Cookies, pixels and wiretap lawsuits: eight steps to keep your website out of court

This post is informational and reflects the state of the law as of October 2026. For advice on your site’s setup, consult a licensed attorney.

On October 21, I co-presented “The Wiretap Trap: Defending and Avoiding Florida Wiretap Litigation” for the IAPP’s North Florida KnowledgeNet chapter, with Adam Hubbell moderating. Hannah Murphy of Stearns Weaver Miller took the defense side: the statute, the claims, how the litigation is going and what it costs to defend. I took the other half, which is how to stay out of court in the first place. The session wasn’t recorded, so this is the written version of my part, with a short recap of Hannah’s to set it up.

The liability side, in brief

Florida’s Security of Communications Act (Fla. Stat. ch. 934) is modeled on the federal Wiretap Act, and courts often borrow federal readings when they interpret it. Intercepting a communication is a crime under section 934.03, and section 934.10 gives anyone whose communication is intercepted a civil claim against whoever intercepted it or procured someone else to. The remedy is what draws plaintiffs: actual damages, but not less than $100 a day for each day of violation or $1,000, whichever is higher, plus punitive damages and attorney’s fees.

Hannah explained that two provisions drive the website cases. The first is all-party consent: an interception is lawful only when every party to the communication has given prior consent. The second is the definition of “contents,” which the statute defines as information concerning the substance, purport or meaning of a communication. The early federal session-replay cases mostly failed because courts treated clicks and page views as activity data rather than contents. Claims built on pixels that pick up what a visitor types (form entries, button text, search terms, URLs that reveal what someone was looking for) are harder to get rid of early. And in federal court, standing has become a real defense when the named plaintiffs can’t show a concrete harm.

There is also a second front. Hannah described hundreds of copy-and-paste suits in small claims court in Broward and Miami-Dade counties, alleging that cookies work as pen registers and aimed at site owners with no tracking disclosure or consent management. That theory is worth watching closely, because the pen-register prohibition sits in section 934.31, which carries criminal penalties and is not one of the sections that 934.10’s civil remedy lists. Small claims are capped at $8,000, but the fee exposure comes along with them. Class actions sit at the other end, where the numbers can reach eight figures. Her caution on settlement was the one I’d underline: settling early may not buy peace, because the filing firm can keep filing from its inventory and has no power to settle claims brought by other firms.

That is the problem. Here is how I approach the fix.

Two questions

For all the statutory detail, website compliance with the FSCA comes down to two questions. Does anything on the site capture a visitor’s communications before the visitor agrees? And does what you tell visitors match what the site actually does?

The eight steps below are designed to get you to “no” on the first question and “yes” on the second. One date to keep in mind as you read: a civil claim must be filed within two years after the claimant first had a reasonable opportunity to discover the violation (§ 934.10(3)). That window comes back in step 5.

Step 1: Know what is on your site

You can’t get consent for a tool you don’t know is running. Build a tracking-technology inventory for each property on its own: the main site, every subdomain, the checkout flow, the careers portal, the customer login. A consent template configured once tells you nothing about what fires on each page, and in the audits I’ve done, the problems usually show up on the properties nobody thinks of as “the website.”

The categories plaintiffs target are advertising pixels from Meta, TikTok and LinkedIn; analytics such as GA4 and Adobe; session replay tools like Clarity, FullStory and Hotjar; chat widgets; site-search boxes; embedded video players; and the “free” plug-ins that send data back to their vendor. For each tool, write down what it collects, where the data goes, who added it, and whether anyone still uses it. That last question is where the easy wins for step 2 come from.

Plaintiff firms find their targets with automated scanners that log every third-party request made before consent. Run the same scan on yourself first, before anyone else does. Step 4 covers how.

Step 2: Rank the risk and cut what you don’t need

The highest-risk tools are the ones that capture what a visitor types or does: session replay, chat transcripts, search-bar capture. Add to that list any pixel on a sensitive page, such as health or financial content, anything directed at children, HR and job-application portals, and checkout forms. Those are the fact patterns Hannah walked through.

Lower risk is first-party analytics configured to minimize data, with IP truncation, no user IDs and no sharing with ad platforms. One caveat: if Google Analytics is linked to Google Ads, it isn’t lower risk anymore, because the data feeds an ad platform. Treat it like advertising.

