Over the past few months, we’ve seen a wave of identical letters hitting inboxes of our clients, each one carefully crafted to look like a serious legal threat. If you’ve received a “Final Letter Before Legal Action” from someone named Bill Foster, you’re not alone. We’ve now had multiple clients contact us in a panic after receiving this exact same letter — and we’ve investigated it thoroughly regarding tracking.
The claim? That your website is unlawfully using the Facebook Pixel to track personal data without proper consent, breaching UK GDPR and PECR regulations. The demand? A tidy sum of £470 to settle alleged damages, plus immediate removal of the Facebook Pixel.
Let’s break this down, understand what’s really going on, and crucially, show you how to protect your business.
What’s Actually in the “Bill Foster” Letter?
These letters usually follow a precise format:
- Allegation that your website has installed Facebook Pixel without prior consent.
- Claims of unlawful personal data processing under UK GDPR and PECR.
- Specific references to legal cases like Fashion ID and Bindl.
- Demands for payment (£470) for “loss of control of personal data”.
- Threats to escalate to the ICO or take legal action if you don’t respond in 14 days.
While the language is slick and peppered with valid legal terminology, we’ve found strong indications that this is part of a speculative invoicing strategy — designed to get businesses to pay up without a fight.
Is It a Scam?
We wouldn’t go so far as to call it an outright scam. The legal frameworks referenced are real, and yes, tracking pixels like Facebook’s can fall foul of regulations if not properly configured.
But here’s the thing: the low value of the claim, the copy-paste structure of the letters, and the fact that it’s clearly being sent to many businesses point to this being a volume-based tactic. It’s designed to sound scary, seem legitimate, and extract small settlements — with minimal actual legal pursuit.
UK courts have already shown resistance to claims that don’t demonstrate actual harm. “Loss of control” alone rarely gets damages awarded unless there’s distress or measurable loss. This is important.
So yes — it’s legally sophisticated. But in most cases, it’s not enforceable.
But Could My Website Actually Be in Breach?
Possibly — and this is where things get serious.
The Facebook Pixel, along with other tracking scripts (Google Analytics, Meta, Hotjar, etc), must not load before the user gives explicit consent. If you have a cookie banner that says “By using this site you accept cookies” without offering a real “Accept” and “Reject” option — you’re not compliant.
What makes this more important than ever is Google’s Consent Mode v2. As of March 2024, Google requires full cookie compliance to serve personalised ads or use remarketing tools. So even if you dodge the speculative letters, you won’t be able to run Google Ads properly unless your site complies.
How the Consent Kit Can Protect You
To stop this from happening again — and prevent future legal, reputational, or advertising headaches — we built The Consent Kit.
💼 The Consent Kit is our all-in-one compliance setup designed specifically for small businesses.
We:
- Audit your website for cookie and tracking tools.
- Install a fully compliant cookie banner that blocks tracking scripts until permission is granted.
- Ensure that “Accept” and “Reject” options are equally visible.
- Write and implement your cookie policy, linked directly from your banner.
- Enable Consent Mode v2 for any business running Google Ads.
- Set up consent withdrawal options, per legal requirements.
👉 It’s clean, lightweight, branded to your site, and keeps you fully in line with UK GDPR, PECR, and Google’s ad policies.
You can get it set up fast — and yes, we’ll even check if you’ve had a pixel firing pre-consent and fix that too.
So, What Should You Do If You Receive a Letter?
If you’ve had a Bill Foster letter drop into your inbox:
- Don’t panic.
- Don’t pay.
- Don’t respond with admissions.
Just forward it to us if you’re a client. We can usually tell within moments if it’s the same template we’ve seen before.
Then — whether you’ve received a letter or not — get compliant. Because even if this wave dies down, the risks of non-compliance are very real. The ICO is actively investigating cookie banners, and non-compliance is one of the most common triggers for fines.
This Isn’t Going Away
The era of “we just installed Google Analytics and forgot about it” is over. Regulations are tightening. Tools like Cookiebot and Blacklight make it easy to detect violations. And enforcement is ramping up — not just by regulators, but by opportunists too.
Don’t give them a reason to target your business.
We created The Consent Kit so you don’t have to spend hours googling, wondering if you’re safe, or dealing with legal threats that feel like they’ve come out of nowhere.
Protect your business, run your ads, and stay squeaky clean with:
🔗 The Consent Kit → Get it now
If you’d like help auditing your setup, or want to talk about next steps — you know where we are 💬
Need the full breakdown of this issue for your team? Share this article, or get in touch and we’ll walk you through it.
Stay safe,
Team Precise Impact
