Texas Attorney General Ken Paxton issued a consumer alert warning Texas businesses and nonprofits about a surge of demand letters alleging California Invasion of Privacy Act (CIPA) violations based on common website technologies such as cookies, pixels, and analytics tools. The AG cautions that some letters may exaggerate or misrepresent violations and may be fraudulent, noting serial CIPA plaintiff Vivek Shah has been declared a vexatious litigant. Recipients are advised not to pay or respond directly, to consult privacy counsel, and to report suspected fraud to the Consumer Protection Division.
None. This is a consumer alert, not an enforcement action; no penalties or remedies were imposed. The AG recommends consulting counsel experienced in privacy and website-tracking litigation, reviewing the organization's use of pixels, cookies, and analytics tools, monitoring evolving privacy laws, and reporting suspected fraudulent demand letters to the Consumer Protection Division.
Although this is a consumer alert rather than an enforcement action against a company, it signals active CIPA 'wiretapping' litigation risk arising from everyday website technologies. In-house teams should review vendor and SaaS agreements with analytics, advertising, session-replay, chatbot, and tag-management providers to confirm data processing terms restrict collection and onward sharing of website visitor communications, and should negotiate or verify CIPA-specific indemnification and defense provisions for claims arising from pixels, cookies, and similar tools. Privacy policies and website terms of service should accurately disclose tracking technologies, and any consent or opt-out mechanisms should be documented, since demand letters often include screenshots of the recipient's website. Procurement and marketing contracts should require vendors to flow down compliance with California privacy law, and legal playbooks should include a protocol requiring privacy counsel review of any demand letter before payment or response, given the AG's warning that some letters may be fraudulent or abusive.
Entity
N/A (consumer alert; no enforcement target)
Industry
OtherOfficial Press Release
https://www.texasattorneygeneral.gov/news/releases/consumer-alert-attorney-general-ken-paxton-warns-texans-scam-demand-letters-alleging-website-privacy
Demand Letter
https://www.texasattorneygeneral.gov/sites/default/files/images/press/Demand%20Letter.pdf
Texas Attorney General Enforcement Page
https://www.texasattorneygeneral.gov/consumer-protection/privacy
"September 17, 2026 | Press Release"
"Attorney General Ken Paxton is advising businesses and nonprofit organizations to be aware of a recent surge in demand letters alleging website privacy violations under California law"
"These demand letters allege violations of the California Invasion of Privacy Act (“CIPA”) based on the use of common website technologies such as cookies, pixels, analytics tools, and search bars."
"Senders may claim that these tools constitute unlawful “wiretapping” under California law and demand immediate payment to avoid litigation."
"one serial CIPA plaintiff, Vivek Shah, who is known to have sent demand"
"has been declared a vexatious litigant and is barred from filing any new action asserting CIPA or related digital privacy claims in the U.S. District Court for the Central District of California"
$3.0M
Texas Attorney General Ken Paxton announced a settlement requiring Temu to protect Texans’ sensitive personal data from exposure to the Chinese Communist Party and to strengthen product-safety practices. Temu must pay Texas $3 million, comply with data-security requirements backed by a potential $8 million annual penalty, conduct annual independent product testing, and take specified action on products found to contain harmful substances.
$773.0M
Texas Attorney General Ken Paxton announced that a multistate coalition had secured an opioid settlement with Albertsons, which would require the grocery chain to pay more than $773 million nationally once final. Texas and its political subdivisions may receive up to $57.8 million for opioid abatement; the release does not identify privacy violations.
Texas Attorney General Ken Paxton sued Gerber Products Company and Nestlé USA, Inc., alleging that Gerber made deceptive safety and testing claims while its baby food contained dangerous levels of toxic heavy metals. The lawsuit asserts claims under the Texas Deceptive Trade Practices Act; the release does not report a settlement, monetary penalty, or court order.
$1.5M
The Texas Attorney General obtained a judgment holding Rubinsky Roofing LLC liable for 27 violations of the Texas Deceptive Trade Practices Act, including deceptive practices involving older consumers and payment for unnecessary or unfinished repairs. The judgment requires more than $1.5 million in civil penalties, allocates at least $500,000 to consumer restitution, and permanently bars the company and its owner from the practices at issue.
The Texas Attorney General opened an investigation into UnitedHealth Group over allegations that its insurance-benefit administration and patient-care decisions denied Texans medically necessary healthcare. The AG issued Civil Investigative Demands to collect evidence; the release announces no penalty or remedy.
$7.5M
Texas Attorney General Ken Paxton announced a $7.5 million settlement with Tris Pharmaceuticals over alleged misrepresentations about the efficacy of Dyanavel XR, an ADHD drug marketed for children. The release says the company overstated the drug’s efficacy and directed sales representatives to make misleading claims to doctors, including Medicaid providers.