What the Attorney General’s September 17, 2026 Alert Says About Tracking Demand Letters

On September 17, 2026, the Texas Attorney General issued a consumer alert about demand letters that accuse Texas businesses and nonprofits of violating California privacy law through their websites. The alert is a warning, not a ruling. It tells recipients to slow down; it does not tell them the claims are worthless.

What the letters say

The letters invoke the California Invasion of Privacy Act (CIPA), a 1967 wiretapping statute. They claim that cookies, pixels, analytics tools, or a site's search bar intercept visitors' communications without consent. Many include screenshots of the site and a draft complaint, and they demand payment at once to avoid suit.

What the alert says

The alert reports a recent rise in these letters. It cautions that some may exaggerate or misstate the law and that some may be fraudulent. It names one serial plaintiff whom a federal court in California has declared a vexatious litigant. And it advises recipients to consult a lawyer before responding or paying, and to report suspected fraud. It also makes a point recipients often miss: a demand letter, by itself, proves nothing.

What the alert does not say

It does not say every letter is a scam. It does not say a Texas business is beyond CIPA's reach. It does not decide whether any particular tool violates any law. A business that ignores a letter on the strength of the alert takes a risk the alert never endorsed.

What has changed since

California enacted SB 690 on September 30, 2026, with operation beginning January 1, 2027. It limits specified civil actions against private actors alleging online-conduct violations of the pen-register/trap-and-trace provision, §638.51, to the Attorney General. Its retroactivity clause reaches pending claims in actions commenced within two years before operation. It does not remove the separate §631 wiretapping theory, although any such claim still must satisfy its own legal requirements.

That last qualification matters. A letter that pleads the wiretapping provision is not automatically defeated: the §631 theory still requires analysis of standing, territorial reach, consent, the defendants' roles, the actual transmissions, and controlling case law. SB 690 itself does not decide those questions.

How to respond to a letter

Preserve the letter, every attachment, website and tag configurations, consent settings, and relevant records. Make no admission and no payment until counsel has reviewed it. Distinguish an informal demand from a served complaint, and calendar actual court deadlines rather than the letter's threats. Identify the sender and check whether the sender or counsel has a litigation history. Have the website reviewed: which tags fire, when, what they send, and what the consent banner actually does. Review what transmitted at the alleged time. Decide whether the tracking practice needs to change regardless of the letter; treat technical remediation as a separate fact-sensitive decision.

The same tags that draw CIPA letters can raise questions under Texas law, including the TDPSA's rules on targeted advertising and the DTPA's ban on deceptive practices.

Sources

Texas Attorney General consumer alert, Sept. 17, 2026
WilmerHale on SB 690 (commentary; the operative text is the chaptered statute)
SB 690, ch. 976, Stats. 2026, chaptered text (via LegiScan) (approved Sept. 30, 2026; operative Jan. 1, 2027 under Cal. Const. art. IV, § 8(c))
Cal. Const. art. IV, § 8 (default operative-date rule, § 8(c))