This Isn’t Hypothetical: The Cases

Everything laid out in the previous tabs—the consent banner, the privacy policy, the way they wire together—may read like a lot of process for a threat that hasn't visibly landed on anyone you know. So this section sets the argument aside and points at the record instead. Below are real cases: real companies, real dispositions. The summaries are deliberately short, with links out to the reporting, so you can read as much or as little as you want. The lawyers and journalists did the heavy lifting.

A note on how to read this: not every theory here is settled. One of the biggest is actively contested, and a court recently rejected it outright. That's included on purpose—the goal is an accurate picture of the risk, not a scare.

1. The CIPA "trap" wave — ordinary businesses, old wiretapping law

A 1967 California wiretapping statute (CIPA) is being aimed at websites running a pixel, chat widget, or analytics script. It carries $5,000 per violation with no requirement to prove actual harm, which is why a small circle of plaintiffs' firms files these by the hundreds. Most begin as a demand letter that never becomes public because it settles quietly. This is the same theory behind the notice that prompted this entire program.

The scale of it — Active wave (2025 filings, nationwide) More than 800 CIPA claims were filed in 2025 alone, and the count has climbed every year since chatbots were the original target in 2022. California tried to carve out ordinary business analytics (SB 690); it passed the state Senate unanimously and then stalled, so there is no safe harbor. The courts are split, meaning similar setups produce opposite outcomes depending on the judge. → OneTrust, "CIPA Litigation Is Accelerating": https://www.onetrust.com/blog/cipa-litigation-is-accelerating-what-website-tracking-practices-are-getting-wrong/

Camplisson v. Adidas America, Inc. — Claim survived dismissal (S.D. Cal., Nov. 2025) A visitor sued Adidas alleging its website tracking pixels functioned as an unlawful "pen register." In November 2025 the court allowed the claim to proceed, agreeing that website trackers can plausibly qualify as pen registers under CIPA. The significance is not Adidas's size; it's that the theory cleared the first hurdle a court could have used to dismiss it. → Jackson Walker, "CIPA Claims Surge": https://www.jw.com/news/insights-california-invasion-privacy-act-claims-surge/

Forbes Media — $10M settlement, in principle (California, 2026) Forbes agreed in principle to a $10 million settlement over allegations that its website trackers passed identifiers such as IP addresses to third parties without adequate consent. The deal also required stronger tracker disclosures and more visitor control—essentially the program recommended here, purchased after the fact. → OneTrust, recent settlements: https://www.onetrust.com/blog/cipa-litigation-is-accelerating-what-website-tracking-practices-are-getting-wrong/

The counter-example: Blaker v. NetScout Systems — Dismissed with prejudice (L.A. County Superior Court, May 2026) A defense win, included deliberately. In May 2026 a California court dismissed a CIPA pen-register case entirely, ruling that those provisions were written for telephone lines, not software on a commercial website. Encouraging—but it is a single trial-court decision, persuasive rather than binding, and plaintiffs' firms continue to file while the question moves toward appeal. The exposure hasn't disappeared; it's contested. → Mac Murray & Shuster, "A California Court Just Handed Website Operators a Win on CIPA": https://mslawgroup.com/a-california-court-just-handed-website-operators-a-win-on-cipa/

2. Meta Pixel + healthcare — the pattern that's actually settling for real money

If the CIPA pen-register theory is still being argued, the healthcare pixel cases are the ones already writing checks. Hospitals placed the Meta Pixel and Google Analytics on their sites and patient portals; plaintiffs argued this sent protected health information to Meta and Google without consent. These settle.

Sutter Health — $21.5M settlement (California, final approval Feb. 2026) One of California's largest health systems settled for $21.5 million over the Meta Pixel, Google Analytics, and other ad tools on its patient portal. Final approval came through in February 2026. → Overview of the hospital pixel settlements: https://www.gblock.app/articles/hospital-tracking-pixel-settlements-100m-patient-data

The wave, in one number — $100M+ across 19 cases (2023–2025, nationwide) A consolidated review found settlements and penalties exceeding $100 million across 19 cases, with the Meta Pixel identified on the patient portals of at least 33 major health systems. Sutter and Inova ($3.1M) are not outliers; they are the pattern. This is the category most relevant to any client touching health data, which is why Coryell warrants its own HIPAA-informed conversation rather than the standard playbook. → The $100M pixel-settlement tally: https://www.gblock.app/articles/hospital-tracking-pixel-settlements-100m-patient-data

3. Session replay & chat widgets — the "we were just improving UX" tools

Session-replay scripts record what a visitor does on a page; chat widgets capture the conversation. Plaintiffs argue that a third-party vendor sitting in the middle of that is the wiretap. The tools feel harmless, which is the trap. What often decides whether a case survives is the consent architecture, not the tool itself.

