Your Website May Be Tracking Visitors in Ways You Never Approved

A business owner receives a demand letter alleging that their website intercepted visitor communications. The letter includes a screenshot of the site, cites a privacy statute they have never heard of, and demands a response.

The owner’s first reaction is often simple: We do not track anyone.

They may sincerely believe that. Nobody on the team decided to install surveillance software. But between the original website build, several marketing vendors, a redesign, and years of plugin changes, third-party code accumulated. Some of it may load before a visitor makes a privacy choice. Other tools may continue operating after an opt-out request.

That gap between what a business thinks its website does and what the browser actually loads is the real problem.

Website Tracking Is Broader Than Cookies

Cookies are only one tracking mechanism. Websites can also disclose or collect information through pixels, JavaScript tags, session-replay tools, chat widgets, embedded media, device identifiers, fingerprinting, form-monitoring scripts, and ordinary network requests to third-party services.

The Federal Trade Commission explains that website tracking can support analytics, saved preferences, personalized content, and advertising. Some tracking is operationally useful. Some is unnecessary. The risk increases when nobody can explain what a tool collects, why it is present, which vendor receives the data, or whether the site’s disclosures and privacy controls match its behavior.

What Changed for Website Owners

For many small and midsize US businesses, privacy compliance was not part of a typical website specification in the 2010s. Analytics tags were added, marketing pixels were installed, and few people revisited those decisions.

Several developments changed that environment.

Privacy laws and consumer rights expanded

The General Data Protection Regulation became applicable in 2018. California’s CCPA took effect in 2020 and was later amended by the CPRA. Other states have adopted their own privacy laws, with different thresholds, definitions, exemptions, and consumer rights.

Not every law applies to every organization. For example, the California Attorney General’s CCPA guidance explains that coverage depends on factors such as revenue, data volume, and data-related business activity. A business needs legal advice about which rules apply, but it also needs an accurate technical inventory before counsel can evaluate those rules.

Older privacy statutes are being applied to modern websites

Some website claims rely on the California Invasion of Privacy Act, commonly called CIPA. California Penal Code Section 631 addresses certain unauthorized interception and use of communications. Section 637.2 provides a civil remedy of the greater of $5,000 per violation or three times actual damages for a violation of the chapter.

That does not mean every analytics request, cookie, or third-party script violates CIPA. Courts continue to address whether and how particular parts of the statute apply to specific website technologies, parties, evidence, and consent flows. In a 2025 Ninth Circuit decision involving website chat technology, the court affirmed summary judgment for the defendants on evidentiary grounds, while a separate concurrence questioned whether one clause of Section 631 applies to internet communications at all.

The legal questions are contested and fact-specific. The practical lesson is narrower: unknown third-party code can create litigation and compliance exposure even when nobody at the business intentionally approved the current configuration.

Why Older Websites Are Often More Exposed

A site built several years ago may have been reasonable for its time. The risk usually comes from everything that accumulated afterward and the absence of a recurring review process.

Common sources of unexpected data collection or disclosure include:

• Old tag-manager containers. A former agency may still control the account, or the container may still fire tags for vendors nobody uses.
• Advertising pixels from completed campaigns. The campaign ended, but the pixel continued loading.
• Chat, booking, review, video, and social widgets. Embedded tools can load code from another company and may set identifiers or observe user interactions.
• Session-replay and form-monitoring tools. These require careful configuration so sensitive fields and pages are excluded.
• Externally hosted fonts and assets. A request to another provider discloses connection data such as an IP address. Self-hosting can eliminate unnecessary third-party requests when licensing and performance allow it.
• Platform, CDN, or hosting-level injection. Some scripts are added outside WordPress, so they will not appear in the plugin list, theme, or database.
• Plugin telemetry and remote services. These connections are not necessarily malicious, but they should still be inventoried and evaluated.

The pattern is consistent: these technologies rarely appear in a place a business owner would think to check.

A Consent Banner Does Not Prove Consent Controls Work

Installing a consent-management plugin can make a banner appear. It does not automatically guarantee that analytics, advertising, chat, or other scripts wait for the required user choice.

Actual control requires configuration. Scripts may need to be categorized, delayed, blocked, or conditionally loaded. The site may also need to honor opt-out preference signals such as Global Privacy Control, depending on the laws and data practices that apply.

