CIPA Website-Tracking Claims: Defending the Demand Letter and Fixing the Website

James D. Snyder, Managing Shareholder | Klinedinst PC

James D. Snyder is the Managing Shareholder of Klinedinst PC’s San Diego office, where he serves as Chair of the firm’s Transactional Practice Group and Co-Chair of its Artificial Intelligence (AI) Group. His practice centers on business transactions, mergers and acquisitions, and data privacy and security, and he is regularly engaged as an outside general counsel by emerging startups and established companies alike.

• Education & Credentials

Mr. Snyder earned his J.D. from California Western School of Law and his B.A. from the University of California, Santa Barbara. He is admitted to practice in California and before the U.S. District Court for the Southern District of California.

• Recognition & Leadership

Mr. Snyder is recognized in Legal 500’s City Elite Series for Corporate and M&A (2026) and received the John D. Klinedinst Entrepreneurial Spirit Award (2023). At Klinedinst, he leads as Managing Shareholder of the San Diego office, Chair of the Transactional Practice Group, and Co-Chair of the AI Group.

• Professional Involvement

Appointed in 2020 to the USLAW NETWORK Data Privacy and Security Practice Group, Mr. Snyder serves as its Educational Coordinator. He is a member of the International Association of Privacy Professionals (IAPP) and the San Diego County Bar Association, and mentors through Ignite at the University of California, San Diego.

• Experience

Mr. Snyder has counseled clients at the leading edge of data privacy, advising on the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), negotiating data processing agreements with major auto manufacturers, and building GDPR-compliant processes for international connected and autonomous car connectivity providers. He previously served as Chief Legal and Compliance Executive of a software development testing company, where he helped grow annual revenue from $10 million to more than $100 million in approximately three years and led the company’s $375 million acquisition by a publicly held international technology company. His work spans commercial SaaS, financial services, licensing, and professional services contracts, along with export and open-source software compliance.

Lori S. Ross, Partner | Outside General Counsel LLP

Lori S. Ross is a Partner with OGC with over 25 years of experience advising companies on data privacy, AI governance, and commercial contracts, including SaaS/IaaS agreements and licensing for clients ranging from startups to Fortune 100 companies giving her a practical, business-first approach to structuring deals that manage risk while enabling growth. She holds the AIGP, CIPP/U.S., CIPP/E, and CIPM and FIP designations from the IAPP and is admitted to practice in California, Colorado, and D.C.

• Education & Credentials

Ms. Ross earned her J.D. from UCLA Law School, an LL.M. from University College London, where she was a Bentham Scholar, and her B.A. from the University of California, Berkeley. She is admitted to the bars of California, Colorado, and the District of Columbia.

• Recognition & Leadership

Ms. Ross was named a Bentham Scholar at University College London, and her career includes senior legal leadership posts as Vice President of Legal and Business Affairs at FanDragon Technologies and Chief Legal Officer of Global Mobile Vision in Dublin, Ireland.

• Professional Involvement

She is a member of the International Association of Privacy Professionals (IAPP) and holds the AIGP, CIPP/US, CIPP/E, and CIPM designations.

• Experience

Across more than 25 years of practice, Ms. Ross has advised new, emerging, and established technology, manufacturing, pharmaceutical, and media companies, with broad experience counseling SaaS and IaaS providers. Her prior roles include Vice President of Legal and Business Affairs at FanDragon Technologies, Chief Legal Officer of Global Mobile Vision in Dublin, Ireland, legal consultant through Lori S. Ross, LLC, and attorney with Paige & Co. in London, England. She speaks fluent French and has lived and worked on three continents.

SESSION 1 – Defending CIPA Web-Tracking Demand Letters and Wiretap Lawsuits | 1:00pm – 2:00pm ET

This session equips defense counsel to respond to California Invasion of Privacy Act demand letters and defend wiretap and pen register lawsuits arising from website tracking technologies. Attorneys will learn how to evaluate your client’s potential exposure, the current circuit-level authority, strategies for defenses, forum selection strategies, key elements for settlements and the status of SB 690’s attempt to unwind CIPA issues for California businesses. Attendees leave with a concrete framework for evaluating client’s CIPA exposure, CIPA demand letters, forum selection, procedural defenses, as well as settlement and client triage strategies.

BREAK | 2:00pm – 2:10pm ET

SESSION 2 – Auditing and Fixing Website Tracking Before the Next CIPA Letter | 2:10pm – 3:10pm ET

In this session, I will walk attorneys through how to evaluate a client’s website for potential CIPA exposure before a demand letter arrives. I will explain how to identify the tracking technologies operating on a website, determine what information they collect and transmit, and prioritize the tools that present the greatest litigation risk. We will look closely at session-replay software, chat widgets, analytics tools, and advertising pixels, as well as why simply displaying a consent banner may not be enough if those technologies begin transmitting information before the user opts in. I will also discuss how consent platforms should be configured, how server-side tagging and data minimization can reduce exposure, and what protections should be included in vendor contracts. Finally, I will cover how attorneys should counsel clients regarding SB 690 while it remains unenacted and what ongoing testing and monitoring should occur after remediation. Attendees will leave with a practical audit checklist and remediation framework they can use with their own clients.