Vitki Data · briefing · No. 01

The Demand Letter Economy.

An automated litigation pipeline is suing tens of thousands of small business websites every year. What it costs. Who's behind it. And the only thing that prevents it.

Download briefing PDF → Run a scan of your site

22 pages · 7 MB · no signup · primary sources cited

What's inside

01

What a demand letter actually is

Statutory damages, no proof of harm required, and why the math works for plaintiff firms.

02

ADA & California Unruh

3,117 federal lawsuits in 2025. Why New York City is the preferred venue.

03

CIPA — California pixel & replay suits

A 1967 wiretap statute weaponized for the Meta Pixel era. The closing window before SB 690.

04

VPPA — video tracking suits

AARP $12.5M, CBN $4M, Limited Run Games $2.7M. The pattern that hits any video page with a pixel.

05

GDPR & state privacy

CalOPPA, CCPA, VCDPA, CPA, TDPSA — the regulatory track. AG enforcement and cure periods.

06

After the letter arrives

Day-by-day timeline. $45-75K typical first-offense cost.

07

Plaintiffs vs. trolls

The blurry middle. Why the distinction is irrelevant to the receiving business.

08

The mental model owners are missing

No proof of harm required. No targeting required. The defense has to be technical, not legal.

09

Sources & primary references

Every statute and case citation, with primary-source URLs.

Why we wrote it

Vitki Data builds an automated scanner that runs the same kinds of checks plaintiff firms use to build demand letters — but delivers the report to the business owner instead. While building it, we had to learn how the whole pipeline works. The numbers are uglier than most owners realize. This briefing is what we wish someone had handed us first.

It is informational, not legal advice. Every statute and case citation has a primary-source URL on the final page.

Want to see your own site's grade?

The quick scan runs the same lens stack on your homepage and emails a 1-page report with your risk grade and the top 5 issues. Under an hour, no signup beyond URL and email.

Run scan →