consent banner’s current configuration.

See what your site actually loads

You can list the external scripts on any page from your browser’s developer console:

// Lists every external script on the current page
[...document.scripts].map(s => s.src).filter(Boolean)

That shows what is on the page, not when each script loaded or what it sent. A scan records both.

Gather what counsel will ask for

1. A list of every script on the pages named in the letter.
2. When each one was added, and by whom: your team or an agency.
3. Your consent banner’s behavior on the dates in question.
4. Your privacy policy as published on those dates.
5. Any business associate agreements with vendors.

Fix forward

Once counsel agrees, the durable fix is structural: hold every script until the visitor opts in, and stop sending identifiers to ad platforms at all. Conversion reporting can continue server-side with a click ID and an opaque code. How server-side conversions work explains the mechanics.