Your Website Is Collecting More Than You Think, and You Are Liable for It
Third party scripts you did not write are reading your visitors. Plaintiff lawyers noticed before most business owners did.
Executive Summary
- The average business website runs code from several outside companies: analytics, advertising pixels, a chat widget, maybe a session replay tool. Most owners have never seen a list of what is actually running or what it collects.
- That has become a legal exposure. A 1967 California wiretapping law is now the most active source of website class actions in the country, with statutory damages of $5,000 per violation and a reach that covers any business collecting data from California residents.
- Tracking has also moved past cookies. In August 2026 researchers found AliExpress playing silent audio in the browsers of visitors to fingerprint their devices, a technique that no consent banner covers and no amount of clearing cookies defeats.
The Code on Your Site Is Not Your Code
When a visitor loads your homepage, your server sends them your pages. It also instructs their browser to go fetch and run software from other companies. The marketing team added a conversion pixel. Someone enabled a heatmap tool during a redesign. The chat widget came with the template.
Each of those is a third party sitting inside the conversation between you and your visitor, with its own data practices and its own commercial interest in what it sees. Very few small businesses could produce an accurate list of them, which is the actual problem. You are accountable for behavior you have never inspected.
What the AliExpress Story Really Shows
In August 2026 a developer noticed his Bluetooth headphones behaving oddly whenever an AliExpress tab was open. Digging into the page code, he found the site generating audio at zero volume through the browser audio system and measuring how his specific device processed it. Tiny variations between hardware, drivers and operating systems made the result a usable identifier. Nobody was being recorded. They were being measured.
Browser makers responded quickly, and the technique itself has been documented in academic research for years. The detail worth holding onto is simpler. This kind of tracking produces no prompt, no cookie and nothing a visitor can clear. It was discovered by accident, by someone who happened to look.
Which raises the question that matters for your business. If a vendor whose script runs on your site did something similar, would you ever find out? And when a visitor eventually asks what your website collects, is the honest answer that you do not know?
A Wiretapping Law From 1967 Is Now a Website Problem
The California Invasion of Privacy Act was written for telephone wiretaps. Plaintiff firms have spent the last few years applying it to routine web instrumentation, arguing that a third party script reading a visitor interaction before consent is an interception. A second provision, aimed at pen registers, is being used against pixels that capture addressing information such as IP addresses.
The shape of these claims is narrow and uncomfortable. The question is rarely whether tracking is wrong. It is whether a tracker fired before the visitor agreed to it, measured in milliseconds. Courts have split, defendants have won dismissals, and an appellate case on whether a pixel counts as a pen register is pending. None of that helps when the first contact is a demand letter.
This is not legal advice, and your counsel should weigh in on your specific exposure. But the trigger is almost always the same thing: a script firing before consent, on a site whose owner never knew it was there.
Why Smaller Companies Are the Easier Target
A law firm can audit your website from the outside in minutes, because the trackers announce themselves to any browser that loads the page. Larger companies have privacy counsel and fight. A fifty person business without in-house legal does the arithmetic on defending a class claim and settles, which is exactly the dynamic the volume depends on. The cost is rarely catastrophic. It is reliably more than the afternoon it would have taken to avoid.
Five Things Worth Doing
- Inventory what actually runs on your site. Not what marketing remembers adding. An actual list of every pixel, tag, analytics script, chat widget and replay tool across every page.
- Delete what no longer earns its place. Most sites carry trackers from campaigns that ended years ago and vendors nobody uses anymore.
- Make trackers wait for consent. A banner that appears while the scripts have already fired is decoration, and it is the specific fact these cases turn on.
- Exclude your sensitive pages. Anything touching health, finances or account detail should be out of scope for session replay and third party analytics entirely.
- Keep the consent records. Being able to show that a particular visitor agreed before anything fired is the difference between a short conversation and a long one.
The Takeaway
Most businesses think of their website as marketing. It is also a data collection system they are legally responsible for, assembled over years by different people, running code they have never read.
The fix is not to stop measuring. It is to know what is running, make it ask first, and be able to prove that it did. That is an afternoon of work and a list you keep current, which is a far better position than finding out from a letter.
How Simulint Helps with BlueSphere
Our vCISO practice builds and maintains that inventory with Clients, covering what runs on your public web properties, what each vendor receives, and where consent needs to sit in front of it. It is the same discipline we apply to any third party with access to your data, applied to the ones your visitors meet first. Learn more at https://lnkd.in/eE9HTaw8
