Illinois Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: August 31, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: August 31, 2026.

Current Landscape

In Illinois the tracked litigation activity is currently modest: one tracked putative class action is pending. Relevant state and federal statutes that appear in tracked matters include the Illinois Eavesdropping Act (720 ILCS 5/14-1 et seq.) and the Illinois Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq.), and courts are also being asked to apply federal statutes in related privacy claims. The technologies appearing across tracked matters include third-party tracking pixels and scripts (e.g., Meta/Facebook Pixel and Facebook Conversions API), cookies (including example c_user cookies and first-party cookies), Google Analytics and other Google tracking tools, browser fingerprinting, IP and device identifiers, session replay and form-field capture, SDKs, URL/form field capture, appointment forms, patient portals, and a range of third-party vendors (Meta/Facebook, Google, LinkedIn, TikTok, Microsoft, Amazon).

Current Litigation Activity

Current litigation component: 3/100.

Current Filing & Litigation Trends

Filing activity tracked in Illinois is currently limited to one filed case, but the matters focus on a consistent set of technologies and factual patterns: use of tracking pixels and analytics (including server-side conversion tools), cookie-based identifiers, form-field and URL capture, session replay, and cross-vendor data transfers. Courts in the tracked matter are parsing statutory theories under the Illinois Eavesdropping Act, VPPA-related allegations, and federal privacy statutes at the pleading stage.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• Illinois Eavesdropping Act — 720 ILCS 5/14-1 et seq. · all-party consent · private right of action
• Illinois Biometric Information Privacy Act (BIPA) — 740 ILCS 14/1 et seq. · private right of action · statutory damages

Regulatory Enforcement

Regulatory enforcement component: 0/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

No specific enforcement actions are itemized for this jurisdiction.

Agency Guidance

Regulatory trend: insufficient data.

Global Privacy Control / Opt-Out Signals

Limited data

GPC / universal opt-out exposure component: limited data — this component is excluded from the overall risk guideline for this jurisdiction until researched (remaining components are reweighted accordingly).

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

GPC evidence confidence: 50%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

Technologies Appearing in Claims

• Facebook Tracking Pixel
• cookies (e.g., c_user cookie)
• browser fingerprinting
• IP addresses
• unique device identifiers
• machine unique identifiers
• third-party tracking pixels and scripts
• cookies
• third-party tracking technologies (Meta/Facebook, Google, LinkedIn, TikTok, Microsoft, Amazon)
• pixels
• session replay
• AdTech / third-party tracking tools
• website tracking tools
• scheduling tools / form submission
• checkout/ordering interfaces
• Meta Pixel
• TikTok Pixel
• Google Analytics
• fingerprinting
• session-replay tools
• customer-service chatbots
• fingerprinting scripts
• web chat software
• third-party tracking scripts
• Meta Pixel (Facebook Business Tools)

Historical Risk Guideline

What Businesses Should Review

Technical review suggestions for businesses operating in this landscape: perform an audit of all third-party scripts, pixels, SDKs and server-side trackers; map data flows from client pages (especially video players, appointment/patient portals, and form pages) to vendor endpoints; minimize collection and transmission of identifiable or sensitive fields, and disable or reconfigure tools that capture form fields or session replay on sensitive pages; implement or review consent-management and cookie controls; ensure logging, access controls, retention limits, encryption in transit and at rest, and up-to-date vendor DPAs that address data handling and deletion requests; and document decisions and settings so that technical configurations and contractual terms can be correlated if litigation or regulatory inquiries arise.

Data Quality

22 source(s), 8 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• Privacy Litigation Report: Takeaways From March 2026 Decisions — Troutman Pepper (Privacy + Cyber + AI) · Tier C (Professional analysis)
• When a Website Becomes a Wiretap — Mason & Perry LLP (Mason LLP) · Tier C (Professional analysis)
• When a Website Becomes a Wiretap — Mason & Perry LLP · Tier C (Professional analysis)
• L.C. v. Fertility Centers of Illinois, PLLC (N.D. Ill. Dec 8, 2025) - Memorandum Opinion and Order — CaseMine · Tier B (Authoritative secondary)
• Lisota v. Heartland Dental, LLC et al, 1:2025cv07518 - Document 38 (N.D. Ill. 2026) — Justia · Tier A (Primary authority)
• U.S. Cybersecurity and Data Privacy Review and Outlook – 2025 — Gibson, Dunn & Crutcher LLP · Tier E (General web)
• The ECPA: A Federal Private Right of Action for Privacy Policy Inaccuracies? (And What You Can Do to Cut Off Class Action Lawsuits) — Troutman Pepper Locke (JD Supra) · Tier B (Authoritative secondary)
• Multi-Court Split on Website Tracking Federal Wiretapping Claims Creates Compliance Confusion: 6 Strategies to Avoid Risk — Fisher Phillips (published on JD Supra) · Tier A (Primary authority)
• AHA urges court to dismiss tracking tech lawsuit against Endeavor Health — TechTarget · Tier E (General web)
• Nourish Stuck With Wiretap Claim Over Use of Google Web Tracker — Bloomberg Law · Tier B (Authoritative secondary)
• AHA asks court to dismiss website-tracking lawsuit against Endeavor Health — Beckers Hospital Review · Tier A (Primary authority)
• Doe et al v. Veradigm, Inc., No. 1:2025cv10147 - Document 60 (N.D. Ill. 2026) — Justia (docket/document) · Tier C (Professional analysis)
• AHA asks court to dismiss website-tracking lawsuit against Endeavor Health — Becker's Hospital Review · Tier B (Authoritative secondary)
• Dawson v. The University of Phoenix, Inc., No. 1:2025cv03497 - Document 52 (N.D. Ill. 2026) — Justia (court document) · Tier B (Authoritative secondary)
• Multi-Court Split on Website Tracking Federal Wiretapping Claims Creates Compliance Confusion: 6 Strategies to Avoid Risk — Fisher Phillips (via JD Supra) · Tier A (Primary authority)
• So v. Hyatt Hotels Corp. — vLex (case law repository) · Tier A (Primary authority)
• When Your Own Website Becomes the “Wiretap”: Defending Illinois Businesses Against Pixel Tracking Class Actions Under the Federal Wiretap Act — Chicago Business Litigation Lawyer Blog (DiTommaso Lubin, P.C.) · Tier C (Professional analysis)
• Dawson v. The University of Phoenix, Inc., No. 1:2025cv03497 - Document 52 (N.D. Ill. 2026) — Justia (federal docket/opinion) · Tier A (Primary authority)
• Tips for Protecting Your Business from Wiretap Lawsuits Targeting Companies with Consumer-Facing Websites — American Bar Association · Tier A (Primary authority)
• California SB 690 Spares Email Pixel Wiretap Suits — Gblock · Tier E (General web)
• Juhyun So v. Hyatt Hotels Corporation — CaseMine · Tier A (Primary authority)
• How Website Wiretapping Lawsuits Work: Tracker to Demand Letter — Consently · Tier E (General web)

All State Pages