Briefings
I write these to explain what is changing in privacy and what it means for people who run websites or privacy teams. Most cover litigation trends, privacy laws, and web tracking topics. Others stray into whatever is on my mind at the time.
Website wiretapping lawsuits are growing in Florida. Like the California Invasion of Privacy Act (CIPA), the Florida Security of Communications Act requires the consent of every party to a communication. Unlike CIPA, it lets plaintiffs recover attorney fees and punitive damages on top of statutory damages. Many of the new cases involve health-related searches on healthcare websites and messages typed into website chats.
California's privacy regulations describe opt-out preference signals only in general terms today. CalPrivacy, the state's privacy agency, has drafted rules that would specifically name the Global Privacy Control and make clear that websites already have to check for it before loading tools that sell or share personal information. They would also require more businesses to publish opt-out metrics. The agency's board will vote on November 6 on whether to begin the formal rulemaking process.
The TikTok pixel appears in dozens of website tracking lawsuits each year. People without TikTok accounts sued TikTok itself over the data that the pixel collects about them, and lost in federal court in 2024. Most other claims target the businesses that install the pixel and treat it as a pen register, a theory on which courts have split. SB 690 ends most of those claims in California on January 1, 2027, but wiretapping claims will continue.
The LinkedIn Insight Tag appears in a growing number of website tracking lawsuits. Some target the businesses that installed it, while others target LinkedIn itself over data collected from health-related websites. Like the Meta Pixel, the tag reports visitor activity to an advertising platform that can tie that activity to a specific person. In LinkedIn's case, that person usually has a professional profile with a real name and an employer.
Pending CIPA pen register claims are already ending under California's SB 690, even though the law does not take effect until January 1, 2027. In October 2026, a federal judge in San Francisco dismissed one of these claims. In a separate state court case, a plaintiff agreed to drop another. However, SB 690 does not affect the wiretapping and privacy claims often filed alongside them, so websites still face much of the same risk.
Consent banners place some trackers, such as cookies and scripts, in a strictly necessary category that visitors cannot switch off. The concept and term come from European law, where regulators define it narrowly. In the U.S., privacy laws generally do not define the category as explicitly. In either case, businesses should be able to justify each tracker they treat as strictly necessary or essential.
Cookie banners have to remember visitors' opt-outs for a reasonable amount of time, while businesses may want to prompt again sooner, depending on the privacy choice. California requires businesses to wait at least 12 months before asking consumers who opted out to opt back in. Browser privacy features add a complication, because some delete stored choices long before they expire.
Embedded videos, maps, and security checks such as reCAPTCHA operate by loading content from third-party companies inside web pages. Each one sends visitors' information to its provider. Consent banners often do not control them, so they may keep running even when visitors have opted out.
Many businesses run their websites, stores, booking tools, and help centers on different subdomains. Consent banners usually record visitors' choices in browser cookies, which may not follow them from one subdomain to the next by default. However, regulators expect opt-outs to follow consumers across devices and services, while agreement to tracking should stay within the scope that visitors understood.
Meta's Limited Data Use flag gives websites an alternative to blocking the Meta Pixel when visitors opt out. The pixel keeps sending visitors' activity, such as the pages they view and the purchases they make, along with identifiers such as IP addresses. The flag tells Meta to use that information only as a service provider for the business. Meta presents it as one way to respond to opt-outs, but California's rules raise serious doubts about whether it is enough.
Many consent platforms estimate visitors' locations from their IP addresses to decide which consent model to apply. That creates an apparent tension, because the IP lookup processes a form of location data before visitors have made any consent choice. In most cases, the location is too coarse to count as sensitive data. The lookup also serves the consent process rather than non-essential tracking.
Most businesses treat Google Tag Manager (GTM), a container that loads website tags, as strictly necessary and exempt from consent choices. A German court disagreed in 2025, in part because loading the container sends visitors' IP addresses to Google. That stance is stricter than the prevailing view. In the U.S., the larger risk tends to sit with the tags inside the container, and with whether those tags are blocked or only adjusted when visitors disable tracking.
Consent is one of the main defenses to website tracking claims. Courts generally expect businesses that raise consent to prove it with records of what the banner displayed, what visitors chose, and what the website did afterward. Many consent platforms keep those records only for a limited time, and finding a specific visitor's choice usually requires an identifier stored in that visitor's browser.
