Common Website Lawsuits in the US

A surprisingly small set of legal claim types generates most of the demand letters landing in website owners’ inboxes right now.

Published October 2026. This reflects the landscape as of that date and it changes quickly. This article is general information, not legal advice. Consult an attorney about your specific situation.

I maintain websites for organizations across many industries, and over the past two years the same categories of demand letters and lawsuits have come up again and again in conversations with clients and their counsel. The list below covers the claim types driving most of that volume in the US, roughly ordered by how often they appear based on the research cited, along with the general practices that reduce exposure to each. None of this substitutes for a lawyer; its purpose is to help you recognize what you’re looking at and understand why these claims exist before you talk to one.

CIPA Website Tracking Claims

The California Invasion of Privacy Act (CIPA), a 1967 wiretapping statute, is now the basis for thousands of demand letters and class actions targeting websites. The core facts:

• The claims allege that tracking pixels, cookies, session replay, and similar tools capture user communications without consent, or act as a “pen register” or “trap and trace” device.
• Statutory damages are $5,000 per violation, with no proof of actual harm required, which is what makes a routine analytics install worth a demand letter.
• Letters are reaching companies of every size and industry, most with no tie to California beyond a website a resident there can open.
• 2026 filings increasingly focus on timing: tracking that begins before a visitor consents, or continues after they decline. A consent banner that loads after your pixels have already fired is the exact pattern these complaints describe.
• Letters come from plaintiffs’ firms and also from individual pro se plaintiffs sending them in volume to businesses nationwide.
• Courts are divided. California state courts have been increasingly willing to hold that the pen register section does not reach website tracking, and the first appellate rulings are pending.

Reducing exposure. The technical pattern that matters is true pre-consent blocking: no analytics, advertising, session replay or heatmap scripts execute until an affirmative opt-in, and declining actually prevents them from loading rather than merely hiding the banner. In practice that means a consent management platform wired into your tag manager with consent mode or hard script blocking, verified in the browser’s network tab rather than trusted from the CMP’s dashboard. Session replay tools deserve special scrutiny, since recordings of keystrokes and form fields are the centerpiece of many complaints. Audit what actually fires on first paint a few times a year; third-party scripts have a way of creeping in with plugins and marketing tools.

ADA Website Accessibility

• 5,006 federal ADA Title III lawsuits were filed in the first half of 2026, the highest mid-year count since 2021. That figure covers all Title III suits, not only websites.
• Website accessibility cases specifically: 3,117 federal filings in 2025, up 27% from 2024.
• UsableNet’s 2026 midyear report finds the 10 most active plaintiff firms account for roughly 84% of filings, with about 20 to 25 plaintiffs bringing most cases.
• Ecommerce was the top target in UsableNet’s 2025 midyear report, at 69% of lawsuits.
• Initial demand letters are reported to typically ask for $1,500 to $5,000 plus a commitment to remediate.
• In the first half of 2025, 22.6% of lawsuits targeted websites that had an accessibility widget installed.

Reducing exposure. That last statistic is the one to internalize: overlay widgets do not prevent these suits, and nearly a quarter of targets had one installed. What reduces risk is actual conformance work against WCAG 2.1 AA: automated scans (Lighthouse, axe) triaged into fixes, plus the manual checks automation can’t do, like keyboard-only navigation, screen reader passes on key flows, focus states, form labels and color contrast. Fix the templates, not just the pages a scanner flagged, prioritize the money paths (search, product pages, cart, checkout, contact), publish an accessibility statement with a working contact method, and keep records of audits and remediation, which both deters claims and matters if one arrives.

Copyright Image Claims

• Copyright enforcement agencies send demand letters on behalf of news agencies and other image rights holders, often demanding thousands of dollars with a 14-day deadline.
• Unresolved matters are often escalated to a law firm, whose demands are reported to often range from $1,500 to over $7,500.
• These claims usually involve a single image used on a site without a license, frequently one that’s been sitting in a blog post for years.

Reducing exposure. This is the most preventable category on the list. Use only images you’ve licensed, created, or sourced from reputable free-license libraries, and keep the receipt: a simple record of where every image came from and under what license. “It was on Google Images” and “our old designer added it” are not defenses, and neither is taking the image down after the letter arrives, which resolves nothing about past use. Audit legacy content, since posts from a decade ago are a common source, and be careful with editorial photos of news events and celebrities, which are the most aggressively enforced. If a letter arrives, resist the urge to reply in panic or admit anything; these matters have a going rate that counsel familiar with them can often reach.

Automatic Renewal and Subscription Claims

• Demand letters and lawsuits under California’s Automatic Renewal Law (ARL) often allege a missing online cancellation method, a missing post-purchase acknowledgment, or renewal disclosures that are not shown next to the consent prompt.
• State-law class actions over subscription practices are accelerating, and a newer wave involves B2B subscription services, so “we only sell to businesses” is no longer the shield it was assumed to be.

