White-label sample — a real scan under a fictional agency’s brand. Yours would carry your logo and colors. The agency plan

Technical scan report — not legal advice. Full disclaimer below.

Harbor Lane Digital pre-consent tracker evidence

Tracking exposure scan

F

www.sample-boutique.example

Scanned 2026-07-16 · fresh browser profile · no prior consent state

Prepared by Harbor Lane Digital for sample-boutique.example

9 trackers transmitted visitor data to third parties before any consent interaction — the exact evidence pattern §631 / §638.51 demand letters are built on. 9 ignored the GPC signal.

9trackers transmitting before consent
9still firing with GPC signalled
—no reject control to test
OneTrustconsent banner

Banner detected (OneTrust), no reject control found on the first layer.

Also pre-consent: 2 tracker libraries loaded with no data beacon observed · 34 other third parties contacted · 22 third-party cookies set.

Theory-by-theory summary

What this scan observed, mapped to the theories demand letters plead. Observed behavior only — not a legal conclusion.

CategoryResultRiskEvidence & authority
CIPA §631(a)Prior-consent interception 4 trackers transmitting High TikTok Pixel, Google Analytics 4 (gtag), FullStory and 1 more transmitted visitor data before the OneTrust banner was answered — the fact pattern §631 letters plead, since consent must come before interception (Javier v. Assurance IQ). Content-capture theories survived dismissal in Heerde v. Learfield and Shah v. Capital One.
CIPA §631(a)Content capture — session replay & chat 1 tool active High FullStory — session recording and chat account for the majority of filed complaints. Courts are split: the Ninth Circuit revived a session-replay claim in Mikulsky v. Bloomingdale's (2025); Torres v. Prudential granted the defense summary judgment.
CIPA §638.51Pen register / trap-and-trace 9 trackers transmitting High TikTok Pixel, Google Analytics 4 (gtag), Google Ads / DoubleClick and 6 more captured IP/device signals pre-consent — the dominant theory in current filings (Heiting v. IHOP; Camplisson v. Adidas). Courts are split: Rodriguez v. Plivo and Licea v. Hickory Farms rejected IP-alone theories.
CCPA §1798.135Global Privacy Control 9 ignored the signal Medium Re-scanned with the browser legally signalling “do not share” (Sec-GPC); 9 trackers kept transmitting — the pattern behind CPPA enforcement actions (Honda, Todd Snyder).
Consent flowTracking after “Reject” No reject control Medium The banner offers no first-layer reject control — itself a common allegation in filed complaints.

“Risk” grades how often the observed pattern appears in filed complaints and demand letters — several of these theories remain contested, and courts have rejected them in the cases noted.

Privacy-signal tests

Most scanners skip both of these.

Pass 2 · GPC signalled

9 trackers ignored it

We re-scanned with the browser legally signalling “do not share” (Sec-GPC header + JS API). 9 of the trackers above kept transmitting anyway; 2 stopped.

Pass 3 · reject clicked

No reject control

The banner offers no first-layer reject control — itself a common allegation.

The demand-letter math

Their framing — not a damages estimate

This reproduces the arithmetic plaintiff demand letters use: per tracker, per statute, at CIPA's $5,000 statutory figure. Real settlements run far lower, and several courts have rejected these theories outright — see the defense section below.

Meta Pixel: §631 + §638.51$10,000
TikTok Pixel: §638.51 + §631$10,000
Google Analytics 4 (gtag): §638.51 + §631$10,000
Google Ads / DoubleClick: §638.51$5,000
Microsoft UET / Bing Ads: §638.51$5,000
Snap Pixel: §638.51$5,000
Pinterest Tag: §638.51$5,000
Reddit Pixel: §638.51$5,000
Microsoft Clarity: §631 + §638.51$10,000
FullStory: §631 + §638.51$10,000
Klaviyo: §631 + §638.51$10,000
34 additional third-party vendors × §638.51 × $5,000$170,000
PER-CLAIMANT DEMAND FIGURE$255,000

Class-action framing: one real TikTok-pixel letter claimed “$50M class exposure at 10,000 visitors” — a single violation × $5,000 × 10,000 California visitors = $50,000,000. This site has 45 third parties a letter could price this way.

