Website visitor identification is widely used in the United States, and it is not a legal free-for-all. Privacy laws, wiretap laws and outreach rules all apply, and lawsuits over website tracking pixels are active. This guide covers what a service business should know before installing a visitor identification pixel and before contacting anyone it identifies. It’s general information, not legal advice; talk to your attorney about your situation.
Key Takeaways
- There is no single federal privacy law covering website visitor identification. State laws, wiretap statutes and outreach rules fill the gap.
- Lawsuits under California’s wiretap law over website pixels are common, with statutory damages of $5,000 per violation.
- Disclose tracking in your privacy policy, honor opt-outs and consider consent before tracking scripts fire.
- Outreach is a separate set of rules: CAN-SPAM for email, the TCPA for calls and texts.
How visitor identification works, and why the law cares
A visitor identification pixel is a script on your website that sends information about each visit to a provider, which matches it against an identity network. When there’s a match, you receive the visitor’s contact details and browsing behavior.
Two things draw legal attention. The first is the collection and sharing of personal information, which privacy laws regulate. The second is a third party receiving information about a visit while it happens, which plaintiffs’ lawyers have argued amounts to wiretapping or eavesdropping under some state laws.
Federal rules
The U.S. has no comprehensive federal privacy law that governs website tracking. The federal laws that matter most for visitor identification govern what you do with the data afterward:
- CAN-SPAM sets rules for commercial email: honest sender information and subject lines, identifying the message as an ad, including a physical mailing address, and honoring opt-out requests within 10 business days.
- The Telephone Consumer Protection Act (TCPA) restricts marketing calls and texts. Marketing calls and texts to mobile phones using automated technology or prerecorded messages generally require prior express written consent, and the National Do Not Call Registry applies. TCPA penalties are steep, so treat calling and texting identified visitors with extra caution.
- The FTC Act prohibits unfair and deceptive practices, which includes saying one thing in your privacy policy and doing another.
State privacy laws
California’s Consumer Privacy Act, as amended by the CPRA, applies to businesses that meet any of its thresholds: annual revenue above roughly $25 million (adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning half or more of revenue from selling or sharing personal information. Covered businesses must disclose what they collect, honor requests to opt out of the sale or sharing of personal information, and generally provide a “Do Not Sell or Share My Personal Information” link.
Around 20 states now have comprehensive privacy laws with their own thresholds and opt-out rights. Many small service businesses fall below these thresholds, but the providers they work with often don’t, and the rules on disclosure and opt-outs are worth following either way.
Wiretap and pixel lawsuits
This is the area of real risk right now. Plaintiffs have filed large numbers of class actions claiming that tracking pixels, chat widgets and session-recording tools violate the California Invasion of Privacy Act (CIPA), which provides statutory damages of $5,000 per violation, as well as similar laws in states like Pennsylvania and Florida and the federal Wiretap Act. Courts have split on many of these claims, but defending one is expensive regardless of the outcome.
The common thread in these cases is tracking that starts before a visitor has meaningful notice or a chance to say no. That points to the main ways to reduce risk.
How to reduce your risk
- Disclose it. Your privacy policy should say plainly that you use visitor identification and other tracking technologies, what you collect and who you share it with. Make sure what the policy says matches what your site actually does.
- Consider consent before the pixel fires. A cookie banner alone doesn’t help if trackers load before the visitor clicks anything. A consent tool that holds non-essential scripts until the visitor opts in, at least for California visitors, is the strongest protection.
- Keep it off sensitive pages. Don’t run identification on pages where people submit health, financial or other sensitive information, and don’t capture form-field contents.
- Honor opt-outs everywhere. Suppress anyone who asks not to be tracked or contacted, across every list and channel.
- Ask your provider hard questions. How is the data sourced? Is it consent-based? How are opt-outs handled? Does it resolve visitors outside the U.S.?
- Follow the outreach rules. CAN-SPAM for every email, TCPA consent before calls and texts, and suppression of existing customers and do-not-contact lists.
- Talk to your attorney, especially if you get a lot of California traffic or work in a regulated field like healthcare, finance or law.
What about visitors outside the U.S.?
Europe’s GDPR generally requires consent before identifying individuals through tracking. Most person-level identification products focus on U.S. visitors. If you serve customers in Europe or Canada, get specific advice before using any identification tool on that traffic.
FAQ
Do I need to tell visitors I’m using visitor identification?
You should. Your privacy policy should disclose the tracking technologies you use, and saying one thing while doing another can create liability under consumer protection laws.
Can I call or text people identified on my website?
Be careful. The TCPA generally requires prior express written consent for marketing calls and texts to mobile phones using automated technology, and the Do Not Call Registry applies. Email under CAN-SPAM rules is usually the safer starting point.
Does a small business need to comply with the CCPA?
Only if it meets one of the CCPA’s thresholds, which many small service businesses don’t. Wiretap claims, outreach rules and consumer protection laws still apply regardless of size.
Conclusion
Website visitor identification can be done responsibly: disclose it, get consent where it matters, keep it off sensitive pages, honor every opt-out and follow the outreach rules. Ronin sets every website visitor identification client up with privacy policy language, suppression and compliant follow-up. This article is general information, not legal advice. To see who’s visiting your site, start a free trial at ronincomms.com/data-as-a-service.
About the author
Justin Smith is the founder of Ronin Communications, a fractional CMO practice for owner-led businesses. He spent more than 20 years writing and leading strategic communications for the federal government and holds an M.A. in Strategic Communications from American University.