Routine website instrumentation—pixels, session-replay tools, analytics SDKs, chat widgets, and ad-serving tags—has become a major class-action litigation target across multiple U.S. jurisdictions. What began as California-specific claims under CIPA has evolved into a multistate campaign involving federal ECPA, Florida's FSCA, Pennsylvania's WESCA, and other statutes, creating significant statutory-damages exposure for companies with ordinary AdTech stacks.
Highlights
Routine website instrumentation – pixels, session-replay tools, analytics SDKs, chat widgets, and ad-serving tags – is now a class-action target in multiple jurisdictions. What began as a wave of California-specific claims under the California Invasion of Privacy Act (CIPA) has matured into a multistate, multi-statute litigation campaign in which companies with ordinary AdTech stacks face statutory-damages exposure, expensive motion practice, and class certification risk. Marketing and IT teams are not equipped to manage this risk because it is now a legal problem, not a technical one.
As of April 2026, the center of gravity is still California, but plaintiffs are increasingly pairing or replacing CIPA claims with claims under the federal Electronic Communications Privacy Act (ECPA or the Wiretap Act), Florida’s Security of Communications Act (FSCA), Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA), and adjacent theories such as the Video
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.
The content of this article is intended to provide a general guide
to the subject matter. Specialist advice should be sought about your
specific circumstances.
View source
