The agency set up the campaign. The agency installed the pixel. The agency managed an ad account for two years.
The demand letter came to you.
This is one of the most frustrating situations we see business owners walk into. They trusted a professional to handle their digital marketing, assumed compliance was part of that, and found out otherwise when a letter arrived with a settlement demand attached.
Why the Letter Almost Always Goes to the Business Owner
Under CIPA, the legal responsibility for how a website collects visitor data falls on the website operator. That’s the business — not the agency, not the developer, not the plugin vendor.
It doesn’t matter who installed the pixel. What matters is whose website it lives on and whose visitors are being tracked. Agencies act as service providers. They implement tools on your behalf, but the compliance obligation stays with you.
What Most Agency Contracts Say
This is where business owners are often surprised. Most agency agreements include language that limits the agency’s liability for compliance issues and places responsibility for legal requirements on the client. That clause may be buried in a service agreement you signed years ago, but it’s there.
That doesn’t mean agencies bear zero responsibility in every case. But it does mean that waiting for your agency to raise a compliance concern is not a strategy you can count on.
The Questions to Ask Before It Becomes a Problem
If you work with a marketing agency, a freelancer, or anyone who has access to your website’s backend, these are worth clarifying now:
- Which tracking tools has the agency installed on your site, and are they documented anywhere?
- Does your agency contract address compliance responsibility explicitly?
- Who is responsible for ensuring tracking tools fire after consent, not before?
- When did your agency last audit your site’s tracking setup?
- Does the agency carry errors and omissions or professional liability insurance that would apply to a compliance failure?
Most agencies are not thinking about these questions unless you ask them. That doesn’t mean they won’t help, it means the conversation must start with you.
When an Agency Does Share Responsibility
There are situations where an agency’s actions create meaningful exposure for both parties. If an agency installed a tracking tool that wasn’t requested, misrepresented a setup as compliant, or ignored a known problem, there may be grounds to involve them in the response.
But even in those cases, the business owner typically receives the demand letter first, responds first, and bears the initial cost. Sorting out who ultimately pays is a separate conversation that happens later, usually with attorneys involved.
How Social Spice Media Can Help
Part of what we do is give business owners a clear picture of what’s actually running on their site, regardless of who put it there. We identify tracking tools installed by past or current agencies, flag what’s firing before consent, and help you understand where the compliance gaps are before a letter makes the question urgent.
If you’re not sure what your agency has installed or how it’s configured, that’s exactly the kind of thing a compliance review shows.
Reach out to the Social Spice Media team to schedule a compliance consultation.
