If you have heard that businesses are being sued over the tracking technology running on their websites, you are not imagining it. A wave of litigation is sweeping across Florida under a law that, on its face, has little to do with website cookies: the state’s decades-old wiretapping statute.
The lawsuits are catching many ordinary businesses off guard. If your website uses Google Analytics, a Meta advertising pixel, a live-chat widget, session-replay software, or similar tracking technology, your business may already face potential exposure.
The Law Behind the Lawsuits
The statute driving this wave of litigation is the Florida Security of Communications Act (“FSCA”), found in Chapter 934 of the Florida Statutes.
Originally enacted in 1969 to address illegal wiretapping and electronic surveillance, section 934.03, Florida Statutes, makes it unlawful to intercept certain “wire, oral, or electronic communications” without the consent of the parties involved. Florida is generally considered an “all-party consent” state, imposing a stricter consent requirement than the federal one-party-consent standard. Plaintiffs’ attorneys are now attempting to apply that distinction to modern website technology.
The theory is that common website tracking tools—including analytics scripts, advertising pixels, chat widgets, and session-replay software—can “intercept” a visitor’s communications as soon as a webpage loads and before the visitor has affirmatively consented.
Some plaintiffs also invoke section 934.31, Florida Statutes, commonly referred to as the “pen register” provision. Although originally directed toward technology that recorded information such as dialed telephone numbers, plaintiffs argue that website technology capturing information such as a visitor’s IP address can constitute the modern digital equivalent.
Florida courts have allowed some of these theories to move beyond the pleading stage. A March 2025 ruling in W.W. v. Orlando Health allowed FSCA website-tracking claims to survive a motion to dismiss, and an August 2026 decision in Crespi v. BayCare Health System allowed similar claims against a healthcare system to proceed.
The volume of litigation is substantial. Fisher Phillips has reported tracking more than 5,400 similar cases nationwide, including more than 800 filed in Florida.
Why the Volume of Lawsuits Is Exploding
These cases are not necessarily the result of individual consumers discovering tracking technology while browsing a website.
Automated scanning tools can analyze large numbers of websites and identify tracking scripts that may activate before a visitor provides consent. Similar technology is available through publicly accessible website-compliance scanners. The result is an environment in which potential claims can be identified quickly and at scale.
A relatively small number of plaintiffs’ firms, including South Florida firms Salpeter Gitkin, LLP and Johnson | Dalal, have filed hundreds of these cases or pursued related demands against businesses of varying sizes. The litigation has reached major national companies as well, including a class action filed against Nike in the Southern District of Florida.
The statute’s remedies also make relatively small individual claims economically viable.
Section 934.10, Florida Statutes, provides a civil remedy that can include the greater of $1,000 or $100 per day of violation, as well as actual damages and potential punitive damages. Importantly, the statute also provides for recovery of attorney’s fees and litigation costs by a successful plaintiff.
That fee-shifting provision can significantly change the economics of litigation and helps explain why businesses may face claims even when the alleged damages to an individual website visitor appear minimal.
Who Is Being Targeted?
This litigation is not limited to major national retailers or technology companies.
Healthcare systems, dermatology practices, and ordinary small and mid-sized businesses have faced these claims. Any business operating a website that uses third-party tracking or communication technology should understand the potential issue.
Businesses also should not assume they are outside the scope of these claims merely because they have no physical office or storefront in Florida. Potential liability may turn on the location of the website visitor rather than the physical location of the business. A company located outside Florida may therefore face a claim arising from visits to its website by Florida residents.
Why a Standard Cookie Banner May Not Protect Your Business
One of the most important misconceptions is that a standard “we use cookies” notice necessarily solves the problem.
It generally does not.
A passive cookie banner may inform visitors that a website uses tracking technology, but if the website’s non-essential tracking scripts continue to activate before the visitor affirmatively provides consent, the banner may not provide the type of consent plaintiffs contend the FSCA requires.
The distinction is important: notice is not necessarily the same thing as consent.
A more defensible approach uses a consent mechanism that actually prevents non-essential tracking technology from activating until the website visitor affirmatively opts in.
For businesses that have relied on a standard cookie banner for years, this may require changes not merely to the language displayed on the website, but to the underlying way the website loads and operates.
What Florida Businesses Should Do Now
Businesses that operate websites accessible to Florida consumers should consider taking the following steps:
-
Audit your website’s tracking technology. Identify every analytics tool, advertising pixel, chat feature, session-replay program, and similar technology operating on the website. Determine what information each tool collects and, importantly, when it begins collecting that information in relation to user consent.
-
Fix the consent mechanism—not just the banner. Consider implementing a consent-management tool that blocks non-essential scripts by default and does not activate them until the visitor affirmatively opts in. Merely displaying a notice while tracking technology continues to operate may not address the alleged risk.
-
Preserve timestamped consent records. Maintain documentation showing when compliant consent controls were implemented and how those controls function. A reliable history of the website’s configuration may become important evidence if a claim is later asserted.
-
Do not modify your website after receiving a demand letter or lawsuit without consulting counsel. Once a claim has been asserted, changes to the website or its tracking configuration can raise evidence-preservation and spoliation issues. Preserve the existing systems and information and consult counsel before making changes.
-
Calendar every deadline immediately. A business that receives a lawsuit should not assume the claim can be addressed informally or at a later date. Response deadlines can arrive quickly, and failing to respond can result in a default.
-
Consider conducting the compliance review through outside counsel. Businesses may wish to coordinate technical reviews of tracking technology and consent practices with legal counsel so that the review is structured to address the developing legal issues and, where applicable, preserve attorney-client privilege and work-product protections.
-
Work with Florida counsel familiar with FSCA website claims. This is a rapidly developing and statute-specific area of litigation. Businesses facing a demand or lawsuit should evaluate not only potential compliance changes, but also the factual and legal defenses available under the FSCA and recent Florida decisions.
Compliance Now Can Be Far Less Expensive Than Litigation Later
The practical problem for businesses is that website technology that has been commonplace for years is now being evaluated under a statute enacted decades before modern websites existed.
That does not mean businesses should simply remove every analytics, advertising, or customer-service tool from their websites. These technologies serve legitimate and often important business purposes. It does mean businesses should understand what technology is operating on their websites, what information it collects, when it activates, and whether the business’s consent process actually controls that activity.
For many businesses, the first step is not complicated: identify the technology currently running on the website and determine whether non-essential tracking begins before the visitor has affirmatively consented.
How Southern Atlantic Law Group Can Help
Whether your business has already received a demand letter or lawsuit, or you want to address potential exposure before a claim arrives, Southern Atlantic Law Group can help evaluate the legal issues surrounding your website’s tracking and consent practices.
Our firm can assist businesses with reviewing website tracking configurations, evaluating and developing defensible consent practices, responding to demand letters, and defending FSCA claims when litigation has already been filed.
If your business uses website analytics, advertising pixels, chat features, session-replay technology, or other third-party tracking tools and you have questions about Florida’s developing website wiretapping litigation, contact Southern Atlantic Law Group to discuss your business’s particular circumstances.
Southern Atlantic Law Group, LLC
Latest posts by Southern Atlantic Law Group, LLC (see all)
- Nonprobate Does Not Mean Dispute-Free - October 26, 2026
