I spent part of last week doing something any of you can do without opening a ticket. I ran a handful of association websites through a free scanner and watched what their donation and member-login pages quietly handed to companies nobody at those organizations has spoken to in years. On one, a social advertising pixel fired the instant the donation form loaded. On another, a session-recording script sat watching the fields on the member profile page. Nobody chose that this year. Someone added a tag for a campaign in 2021, moved on, and it has been running ever since.
Here is the uncomfortable part. That forgotten tag is now one of the most legally exposed lines of code on the site, and it has almost nothing to do with your AMS, your data warehouse, or the architecture I usually go on about. It is the marketing plumbing at the edge of your stack, and it has quietly become the thing plaintiffs' firms screen for.
The reason is a set of laws that predate the web by decades. The California Invasion of Privacy Act was written in 1967 to stop wiretapping of phone calls.1 Courts now read it to cover third-party trackers on a website, and it carries statutory damages of $5,000 per violation, with plaintiffs arguing each visit is its own.2 That math is why more than 800 CIPA claims were filed in 2025 alone.3 In June a federal court gave final approval to a $3.85 million settlement against the Los Angeles Times over three trackers most readers would never have noticed.4
It is not only California, and not only that one statute. The Supreme Court agreed in January to decide whether the Video Privacy Protection Act, a 1988 law about videotape rentals, reaches people who merely sign up for a free newsletter on a site that runs a Meta pixel and shows video clips.5 If you send a newsletter and embed a webinar recording, that question is about you. Health regulators, meanwhile, warned roughly 130 hospital systems about pixels after finding a Meta tag on a third of the top 100 hospital sites, some inside password-protected patient portals.6 Kaiser Permanente settled one such case in December for $46 million, over trackers that shared the data of 13.4 million people.7 The American Hospital Association, headquartered a few blocks from where I write, is still in court over how far that guidance reaches.8
Associations sit squarely in the blast radius, because you run exactly the pages these cases are about. A donation form. An event-registration flow. A renewal page behind a login. A continuing-education portal that knows what someone studied. A newsletter that drops readers onto pages with embedded video. Every one of those is a place where a marketing tag can watch a member do something specific and report it to an advertising network. And the tags rarely arrive through a decision. They arrive the way the AI notetakers did, one well-meaning free account and one campaign at a time, until nobody can tell you what is running or who approved it.
This is a different problem from the one I wrote about when four states declined to exempt nonprofits from their privacy laws. That question, whether a statute even applies to you, is real and slow. The wiretapping theories do not wait for it, and they do not turn on your tax status. They turn on whether a third party received a member's activity without clear consent.
What to actually do this week
You do not need a warehouse, a consent platform, or a budget line to start. You need a browser and about two hours. Write down your transactional and logged-in pages: donate, register, renew, log in, member profile, anything that collects or confirms something. Run each one through Blacklight, the free scanner from the nonprofit newsroom The Markup. It lists the trackers, ad-network cookies, and any session-recording or keystroke monitoring a page loads, with no download and no account.9 For pages behind a login, open your browser's developer tools, watch the network tab, and submit the form yourself. You are looking for one thing: does a request go out to a company that is not you, the moment a member acts.
Here is how to read what you find.
| Where a tracker fires | What it can mean | What good looks like |
|---|---|---|
| Public donation or join form | A member's intent to give, sometimes the amount, is shared with an ad network before they consent to anything | No third-party ad or social tag on the form itself |
| A page behind the member login | Named, logged-in activity is tied to a real identity and sent onward | Only first-party analytics you actually control, if anything |
| The confirmation or thank-you page | The completed action, the most sensitive signal, is broadcast to marketing tools | No advertising pixels on confirmation pages at all |
| A session-recording script, anywhere | Keystrokes and form fields, sometimes including what people typed and then deleted, are captured | No session replay on any page that collects personal data |
The single most useful move is not technical at all, and it is one an executive director or COO can make without writing a line of code. Ask whoever owns the website a plain question: which third-party tags fire on our donation-confirmation and logged-in member pages, and who signed a data agreement with each of those companies? A good answer is a short, current list with names attached. A bad answer, and the one you should expect, is "marketing set those up," or a screenshot of a tag manager with thirty entries nobody owns, or silence. That silence is your finding. It means member activity is leaving the building on terms you never set.
None of this is the governed system of record I keep arguing associations need. That is the long game, and it is still right. This is the opposite of a capital project. It is subtraction. Most of these tags were added for a campaign that ended years ago, and the fix for the riskiest ones is to find them and delete them before lunch.
Quick takes
The cookie banner is not the shield people assume. Many of these tags fire before anyone clicks "accept," and the whole theory of the cases turns on prior, clear consent. A banner that loads trackers on page-load can end up documenting that you knew. Check whether yours actually blocks tags before consent, or just asks politely while they run.
It is not only the Meta pixel. The complaints name Google Analytics, chat widgets, and "pen register" trap-and-trace tools too, and the Los Angeles Times case turned on three trackers most people have never heard of. Do not scan for one logo. Scan for anyone who is not you.
Do not wait for the legislature. California's SB 690, which would have carved out a safe harbor for routine website analytics, has repeatedly stalled, so the private suits it aimed to curb keep coming. Whatever relief eventually arrives is unlikely to reach back and cover the tags running on your pages today.
Worth a read
Blacklight, from The Markup. Run your own donation and login pages through it first, then read how they built the scanner and what they found across the web.
The FTC and HHS joint warning on tracking technologies. The clearest official statement of why a pixel on a sensitive page is a problem, written for organizations, not lawyers.
A year in review of Video Privacy Protection Act litigation. If you send newsletters and host video, this is the trend line the Supreme Court is now weighing in on.
My guess is that within a year, scanning your own pages becomes as routine as the annual security review, not because the sector got enlightened, but because a peer got a demand letter first. The cheaper version is the one where the only person looking at the results is you.
Quick answers
What is a tracking pixel, and why is it suddenly a legal problem?
A tracking pixel is a small piece of third-party code, usually from an advertising or analytics company, that reports what visitors do on your site back to that company. It has been common for years. The change is legal, not technical: courts are applying old wiretapping and video-privacy laws to these tools, and several carry fixed statutory damages per violation, so a tag on a busy page can add up to real exposure.
How do I check my own association's site without involving IT?
Run your key pages, especially your donation, registration, renewal, and login pages, through Blacklight, a free web scanner from the newsroom The Markup. It needs no download or account and lists the trackers each page loads. For pages behind a login, open your browser's developer tools, watch the network tab, and submit the form yourself to see what gets sent and to whom.
We have a cookie consent banner. Doesn't that cover us?
Not by itself. The theory in many of these cases is that trackers fired before the visitor gave clear consent, so a banner that loads tags on page-load while asking permission can make things worse, not better. What matters is whether your setup actually blocks third-party tags until someone agrees, and whether you can prove it. A banner that only asks politely is not a control.
From the Mind of Ravi Rooprai is a weekly column on association tech, data, and AI. Read the perspectives for the longer arguments behind it.
Researched with AI assistance and fact-checked against primary sources. The analysis, judgment, and writing are mine. How this column is made →