Illinois Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: October 12, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: October 12, 2026.

Current Landscape

The supplied Illinois dataset assigns an elevated risk level and reports three lawsuits, zero demand letters, and zero additional tracked matters. It lists the Illinois Eavesdropping Act and BIPA, but the supplied case summaries do not identify a BIPA claim or ruling.

Brand v. The University of Phoenix concerns allegations that students’ personally identifiable information was disclosed to Meta and other third parties without consent. The defendant denies wrongdoing. The court-authorized website reports a settlement subject to court approval, with final approval scheduled for November 20, 2026. Charlie Lucas v. Call-On-Doc concerns allegations involving third-party tracking pixels under certain California laws, despite being filed in Illinois state court. Call-On-Doc denies wrongdoing, and the settlement website states that the court has neither decided the merits nor granted final settlement approval.

In Dawson v. The University of Phoenix, the district court granted in part and denied in part a motion to dismiss. ECPA, Illinois Eavesdropping Act, and some VPPA theories may proceed, while certain vendor-specific VPPA theories were dismissed. This pleading-stage ruling is not a finding of liability. The supplied summaries identify no standing determination.

Current Litigation Activity

Current litigation component: 37/100.

Important New Filings

• Brand, et al. v. The University of Phoenix, Inc.
• Charlie Lucas v. Call-On-Doc, Inc.

Current Filing & Litigation Trends

The three supplied summaries share a focus on alleged third-party disclosures through website tracking technologies. They include two settlement-related matters and one partial dismissal ruling. This limited set does not establish whether filings are increasing, how frequently particular claims succeed, or a broader statewide trend. The reported absence of demand letters applies only to the supplied dataset.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• Illinois Eavesdropping Act — 720 ILCS 5/14-1 et seq. · all-party consent · private right of action
• Illinois Biometric Information Privacy Act (BIPA) — 740 ILCS 14/1 et seq. · private right of action · statutory damages

Regulatory Enforcement

Regulatory enforcement component: 0/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

No specific enforcement actions are itemized for this jurisdiction.

Agency Guidance

Regulatory trend: insufficient data.

Global Privacy Control / Opt-Out Signals

Limited data

GPC / universal opt-out exposure component: limited data — this component is excluded from the overall risk guideline for this jurisdiction until researched (remaining components are reweighted accordingly).

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

The excerpt does not discuss Global Privacy Control or universal opt-out requirements.

GPC evidence confidence: 100%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

Technologies Appearing in Claims

• Pixels
• Cookies
• Similar website tracking tools
• Pixels, as identified in the settlement title
• Similar website tools
• Third-party tracking pixels
• Facebook Tracking Pixel
• cookies (e.g., c_user cookie)
• browser fingerprinting
• IP addresses
• unique device identifiers
• machine unique identifiers
• third-party tracking pixels and scripts
• cookies
• third-party tracking technologies (Meta/Facebook, Google, LinkedIn, TikTok, Microsoft, Amazon)
• Meta advertising trackers
• Google advertising trackers
• Website tracking tools
• Built-in search bar
• Website video viewing
• Instagram
• Facebook
• Algorithmic feeds
• Age assurance
• Push notifications

Historical Risk Guideline

What Businesses Should Review

Review deployed website and app tracking tools, their triggers, transmitted data fields, and recipients. Where present, examine pixels, cookies, fingerprinting, advertising tags, identifiers, and tools associated with search, video, or account activity. Compare actual data sharing with cookie banners, privacy policies, and consent flows, including disclosures involving Meta and other vendors. The broader technology list is a review inventory, not evidence that every listed tool or vendor appears in each summarized case. Assess statutory relevance separately: the dataset lists BIPA, but the supplied summaries do not explain its application to these matters.

