Pennsylvania Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: October 12, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: October 12, 2026.

Current Landscape

The supplied dataset labels Pennsylvania’s risk level as elevated and reports seven lawsuits, zero demand letters, and zero other tracked matters. Those counts are dataset figures, not a measure of all Pennsylvania litigation. The summaries include two entries for Petris v. Sportsman’s Warehouse, so they do not independently establish seven distinct lawsuits. Website-related matters concern tracking pixels, analytics, session replay, and alleged third-party disclosure of purchase information, with the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA) a recurring statutory basis.

Several summaries describe settlements or proposed settlements, not merits holdings. In Mohr v. The Trustees of The University of Pennsylvania, a reported $9.25 million agreement concerns alleged sharing of patient information through tracking pixels, includes website-governance changes, and has a final approval hearing scheduled for November 12, 2026; UPHS admitted no wrongdoing. Farst v. AutoZone describes a session-replay settlement offering $20 per valid, timely claim, subject to court approval, with defendants denying liability. Petris describes a proposed settlement concerning alleged disclosure of online firearm-purchase information, with payments of up to $107 for eligible claimants and defendants denying the allegations and liability. The supplied Petris sources conflict on the hearing date—July 31 versus September 3, 2026—and neither establishes final approval. Delsignore v. Zazzle describes complaint allegations about session-replay recording, not a judicial finding.

Other decisions address threshold issues. In Delong v. PHE, the court dismissed without prejudice for failure to allege a concrete Article III injury, alternatively held that specific personal jurisdiction was lacking, and did not reach the WESCA merits. In Winig, the Pennsylvania Supreme Court held that high public official immunity shielded district attorneys and assistant district attorneys from monetary-damages claims for acts within their official duties. It left certain other immunity arguments unresolved.

Current Litigation Activity

Current litigation component: 59/100.

Important New Filings

• Mohr, et al. v. The Trustees of The University of Pennsylvania as Owner and Operator of The University of Pennsylvania Health System (d/b/a Penn Medicine)
• Petris v. Sportsmans Warehouse, Inc., et al.
• Petris v. Sportsman’s Warehouse, Inc., et al.

Current Filing & Litigation Trends

Within this dataset, recurring subjects include session replay, tracking pixels, analytics, and alleged disclosure of purchase information. Several summaries concern class actions or proposed class settlements, while others concern standing, personal jurisdiction, or immunity. The supplied facts do not establish an increase or decrease in filings over time, and the duplicate Petris entries limit conclusions about the number of distinct cases.

Precedent Landscape: What Courts Have Decided

Precedent component: 20/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

0 plaintiff-favorable and 1 defense-favorable decision(s) tracked; 1 carry binding authority.

Key Decisions

• Winig v. Office of the District Attorney of Philadelphia · defense favorable · weight: binding high

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA) — 18 Pa. Cons. Stat. § 5701 et seq. · all-party consent · private right of action · statutory damages

Regulatory Enforcement

Regulatory enforcement component: 0/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

No specific enforcement actions are itemized for this jurisdiction.

Agency Guidance

Regulatory trend: insufficient data.

Global Privacy Control / Opt-Out Signals

Currently recognized

GPC / universal opt-out exposure component: 60/100. This component reflects whether the state currently requires or recognizes universal opt-out preference signals (such as GPC) and related enforcement activity, and is a weighted input to the overall risk guideline. It describes the state's legal posture — never any individual website's behavior.

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

The opinion cites that the plaintiff alleged PHE did not enable Google Analytics' IP anonymization feature, but the court found lack of expectation of privacy dispositive of standing. The opinion does not analyze statutory enforcement mechanisms under a privacy framework.

GPC evidence confidence: 20%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

Technologies Appearing in Claims

• tracking pixels
• analytics technologies
• advertising technologies
• session replay
• Session replay
• website
• Google Analytics
• web analytics/tracking
• surreptitious audio recordings
• Meta Pixel
• Google Tag Manager
• LinkedIn Insight Tag
• Website tracking, mechanism unspecified
• Website tracking tools
• Built-in search bar
• Website video viewing
• Session Replay Code
• Keystroke and text-entry capture
• Browser interaction recording
• Session replay software
• Embedded JavaScript
• Keystroke and text-entry tracking
• Website navigation tracking
• Purchase disclosure to Facebook
• session replay software

Historical Risk Guideline

What Businesses Should Review

Businesses can review which tags, pixels, analytics tools, and replay scripts are deployed; what information they capture; which third parties receive it; and how those flows compare with website disclosures and consent practices. Relevant implementation details include search inputs, keystrokes, text-entry capture, browsing interactions, and purchase workflows. Vendor configurations and website-governance controls also warrant review. Before publishing case-specific settlement information, verify current approval status and reconcile the conflicting Petris hearing dates.

