In practice, yes — the letters arrive at the business that operates the website, because that is whose domain served the script and whose visitors were affected. Who you can recover from afterwards is a contract question. Who gets the letter is not.
The short answer
That is an uncomfortable answer, so here is the useful part: the same fact that makes you the recipient also makes you the person who can fix it, and most owners in this position discover they have less visibility into their own site than they assumed. The agency has publish rights in Tag Manager. The agency knows which pixels are live. Nobody on your side has looked at the container in a year.
Whether your agency agreement shifts any cost — through an indemnity, a data-processing addendum, or service-provider contract terms — is a real question for a lawyer reading your actual contract. It is worth asking. It is not a substitute for knowing what is running on your own domain.
The pattern is consistent. A campaign launches; the agency adds a pixel or three through the Tag Manager container you gave them access to; nobody tells the website owner because nobody considers it a change to the website. Months later a scan, an audit, or a letter surfaces a tracker the owner has never heard of — and the first internal question is "who added this?", which nobody can answer because the container has no change log anyone reads.
The second discovery is worse: the owner does not have admin rights on their own container, or the analytics property is on the agency's account, or the pixel belongs to an ad account the agency owns.
Before the contract conversation, establish the facts. All of this is read-only and takes minutes.
What a healthy result looks like: You should end up owning admin rights, with a readable publish history, and a list of live tags each of which has a named owner and a business reason.
A container edit ships instantly. No code review, no deploy, no QA. Your engineering change-control process, however good, does not cover the surface that adds most trackers.
Agency onboarding hands over admin rights on the container, the ad accounts, and sometimes the CMS. Offboarding rarely reverses all of it. Old vendors frequently still have publish rights.
New tools get evaluated on price and features. The question of what they inject into the page — and whether it needs to be consent-gated — is not on the approval checklist at most small businesses.
Whoever configured the banner categorized the trackers present that week. Nothing forces a tag added later to pass through the same process, so each addition ships ungated by default.
California's Invasion of Privacy Act (CIPA), Penal Code § 631, prohibits reading or learning the contents of a communication in transit without the consent of all parties, and separately reaches anyone who "aids, agrees with, employs, or conspires with" a person who does. Demand letters built on that theory are addressed to the operator of the website whose visitors were affected. Statutory damages under § 637.2 run up to $5,000 per violation, argued per session.
Separately, California's consumer-privacy framework does contemplate the relationship you have with vendors: Civil Code § 1798.140 defines service providers and contractors, and the CCPA regulations set out required contract terms for them. Those provisions are about how a business and its vendors allocate obligations — a genuinely useful conversation to have with counsel and with your agency. They are not a reason to assume the exposure sits somewhere else.
To be precise: a tracker firing before consent is a technical finding — it establishes when a script transmitted data, not who is legally answerable for it. Who ends up bearing the cost depends on facts and contracts a network log knows nothing about.
Terminology bridge
The person the law looks to is usually the website operator or, in privacy-law language, the business — as opposed to a service provider or contractor, terms California defines with specific contract requirements attached. The document that sets out those terms is typically a data processing addendum (DPA). The operational discipline you are missing has a name too: tag governance — controlling who can publish tags, with review and a change log. And a tracker nobody can account for is, in audit language, an unattributed third party.
This page is general information, not legal advice, and the allocation of responsibility between a business and its agency depends entirely on documents we cannot see. What a scan settles is narrower and still valuable: exactly which third parties your site loads, in what order, relative to consent — so the conversation with your agency and your attorney starts from evidence instead of recollection.
RegSentry loads your site in a real browser, records when each third-party tracker first contacts its server, and flags everything that fires before consent — with the fix for each one. Continuous monitoring re-runs it and emails you when something new appears.
Free real-browser scan
See every pre-consent tracker on your site — free, 30 seconds, no signup.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.