Internal — Not Legal Advice
Freedom Laser Therapy, Inc. — iRESTORE Laser
Litigation Mill Defense
Gap Analysis & Hardening Plan
An assessment of our Terms of Service and Privacy Policy against a litigation-mill deterrent framework — identifying what we have, what we're missing, and what counsel needs to do before we can strengthen our documents.
The Threat: Litigation Mill Operations
How the racket works
- 1.Pick a statute that pays statutory damages with low proof requirements — no need to prove actual harm. CIPA, TCPA, BIPA, session-replay, pixel-tracking.
- 2.Find a technical artifact common across many websites — a pixel, a chat widget, session recording, a missing cookie disclosure. Build the theory once, apply it to hundreds.
- 3.Source claimants in bulk through paid plaintiff networks, repeat filers, advocacy mailing lists.
- 4.Mass-produce demand letters from a template. Set the settlement low enough that paying is cheaper than fighting — typically $5K–$25K.
- 5.Settle most on first contact. Drop the ones who push back. Move to the next batch. Your case is one row in their spreadsheet.
Why iRESTORE is a target
Consumer-facing e-commerce with these characteristics is the primary target profile. We check every box:
- ●Advertising & analytics pixels (Meta, Google, etc.)
- ●SMS/MMS marketing program (TCPA exposure)
- ●Third-party AI chat tools recording conversations
- ●California-based company with CA customer base
- ●Generic cookie disclosure — no tools named by name
- ●Likely browsewrap (not clickwrap) TOS acceptance
Mill economics per case
The Defense Tool: Mill-Deterrent Pack
mindheadllc/mill-deterrent-pack
Open-source drop-in contract clauses for TOS and Privacy Policy
Eight contract clauses, ready-to-merge TOS and Privacy Policy templates, and response playbooks for when a demand arrives. Clauses are designed as anti-fraud screening — procedural steps any honest claimant can clear, and that a high-volume filing operation cannot clear at scale. Provisions are tiered by enforceability risk.
Tier 1 — Solid
High-confidence enforceability across U.S. jurisdictions. Notice gate, named tracking tech, class waiver, choice of law.
Tier 2 — Probably OK
Likely enforceable, jurisdiction-sensitive. 60-day cooling-off, principal meetings, fee/prior-claims disclosure.
Tier 3 — Aggressive
Maximum deterrent, meaningful severance risk. Pre-merits review, claimant-pays fees, bad-faith reimbursement.
We selected Tier 1 only for this analysis — the highest-confidence, most durable provisions available. Right starting point given California's aggressive consumer-protection regime and the need for counsel review before anything is published.
Current State of Our Documents
Terms of Service
View live →Privacy Policy
Last updated Aug 7, 2025
Gap Analysis — All Eight Provisions
Recommended Changes — Tier 1
High-confidence, durable across U.S. jurisdictions. None should be published until (a) the current demand resolves and (b) counsel has reviewed.
1. Add a Notice Gate to the TOS Dispute Resolution Section
Modifies: Section 16 — Dispute Resolution
Before any dispute clock starts, a claimant must send detailed written notice including: full legal name, all email addresses used, specific dates/times and URLs of access, device/OS/browser, IP address if known, proof of standing, a specific factual description of the conduct and harm, and the legal theory asserted.
2. Fix the Class Waiver — Add Non-Severable Drafting
Modifies: Section 16 — Class Action Waiver
The class-action waiver must state explicitly that if the waiver is found unenforceable, the entire arbitration clause is void as to that dispute. Without this, a court can strike the waiver while keeping us in arbitration with a class proceeding.
3. Add McGill v. Citibank Carve-Out (California)
Modifies: Section 16 — Arbitration / Class Action
California's McGill v. Citibank ruling prohibits waiving the right to seek public injunctive relief in court. If our class waiver doesn't carve out McGill-type claims, a California court could find the entire arbitration clause unenforceable. This is a structural fix, not an aggressive move.
4. Make the Venue Clause Symmetric
Modifies: Section 16 — Governing Law / Venue
The current language only gives Freedom Laser Therapy the right to sue in California courts. It should require both parties to use California courts for any dispute that escapes arbitration — not just give us that option while leaving claimants free to file elsewhere.
5. Name Every Tracking Tool in the Privacy Policy
Modifies: Privacy Policy Section 4 — Tracking Technologies
The current PP discloses cookie categories but names no specific tools. We need to audit our actual tag-management configuration and list every tool by name — Google Analytics, Meta Pixel, TikTok Pixel, Klaviyo, any session replay or heat-mapping tool, any email tracking pixel, etc.
6. Add "Continued Use = Consent" to the Privacy Policy
Modifies: Privacy Policy Section 4 — Tracking Technologies
After listing specific tools, add explicit language: "By accessing and continuing to use our website, you acknowledge and consent to the use of the tracking technologies listed above." This creates the factual consent record that defeats the "no consent" element in CIPA and similar pixel-tracking theories.