Analytics and advertising tools typically send their vendors the full address, or URL, of each page that visitors view. Those addresses often describe the pages, so, on certain categories of websites, they can reveal health conditions, financial concerns, and other sensitive interests. This has made them a recurring issue in health privacy enforcement and wiretapping claims.
Twelve U.S. states require businesses to honor the Global Privacy Control, a signal that visitors can send from their browsers to opt out of the sale and sharing of their personal information. However, many websites do not act on the signal at all, or act on it only after their tracking tools have already run. California has already fined businesses for failing to honor it.
Shopify runs many of the tracking tools on its merchants' stores, so external consent banners cannot block those tools directly. Instead, banners have to pass visitors' choices to Shopify through its Customer Privacy API. When that connection is missing, tracking may continue after visitors opt out. Shopify stores are also frequent targets of website tracking lawsuits.
Websites that load fonts from Google's servers send visitors' IP addresses to Google, oftentimes by default or without regard for visitor privacy choices. In Germany, that practice led to a court ruling against a website operator. In the U.S., it has been cited in wiretapping demand letters. Businesses often overlook fonts, which are rarely thought of as tracking tools.
With server-side tracking, businesses collect information about website visitors on servers that they control before sending it to advertising and analytics companies. Many businesses are adopting it because browser-based tools such as pixels have become less reliable. However, the change in method does not remove the need to give notice and obtain consent.
The Meta Pixel appears in website tracking lawsuits across industries, including claims against hospitals, telehealth companies, med spas, and media websites. The pixel draws these claims because it is widely installed, it collects a broad range of information, and Meta can often tie what it collects to a specific person.
Med spas and laser hair removal chains are being named in website tracking lawsuits. A class action filed in Los Angeles in September 2026 alleges that a national chain's consultation questionnaire sent visitors' treatment selections to Meta, TikTok, and other advertising companies. Notably, these websites tend to collect visitors' answers about the treatments they want, which wiretapping claims treat as the contents of a private communication.
More than 550,000 Californians have signed up for the Delete Request and Opt-out Platform (DROP), which sends a single deletion request to every registered data broker. Data brokers have been required to process these requests since August 1, 2026. Notably, California's definition of a data broker is broader than many businesses assume.
Vibe coding is the practice of describing a website or app to an AI assistant and publishing the code it writes. Websites built this way often include analytics, session replay, and other tracking tools that the assistant or a starter template added by default. The business that operates the website is responsible for what those tools collect, no matter who wrote the code. Notably, wiretapping laws such as the California Invasion of Privacy Act (CIPA) have no size thresholds, so they can be used against any website, regardless of its reach.
Most U.S. websites that use advertising or analytics tools need a cookie banner, even though no law requires one explicitly. State privacy laws require a way to opt out of certain web tracking. Wiretapping lawsuits may also turn on whether a visitor consented to tracking. A working consent banner is the most practical way to address both.
Amazon plans to put smart glasses with cameras on over 20,000 delivery drivers by the end of 2027. The glasses take frequent photos while a driver is on foot. Customers reportedly have no way to view or delete them. However, privacy laws in California and other states may give residents those rights.
A federal judge in Michigan has allowed patients to pursue wiretapping claims against McLaren Health Care and its Karmanos Cancer Institute over tracking tools on their websites. Michigan has no comprehensive privacy law, and the case does not rely on California's wiretapping statute. Instead, the claims rest on a federal wiretapping law that applies to websites in every state.
Governor Newsom vetoed AB 1542 on September 27, 2026, declining to ban the sale of sensitive personal information in California. However, five other states have already taken that step by banning the sale of either sensitive data or precise location data.
Governor Newsom signed SB 690 on September 30, 2026. Starting January 1, 2027, only the California Attorney General may bring pen register claims over website and app tracking under the California Invasion of Privacy Act (CIPA). The change reaches lawsuits filed since January 1, 2025. Notably, it will not end website tracking lawsuits, because many of them also rely on the Section 631 wiretapping claim, which is unchanged.
California has expanded the right to delete under the California Consumer Privacy Act (CCPA). Starting January 1, 2027, a business has to delete personal information it obtained from third parties, in addition to what it collected from the consumer. The same law requires online-only businesses to offer a web form or online portal for privacy requests, alongside an email address.
