Your Cookie Banner Won't Save You: Small-Site Lawsuits

Most founders I talk to worry about hackers. Fair enough. But the thing more likely to cost a small website money this year isn't a hacker in a hoodie. It's a demand letter from a law firm that found something on your site in about thirty seconds.

I want to walk through three areas where that happens a lot: tracking pixels, accessibility, and children's data. None of this is legal advice (talk to a lawyer about your specific situation), but all of it is checkable before you launch, and that's the point.

1. Tracking pixels that fire before anyone clicks "Accept"

A tracking pixel is a tiny piece of code from Meta, Google, TikTok and others that reports what visitors do on your site. Marketers love them. Plaintiffs' lawyers love them too.

In California, lawsuits have used the California Invasion of Privacy Act (CIPA), a law originally written for phone wiretapping, against websites that share visitor activity with third parties through pixels, cookies and session-replay tools. One law firm counted roughly 1,500 CIPA suits in the 18 months before August 2025, with statutory damages of up to $5,000 per violation on the table. Courts haven't all agreed on how far the law reaches, and California lawmakers have debated narrowing it, but the letters keep coming in the meantime.

Here's the part that catches people out: having a cookie banner isn't the same as waiting for consent. On a lot of sites the pixel loads the instant the page opens, before the visitor has touched the banner at all. The banner is decoration. The tracking already happened.

The fix is simple once you know to look:

• Open your site in a fresh private window, don't click anything, and look at the network requests. If you see calls to Facebook, Google Analytics, TikTok, Hotjar or similar before you've clicked "Accept," you have a problem.
• Click "Reject" and check again. Nothing should fire.
• Load tracking scripts only from your consent tool's "accepted" callback, never directly in your page's HTML.
• Respect the Global Privacy Control signal that some browsers send automatically.

This is now a standard test in every LaunchGate audit. We record every request your pages make before consent and keep the log as evidence. (For what it's worth, our own site loads zero third-party scripts, so there's nothing to consent to.)

2. Accessibility: the lawsuit that hits small businesses hardest

If someone who's blind or can't use a mouse can't get through your checkout, that's not just a lost sale. In the US it can be a lawsuit under the Americans with Disabilities Act. According to the law firm Seyfarth Shaw, 3,117 website accessibility lawsuits were filed in federal court in 2025, up 27% from the year before, and that doesn't count the many filed in state courts.

The uncomfortable truth is that almost everyone has work to do. WebAIM's annual scan of the top million home pages found detectable accessibility failures on about 95% of them. The most common problems are boring and fixable: text with too little contrast, images with no description, form fields with no label, buttons a keyboard can't reach.

A good website accessibility audit before launch checks the flows that matter most (sign up, log in, pay, contact) with a keyboard, with zoom turned up, and with a screen reader, against the WCAG 2.2 AA standard. Automated scanners help, but they can't tell you whether a real person can finish buying something. That takes a human actually trying.

3. Kids' data: the rules got stricter in 2025

If your app is aimed at children, used in schools, or likely to attract under-13s, the bar is higher. The FTC updated the Children's Online Privacy Protection Rule (COPPA) in 2025, and most companies had to comply by April 22, 2026. The changes include a written data-retention policy, a written security program, and separate parental consent before sharing children's data with third parties such as ad networks.

Saying "you must be 13 to use this app" in your terms doesn't solve it if your app is obviously built for kids. Education and kids' platforms need a real review, ideally before the first classroom signs up.

What these three have in common

Every one of these risks is invisible when you test your site the normal way, and every one of them is visible in minutes if you test on purpose. That's really the whole case for a pre-launch audit. You're not paying someone to find exotic problems. You're paying them to look at your site the way a plaintiff's lawyer, an attacker or a frustrated customer will, before those people do.

I'll be straight about the limits. An audit can't promise you'll never be sued, and it doesn't replace a lawyer. What it can do is close the obvious gaps, show you the evidence, and tell you which questions need a lawyer, an accountant or an accessibility specialist. At LaunchGate we never call a site "compliant." We tell you what we tested, what we found, and what still needs a professional's sign-off, because that's the honest version.

Protecting your customers' privacy and making your site usable for everyone isn't just about avoiding lawsuits. It's how you earn trust from the people you built the thing for.

Want to know where your site stands? Ask for a free launch check, or see what a full report looks like in our sample audit.