Your app fires a tracking pixel before anyone consents

You asked the AI to "add Facebook ads tracking" or "add analytics" or "add session recording so I can see what users do". It pasted a Meta pixel, a TikTok pixel, Hotjar, or Microsoft Clarity into the page head, and those scripts now run for every visitor the instant the page loads. There is no banner, no choice, and no mention of any of it in a privacy policy. In California that pattern has become its own category of demand letter, and it is visible from the outside in about ten seconds.

Why this is the one the letters lead with

The California Invasion of Privacy Act (CIPA) is a 1960s wiretap statute that plaintiff firms have been applying to websites since roughly 2022. The theory: a pixel or session recorder that captures what a visitor does and sends it to a third party, before the visitor agreed, is an unauthorized interception, and a tracking pixel that fingerprints the visitor's device is an unregistered "pen register". CIPA carries statutory damages of $5,000 per violation, and the letters lead with that number. Courts are split on how far the theory goes, but you do not get to argue that in a demand letter; you get to decide whether to pay or hire someone to respond.

Session recorders are the worst case because they capture keystrokes and form fields, which can include a visitor's email, address, or a support message. Ad pixels are next because Meta and TikTok match the event data to a real identity on their side.

For EU visitors the same setup violates the ePrivacy rules and GDPR consent requirement, which is why every serious cookie banner exists. And if the pixel fires on a health, finance, or dating app, add sector rules on top.

Confirm it in two minutes

1. Open your deployed app in a private window so nothing is cached, and do not click anything.
2. Open the browser developer tools (right click, Inspect) and go to the Network tab. Reload the page. Type facebook in the filter, then tiktok, then hotjar, then clarity. Any request to connect.facebook.net, analytics.tiktok.com, static.hotjar.com, or clarity.ms on a fresh load, before you accepted anything, is the problem.
3. Quicker version: view the page source (Ctrl-U or Cmd-Option-U) and search for fbq(, ttq.load, hj(, or clarity(. If the call sits in the page head with nothing gating it, it fires for everyone.
4. Now look for a consent banner. Not a "we use cookies" notice with an OK button that changes nothing. A real banner blocks the scripts until the visitor accepts. If you saw the requests in step 2 with no banner, or with a banner that had not been clicked yet, the banner is decorative.

First question: do you actually use it?

A lot of AI built apps carry a pixel that no ad campaign ever used, or a Hotjar snippet the builder added "for insights" that nobody has opened since. If you are not running ads and not reading recordings, delete the snippet. That is the whole fix, and it removes the exposure entirely instead of managing it. Tell your builder: "Remove the Meta pixel and the Hotjar script from every page. Do not replace them with anything."

The fix if you do need it, under an hour

1. Gate the scripts behind consent, for real. The pixel and recorder must not load until the visitor clicks accept. A banner that shows while the scripts already fired gives no cover. For Lovable, Bolt, or v0, this prompt works: "Add a cookie consent banner. Do not load the Meta pixel, TikTok pixel, Hotjar, or Clarity scripts until the visitor clicks Accept. Store the choice in localStorage. If they click Decline, never load them. Add a Cookie settings link in the footer that reopens the banner." Then verify with the Network tab that nothing tracking related fires on a fresh load until you click Accept.
2. Or use a consent manager that does the blocking. Cookiebot, CookieYes, Termly, Osano, and iubenda all have free tiers and all can auto-block known tracking scripts until consent. The important setting is auto-blocking or "prior consent", not just showing a banner. Follow their install instructions, then re-run the Network tab test.
3. Turn off keystroke capture in session recorders. Hotjar and Clarity both mask form input by default, but AI generated setups sometimes turn it off or add custom attributes. Check the tool's privacy settings and make sure form fields, and any element showing personal data, are masked.
4. Disclose it in the privacy policy. Name the tools (Meta, TikTok, Hotjar, Clarity, Google Analytics), what they collect, and how to opt out. If you have no privacy policy at all, start with that guide; it is a bigger gap than the pixel.
5. Re-test as a stranger. Private window, fresh load, Network tab, no clicks: zero tracking requests. Click Accept: they appear. Click Decline: they do not. That is the state that holds up.

Do not do this

Do not add a banner that says "By using this site you agree to cookies" while the scripts fire anyway. It advertises that you knew and did nothing, and it is what a letter will screenshot. Do not set the consent default to accepted. Do not rely on a Google Analytics "consent mode" setting to cover a Meta pixel; it does not.

Related exposure the same audience ships

The same page that has a pixel without consent usually has no privacy policy either, which is its own statute (CalOPPA) and its own guide. And if the AI skipped alt text on most of your images, that is the ADA accessibility category, covered in the alt text guide. If you also added an AI chat widget, the same wiretap theory reaches recorded chats: see the AI chatbot guide. All three are checked from the outside in seconds, which is how the letter mills find small apps.

Not sure what your app is exposing?