New York Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: August 31, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: August 31, 2026.

Current Landscape

Jurisdiction: New York. Risk level (informational guideline): Lower. Tracked litigation activity in this jurisdiction currently centers on a single tracked class action, Kaplan v. Northwell Health, Inc., pending in New York State Supreme Court (Kings County). The complaint in that matter alleges that patients' personally identifiable information (PII) was disclosed via tracking technologies embedded in a patient portal and related appointment-booking pages; the parties reached a settlement that a court approved by Final Approval Order dated April 23, 2026, and a Notice of Appeal has been filed challenging that approval. Courts in the jurisdiction are examining how healthcare-related websites and portals use web-tracking scripts, tags, and pixels and how data flows to third-party analytics and advertising services.

The New York Eavesdropping Statute (N.Y. Penal Law § 250.05) is part of the statutory backdrop referenced in the tracked matter. Technologies appearing in the Kaplan matter and in related monitoring include tracking pixels (including Meta/Facebook Pixel, Snap Pixel, TikTok Pixel), Google Ads and DoubleClick, Google Analytics, Microsoft UET, cookies and consent management platforms (CMPs), web tracking scripts/tags, session replay, and third-party tracking tools. Contextual topics tracked alongside technical tools include telehealth, patient portals (FollowMyHealth), appointment booking pages (northwell.edu), automated decisionmaking, artificial intelligence and algorithmic bias, biometrics, location data, data brokers, and social media integrations.

Current Litigation Activity

Current litigation component: 6/100.

Important New Filings

• Kaplan v. Northwell Health, Inc. · April 23, 2026

Current Filing & Litigation Trends

Tracked filings in New York are limited at present: one tracked lawsuit (Kaplan v. Northwell) and no tracked demand letters or other matters in the current dataset. The notable procedural development is a court-approved settlement (Final Approval Order, April 23, 2026) that is the subject of a Notice of Appeal, which may prolong judicial attention to issues raised in the case.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• New York Eavesdropping Statute — N.Y. Penal Law § 250.05

Regulatory Enforcement

Regulatory enforcement component: 0/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

No specific enforcement actions are itemized for this jurisdiction.

Agency Guidance

Regulatory trend: insufficient data.

Global Privacy Control / Opt-Out Signals

Limited data

GPC / universal opt-out exposure component: limited data — this component is excluded from the overall risk guideline for this jurisdiction until researched (remaining components are reweighted accordingly).

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

GPC evidence confidence: 50%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

Technologies Appearing in Claims

• Tracking Technologies
• FollowMyHealth patient portal
• Northwell website appointment booking (northwell.edu)
• pixels (implied by 'Pixel Settlement')
• cookies
• pixels
• session replay
• AdTech / third-party tracking tools
• website tracking tools
• scheduling tools / form submission
• checkout/ordering interfaces
• session replay tools
• advertising pixels
• analytics
• chat widgets
• ad platforms
• third-party tracking cookies
• device fingerprinting
• mobile advertising IDs
• IP addresses / HTTP request information
• cookie IDs
• session replay software
• third-party advertising trackers
• analytics platforms
• Google Ads

Historical Risk Guideline

What Businesses Should Review

Technical review priorities for organizations operating in this space include: inventorying all third-party tags/pixels and mapping data flows from patient-facing pages to external vendors; identifying whether any patient identifiers or sensitive health-related fields are transmitted to analytics/advertising endpoints and minimizing such transmissions; reviewing CMP configurations and consent capture/logging to ensure alignment between collected consents and actual tag behavior; evaluating session-replay tools and disabling or restricting them where they may capture PII or protected health information; considering server-side measurement or tag management to limit client-side leakage; reviewing vendor contracts for permitted uses, retention, and onward sharing; implementing access controls, logging, and data-retention limits; and conducting privacy/security impact assessments (or DPIAs) and consulting privacy and regulatory counsel to align technical mitigations with legal and business requirements.

Data Quality

9 source(s), 3 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• Privacy Litigation Report: Takeaways From March 2026 Decisions — Troutman Pepper (Privacy + Cyber + AI) · Tier C (Professional analysis)
• The Federal Wiretap Act & Website Tracking Litigation — Crandall Consulting · Tier D (Industry data)
• Courts Still Divided on Whether California Privacy Law Applies to Website Tracking: 4 Rulings in 10 Days Highlight Business Confusion — Fisher Phillips (published on JD Supra) · Tier A (Primary authority)
• Pfizer faces CIPA class action over alleged post-opt-out personal data sharing — Privado AI · Tier D (Industry data)
• CLASS ACTION COMPLAINT (Laura Gilbert v. Brooklinen, Inc.) — ClassAction.org · Tier A (Primary authority)
• U.S. Cybersecurity and Data Privacy Review and Outlook – 2025 — Gibson, Dunn & Crutcher LLP · Tier E (General web)
• The ECPA: A Federal Private Right of Action for Privacy Policy Inaccuracies? (And What You Can Do to Cut Off Class Action Lawsuits) — Troutman Pepper Locke (JD Supra) · Tier B (Authoritative secondary)
• Northwell Pixel Settlement — Kaplan v. Northwell Health, Inc. — Northwell Pixel Settlement (settlement administrator / Simpluris) · Tier A (Primary authority)
• Recent Insights on Website Tracking Litigation — Workplace Privacy, Data Management & Security Report (Jackson Lewis) · Tier C (Professional analysis)

All State Pages