The Demand LetterEconomy.

The legal system has been quietly automated against your website. Four civil-rights and privacy statutes -- ADA, California's Unruh Act, California's Invasion of Privacy Act, and the federal Video Privacy Protection Act -- share a single feature that makes them irresistible to plaintiff firms: the plaintiff doesn't have to prove harm. The violation itself is the harm, by law. That feature, combined with cheap automated scanning, has produced an industrial pipeline of demand letters, settlements, and quiet payouts from businesses that mostly don't know what hit them.

This briefing is for the people on the receiving end -- small business owners, founders, marketing leads, and the lawyers who get the panicked phone call after the FedEx envelope arrives. It explains the four legal regimes in plain language, walks through the playbook used against businesses, and lays out the actual economics. It is informational, not legal advice.

How to read this

Each chapter opens with the statute, what plaintiffs must prove, and what the defense looks like in practice. Real cases are cited with primary sources. Margin notes flag the numbers and quotes worth remembering.

A demand letter is a private settlement shakedown sent before a lawsuit is filed. A law firm scans your site with an automated tool, identifies a violation of a statute that carries statutory damages, and sends you a letter saying, in effect: 'We have a client who visited your site. We documented X violations. Each entitles our client to $Z. Multiplied by the affected class, your exposure is in the seven figures. We'll settle for $YY,YYY if you sign within 30 days. Otherwise, we file.'

The letter usually arrives by FedEx or certified mail, on real letterhead, with a real bar number, with screenshots and network captures attached. It is not spam. Ignoring it gets you sued.

Why it works as a business model

The mechanism is statutory damages. Under most consumer-protection statutes, plaintiffs must prove they were actually harmed in some way -- lost money, suffered emotional distress, missed an opportunity. Statutory damages skip that step entirely. The legislature has decided in advance that violating the statute is itself a compensable harm, and set a fixed dollar amount per violation. Multiply by the alleged class size and the exposure number on the demand letter routinely runs into seven figures.

The settlement number is always smaller than the projected exposure. That's the trade plaintiffs offer: pay a known five-figure sum now, or roll the dice on a seven-figure number later. Almost everyone pays.

A blind, deaf, or motor-impaired user -- or a 'tester' with a long history of suing -- cannot navigate your site with a screen reader, keyboard, or captioning. Their lawyer files. The plaintiff's burden is light: prove a qualifying disability, prove your business is a 'place of public accommodation' (in California state court, simply selling things online is enough), and prove they encountered a barrier -- an unlabeled button, a missing alt text, a keyboard trap, an uncaptioned video. They do not have to prove they intended to buy anything. They do not have to prove damages.

Under California's Unruh Act, every visit to an inaccessible page is a separate $4,000 violation. Multiply by twelve months of California traffic and the math gets ugly fast.

Why New York is the preferred venue

Plaintiff firms forum-shop into New York City for two reasons. First, NYC Administrative Code §8-502 allows public-accommodation plaintiffs to recover punitive damages plus attorney's fees, with a 3-year statute of limitations. NY State HRL does not allow punitives in public accommodation cases -- only NYC's law does. Second, NYC Admin. Code §8-126 sets civil penalties at $125,000 per violation, doubled to $250,000 for willful violations.

California's numbers look smaller in federal statistics not because there are fewer suits, but because Unruh suits go to state court and don't show up in federal filing counts.

California's Invasion of Privacy Act was written in 1967 for telephone wiretaps. Plaintiff firms argue that when your site loads a third-party tracking pixel (Meta, TikTok, Google), a session-replay tool (Hotjar, FullStory, Microsoft Clarity), or a chat widget that pipes conversations to a vendor, you're 'wiretapping' the visitor by routing their interactions through a third party without consent.

The plaintiff has to prove only three things: they visited from California, a third-party tracker fired during their session, and they didn't consent. All three are trivially documented in browser developer tools.

The damages: $5,000 per violation, no actual harm required, plus attorney's fees. This is the fastest-growing category of website litigation, and the one most small-business owners have never heard of.

