Steps after a website demand letter
Seven steps after an attorney's website demand letter: keep the letter, call counsel, preserve evidence, investigate, fix issues, check insurance, and respond.
What to Do After Receiving a Website Demand Letter
Receiving a website demand letter from an attorney can be unsettling, especially when it alleges that your business violated accessibility, privacy, or tracking laws. But a demand letter is not a court ruling. It is an allegation, and your first priority should be preserving information and understanding exactly what they're claiming.
Here are the practical steps businesses should take before changing their website.
Key takeaways
A demand letter from an attorney is an allegation, not a court ruling or proof your business broke the law.
Keep the letter and record who sent it, what it claims, and any response deadline.
Involve legal counsel before you reply to the claimant or change your website.
Preserve scans, consent logs, and page archives first, because early changes can erase useful evidence.
Investigate the specific page, technology, or barrier named in the letter rather than auditing everything at once.
Check your cyber and business insurance policies, since you may need to notify your insurer.
What is a demand letter from an attorney?
A demand letter from an attorney is a formal letter sent on behalf of a client that sets out a legal claim against your business and states what the client wants, such as payment, a fix, or both, usually by a deadline. For websites, the claim usually concerns accessibility or how visitor data is tracked and shared. It isn't a lawsuit or a court order, but it's often the step before a lawsuit is filed.
1. Preserve the demand letter and related communications
Keep the original demand letter and any related emails, envelopes, attachments, or follow-up messages.
Record important details such as:
- Who sent the letter
- When it was received
- Which laws are mentioned
- What website pages or technologies are identified
- Any deadline for responding
Having this information organized can make it easier for legal counsel and your internal teams to evaluate the claim.
2. Speak with legal counsel early
Website demand letters can lead to settlement discussions or litigation, so businesses should involve legal counsel early.
An attorney can help determine which laws may apply, what evidence to preserve, and how the business should communicate with the claimant.
Avoid responding directly until you understand the allegations and their potential legal implications.
3. Preserve evidence before changing your website
One of the most important steps is documenting how your website operates before making technical changes.
Depending on the allegation, useful records may include:
- Screenshots of relevant pages
- Cookie and tracker scans
- Consent logs
- Consent banner configurations
- Tag manager history
- Accessibility scans
- Website release notes
- Archived versions of pages
- Vendor settings
Making immediate changes without preserving the existing setup can make it harder to determine what was happening when the alleged violation occurred.
If the dispute reaches court, preservation still matters. In federal cases, Federal Rule of Civil Procedure 37(e) lets courts sanction a party when electronically stored information that should have been preserved is lost.
4. Investigate the specific claim
Website demand letters typically focus on one of two areas: accessibility or privacy.
An accessibility claim may allege that a visitor with a disability could not use part of the website. Common issues can involve forms, navigation, images, videos, PDFs, or checkout experiences.
A privacy or tracking claim may focus on technologies such as advertising pixels, analytics tools, chat software, session replay, or embedded video.
Instead of trying to audit every possible compliance issue at once, start with the technology, page, or barrier identified in the letter.
If the letter cites accessibility, our guide to ADA demand letters explains which barriers and records to review first. If it cites CIPA or another wiretapping law, our CIPA demand letter guide covers what the claim may mean for your business and what to review next.
How Clym can help: Clym's free privacy and accessibility scanner produces a dated, exportable report of the scripts, cookies, and accessibility issues on your website, giving you a snapshot before anything changes. If you use Clym's consent management platform, consent receipts record each visitor's consent choices over time.
5. Correct confirmed problems
If your investigation confirms that an issue exists, work with the appropriate legal, privacy, accessibility, marketing, or web teams to address it.
The investigation may also reveal related gaps that should be corrected as part of a broader compliance process.
6. Check your cyber insurance and business insurance
Review your cyber insurance and other business insurance policies after receiving a website demand letter. Some business policies may cover this type of claim, and your policy may require you to notify your insurer.
Ask your broker or insurer whether your policy covers accessibility claims, privacy or wiretapping claims, or both, because coverage terms vary from policy to policy.
Check your coverage and notification requirements promptly, and discuss the demand letter with legal counsel before deciding how to respond.
7. Respond to the claimant
Your response may dispute the claim, explain fixes you've already made, propose a resolution, or ask for more time. Keep a copy of everything you send and add it to the records you've preserved. Generally, it’s not a good idea to ignore the claim.
A website demand letter is not the same as a lawsuit
Demand letters are often sent before litigation. They typically ask a business to correct an alleged problem, pay a settlement, or both.
Receiving one does not automatically establish that your business violated the law.
Litigation in this area is common, though. Plaintiffs filed 360 ADA website accessibility lawsuits in September 2026 alone, according to UsableNet's lawsuit tracker. Most claims never go to court, so the number of demand letters sent to businesses may be exponentially higher.
The strongest response starts with evidence: preserve the letter, document how your website was configured, involve legal counsel, and investigate the specific allegations before deciding what changes to make.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Clym is not a law firm and does not provide legal advice. Consult a qualified legal professional for guidance specific to your business.
Frequently asked questions
Most website demand letters name the claimant and their attorney, describe the alleged problem on your website, cite the laws involved, and say what the claimant wants, such as fixes, a settlement payment, or both. They usually set a response deadline. Some attach screenshots or a report showing the alleged barrier or tracking activity.
No. A demand letter isn't a court order, and you aren't legally required to agree to what it asks. It's a formal statement of one side's claim. Ignoring it can still lead to a lawsuit, so keep records and ask legal counsel how to respond before the deadline.
It varies. Some website claims resolve soon after the first response, while others take months or turn into lawsuits. The timeline depends on the claim, how quickly you can investigate, and what each side proposes. Your legal counsel can advise whether and when a settlement discussion makes sense for your business.
A demand letter is usually a private communication between the parties, not a court filing, so it doesn't create a public court record. If the claimant files a lawsuit, that case generally becomes part of the public court record. Ask your legal counsel about any disclosure duties, such as notifying your insurer.
Sometimes. Coverage depends on your policy wording, and some policies treat privacy, wiretapping, and accessibility claims differently. Review your cyber and general liability policies, check their notice requirements, and tell your insurer or broker promptly if your policy requires it. Don't assume you're covered until your insurer confirms it in writing.
Michael Williams
Chief Financial Officer
Michael is an experienced C-suite executive who has spent his career guiding organizations through an ever-evolving regulatory landscape. After starting his career at Ernst & Young, Michael worked as a CFO with large, global organizations before co-founding Clym to assist organizations of all sizes with their website regulatory compliance needs.