What a defense would argue

Accuracy over fear: a tracker firing pre-consent is what these letters allege — it is not, by itself, a finding of liability.

Defense file — the raw evidence

Timestamped outbound requests to third-party domains in a fresh browser session, before any consent interaction — the same package a demand letter attaches as Exhibit A.

Pre-consent findings — the per-tracker detail · 11

Meta Pixel

Class A — Ad/identity pixel (top demand-letter target)

Library loaded pre-consent — no data beacon observed during this scan · fires with GPC signalled: no

Captures: pageviews, IP address, fbp/fbc cookies, clicks, form/search inputs; Advanced Matching can include hashed email/phone in tr params · Theories in filed cases: §631, §638.51, VPPA, WA MHMD · HIGH — repeatedly named in filed complaints and settlements

European Wax Center settlement ($5M); Heerde v. Learfield

#1 most-named tracker in demand letters

Evidencetimestamped · pre-consent
21:53:23.499 +2.4sGEThttps://connect.facebook.net/en_US/fbevents.js
21:53:25.476 +4.3sGEThttps://connect.facebook.net/signals/config/391121354387940?v=2.9.356&r=stable&domain=www.sample…

TikTok Pixel

Class A — Ad/identity pixel (top demand-letter target)

Data transmitted pre-consent — beacon endpoint hit at +4.5s · fires with GPC signalled: yes

Captures: device, browser, geolocation, IP, ttclid, browser fingerprint ("de-anonymization") · Theories in filed cases: §638.51, §631 · HIGH — repeatedly named in filed complaints and settlements

Heiting v. IHOP; Price v. Entravision; Camplisson v. Adidas

§638.51 wave leader — 100+ class actions in one year

Evidencetimestamped · pre-consent
21:53:25.580 +4.5sGEThttps://analytics.tiktok.com/i18n/pixel/events.js?sdkid=CCQ52JRC77UEQ07IGPRG&lib=ttq
21:53:27.215 +6.1sGEThttps://analytics.tiktok.com/i18n/pixel/static/main.MTA2MWE1OWMwMw.js
21:53:27.437 +6.3sGEThttps://analytics.tiktok.com/i18n/pixel/static/identify_b8133453.js
21:53:27.438 +6.3sPOSThttps://analytics.tiktok.com/api/v2/pixel
21:53:27.461 +6.3sPOSThttps://analytics.tiktok.com/api/v2/pixel/perf
21:53:27.667 +6.5sPOSThttps://analytics.tiktok.com/api/v2/pixel/act

Google Analytics 4 (gtag)

Class A — Ad/identity pixel (top demand-letter target)

Data transmitted pre-consent — beacon endpoint hit at +2.4s · fires with GPC signalled: yes

Captures: IP, client ID, page paths, search terms embedded in URLs · Theories in filed cases: §638.51, §631 · HIGH — repeatedly named in filed complaints and settlements

Heerde v. Learfield (search terms = contents)

Evidencetimestamped · pre-consent
21:53:23.497 +2.4sGEThttps://www.googletagmanager.com/gtag/js?id=GT-TBW8XFPT
21:53:25.947 +4.8sPOSThttps://analytics.google.com/g/collect?v=2&tid=G-J11MBLGD5V&gtm=45je67f0v893703265z8867723131za2…

Google Ads / DoubleClick

Class A — Ad/identity pixel (top demand-letter target)

Data transmitted pre-consent — beacon endpoint hit at +4.7s · fires with GPC signalled: yes

Captures: conversion events, IP, remarketing IDs · Theories in filed cases: §638.51 · HIGH — repeatedly named in filed complaints and settlements

Evidencetimestamped · pre-consent
21:53:25.846 +4.7sGEThttps://www.googleadservices.com/pagead/conversion/960173363/?random=1784238805836&cv=11&fst=178…
21:53:25.781 +4.7sGEThttps://googleads.g.doubleclick.net/pagead/viewthroughconversion/960173363/?random=1784238805763…
21:53:25.947 +4.8sPOSThttps://stats.g.doubleclick.net/g/collect?v=2&ngs=1&ibt=1&tid=G-J11MBLGD5V&cid=1882361899.178423…
21:53:26.068 +4.9sPOSThttps://googleads.g.doubleclick.net/pagead/viewthroughconversion/960173363/?random=612829112&cv=…

