Small Businesses Are Getting $10,000 Letters Over Their Own Websites

A solar and electrical company in Dixon, California has been in business for twenty years. Last month the owner posted a short video online, visibly shaken, because the business was being sued. Not by a customer. Not by anyone they had ever met, called, or emailed. They were being sued by strangers, over their website, and the claim was that the website had “wiretapped” the people who visited it.

That word sounds absurd for a small contractor’s website. It is also, under a decades-old California law, a real legal argument that is being used to extract thousands of dollars from small businesses every week. And the uncomfortable truth is that the website you are reading this on, and the one your own business runs, very likely has the exact setup these claims are built on.

This is not meant to scare you into a panic. Let me be honest about the odds up front: for any one small business, the chance of getting hit in a given year is low. But the letters are real, they cost five figures to make go away, and the people sending them run automated tools that scan the web looking for precisely the mistakes most small business websites make. Knowing about it and spending twenty minutes to close the hole is cheap. Finding out the hard way is not.

It is not bad luck. It is an industry.

The scale of this is the part most owners do not realize. In 2025 there were 3,117 federal lawsuits filed over website accessibility alone, up 27 percent from the year before, and the first quarter of 2026 was already on pace to beat it. That is just one of the two waves. The other, the “your website tracked me without consent” wave, went from a few hundred cases in 2023 to thousands, and litigation trackers estimate the large majority of those come from a small handful of law firms that have turned it into a repeatable, high-volume business.

Two things stand out from the data. First, this is aimed squarely at small operators: roughly two thirds of the businesses sued make under $25 million a year. Second, it is concentrated. A tiny number of firms and repeat plaintiffs file the overwhelming majority of these cases. They are not reviewing your business. They are running a machine.

If you want to see what that machine does to a real street of ordinary businesses, a local paper in Hermosa Beach documented a cluster of them: a restaurant that paid $18,000 over a counter a handyman fixed in three hours, businesses sued twice, five-figure settlements up and down the block. 60 Minutes ran a whole segment on the same phenomenon, calling them “drive-by lawsuits.” None of it is our reporting. It is all out there, from mainstream outlets, and you can read it yourself.

How the machine finds you

Here is the part that makes owners angry, because it is so impersonal.

An automated scanner loads thousands of websites and records what each one does the instant the page opens, before the visitor clicks anything. If your site quietly sends data to Facebook, Google, TikTok, or a chat or session-recording tool the moment someone lands, before they have agreed to anything, the scanner flags it. A template complaint gets filled in. The demand that follows is deliberately priced just below what it would cost you to hire a lawyer and fight, so paying quietly “feels” like the smart move.

And then the worst part: once you pay, you are marked as a business that pays. You go on a list, and the letters can come again.

Nothing about this is illegal. That is exactly why nobody has been able to stop it. The people doing it are using laws that are already on the books. It is not right, but it is legal, and that means the only person who can protect your business is you.

How to check and fix yours, for free

I am going to give you the fix that costs nothing before I tell you about the one we sell, because the free version is real and you should do it either way. You do not need us for any of this.

If your site runs a Facebook (Meta) pixel, Google Analytics, or a TikTok pixel. This is the number one trigger. You have two free options. Remove them if you are not really using the data. Or, if you want to keep them, put them behind a consent banner that actually blocks them until the visitor agrees. Read that last part twice: a banner that pops up but lets the trackers fire anyway is not protection, it is now its own category of lawsuit. There are free, open-source consent tools that do the blocking properly. Whoever manages your site can install one.

If you have live chat or session recording (tools that record what visitors type or how they move the mouse): these carry the highest risk for the least benefit on a small trades site. Remove them, or put them behind that same consent step.

If you have no privacy policy, add one that honestly describes what your site actually collects. For any site that gets California visitors, a conforming privacy policy is expected regardless of how small you are. Free generators exist. The only rule is that it has to match what your site really does.

For accessibility, run a free automated check with Google Lighthouse (built into the Chrome browser) or WAVE, then fix the easy, high-impact things: image alt text, labels on form fields, color contrast, and being able to move through the page with a keyboard. Be aware that automated tools catch only about half of the real issues, so this reduces your exposure rather than eliminating it.

One warning that could save you a bad purchase. Do not buy an “accessibility overlay” widget believing it makes you safe. The FTC fined the largest one $1 million for claiming its product makes websites compliant, and more than a thousand businesses that installed such widgets got sued anyway. There is no line of code you paste in that makes this go away.

And if a letter ever does arrive: do not ignore it, tell your insurance broker within about thirty days (many policies now require fast notice and exclude these claims otherwise), and talk to a lawyer. We build websites. We are not a law firm and none of this is legal advice.

Do those things and you have closed the biggest hole for nothing. If that is all you take from this article, good. I mean that.

Fixing it is only half the job

Here is the honest catch. Stripping the trackers stops the bleeding, but it leaves you with the same website you already had, the one that probably was not winning you much work in the first place. You have removed a risk. You have not gained anything.

The businesses that come out of this ahead do not just patch the old site. They use it as the moment to replace it with something built for how people actually find a tradesperson now, because that has quietly changed more in the last two years than in the ten before it.

What a website built for 2026 actually looks like

More and more people are not scrolling through ten blue links anymore. They ask Google’s AI answer, or ChatGPT, “who is a good roofer near me,” and they take the handful of names it gives back. If your website is not built so those systems can read it and recommend you, you are simply not in the conversation, no matter how good you are at the actual job. Soon they will not just be reading either. People are starting to let an assistant do the legwork, and that assistant needs a site it can actually work with to get you the quote request.

That is the kind of website we build. In plain terms, it is:

• Built to be found by AI, so Google’s AI answers and ChatGPT can surface you when someone nearby is looking, which is the new front page of local search.
• Ready for the assistants that are starting to browse and book on people’s behalf, so you get handed the job instead of skipped.
• Fitted with a simple lead system that is yours. When someone fills in your form, it lands in a clean little app and your phone buzzes right away, so you can call them back before your competitor does. No spreadsheet, no logging in to five different tools. The obvious junk, the bots and the endless “we can rank your website” pitches, is kept out of your way so what you see is what could turn into a job.
• Compliant by design, with the consent and accessibility work from the free section above built into the code from the start, not bolted on with a widget.

And the part that matters most to a small business: it is a one-time build that you own. No monthly fee, no hosting bill, no maintenance contract. It runs on accounts that are yours, which we set up for you, and the only thing you ever pay after that is your domain name, around fifteen dollars a year. If you never speak to us again, it keeps working and it stays yours.

Does this actually move the needle?

Fair question, and you should not take it on faith. Take a gardener in Barnet, North London, whose only advertising was the van parked outside the job. No paid ads, no separate SEO campaign, just a new website built the way I described above. In our Semrush analysis he went from position 20 on Google to number 4, he started getting cited by ChatGPT for his area, and his first lead came in within minutes of the site going live.

That is a whole story on its own, with the before-and-after and the real numbers, so we wrote it up separately.

If you take one thing from this article, let it be the free fix. Do it this week, or send it to whoever runs your site. And if at some point you would rather have the whole thing handled, and own a website that actually brings you work instead of just sitting there as a liability, that is exactly what we do.