Data Quality

68 source(s), 28 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• $9.25M Penn Medicine pixel tracking class action settlement — Top Class Actions · Tier D (Industry data)
• Michigan Court Lets Patients’ Federal Wiretap Act Claim Over Website Tracking Proceed as Pennsylvania Court Reaches the Opposite Result — Sourcepoint · Tier D (Industry data)
• Sanders v. Shoe Carnival, Inc. — U.S. District Court for the Eastern District of Pennsylvania, via Leagle · Tier A (Primary authority)
• Stowe et al. v. Hearst Magazine Media, Inc., d/b/a Bicycling — Opinion and Order Denying Motion to Compel Arbitration — U.S. District Court for the District of Delaware · Tier A (Primary authority)
• Hasson v. Mattress Firm session-replay appeal opinion — U.S. Court of Appeals for the Third Circuit · Tier A (Primary authority)
• Session replay Website Users Calvert, Hernandez, Moore, Tucker, and Vonbergen lack standing. — GovInfo · Tier A (Primary authority)
• Case 2:22-cv-01568-RJC Document 52 Filed 06/03/24 — GovInfo · Tier A (Primary authority)
• Utah Secures $12.2 Billion Settlement With Meta Over Child Safety Practices — Governor Spencer J. Cox · Tier A (Primary authority)
• Petris v. Sportsmans Warehouse, Inc., et al. — Settlement Website — Simpluris · Tier E (General web)
• Still Tracking, Still Suing: Website Privacy Litigation After SB 690 — Bass, Berry & Sims (via Mondaq) · Tier C (Professional analysis)
• California Enacts SB 690, But Website Tracking Litigation Is Far from Over — Seyfarth Shaw LLP — Carpe Datum Law · Tier C (Professional analysis)
• Felsen et al. v. The Vanguard Group, Inc. — Memorandum — U.S. District Court for the Eastern District of Pennsylvania, via Justia · Tier A (Primary authority)
• Felsen v. The Vanguard Group, Inc. — Leagle — U.S. District Court for the Eastern District of Pennsylvania · Tier A (Primary authority)
• Courts Pushed Back on Website Tracking Lawsuits in September, But Broken Cookie Banners Are Still a Major Risk — Fisher Phillips LLP · Tier C (Professional analysis)
• Felsen v. The Vanguard Group, Inc. — CaseMine — U.S. District Court, Eastern District of Pennsylvania · Tier A (Primary authority)
• DELSIGNORE v. ZAZZLE, INC., No. 2:2022cv01444 — Justia · Tier C (Professional analysis)
• Farst v. AutoZone, Inc. et al. — Settlement Agreement — ClassAction.org (hosting settlement agreement) · Tier A (Primary authority)
• Felsen v. The Vanguard Group, Inc., 2:25-cv-02359 — Midpage · Tier A (Primary authority)
• In Re: Zillow Group, Inc. Session Replay Software Litigation — Document 119 — U.S. District Court for the Western District of Washington, via Justia · Tier A (Primary authority)
• Felsen v. The Vanguard Group, Inc. — Memorandum on Website-Tracking Claims — U.S. District Court for the Eastern District of Pennsylvania, via CaseMine · Tier A (Primary authority)
• Stowe et al. v. Hearst Magazine Media, Inc. — Document 23, Opinion Denying Motion to Compel Arbitration — U.S. District Court for the District of Delaware, via Justia · Tier A (Primary authority)
• Felsen et al. v. The Vanguard Group, Inc. — Memorandum and Opinion — U.S. District Court for the Eastern District of Pennsylvania / Justia · Tier A (Primary authority)
• Santoro v. Tower Health, No. 24-3173 — Justia — U.S. Court of Appeals for the Third Circuit · Tier A (Primary authority)
• Felsen v. The Vanguard Group, Inc. — Memorandum — U.S. District Court for the Eastern District of Pennsylvania, via Leagle · Tier E (General web)
• In Re: Zillow Group, Inc. Session Replay Software Litigation — Document 119 — U.S. District Court for the Western District of Washington (via Justia) · Tier A (Primary authority)

All State Pages