Microsoft UET / Bing Ads

Class A — Ad/identity pixel (top demand-letter target)

Data transmitted pre-consent — beacon endpoint hit at +6.4s · fires with GPC signalled: yes

Captures: IP, browser fingerprint, identifiers · Theories in filed cases: §638.51 · MEDIUM-HIGH — appears in complaints and firm alerts

Evidencetimestamped · pre-consent
21:53:27.516 +6.4sGEThttps://bat.bing.com/bat.js
21:53:27.751 +6.6sGEThttps://bat.bing.com/p/action/5525025.js
21:53:27.858 +6.7sGEThttps://bat.bing.com/action/0?ti=5525025&tm=gtm002&Ver=2&mid=29d1684f-670d-4ee7-9622-3d2d7414fba…

Snap Pixel

Class A — Ad/identity pixel (top demand-letter target)

Data transmitted pre-consent — beacon endpoint hit at +4.7s · fires with GPC signalled: yes

Captures: events, IP, identity · Theories in filed cases: §638.51 · MEDIUM — appears in complaints and firm alerts

European Wax Center settlement

Evidencetimestamped · pre-consent
21:53:25.845 +4.7sGEThttps://sc-static.net/scevent.min.js
21:53:26.257 +5.1sGEThttps://tr.snapchat.com/config/com/0799b531-14db-475b-9828-0feaf5ed109e.js?v=3.59.0-2606221835
21:53:26.257 +5.1sGEThttps://tr.snapchat.com/cm/i?pid=0799b531-14db-475b-9828-0feaf5ed109e&u_scsid=1d173891-46dd-400b…
21:53:26.463 +5.3sPOSThttps://tr.snapchat.com/p
21:53:26.565 +5.4sGEThttps://tr.snapchat.com/cm/s?bt=1d53c387&pnid=140&cb=1784238806563&u_scsid=c5984b11-4488-46fa-8f…
21:53:26.662 +5.5sGEThttps://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com…
+2 more requests in the downloadable defense file

Pinterest Tag

Class A — Ad/identity pixel (top demand-letter target)

Data transmitted pre-consent — beacon endpoint hit at +4.0s · fires with GPC signalled: no

Captures: events, IP · Theories in filed cases: §638.51 · LOW-MEDIUM — demand-letter padding / emerging

Evidencetimestamped · pre-consent
21:53:25.151 +4.0sGEThttps://ct.pinterest.com/user/?cb=1784238805107&ed=%7B%22np%22%3A%22shopify-web-pixel%22%2C%22ev…
21:53:25.492 +4.4sGEThttps://ct.pinterest.com/v3/?cb=1784238805107&ad=%7B%22mh%22%3A%2258027b7f%22%2C%22ua%22%3A%22Mo…

Reddit Pixel

Class A — Ad/identity pixel (top demand-letter target)

Data transmitted pre-consent — beacon endpoint hit at +4.7s · fires with GPC signalled: yes

Captures: events, IP · Theories in filed cases: §638.51 · LOW-MEDIUM — demand-letter padding / emerging

Evidencetimestamped · pre-consent
21:53:25.845 +4.7sGEThttps://www.redditstatic.com/ads/pixel.js
21:53:26.164 +5.0sGEThttps://alb.reddit.com/rp.gif?ts=1784238806163&id=t2_3j2avnpr&event=PageVisit&m.value=&m.transac…

Microsoft Clarity

Class B — Session replay (65% of filed complaints)

Library loaded pre-consent — no data beacon observed during this scan · fires with GPC signalled: yes

Captures: session recording: clicks, scrolls, keystrokes/masked inputs · Theories in filed cases: §631, §638.51 · HIGH — repeatedly named in filed complaints and settlements

Evidencetimestamped · pre-consent
21:53:24.977 +3.8sGEThttps://www.clarity.ms/tag/shopify/w4j1994wue

FullStory

Class B — Session replay (65% of filed complaints)

Data transmitted pre-consent — beacon endpoint hit at +4.0s · fires with GPC signalled: yes

