The Federal Wiretap Act & Website Tracking Litigation
What the Federal Wiretap Act Is
The Federal Wiretap Act (Title III of the Omnibus Crime Control and Safe Streets Act, 18 U.S.C. § 2510 et seq.), as amended by the Electronic Communications Privacy Act (ECPA), generally restricts the intentional interception of wire, oral, and electronic communications and provides a civil cause of action with statutory damages. Because it is federal law, litigants may raise it regardless of state, which is why federal theories can be potentially relevant to websites nationally.
How It Is Being Applied to Website Tracking
Courts and litigants are increasingly examining whether modern website technologies — session replay tools, advertising pixels, chat widgets, and analytics that transmit visitor activity to third parties — can constitute an "interception" of electronic communications under the Act. Key contested questions in public decisions include whether the third party is a direct "party" to the communication, whether consent was obtained, and whether the intercepted information includes "contents" of a communication. The legal landscape remains unsettled and outcomes vary by circuit and by facts.
Current Landscape
The supplied summaries describe federal website-tracking litigation involving pixels, analytics tools, session-replay software, and alleged disclosures of browsing, video-viewing, financial, or health-related information. Claims include the Federal Wiretap Act, Electronic Communications Privacy Act, Stored Communications Act, Video Privacy Protection Act (VPPA), and state privacy laws. Defendants include healthcare providers, media companies, retailers, and other service providers.
The reported outcomes are mixed and must be distinguished by procedural posture. Golden affirmed dismissal of a VPPA claim in a nonprecedential summary order. Salazar affirmed dismissal because a newsletter subscription did not establish VPPA consumer status; the supplied source reports Supreme Court review of that question, not a Supreme Court decision. Cedars-Sinai and several other healthcare cases concern removal jurisdiction and remand rather than liability. Other decisions allow some claims to proceed at the pleading stage, dismiss claims with opportunities to amend, or address class certification and arbitration.
Standing is a recurring threshold issue. The supplied BPS Direct appellate summaries distinguish allegations involving capture of names and full payment-card numbers from ordinary browsing activity. Other cases find insufficient allegations of concrete privacy injury, while some find standing adequately pleaded. Settlements also have different statuses: the sources report final approval in Allina and Duke Health, but approval remains unresolved in several other matters. Settlement approval does not establish liability. Some overlapping summaries describe different or potentially inconsistent rulings without enough procedural context to reconcile them; no definitive current outcome should be inferred for those matters.
Tracked Federal Cases & Matters
Doe v. Cedars-Sinai Health System
The Ninth Circuit affirmed remand orders in three patient class actions alleging disclosure of private medical information through Cedars-Sinai's website tracking software. The court concluded that Cedars-Sinai's website development did not establish federal officer removal jurisdiction; the excerpt describes a jurisdictional ruling rather than a determination of the underlying privacy claims.
In re: Novant Health, Inc.
The agreement concerns consolidated federal class litigation alleging privacy-related claims arising from Novant Health’s use of an Internet tracking pixel and potential disclosure of personal or health-related information. The parties reached an agreement before a ruling on the motion to dismiss, but settlement and dismissal remain subject to court approval in this excerpt; Novant denies wrongdoing and liability.
Golden v. NBCUniversal Media, LLC
The Second Circuit affirmed dismissal of Sherhonda Golden’s lawsuit against NBCUniversal Media concerning alleged disclosure of her Today.com video-viewing activity to Facebook through the Facebook Pixel. The nonprecedential summary order stated that Solomon compelled dismissal of her VPPA claim based on substantially similar allegations; Golden did not challenge dismissal of her unjust enrichment claim on appeal.
Montana Strong, et al. v. LifeStance Health Group Incorporated
The court-authorized notice describes a proposed settlement in a federal class action concerning LifeStance's alleged use of website pixels to collect and disclose patients' personally identifiable information to third parties. Court approval remains pending, with the final approval hearing scheduled for October 16, 2026, at 2:00 p.m. MT.
Matthew Horan et al. v. National Cable Satellite Corporation
Plaintiffs filed a putative VPPA class action alleging that National Cable Satellite Corporation shared C-SPAN website video-viewing information with Facebook and associated viewing activity with their Facebook accounts without consent. The excerpt discusses the motion to dismiss and whether plaintiffs' email-address exchange supports subscriber commitment, but does not include the court's final disposition.
Salazar v. Paramount Global
Salazar alleges that Paramount transmitted his 247Sports.com video-viewing information to Facebook without consent through a web-tracking tool. The district court dismissed his VPPA class action, and the Sixth Circuit affirmed because his newsletter subscription did not establish VPPA consumer status. The Supreme Court granted review of the consumer-definition question, with oral argument listed for October 14, 2026.
Brian Elkins and Annie Elkins v. Southeastern Indiana Health Management Inc. d/b/a Columbus Regional Health
Brian and Annie Elkins brought a putative class lawsuit alleging that a tracking pixel in Columbus Regional Health's patient portal shared health data without consent. The hospital removed the case from state court, and the excerpt discusses plaintiffs' motion to remand and questions the hospital's federal officer removal theory; it does not include the ultimate ruling.