Consent architecture is the whole ballgame — Mixed results, one theme (Federal courts, 2025–2026) Across recent session-replay and interception rulings, cases that get dismissed tend to involve genuine click-through consent, while those that survive tend to rely on "browsewrap"—a buried notice a visitor is deemed to have accepted simply by arriving. Courts are increasingly hostile to browsewrap. The lesson: having a policy is not enough. Consent has to fire before the tracking does, and the visitor has to affirmatively agree. That gap—notice presented versus choice enforced—is precisely what a properly configured Cookiebot setup is built to close. → Wiley, "Key Areas to Watch as Website Technology Litigation Continues to Surge": https://www.wiley.law/alert-Key-Areas-to-Watch-as-Website-Technology-Litigation-Continues-to-Surge

It's not just California anymore — Multi-state theory (FL, PA, MA and others, 2026) Plaintiffs have stopped relying on CIPA alone. They are layering in the federal Wiretap Act, Florida's Security of Communications Act, Pennsylvania's wiretap statute, and others—so "we don't do business in California" is no longer the shield it is often assumed to be. → Barnes & Thornburg, "CIPA/ECPA Website-Tracking Privacy Litigation in 2026": https://btlaw.com/en/insights/alerts/2026/cipa-ecpa-website-tracking-privacy-litigation-in-2026

4. The Texas angle — because "that's a California problem" is the first objection

Most 4C clients are Texas businesses, and the instinct is to treat this as a coastal issue. It isn't. Texas has built one of the most aggressive privacy-enforcement operations in the country, and—as an earlier tab noted—Texas law does not exempt small businesses from its rules on selling sensitive data.

Texas v. Allstate / Arity — First-in-nation TDPSA suit (filed Jan. 2025, Texas AG) In January 2025 the Texas Attorney General filed the first enforcement action under the Texas Data Privacy and Security Act, accusing Allstate and its analytics subsidiary of collecting and selling Texans' location data without proper notice, consent, or a working opt-out. (The underlying fact pattern involved a software kit embedded in mobile apps rather than a website pixel—adjacent to, not identical to, the theory driving the website cases.) The specific failures the state cited—no clear privacy notice, no required sale disclosure, a broken opt-out link—are the same categories a consent program exists to prevent. → Vinson & Elkins, "Texas AG Targets Allstate": https://www.velaw.com/insights/texas-ag-targets-allstate-in-first-enforcement-of-texas-data-privacy-and-security-act/

The Texas AG has been busy — $1.375B + $1.4B settlements (2024–2026, Texas AG) The state stood up a dedicated privacy-enforcement team—described as one of the largest at the state level anywhere—and has since landed a $1.375 billion settlement with Google and a $1.4 billion settlement with Meta over data and biometric claims. Those are Big Tech figures. The point is not that a Texas SMB is next for a billion dollars; it's that Texas is not sitting this out, and enforcement here runs through an AG who has made the issue a priority. → Texas Lawbook, "Texas Emerges as a Leading Force in State Privacy Law Enforcement": https://texaslawbook.net/texas-emerges-as-a-leading-force-in-state-privacy-law-enforcement/

The takeaway

Not "you're about to get sued." Some of these theories are genuinely contested, and one court recently rejected the biggest one. The honest read: the filings are real, the settlements are real, the tools involved are the ordinary ones already on most sites, and Texas is not the safe harbor it's assumed to be. The consent program recommended here is the inexpensive, up-front version of what every company on this page ended up doing anyway—minus the lawsuit.

Driving Results for B2B Companies | fourcolumns.net

This overview is for general information and reflects reporting current as of mid-2026. It is not legal advice, and case dispositions change—several of the theories above are being actively litigated on appeal. For how any of this applies to a specific site and technology stack, consult counsel.