The dominant troll firms

Pacific Trial Attorneys (Scott Ferrell) focuses on chat-widget wiretap claims; demands typically run $10,000-$75,000 depending on traffic and class size estimates. Bursor & Fisher brings broader pixel and tracking class actions, including Lesh v. CNN, which alleges CNN's site functions as an illegal "trap and trace" device merely by capturing visitor IP addresses.

A 1988 federal law passed after a journalist published Robert Bork's video-rental records. Plaintiff firms revived it for the streaming and Meta-Pixel era. Any site that (a) shows pre-recorded video and (b) loads Meta Pixel on the page where the video plays is on the hook. The pixel transmits the user's Facebook ID along with the video URL, which plaintiffs argue is a knowing disclosure of 'video viewing records' to a third party.

To prevail, the plaintiff must prove three things: that the defendant is a "video tape service provider" (case law has stretched this to any site offering pre-recorded video), that the plaintiff was a "subscriber" (a newsletter signup is sufficient in most circuits), and that the defendant knowingly disclosed personally identifiable information plus what video the plaintiff watched, to a third party.

Liquidated damages: $2,500 per violation, plus punitives and attorney's fees.

GDPR and the U.S. state privacy laws (CalOPPA, CCPA, VCDPA, CPA, TDPSA) are the lower-acute, higher-regulatory track. Critically, the state privacy laws are attorney-general only with cure periods. They are not direct lawsuit risk like ADA, CIPA, and VPPA. The framing for prospects is different but the cost can still be steep.

GDPR (Europe)

Applies if your site has any EU visitors and you handle their personal data. Penalty ceiling: €20M or 4% of global annual turnover, whichever is higher. The "demand letter" analog is privacy NGOs -- most prominently NOYB, Max Schrems' organization -- filing complaints with EU data protection authorities.

CCPA private right of action

Only $750 per incident, and only for actual data breaches involving statutorily-defined personal information. Limited demand-letter risk. Unlike CIPA, there is no general private right of action under CCPA for tracking violations.

VCDPA / CPA / TDPSA

Virginia, Colorado, and Texas privacy laws all share the same basic structure: AG-only enforcement, with a cure period before penalties attach.

Every step has a cost and a clock. This is the timeline a small business owner walks through, in compressed form.

It is tempting to villainize one side or the other -- the noble disabled plaintiff who was actually shut out of a service, or the cynical lawyer running a litigation factory. The reality is messier and, for the receiving business, irrelevant.

The legitimate end

A blind retiree in Brooklyn who can't book a hotel for her grandson's wedding because the booking page is unusable with a screen reader. She files suit, the hotel pays a settlement and fixes the site, and every blind user benefits. The mechanism Congress designed in 1990 is doing exactly what it was supposed to do.

The troll end

A law firm runs a script overnight against 50,000 small business websites. By morning it has 8,000 with WCAG violations. Paralegals draft near-identical demand letters with names swapped in. Settlements average $12,000 -- roughly $96M in annual revenue, with marginal cost approaching zero per case.

The blurry middle

Most cases sit between. The plaintiff is real and was really turned away by an inaccessible site -- and is on retainer with a firm that finds them new sites every week. Each case is colorable on its facts. Each case is part of a pipeline.

Most small business owners think: 'I haven't done anything wrong, so I can't be sued.' Two facts dismantle that assumption.

Statutory damages are the entire point. The plaintiff doesn't have to prove they tried to buy your product, were upset, or lost anything. The violation is the harm, by statute. This is fundamentally different from how most civil litigation works, and it is what makes the demand-letter pipeline economical at scale.

Plaintiff firms run scanners against tens of thousands of sites a month. There is no "I'm too small to notice." Small sites with obvious issues are preferred targets -- they settle faster, cheaper, and without the friction of corporate legal departments.

The legal system has been quietly automated against you. The only defense is to automate the inspection on your side first.

The audit doesn't make you "compliant" in any binding legal sense -- no automated scan can. What it does is give you the same list the plaintiff's scanner is going to produce, before they hit "send" on the demand letter. Once the list is in your hands, the issues are fixable. Once it's in their hands, it's a settlement.