PRIVACYTROLLSHIELD GitHub ↗

Evidence console Open source · MIT Runs locally

Find Your Tracking Vulnerabilities Before the Plaintiffs Do

PrivacyTrollShield is a new open-source scanner that finds the website tracking misconfigurations plaintiffs' attorneys are turning into wiretapping lawsuits — before the demand letter arrives.

In 2024, plaintiffs' attorneys filed 1,853 wiretapping lawsuits over tracking misconfigurations. Each violation is a $5,000–$50,000 claim under California's Invasion of Privacy Act — and plaintiffs don't have to prove they were harmed.

Scan your site → View sample report $ free · open source · your data never leaves your machine
privacytrollshield — evidence capture · dossier PTS-2026-0610-A REC
    chain of custody: request log + screenshots captured: local headless browser format: HTML / JSON

    FILE 02 The Threat

    Privacy-troll litigation is industrialized.
    Your website is the evidence.

    1,853
    Wiretapping lawsuits filed in 2024
    Against companies over tracking misconfigurations: session replay loading before consent, Meta Pixels capturing form data, "Decline" buttons that don't actually decline.
    $5,000–$50,000
    Per violation, under CIPA § 631 [1]
    California's Invasion of Privacy Act sets statutory damages per violation — and claims arrive at volume, often as demand letters priced just below the cost of defending.
    0
    Harm plaintiffs must prove [1]
    Plaintiffs don't have to show they were injured — only that the statute was violated. Most targets had no idea they were vulnerable until they got served.

    The plaintiff bar has automated target discovery. Firms scan thousands of websites for the same misconfigurations, then send demand letters and file suits at volume. Small businesses are common targets — 1,500+ businesses were sued in an 18-month span, and 1,560+ suits have been filed across 28 states since 2022, 83% of them under CIPA.[4]

    The courts widened the door in 2025. In Mikulsky v. Bloomingdale's (9th Cir. 2025), the appeals court expanded potential liability for session replay tools — software that millions of websites run today.[2]

    PrivacyTrollShield turns the same automated techniques plaintiffs' firms use to find targets into a free defensive tool. Fixing these issues protects both your company and the visitors whose data was leaking.

    FILE 03 Method of Capture

    A real browser. A real "Decline" click.
    A record of everything that fires anyway.

    Load

    The scanner launches a real headless browser against your site and captures every network request — before any consent interaction happens.

    Decline

    It finds your cookie banner and clicks "Decline" itself, exactly like a privacy-conscious visitor — or a plaintiff's expert — would.

    Observe

    Then it watches what keeps firing anyway: pixels, session recorders, form-data collectors — each request logged with evidence.

    Grade

    Every finding is graded by litigation risk — CRITICAL / HIGH / MEDIUM / LOW — and linked to the specific law and court case behind it.

    Core check It compares what your site actually does versus what your consent banner promises.

    FILE 04 Findings Catalog

    What it finds

    Session replay, tiered by what it captures

    CRITICAL

    Flags Hotjar, FullStory, Microsoft Clarity, Mouseflow, and Lucky Orange. Form-input capture is CRITICAL — courts ruled it constitutes wiretapping under CIPA § 631 (Mikulsky v. Bloomingdale's, 9th Cir. 2025). Navigation-only recording is MEDIUM (Yoon v. Lululemon).

    CIPA § 631 · FSCA § 934

    Pre-consent trackers

    HIGH

    Detects 40+ trackers firing before consent, matched against known signatures plus the industry-standard EasyPrivacy list.

    GDPR · ePrivacy · CCPA/CPRA

    Form data & search leakage

    CRITICAL

    Catches form data and search queries leaking to third parties — including keystroke logging that captures input before the user ever hits submit (HubSpot Collected Forms, Hotjar input capture).

    CIPA § 631 · wiretap theories

    Consent verification

    HIGH

    Verifies whether declining consent actually stops anything, with per-tracker compliance detail — including Google Consent Mode v2 handling.

    GDPR · ePrivacy · "Decline" that declines

    Video player VPPA exposure

    MEDIUM

    Detects YouTube embeds not in privacy-enhanced mode and Vimeo players without Do-Not-Track — the misconfigurations behind video-viewing-history claims.