Data minimization is the cheapest fix available, since every tool you remove is one less exhibit in a complaint. On sensitive pages, turn tracking off rather than trying to consent your way through it. Before cutting a tool, though, ask marketing what turning it off costs in conversions and traffic. Every fix has a business impact, and it should be a business decision made with the risk in view.

This is where most privacy programs go wrong. Programs built around the CCPA run on opt-out: the notice is posted, the page loads, and the trackers fire unless the visitor’s browser sends an opt-out signal or the visitor uses the “do not sell or share” link. Wiretap statutes like Florida’s and California’s CIPA require prior consent. A banner that lets trackers load and then offers an opt-out link does not solve the wiretap problem. Non-essential trackers have to stay blocked until the visitor affirmatively accepts.

At a minimum, require opt-in in the states with the most website-tracking filings: Florida, California, Pennsylvania, Illinois and New York. That list reflects filing volume. New York’s wiretap statute, for one, requires only one party’s consent. Geo-gating has limits, though. A federal Wiretap Act claim can be filed anywhere. The federal statute needs only one party’s consent, and the site’s own consent defeats the claim unless the interception is for the purpose of committing a criminal or tortious act, which is the theory plaintiffs press in the health-data pixel cases. And youth-facing pages need a nationwide fix no matter what the state map shows. Many companies decide nationwide opt-in is simpler to run.

On banner design, give Accept and Reject equal prominence, skip pre-checked boxes and “by continuing to browse, you agree” language, and link the privacy policy and terms in the banner itself. No U.S. state privacy law requires a cookie banner, but the banner is how you get opt-in consent, which makes it the best litigation mitigation available. Once it’s installed, someone has to own it. A set-and-forget banner that quietly stops working is its own lawsuit.

Step 4: Test it, because configuration is not compliance

The most common failure I see is a consent tool that is configured correctly on paper while a vendor keeps firing after the visitor clicks Reject. Nobody notices because nobody tests from the visitor’s side.

The core test is simple. Open a fresh browser session, click Reject, reload the page and watch the network traffic for calls to third parties. Then repeat it with Global Privacy Control turned on.

A full scan goes further. Start from a browser with cookies and storage cleared, on desktop and on mobile, and note the state you’re browsing from, because geo-aware banners serve different rules in different states. Check what loads before any click, including local storage, which cookie blocking often doesn’t touch. Then accept and walk a few interior pages, and test the change-of-mind case of accepting first and opting out later through the footer link. Don’t rely only on your consent vendor’s own scan. Test from the visitor’s side.

The industry numbers say this failure is common. The Banner Scanner’s Q3 2026 report scanned 100 privately held, U.S.-headquartered mid-market B2B SaaS companies in July 2026. Almost nine in ten site scans loaded at least one non-essential tracker before the visitor touched the banner. And in California, 99 percent of consent platforms detected the GPC signal, but only 20 percent honored it. The authors describe the sample as modest and the findings as directional, but the pattern matches what I find.

Keep dated results. A time-stamped capture showing the site was clean on a given date is defense evidence later. Confirm, too, that your consent platform logs each visitor’s choice with a timestamp, and keep those logs for at least two years after the banner version or tool is retired, and longer if you can, because the limitations period runs from discovery, not from the visit. One more caution: cookie blocking and tag blocking are different things. A banner doesn’t block tags by default, and server-side tagging can bypass it unless the server container is set up to honor the consent signal.

Step 5: Make the paper match the practice

Across the recent decisions, the loss pattern is a banner or privacy policy that promises more than the site delivers. “We never share your data with third parties,” sitting next to a Meta pixel on every page, is a gift to a plaintiff.

Describe the trackers, the categories of data and the recipients accurately, and update the policy when marketing adds a tool rather than waiting for the annual review. Then tick and tie the documents. If the banner calls them targeting cookies, the cookie policy calls them interest-based and the privacy policy calls them marketing, that inconsistency is a red flag. If the banner mentions only analytics while targeting cookies run, the disclosure is incomplete.