Website search bars have become a frequent target for wiretapping claims under the California Invasion of Privacy Act (CIPA). The claims allege that a visitor's search terms were shared with third parties without consent. Notably, SB 690 does not affect these claims, because they rely on a different section of the law.
A business should not require identity verification before honoring an opt-out request. California prohibits it, and its privacy agency has fined two companies that required it. Verification should be reserved for requests to access, delete, or correct personal information.
A cookie banner has to do more than offer visitors a privacy choice. It also has to stop the website's tracking tools from running when a visitor decides to opt out of tracking. Many recent tracking complaints allege that misconfigured banners are violating website visitors' privacy.
Some California lawsuits pair a CIPA tracking claim with a website accessibility claim in the same complaint. In late August 2026 alone, individual plaintiffs filed near-identical versions against restaurant and entertainment chains, each capping the relief sought at $74,999.
A cookie banner designed to steer visitors toward accepting tracking does not collect valid consent. California and Colorado both treat these designs as dark patterns. The most common issues involve the styling of the buttons, the number of clicks to decline, and the wording of the choices.
Many privacy notices describe consumer rights once, in general terms, for any reader who "may have rights" under a state law. Regulators in Delaware, Connecticut, and Oregon have objected to that approach, and the differences between the state laws make a single summary hard to keep accurate.
Regulators differ on minimum privacy notice update requirements. California requires an update at least once every 12 months, and Florida requires one at least annually. In 2025, California fined Tractor Supply $1.35 million for a policy that had not been updated in more than two years.
Since July 1, 2026, Connecticut requires a privacy notice to state whether the business collects, uses, or sells personal data to train large language models. The statement appears to be required regardless of whether the answer is yes or no, so a notice that is silent on the topic may be at risk.
Earlier this year, a company that streams high school sports paid $1.1 million in California. Its privacy policy said it did not sell personal information. California's privacy agency found that it did, through the use of ordinary advertising trackers on its websites.
California's SB 690 ends private lawsuits over website tracking under CIPA's pen register provision, starting January 1, 2027. Governor Newsom signed it on September 30, 2026, the last day he had to act. The law is narrower than many summaries suggest, in part because a core wiretapping theory behind many demand letters goes unaddressed.
On September 17, the Texas Attorney General warned businesses about "scam" demand letters alleging website privacy violations under California law. The attention is welcome, but Texas has less influence over these claims than implied.
The AI labs asked to be slowed down last week, and Washington is debating what to do about them. Most businesses won't be directly impacted by that debate, but they do have AI risks to manage, and this is where to start.
Bernie Sanders and Steve Bannon shared a stage in Washington today to call for limits on AI development. Both sides of this debate have legitimate concerns, and the tension between them comes down to how each side assesses cyber risk.
In a single week, the head of Anthropic called for slowing frontier AI development (the heads of OpenAI and xAI agreed), the Senate moved toward a bipartisan AI safety bill, and the President called the backlash against AI a conspiracy and rejected new guardrails. Here is what is on the table and why the timing matters.
Global Privacy Control and other universal opt-out mechanisms are not widely used today. The signals tend to be available from a few privacy-focused browsers and extensions. Starting January 1, 2027, California's Opt Me Out Act requires every browser provider to include "opt-out preference signal" options, which will change how much Internet traffic arrives with an opt-out attached.
Website visitors can send businesses an automated privacy opt-out signal from their browser, and respecting that signal is mandatory under twelve state privacy laws, with more coming into effect in 2027 and 2028.
CIPA is not the only wiretapping statute being used to litigate website tracking. Some other states have similar laws, and there is also a federal law called the Electronic Communications Privacy Act. It was passed in 1986 and has a lot in common with CIPA. The biggest distinction has to do with consent requirements.
One of the most important decisions in a web consent setup is whether non-essential tracking fires by default. Some parts of the world, like the European Union, have already settled this by law. In the United States, it is a risk-based business decision, and many businesses have not made it deliberately.
Advanced Consent Mode lets Google tags run before a visitor makes a choice, sending Google a "cookieless ping" instead of the full data. That ping preserves conversion modeling, but may leave businesses vulnerable to pen register wiretapping claims.
On July 20, 2026, a federal judge in Los Angeles declared Vivek Shah, the most prolific individual filer in the CIPA litigation wave, a vexatious litigant. The order is a win for the businesses he targets. It is also narrower than the headlines suggest.
No Briefings match. Clear the search or pick another category.