Heredia Crespi et al. v. BayCare Health System, Inc.
Plaintiffs allege that BayCare used Google Analytics 4 and DoubleClick on its website without visitors’ consent, transmitting sensitive medical information and electronic communications to Google. The court granted in part and denied in part BayCare’s motion to dismiss, but the excerpt does not specify the disposition of individual claims.
R.G. v. Oregon Clinic, P.C.
R.G. filed a proposed class action against Oregon Clinic, P.C. in federal court in Oregon on August 10, 2026, alleging that website tracking tools disclosed patients’ private information to third parties, including Google. The excerpt describes invasion-of-privacy and implied-contract claims and requests for damages and injunctive relief; it supplies no court ruling or subsequent case status.
Ward v. Mochi Health Corp.
Ward alleges that third-party trackers or pixels on Mochi Health's website collected her sensitive health information. The court granted in part and denied in part the motion to dismiss, finding several privacy claims plausibly pleaded and concluding that later alleged collection events support timely CIPA claims despite some older incidents falling outside the limitations period.
In re CityMD Data Privacy Litigation
New York residents brought a consolidated class action alleging that Summit Health Management, LLC, doing business as CityMD, disclosed patient information to third-party advertisers through website tracking technologies. The District of New Jersey denied the defendant's motion to transfer venue to the Eastern District of New York; the excerpt does not resolve the merits of the privacy or ECPA claims.
John Doe v. SSM Health Care Corporation
John Doe filed a putative class action alleging that SSM’s MyChart portal transmitted personal health information to third-party marketing services through Meta Pixel. The Eighth Circuit affirmed remand to Missouri state court after the district court rejected federal officer and CAFA removal; the excerpt provides the appellate federal officer analysis but only the beginning of its CAFA discussion.
Relevant Federal Statutes
- Federal Wiretap Act (Title III) — 18 U.S.C. § 2510 et seq. · private right of action · statutory damages
- Electronic Communications Privacy Act — 18 U.S.C. §§ 2510–2523 · private right of action · statutory damages
- Stored Communications Act — 18 U.S.C. § 2701 et seq. · private right of action · statutory damages
Historical Risk Guideline
| Date | Risk Guideline | Level | Confidence | Tracked Lawsuits |
|---|---|---|---|---|
| October 12, 2026 | 68 | High | 96% | 140 |
| October 13, 2026 | 68 | High | 96% | 140 |
| October 13, 2026 | 68 | High | 96% | 141 |
| October 13, 2026 | 68 | High | 96% | 142 |
| October 13, 2026 | 68 | High | 96% | 142 |
| October 13, 2026 | 68 | High | 96% | 142 |
| October 13, 2026 | 68 | High | 96% | 142 |
| October 13, 2026 | 68 | High | 96% | 142 |
| October 13, 2026 | 68 | High | 96% | 143 |
| October 13, 2026 | 68 | High | 96% | 143 |
| October 13, 2026 | 68 | High | 96% | 144 |
| October 13, 2026 | 68 | High | 96% | 145 |
Methodology & Limitations
Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.
The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.
Sources
- Doe v. Cedars-Sinai Health System
- Settlement agreement involving tracking tools and pixel disclosure
- Golden v. NBCUniversal Media — Summary Order
- Memorandum Opinion — Case No. 1:25-cv-01114-BAH, Document 25
- Salazar v. Paramount Global
- FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data
- Utah sues Hims & Hers for charging consumers without consent and sharing private health data
- October 2026 Supreme Court hearing list — Salazar v. Paramount Global VPPA appeal scheduled for October 14
- FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices
- 23-6209 - Doe v. Integris Health [11145755]
- Heredia Crespi et al. v. BayCare Health System, Inc. — Order Granting in Part and Denying in Part Motion to Dismiss
- WW v. Orlando Health, Inc. - Order / filing discussing Meta (Facebook) pixel on website
- X-Mode Social, Inc.
- Federal Wiretap Act claim against Blue Shield dismissed by US federal judge
- Snap asks US judge to dismiss lawsuit over website tracking
- R.G. v. Oregon Clinic, P.C., No. 3:26-cv-01666 — Class Action Complaint
- Salazar v. Paramount Global (25-459)
- The Supreme Court Digital-Privacy Case That Could Go Either Way
- In re CityMD Data Privacy Litigation — Opinion on Motion to Transfer Venue
- Doe v. SSM Health Care Corporation, No. 23-3138: Opinion Affirming Remand of Missouri Website Health-Data Claims
- Swarts v. Home Depot — Order Granting Motion to Dismiss
- Blandford v. UofL Health, Inc. et al., No. 3:23-cv-00192-DJH, Document 55 — Remand Order
- Federal Court Dismisses Lawsuit Over Use of Pixel Technology on University Hospital Websites
- QPReport
- Supreme Court VPPA Case Salazar v. Paramount: Argument Preview
All State Pages
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website