Captures: full session replay including keystrokes · Theories in filed cases: §631, §638.51 · HIGH — repeatedly named in filed complaints and settlements

landmark session-replay cases

Evidencetimestamped · pre-consent
21:53:25.105 +4.0sGEThttps://edge.fullstory.com/s/fs.js
21:53:25.716 +4.6sPOSThttps://rs.fullstory.com/rec/page
21:53:25.963 +4.8sGEThttps://rs.fullstory.com/rec/integrations?OrgId=o-1WSDXJ-na1&isInFrame=false&isNative=false
21:53:28.542 +7.4sPOSThttps://rs.fullstory.com/rec/bundle/v2?OrgId=o-1WSDXJ-na1&UserId=3d5319c6-13ef-4fb8-8bfd-3559024…

Klaviyo

Class D — Identity resolution (IP-to-email matching)

Data transmitted pre-consent — beacon endpoint hit at +1.5s · fires with GPC signalled: yes

Captures: email identity, browse/cart activity · Theories in filed cases: §631, §638.51 · MEDIUM — appears in complaints and firm alerts

Evidencetimestamped · pre-consent
21:53:22.673 +1.5sGEThttps://static.klaviyo.com/onsite/js/Sn6eFZ/klaviyo.js?company_id=Sn6eFZ
21:53:22.673 +1.5sGEThttps://static.klaviyo.com/onsite/js/klaviyo.js?company_id=Sn6eFZ
21:53:23.170 +2.0sGEThttps://static.klaviyo.com/onsite/js/build-preview/commit-4ab341531e941a9ba5cc5e08edb4c91b8124d6…
21:53:23.170 +2.0sGEThttps://static.klaviyo.com/onsite/js/build-preview/commit-4ab341531e941a9ba5cc5e08edb4c91b8124d6…
21:53:23.170 +2.0sGEThttps://static.klaviyo.com/onsite/js/build-preview/commit-4ab341531e941a9ba5cc5e08edb4c91b8124d6…
21:53:23.170 +2.0sGEThttps://static.klaviyo.com/onsite/js/build-preview/commit-4ab341531e941a9ba5cc5e08edb4c91b8124d6…
+4 more requests in the downloadable defense file

The long tail · 34 additional pre-consent third parties

Demand letters pad their math with every third-party domain contacted pre-consent (one letter in our research counted “43 additional vendors” at $5,000 each). These are not in our classified tracker list but were contacted before any consent interaction:

DomainRequestsFirst seen
forter.com332026-07-16T21:53:22.903Z
imgix.net232026-07-16T21:53:22.673Z
gorgias.chat202026-07-16T21:53:22.674Z
shopifysvc.com102026-07-16T21:53:23.336Z
shopify.com82026-07-16T21:53:22.672Z
optimizely.com62026-07-16T21:53:22.671Z
googleapis.com52026-07-16T21:53:25.093Z
posthog.com52026-07-16T21:53:25.103Z
global-e.com52026-07-16T21:53:25.302Z
clairedefermat.com52026-07-16T21:53:25.580Z
getelevar.com42026-07-16T21:53:25.107Z
shop.app32026-07-16T21:53:22.672Z
merchant-center-analytics.goog32026-07-16T21:53:25.410Z
rechargecdn.com32026-07-16T21:53:27.509Z
joinground.com22026-07-16T21:53:22.673Z
agkn.com22026-07-16T21:53:25.359Z
postpilot.com22026-07-16T21:53:26.048Z
trkn.us22026-07-16T21:53:26.048Z
findation.com12026-07-16T21:53:22.671Z
onetrust.com12026-07-16T21:53:22.980Z
cloudflare.com12026-07-16T21:53:23.409Z
postie.com12026-07-16T21:53:25.107Z
pointmediatracker.com12026-07-16T21:53:25.153Z
getletterpress.com12026-07-16T21:53:25.358Z
amazonaws.com12026-07-16T21:53:25.580Z
myshlf.us12026-07-16T21:53:25.580Z
tvspix.com12026-07-16T21:53:25.580Z
facebook.com12026-07-16T21:53:25.658Z
blisspointmedia.com12026-07-16T21:53:25.713Z
impactradius-event.com12026-07-16T21:53:25.845Z
79ic8e.net12026-07-16T21:53:26.286Z
ojrq.net12026-07-16T21:53:26.544Z
tiktokw.us12026-07-16T21:53:27.438Z
cloudfront.net12026-07-16T21:53:31.618Z