Archive every dated version of the privacy policy, the cookie policy and the banner. With a two-year, discovery-based limitations period, an old disclosure that accurately described the tracking can help show the claim was discoverable, and so untimely.

Step 6: Use your terms of use as a litigation tool

Terms of use help only if visitors actually agree to them. An enforceable arbitration clause with a class-action waiver can move individual claims out of court and take away the class exposure, and choice-of-law and forum clauses can change which statute applies at all. That takes a real clickwrap step, meaning a button or checkbox tied to the terms in the consent banner or at account creation. A footer link to long terms won’t hold up. Courts now look closely at the design details, including font size, color contrast and where the terms link sits relative to the button.

Two cautions. Arbitration is not free: serial claimants file individual arbitration demands, including here in Florida, and the filing fees add up quickly, so run the numbers before assuming arbitration is cheaper than defending a class action. And choice of law only helps if the chosen state’s law is friendlier. Picking Florida law does nothing to get a Florida company out of the FSCA.

Step 7: Tighten vendor contracts and settings

Pull the ad-tech and analytics vendor terms and read them. You’re looking for limits on the vendor using your visitors’ data for its own purposes, service-provider status, deletion obligations and indemnity. Do you know whether you’ve accepted Google Analytics’ own data-protection terms? If nobody knows, nobody is checking.

Then check the vendor-side settings, because many of them expand collection by default. Automatic advanced matching, form-field capture and “enhanced conversions” are the usual suspects. A clean contract doesn’t help if a dashboard setting sends form fields to the platform.

Finally, assign an owner to each vendor relationship. Most of the pixels I see were added by marketing without legal review, and you can’t shift the blame to the agency that built the site unless your contract with that agency makes it responsible for compliance. The business owns this. Pair every approval with offboarding, too, so tags are retired when the campaign ends.

Step 8: Governance and demand-letter readiness

Start with change control. No new script goes on the site without privacy review, and because tag managers let anyone with a login add code, the control has to sit in the tag manager. Re-scan quarterly and after every redesign or campaign launch.

When a demand letter arrives, preserve the site as it existed on the alleged visit date and pull the consent logs and banner versions. Then test the letter itself. Do the dates line up? Are the screenshots of your actual site? Did a banner appear? Many of these letters don’t survive that check. Notify your cyber carrier early, and read the policy before you need it, because some carriers are narrowing coverage for “wrongful collection” claims.

A few things not to do. Don’t settle with or respond to the sender before counsel is involved. Don’t paste the letter into a public AI tool, because what you type may be discoverable. And don’t let legal, marketing, IT and the vendors each respond on their own. Building the tracker inventory through counsel helps keep the analysis privileged, though the underlying facts are not.

Most of these claims settle. Readiness is about lowering the price.

A word on California

The question I expected in Q&A was California’s SB 690, which Governor Newsom signed on September 30. Starting January 1, 2027, it removes the private right of action for CIPA pen-register and trap-and-trace claims based on website and app activity, leaving those claims to the Attorney General, and it reaches pending claims in actions filed on or after January 1, 2025. Plaintiffs’ firms have signaled they will challenge that retroactivity provision on constitutional grounds. It leaves CIPA’s wiretapping and recording provisions in place, and those are the closest analogs to the Florida claims. Expect plaintiffs to shift toward those theories, the federal Wiretap Act, and broken-banner claims where a promised opt-out doesn’t work. SB 690 changes nothing in Florida.

The checklist

If you keep one thing from this post, keep this list.

Inventory every tracker on every property.
Remove what you don’t need, and turn tracking off on sensitive pages.
Block non-essential trackers until the visitor opts in.
Test Reject and GPC live, and keep dated results.
Match the privacy policy and banner to the site, and archive every version.
Put conspicuous clickwrap terms in front of visitors, with arbitration, a class waiver and choice of law.
Tighten vendor terms and default settings.
Adopt change control and a playbook for demand letters.

Thanks to Hannah for a sharp walk through the defense side, to Adam for moderating, and to the IAPP and everyone who joined us. If you want to compare notes on your own site’s setup, talk to MB Legal. For the banner-testing side in more depth, see your consent banner is a legal representation and the firm’s privacy and data security practice.

This post is informational and does not constitute legal advice. For guidance on a specific situation, consult a licensed attorney.