In one technical audit across nine websites managed by an agency partner, all nine displayed consent banners. Only one actually prevented the relevant tracking tools from loading before the visitor made a choice. The other eight looked compliant on the surface but behaved differently in the browser.

The California Privacy Protection Agency has also warned that privacy choices must be clear and balanced. A banner that is confusing, nonfunctional, or inconsistent with the site’s actual behavior can create additional risk.

One important qualification: a third-party request before consent is not automatically a legal violation. Some jurisdictions and technologies rely on prior consent. Other requirements focus on notice, opt-out rights, sale or sharing, sensitive data, or honoring browser signals. The network activity is evidence to classify and review, not a legal conclusion by itself.

How to Check Your Website for Leaking Tracking Consent

You can perform a useful first check without special software:

1. Open the site in a fresh private or incognito window so prior cookies do not affect the test.
2. Open the browser’s developer tools and select the Network panel.
3. Reload the page without interacting with the privacy banner.
4. Review requests sent to domains that are not controlled by your organization.
5. Open the Application or Storage panel and review cookies, local storage, and other identifiers created before a choice.
6. Repeat the test on important pages, including contact forms, booking pages, account areas, checkout, chat, and pages with embedded media.
7. Test the accept and reject choices separately. Confirm the expected scripts start or remain blocked.
8. Test any required browser-level opt-out signal and confirm the site honors it.

Record each third-party domain, the tool or vendor associated with it, when it loads, what data it may receive, and the business purpose for keeping it.

This check produces an inventory, not a compliance opinion. A full assessment should also review tag-manager containers, plugins, theme code, custom scripts, server and CDN settings, consent-platform rules, vendor configurations, and the privacy policy.

Our guide on how to conduct a WordPress site audit explains why browser behavior must be evaluated alongside the WordPress installation itself.

Warning Signs That Deserve a Closer Review

• Analytics or advertising tools load before the choice required by the applicable consent model.
• Advertising or cross-context behavioral tracking continues after a valid opt-out request.
• The site does not recognize an opt-out preference signal when required.
• Session-replay or chat tools can observe sensitive form fields.
• The tag manager contains unknown tags, custom HTML, or users from former vendors.
• The privacy policy names tools that are no longer installed or omits tools that are active.
• A third-party request has no current owner or documented business purpose.
• Rejecting optional tracking has no measurable effect on network activity.

How to Reduce Hidden Tracking Risk

The technical work is often manageable once the inventory is accurate:

• Remove tags, pixels, plugins, and widgets that no longer serve a business purpose.
• Reclaim ownership of tag-manager, analytics, advertising, and consent-platform accounts.
• Self-host appropriate fonts and assets to reduce unnecessary third-party connections.
• Configure consent categories and script gating based on guidance from counsel.
• Honor applicable opt-out requests and browser preference signals.
• Exclude sensitive fields and pages from chat, analytics, and session-replay collection.
• Align the privacy policy and notices with the site’s verified behavior.
• Document what changed, when it changed, who approved it, and how the result was tested.
• Repeat the review after redesigns, marketing launches, vendor changes, and major plugin updates.

This is also why ongoing WordPress maintenance should include more than software updates. A site can be fully patched while still loading outdated or unauthorized third-party code.

If You Receive a Demand Letter

Do not ignore it, and do not make sweeping changes before preserving relevant evidence. Contact qualified counsel, retain the letter and attachments, and preserve current website code, tag-manager versions, consent-platform settings, logs, and network captures.

Your attorney can advise whether and how to respond. A technical team can document what the site loaded, identify the responsible systems and vendors, and implement remediation under counsel’s direction.

For related considerations, see our article on the privacy risks of website chat tools.

Know What Your Website Actually Loads

If your site was built before privacy controls became a normal part of website planning, it is worth checking what is active today. The goal is not to assume that every third-party request is unlawful. The goal is to eliminate surprises, remove unnecessary collection, and give legal counsel an accurate technical record.

Inspry’s WordPress website audits can identify third-party requests, old tags, consent-control gaps, and tracking injected through WordPress or surrounding infrastructure. You receive a prioritized technical report showing what is present, what needs clarification, and what can be remediated.

Request a WordPress Website Audit

This article provides general technical information and is not legal advice or a determination that any privacy law applies to a particular business or website. Consult qualified counsel about legal obligations, privacy notices, consent requirements, and demand letters.