Reducing exposure. The pattern state laws keep converging on: renewal terms (price, frequency, how to cancel) presented clearly next to the consent action, not buried in linked terms; an affirmative checkbox or equivalent for the renewal itself; a post-purchase confirmation that restates the terms; and cancellation that’s as easy as signup, online, without a phone call or chat gauntlet. If you run subscriptions through WooCommerce, Stripe Billing or similar, walk your own signup and cancellation flow in a private window twice a year and screenshot it; those screenshots are both a compliance check and evidence of what the flow looked like on a given date.

TCPA Text Message Claims

• TCPA class action filings more than doubled in 2025.
• A large share involve “quiet hours” claims over marketing texts sent before 8am or after 9pm local time, a theory associated with plaintiff recruitment through social media ads beginning in 2024.
• Some courts have held that prior consent defeats these claims, and courts are divided on whether the provision covers text messages at all.

Reducing exposure. Consent records are the whole game: capture and retain proof of opt-in (timestamp, source, the exact disclosure shown), honor opt-outs immediately and keep the suppression list permanent. On timing, schedule sends inside 8am to 9pm in the recipient’s local time zone, which is harder than it sounds when your list stores no time zone; deriving it from area code is imperfect, so a conservative sending window sized to the continental US (for example 11am to 8:59pm Eastern) is the blunt but effective approach. Keep marketing and transactional streams separate, and make sure whatever SMS platform you use enforces all of this rather than assuming it does.

Washington CEMA Email Subject Lines

• Washington’s Commercial Electronic Mail Act prohibits false or misleading information in commercial email subject lines sent to Washington residents.
• Nearly 200 class actions were filed after a 2025 Washington Supreme Court decision interpreted the law broadly.
• An amendment effective June 11, 2026 adds a knowledge requirement and lowers statutory damages, but does not end the litigation risk.

Reducing exposure. The claims that fueled this wave were built on familiar marketing-email habits: “Ends tonight” on a sale that ran all month, fake “Re:” and “Fwd:” prefixes, percentage-off claims that didn’t match the landing page. The fix is editorial discipline: subject lines that are literally true, urgency only when the deadline is real, and offer terms in the subject that match the offer in the email. It’s worth a one-page subject-line policy for whoever writes your campaigns, since this is a category where the copywriter, not the developer, controls the risk.

Other Claim Types Worth Knowing

• Video Privacy Protection Act (VPPA): a 1988 law about video rental records, now applied to analytics and ad pixels on pages with video. The US Supreme Court agreed in January 2026 to hear a case clarifying its scope. If your site embeds video and runs advertising pixels on those pages, this applies to you.
• Florida Security of Communications Act (FSCA): website tracking claims similar to CIPA, a reminder that the tracking-consent issue is multi-state, not a California quirk.
• Illinois Biometric Information Privacy Act (BIPA): $1,000 to $5,000 per violation for unauthorized handling of biometric data. Face-based photo features, voice analysis and some fraud and identity tools can put a website in scope.
• Mass arbitration: hundreds or thousands of coordinated individual arbitration demands, where the filing fees themselves create settlement pressure. If your terms of service include an arbitration clause written years ago, it may be the vulnerability rather than the shield; this one is purely a conversation for your lawyer.

If a Demand Letter Arrives

General practices that counsel in this space tend to agree on, none of which replace actually retaining one:

• Don’t ignore it, and don’t answer it yourself. Deadlines in these letters are designed to provoke a fast, unadvised response. A reply that admits, explains or negotiates can make things worse.
• Preserve everything. Consent logs, tag manager change history, image sourcing records, SMS opt-in records, screenshots of the flows in question as they existed on the date of the claim.
• Check your insurance. Cyber, media liability and some general policies cover certain of these claims, and carriers often have panel counsel who handle them in volume.
• Fix the underlying issue promptly, through the same change process you’d use for any production work, so there’s a record of when and how it was remediated.
• Get a lawyer who has handled that specific claim type. Most of these categories have a well-worn resolution path, and experienced counsel knows what these matters actually resolve for.

The Prevention Checklist

The common thread across every category: these claims target patterns, and the patterns are detectable from the outside by automated scanning, which is exactly how targets get found. The baseline that removes you from most target lists:

• Consent management with verified pre-consent blocking, audited in the network tab quarterly
• WCAG 2.1 AA remediation work with records, not an overlay widget
• A license or provenance record for every image on the site
• Subscription flows with adjacent disclosures and online cancellation
• SMS consent records and a conservative sending window
• Subject lines that are literally true
• A periodic review of what third-party scripts run on pages with video
• Terms of service, including any arbitration clause, reviewed by counsel in the last two years

Again: general information, not legal advice. The landscape above shifts quarterly, courts are split on several of these theories, and what any of it means for your site depends on facts a blog post can’t see. What a website owner controls is the technical and editorial hygiene that determines whether the scanners find anything worth sending a letter about.