7. Add Dispute Cross-Reference to the Privacy Policy
Adds: New section to Privacy Policy
Add a section stating that any dispute arising from or relating to data collection, use, sharing, or retention under this Privacy Policy is governed by the dispute-resolution provisions of the Terms of Service — including the notice requirements, arbitration agreement, class-action waiver, and governing law. This closes the argument that a privacy claim isn't subject to TOS arbitration.
8. Add Claim-Substantiation Requirement to the Privacy Policy
Adds: New section to Privacy Policy
Any claimant alleging a data-handling violation must provide: (a) a complete, unedited copy of the data forming the basis of the claim; (b) specific dates, URLs, device, browser, and IP address; (c) the legal theory; and (d) a description of the harm. Framed as enabling meaningful investigation, not an impossible burden.
What We're Not Adding Yet — and Why
Important Flags & Risks
Active Demand — Do Not Modify the TOS Until Resolved
Do not publish any changes while this matter is active. Modifying legal documents during a live claim can be characterized as consciousness of liability and used against us. All changes proposed in this brief should be queued for after the matter resolves.
TOS Acceptance UX — Likely Browsewrap, Not Clickwrap
No explicit "I agree to Terms of Service" checkbox visible on product pages — likely Shopify's default checkout notice (browsewrap). Browsewrap is significantly weaker. Courts differ on whether continued use constitutes acceptance of arbitration and class-waiver provisions.
Tracking Technology Audit Required Before Publishing
The PP cannot be updated with specific tool names until someone runs a tag inspector against the live site. Naming tools we don't use, or omitting tools we do use, undermines the consent record and is itself a litigation target. Someone needs to: (a) run a tag inspector on irestorelaser.com, (b) check our tag management platform, (c) reconcile against our ads/analytics accounts. This is an internal operations task, not a legal task.
McGill v. Citibank — California Class Waiver Risk
McGill v. Citibank, N.A. (Cal. 2017) prohibits waiving the right to seek public injunctive relief. If our class waiver doesn't carve out McGill claims, a California court may find the entire arbitration clause unenforceable — not just the waiver. This is a structural problem with the existing document, independent of the mill-deterrent changes.
CCP §§ 1281.97-1281.99 — Arbitration Fee Payment Deadlines
California imposes strict deadlines on us (as the drafter) to pay our share of AAA fees after a demand is filed. Missing these deadlines — even by one day — can result in waiver of our own arbitration clause, being moved to court, and sanctions. Counsel and legal ops need to confirm there is a documented internal process for handling these payments on time.
Cookie Banner Consistency Check
If the site uses a cookie consent banner, the categories and tools disclosed there must match the Privacy Policy. Inconsistencies between the cookie banner and PP are a common and easy mill target — treated as evidence of deceptive consent practices. Once the tracking audit is done and PP updated, the cookie banner must be reviewed in parallel.
Questions for Counsel
Specific items that require legal review before any proposed changes can be safely published.
Active matter — safe to queue changes?
Given the potentially active demand, is there a recommended timeline for when we can safely begin drafting and publishing TOS/PP changes? Are there any communications about the active matter that would affect what we can say in a revised document?
Does Section 16 include non-severable class waiver drafting?
Please confirm whether the current Section 16 states that if the class-action waiver is found unenforceable, the entire arbitration agreement is void as to that dispute. If not, please add this language. Without it, a court can convert our individual arbitration clause into class arbitration.
Does Section 16 include a McGill v. Citibank carve-out?
Please confirm whether Section 16 carves out claims for public injunctive relief under California law, as required by McGill v. Citibank, N.A. (Cal. 2017). If not, please add a carve-out. Without it, the entire arbitration clause may be unenforceable in California.
Is our TOS acceptance UX sufficient to bind users to the arbitration clause?
Product pages appear to use browsewrap (no clickwrap checkbox visible). Please advise whether this creates enforceable agreement to the dispute resolution provisions, including arbitration and class waiver. If browsewrap is insufficient, please advise on implementing clickwrap at checkout with a logged timestamp and TOS version number.
What is our internal process for paying AAA arbitration fees under CCP §§ 1281.97-1281.99?
California imposes strict deadlines on the drafter of an arbitration clause to pay its share of fees after a demand is filed. Late payment — even by one day — can result in waiver of the arbitration clause. Please confirm whether we have a documented internal process for meeting these deadlines, and advise on what that process should look like.
Review the proposed Tier 1 additions in this brief for California compliance.
Please review the eight proposed Tier 1 changes in Section 5 and advise on: (a) any that conflict with California consumer law; (b) any additional California-specific provisions we should include; (c) recommended framing adjustments to maximize enforceability in California.
Privacy Policy — does the generic cookie disclosure create CPRA exposure?
Our current PP discloses cookie categories but does not name specific tracking tools. Please advise whether this generic disclosure creates exposure under the CPRA or other applicable California law — and whether naming specific tools (as proposed) is sufficient, or whether additional steps are required.
Should we escalate to Tier 1+2 after the current matter resolves?
Tier 2 provisions — particularly the 60-day cooling-off period, mandatory principal meetings, and fee/prior-claims disclosure — have significantly higher deterrent value than Tier 1 alone. Please advise on California-specific enforceability for each, and whether you would recommend adding them in a second revision after the current matter resolves.
Next Steps
Source Materials