    VPPA (US Federal)

    Compliance elements & coverage

    LOW

    Checks for "Do Not Sell" links, Global Privacy Control (GPC) support, privacy policy disclosures, and DSR portals. Spiders entire sites to find forms, maps data flows, scans domains in batch, compares scans over time, and captures screenshots for evidence documentation.

    CCPA/CPRA · CalOPPA
    HotjarFullStoryMicrosoft ClarityMouseflowLucky OrangeMeta PixelGoogle AdsLinkedIn InsightTikTok PixelTwitter PixelGoogle AnalyticsAdobe AnalyticsMixpanelAmplitudeHeapHubSpotMarketoPardotSalesforceIntercomDriftZendeskLiveChat

    FILE 05 Statutes on File

    Laws covered

    LawJurisdictionAngle
    CCPA/CPRACaliforniaDo Not Sell link, GPC, policy disclosures
    CIPA § 631CaliforniaSession replay/form interception = wiretapping
    VPPAUS FederalVideo viewing history
    GDPREUCookie consent, data subject rights
    ePrivacyEUPrior consent for non-essential cookies
    BIPAIllinoisBiometric data consent
    FSCA § 934FloridaSession replay / pixel interception
    CalOPPACaliforniaPrivacy policy requirements

    jurisdiction profiles: global eu uk us us-ca brazil

    FILE 06 Sample Output

    The report reads like the exhibit it might become.

    ASCII data-flow map · which third parties receive what 
    example-store.com
 ├─ checkout form ──────────────┐
 │   name, email, keystrokes    │
 │   └──▶ ws.hotjar.com        [CRITICAL]
 │   └──▶ facebook.com/tr      [CRITICAL]
 ├─ search box
 │   query terms
 │   └──▶ px.ads.linkedin.com  [HIGH]
 ├─ /products video
 │   viewing history
 │   └──▶ youtube.com          [MEDIUM]
 └─ pageviews
     └──▶ google-analytics.com [LOW · gated]

    Output formats: HTML report dashboard · JSON · console text report · ASCII data-flow map · batch summary JSON

    FILE 07 Begin Capture

    Self-audit in minutes, from your laptop.

    Existing compliance tooling is enterprise-priced. PrivacyTrollShield is MIT-licensed, built on Python 3.8+ and Playwright, and runs entirely on a machine you control.

    ~/quick-start.sh · 5 lines to first report 
    $ git clone https://github.com/atekippe/privacytrollshield.git
$ cd privacytrollshield
$ python3 -m venv venv && source venv/bin/activate
$ pip install -r requirements.txt && playwright install chromium
$ python3 privacytrollshield.py https://example.com --html report.html

    Also usable as a Python library: from privacytrollshield import PrivacyScanner — full docs in the README.

    FILE 08 Questions on Record

    FAQ

    Is this legal advice?

    No. PrivacyTrollShield is for informational purposes only and does not constitute legal advice. Consult a qualified privacy attorney for compliance guidance specific to your situation.

    Is it free?

    Yes — free and open source under the MIT license. Clone it, run it, audit the code, contribute back.

    Does my data leave my machine?

    No. The scanner runs locally in a browser you control. Your scan targets, results, and evidence never leave your machine.

    APPENDIX Verified Sources

    1. CIPA $5,000/violation statutory damages, no harm required: varnumlaw.com — The Rise of CIPA Website Tracking Claims · americanbar.org — California's Invasion of Privacy Act · truevault.com — California Wiretapping Lawsuits · Cal. Penal Code § 631 (statute)
    2. Mikulsky v. Bloomingdale's (9th Cir. 2025): duanemorris.com — Reversal Expands Potential Liability for Companies Using Session Replay
    3. Yoon v. Lululemon: fkks.com — Session Replay Software Does Not Violate CIPA (navigation-only)
    4. Litigation volume: darrow.ai — 1,560+ suits across 28 states since 2022, 83% CIPA · duanemorris.com — 1,500+ businesses sued in 18 months
    5. 2024 litigation landscape: wilmerhale.com — Year in Review: 2024 Web Tracking Litigation and Enforcement