Pixel lawsuits went from 600 filings to 4,000
Adidas is fighting a California privacy suit after a federal court ruled its tracking pixels can qualify as illegal "pen registers." In June, the LA Times paid $3.85M to settle the same theory. Filings under this theory have jumped from 600 to 4,000 over the past 18 months, per testimony in the California legislature, set out in this summary of where CIPA website tracking law stands. The demand letters cost less than defending, which is the whole business model.
And this is no longer just a California story. Florida, Massachusetts, and Pennsylvania now treat stray trackers as wiretapping under their own state laws.
Why isn't a consent banner enough on Shopify?
Most stores getting caught aren't negligent. They have a banner and someone signed off on it. On Shopify especially, that isn't enough, and the reason is structural.
Shopify runs its own Privacy API and treats it as the source of truth for consent, so your store has three systems with an opinion about whether a pixel can fire:
- The consent banner
- The tags themselves
- Shopify's Privacy API
Each runs on its own clock, and Shopify controls the timing. On some page loads, a tag fires while the Privacy API is still waking up. Other times the banner records a choice that never gets applied.
Tuning the banner doesn't help, because the banner is one runner in a race it doesn't control. The gap between what your banner says and what actually fired is exactly what a plaintiff firm finds when they open DevTools.
Why we solved it in the event path
This kept coming up with EdgeTag customers over the past year. Legal wanted consent enforced, marketing didn't want to lose signal, and nobody could make Shopify's timing behave for either side. Since we already sit in the event path, we ended up solving it there.
Blotout Consent and EdgeTag now run as one layer. The banner, Shopify's privacy state, and your blocking rules resolve to a single answer before any tag fires, browser or server-side, and every held event is logged with the reason. That log is the paper trail you want if a demand letter shows up.
Legal sets the posture per market, and the events you're entitled to keep still flow, so Meta and Google keep optimizing on real data. Some customers who are live are seeing opt-outs drop 40%+.
Start by finding out if you have the problem
The first step is knowing whether you have the problem. We're running five consent audits in September, the same audit we've run on 300+ live storefronts. We drive your store through every consent state, record what fires and when, and walk you through the findings on a read-out call.
