Why FSCA and WESCA Wiretapping Laws in Florida and Pennsylvania Could Mean a Lawsuit for Your Website

If you run a website that gets traffic from Florida or Pennsylvania, and most do, there's a good chance a decades-old wiretapping law now applies to your tracking pixels and chat tools, whether you know it or not. 

It started with California's Invasion of Privacy Act (CIPA), a 1967 telephone wiretapping statute that plaintiffs' lawyers began pointing at cookies and pixels. 

Florida and Pennsylvania have since followed with their own vintage wiretapping laws: Florida's Security of Communications Act (FSCA) and Pennsylvania's Wiretapping and Electronic Surveillance Control Act (WESCA). Neither law was written with websites in mind, and that's exactly the problem.

Why These Wiretapping Laws Are Suddenly a Web Risk

Are these laws Florida’s CIPA and Pennsylvania’s CIPA? FSCA, WESCA, and CIPA share the same basic design. Each was passed to stop someone tapping a phone line without permission, and each requires consent from every party to a communication, stricter than the "one-party consent" standard that applies under federal law and in most states, where only one person on a call needs to agree to being recorded.

Plaintiffs' lawyers have applied that old framework to modern websites by arguing that a visitor is a "party" to a communication, and that a chat tool, tracking pixel, or session recorder capturing that interaction without disclosed consent is an illegal interception. 

Courts in both Florida and Pennsylvania have let these claims proceed far enough that they're now a real cost of doing business online, however dated the underlying law.

Florida's FSCA: What It Covers and Why It's Being Used Against Websites

Florida's law, at Chapter 934 of the Florida Statutes, dates to 1969 and changed little until 2025, when it suddenly became relevant to ordinary websites.

A federal court hearing W.W. v. Orlando Health let most of the plaintiff's claims move forward, rejecting the argument that website tracking tools only ever collect harmless metadata. 

The court found that tools capturing substantive information, such as form entries or search terms, could count as intercepting the "contents" of a communication rather than background data like IP addresses. That contents-versus-metadata distinction is now the main thing deciding whether an FSCA case against a website survives.

The Orlando Health case itself was dropped before trial in 2026, but the reasoning behind it stuck, and Florida quickly became the second most active state for these lawsuits after California. 

A separate case, Magenheim v. Nike, is set for trial November 2, 2026, in the Southern District of Florida. It’s one of the next tests of how far the theory extends to ordinary retail tracking pixels.

FSCA Coverage

FSCA is part of Florida's wiretapping statute, and three sections are doing most of the work in the lawsuits currently landing on business websites.

Prohibition: Section 934.03 of FSCA

Section 934.03 bans intercepting wire, oral, or electronic communications without consent from everyone involved. In practice, this is the section plaintiffs lean on when arguing that a chat widget or tracking pixel "intercepted" something on your site without the visitor knowing.

Remedies: Section 934.10 of FSCA

Section 934.10 is the civil remedies provision, and it's the reason an individual visitor, not just a prosecutor, can bring a claim over a 934.03 violation. It sets the damages figure below, and it also allows a court to order the practice stopped outright, not just pay for past use.

Devices: Section 934.31 of FSCA

Section 934.31 covers "pen registers" and "trap and trace" devices, originally physical hardware that recorded which numbers a phone dialed. Plaintiffs' firms now argue that ordinary analytics scripts and ad pixels do the same job by capturing and passing along a visitor's identifiers. It's a stretch of the original law, but it's the theory behind most of the pixel- and script-related claims businesses are seeing today.

Penalties for FSCA Violations

If a court finds a violation, damages are set at USD 1,000 per violation or USD 100 per day, whichever is more, plus actual damages, attorneys' fees, and possibly punitive damages.

Pennsylvania's WESCA: The Ruling That Put It on the Map

WESCA has existed since 1978, but the case that made it a fixture on privacy lawyers’ radar landed in 2022.

A federal appeals court ruled in Popa v. Harriet Carter Gifts that a marketing vendor receiving data from a website visitor's interactions could count as an illegal "interceptor" under WESCA, even though the business had chosen to work with that vendor. 

The court also said the interception is treated as happening at the visitor's browser, in Pennsylvania, regardless of where your business is based. If someone in Pennsylvania visits your site and your tracking setup gets flagged, you can be sued there. 

This isn't a quirk unique to WESCA. FSCA works the same way, as does GDPR, which follows the data subject rather than the company, and most U.S. state privacy laws, which apply based on where the affected resident lives. Jurisdiction following the person, not the business, is the norm in privacy law, not the exception.

That ruling opened the door to class actions over chat widgets, session replay tools, and tracking pixels, and Pennsylvania has stayed a steady source of these filings since.

It isn't entirely one-sided. Some courts have ruled that a bare statutory violation isn't enough to get into federal court unless the plaintiff can show something more concrete was collected, such as sensitive or embarrassing information. 

That doesn't kill the underlying claim, and plaintiffs can often refile in state court, but it has raised the bar somewhat. At least one Pennsylvania court has also dismissed a claim where the business had clearly disclosed its tracking practices in its Terms of Use and Privacy Notice, which is a solid argument for keeping your own disclosures visible and current.

Penalties Under WESCA

Under WESCA, individuals can sue for actual damages, or liquidated damages of up to USD 1,000, whichever is higher, plus punitive damages and attorneys' fees.

How FSCA, WESCA, and CIPA Stack Up

Beyond FSCA and WESCA: The Federal Angle

It's not just state law. Plaintiffs increasingly pair FSCA, WESCA, and CIPA claims with the federal Electronic Communications Privacy Act (ECPA), the federal wiretap statute at 18 U.S.C. § 2511. 

Unlike the state laws above, ECPA is a "one-party consent" statute, so a website, as a party to its own visitor's interaction, can typically consent to its own tracking. Plaintiffs work around that with the "crime-tort exception," arguing the business's own privacy practices were unlawful enough to strip that defense. 

The theory is genuinely unsettled, and a federal appeals court is currently weighing the exact question of website tracking liability under it. ECPA damages run USD 100 per day of violation or USD 10,000, whichever is greater, and because it's federal law, a claim can be filed in any state, not just the handful with all-party consent wiretapping statutes.

A related but separate law, the Video Privacy Protection Act (VPPA), targets a narrower slice of the same problem: tracking pixels that transmit a visitor's identity alongside the video content they watched, without consent. VPPA damages are $2,500 per violation, and the U.S. Supreme Court has agreed to resolve a split over who counts as a protected "consumer" under the statute, a decision still pending. If your site embeds video anywhere near a tracking script, VPPA is worth understanding on its own terms, separately from the wiretapping laws above.

Protecting Your Website From FSCA and WESCA Claims

The reassuring part is that the fix looks the same for all three laws, because the underlying problem is the same. A tracking tool fires before your visitor has consented, and their data goes somewhere else.

Cookiebot CMP blocks non-essential tracking scripts until a visitor consents, which addresses the exact pattern these lawsuits are built around. No tool can make you lawsuit-proof, and it's worth talking to a lawyer about your specific exposure, regulatory obligations, and business operations, but a properly configured setup puts you in a much stronger position if a demand letter arrives.

Usercentrics/Cookiebot™ does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding litigation exposure, regulatory compliance, and data privacy and protection issues and operations.