Data Quality

49 source(s), 23 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• Allstate Accused Of Website Tracking Despite Cookie Opt-Out — Law360 Insurance Authority · Tier B (Authoritative secondary)
• Stowe et al. v. Hearst Magazine Media, Inc., d/b/a Bicycling — Opinion and Order Denying Motion to Compel Arbitration — U.S. District Court for the District of Delaware · Tier A (Primary authority)
• Utah Secures $12.2 Billion Settlement With Meta Over Child Safety Practices — Governor Spencer J. Cox · Tier A (Primary authority)
• University of Phoenix Student Dismisses Video-Privacy Lawsuit — Bloomberg Law · Tier B (Authoritative secondary)
• University of Phoenix Pixel Settlement — Brand, et al. v. The University of Phoenix, Inc. — Simpluris, court-authorized settlement administrator · Tier A (Primary authority)
• Dental Intelligence Reaches $5.75 Million Deal in Privacy Suit — Bloomberg Law · Tier B (Authoritative secondary)
• Still Tracking, Still Suing: Website Privacy Litigation After SB 690 — Bass, Berry & Sims (via Mondaq) · Tier C (Professional analysis)
• Call-On-Doc Pixel Settlement — Lucas v. Call-On-Doc, Inc., Case No. 2026LA000403 — Court-authorized settlement website · Tier A (Primary authority)
• University of Phoenix Student Dismisses Video-Privacy Lawsuit — Bloomberg Law · Tier B (Authoritative secondary)
• University of Phoenix Pixel Settlement — Frequently Asked Questions: Brand, et al. v. The University of Phoenix, Inc. — University of Phoenix Pixel Settlement — Court-authorized settlement website · Tier A (Primary authority)
• Hutcheson et al v. Verogen, Inc., 3:2024cv01977 - Document 54 (S.D. Cal. 2026) — Justia — U.S. District Court for the Southern District of California · Tier A (Primary authority)
• University of Phoenix Pixel Settlement — Brand, et al. v. The University of Phoenix, Inc. — Simpluris, court-authorized settlement administrator · Tier A (Primary authority)
• Hutcheson et al. v. Verogen, Inc. — Order Granting in Part and Denying in Part Motion to Dismiss — U.S. District Court for the Southern District of California via Justia · Tier A (Primary authority)
• Hutcheson et al. v. Verogen, Inc.: Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss the Second Amended Complaint — U.S. District Court for the Southern District of California / Justia · Tier A (Primary authority)
• Grivetti v. Dental Intelligence, Inc. — Preliminary Approval Order — U.S. District Court for the Northern District of Illinois (CourtListener RECAP) · Tier A (Primary authority)
• In Re: Zillow Group, Inc. Session Replay Software Litigation — Document 119 — U.S. District Court for the Western District of Washington, via Justia · Tier A (Primary authority)
• Parties Clash Over Scope Of GIPA In DNA Test-Taker's Suit — Duane Morris LLP · Tier B (Authoritative secondary)
• University of Phoenix Pixel Settlement — Frequently Asked Questions — University of Phoenix Pixel Settlement Administrator · Tier E (General web)
• Stowe et al. v. Hearst Magazine Media, Inc. — Document 23, Opinion Denying Motion to Compel Arbitration — U.S. District Court for the District of Delaware, via Justia · Tier A (Primary authority)
• In Re: Zillow Group, Inc. Session Replay Software Litigation — Document 119 — U.S. District Court for the Western District of Washington (via Justia) · Tier A (Primary authority)
• Privacy Litigation Report: Takeaways From August 2026 Decisions — Troutman Pepper Locke — Privacy + Cyber + AI · Tier C (Professional analysis)
• Website Tracking Lawsuit Against Retailer Dismissed for Lack of Standing: What California Ruling Means for Your Business — Fisher Phillips LLP · Tier B (Authoritative secondary)
• Still Tracking, Still Suing: Website Privacy Litigation After SB 690 — The Legal 500 · Tier C (Professional analysis)
• Session replay lawsuits, explained for site owners — Bigdelta · Tier E (General web)
• IN RE: OTTER.AI PRIVACY LITIGATION — Order Granting Motion to Dismiss in Part — FindLaw (U.S. District Court, N.D. Cal. docket summary) · Tier A (Primary authority)

All State Pages