New York Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: October 13, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: October 13, 2026.

Current Landscape

The supplied New York tracking data reports one lawsuit, no demand letters, and no other tracked matters. These counts describe the supplied dataset, not all litigation in New York. The facts list the New York Eavesdropping Statute (N.Y. Penal Law § 250.05), but the case summary does not establish that Kaplan v. Northwell Health, Inc. asserted a claim under that statute.

According to the settlement FAQ summarized in the facts, Kaplan alleges that Northwell disclosed patients’ personally identifiable information to third parties through tracking technologies without consent. Northwell denies liability. A New York state trial court preliminarily approved a proposed class settlement and conditionally certified a settlement class. Final approval remains required, and the court has not decided the merits. The supplied facts do not identify a standing ruling.

The technology list includes portals, appointment-booking services, pixels, analytics tools, and other digital technologies and controls. The case summary does not establish that every listed technology was involved in Kaplan.

Current Litigation Activity

Current litigation component: 6/100.

Important New Filings

• Kaplan v. Northwell Health, Inc. · April 23, 2026

Current Filing & Litigation Trends

The supplied counts show limited tracked activity: one lawsuit and no demand letters or other matters. A single settlement-stage case does not establish a filing trend, a statewide litigation rate, or how courts will resolve similar claims. The dataset labels New York’s risk level as “Lower,” but supplies no methodology supporting a broader risk assessment.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• New York Eavesdropping Statute — N.Y. Penal Law § 250.05

Regulatory Enforcement

Regulatory enforcement component: 34/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

• OAG investigation of website privacy controls — Office of the New York State Attorney General
  OAG reported finding nonfunctioning privacy controls on 13 high-traffic websites, contacted their operators, and stated that all companies resolved the identified control issues. The excerpt does not describe a court filing or formal disposition.

Agency Guidance

[object Object],[object Object]

Regulatory trend: active.

Global Privacy Control / Opt-Out Signals

Limited data

GPC / universal opt-out exposure component: limited data — this component is excluded from the overall risk guideline for this jurisdiction until researched (remaining components are reweighted accordingly).

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

The excerpt does not discuss Global Privacy Control requirements or mechanisms.

GPC evidence confidence: 100%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

Technologies Appearing in Claims

• Tracking Technologies
• FollowMyHealth patient portal
• Northwell website appointment booking (northwell.edu)
• pixels (implied by 'Pixel Settlement')
• Tracking technologies
• Pixels, as identified in the settlement website title
• Facebook Pixel
• Meta Pixel
• Google Analytics
• Google DoubleClick
• LinkedIn Insight Tag
• Conversions API
• cookies
• device fingerprinting
• browser privacy controls
• ad blockers
• browser extensions
• pixels
• website
• app
• Instagram
• Facebook
• Algorithmic feeds
• Age assurance
• Push notifications

Historical Risk Guideline

What Businesses Should Review

Organizations may consider reviewing tracking tools on patient-facing pages, portals, and appointment-booking flows; the information transmitted to third parties; consent mechanisms and privacy controls; vendor settings and contracts; and whether public disclosures reflect actual data practices. These are practical review topics prompted by the allegations, not requirements established by a merits or standing ruling in the supplied record.

Data Quality

23 source(s), 12 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• Golden v. NBCUniversal Media — Summary Order — U.S. Court of Appeals for the Second Circuit · Tier A (Primary authority)
• Northwell Pixel Settlement: Frequently Asked Questions — Kaplan v. Northwell Health, Inc. — Northwell Pixel Settlement Administrator · Tier E (General web)
• In re CityMD Data Privacy Litigation — Opinion on Motion to Transfer Venue — U.S. District Court for the District of New Jersey (via Justia) · Tier A (Primary authority)
• A consumer guide to web tracking — New York Attorney General · Tier A (Primary authority)
• MLB Defeats Three Video-Privacy Suits Over Meta Info Sharing — Bloomberg Law · Tier B (Authoritative secondary)
• Utah Secures $12.2 Billion Settlement With Meta Over Child Safety Practices — Governor Spencer J. Cox · Tier A (Primary authority)
• Attorney General James and Governor Hochul Release Final SAFE for Kids Act Rules to Protect Children Online — New York Attorney General · Tier A (Primary authority)
• Website Privacy Controls: A Guide for Business — New York State Office of the Attorney General · Tier A (Primary authority)
• Northwell Pixel Settlement — Kaplan v. Northwell Health, Inc.; Final Approval Order Appeal Update — Simpluris, court-authorized settlement administrator · Tier A (Primary authority)
• Golden v. NBCUniversal Media, LLC — Petition for a Writ of Certiorari — Supreme Court of the United States (petition filed by counsel for Sherhonda Golden) · Tier A (Primary authority)
• Gilbert v. Brooklinen, Inc., No. 1:2026cv03697 — Public Docket — Justia Dockets & Filings · Tier B (Authoritative secondary)
• Website Tracking Lawsuit Against Retailer Dismissed for Lack of Standing: What California Ruling Means for Your Business — Fisher Phillips LLP · Tier B (Authoritative secondary)
• D'Antonio v. Cable News Network, Inc. (CNN), Document 86 (S.D.N.Y. Decision) — Justia (U.S. District Court for the Southern District of New York) · Tier A (Primary authority)
• Website Tracking Litigation Cases — Tracked Matters — Crandall Consulting (Inspection-Ready Institute, Inc.) · Tier D (Industry data)
• Privacy Litigation Report: Takeaways From March 2026 Decisions — Troutman Pepper (Privacy + Cyber + AI) · Tier C (Professional analysis)
• The Federal Wiretap Act & Website Tracking Litigation — Crandall Consulting · Tier D (Industry data)
• Courts Still Divided on Whether California Privacy Law Applies to Website Tracking: 4 Rulings in 10 Days Highlight Business Confusion — Fisher Phillips (published on JD Supra) · Tier A (Primary authority)
• Pfizer faces CIPA class action over alleged post-opt-out personal data sharing — Privado AI · Tier D (Industry data)
• CLASS ACTION COMPLAINT (Laura Gilbert v. Brooklinen, Inc.) — ClassAction.org · Tier A (Primary authority)
• U.S. Cybersecurity and Data Privacy Review and Outlook – 2025 — Gibson, Dunn & Crutcher LLP · Tier E (General web)
• The ECPA: A Federal Private Right of Action for Privacy Policy Inaccuracies? (And What You Can Do to Cut Off Class Action Lawsuits) — Troutman Pepper Locke (JD Supra) · Tier B (Authoritative secondary)
• Northwell Pixel Settlement — Kaplan v. Northwell Health, Inc. — Northwell Pixel Settlement (settlement administrator / Simpluris) · Tier A (Primary authority)
• Recent Insights on Website Tracking Litigation — Workplace Privacy, Data Management & Security Report (Jackson Lewis) · Tier C (Professional analysis)

All State Pages