Florida Wiretapping Lawsuits Are Rising. How Does the Law Compare to CIPA?

What Is Florida's Wiretapping Law?

The Florida Security of Communications Act (FSCA) is Florida's wiretapping law, which prohibits intentionally intercepting a wire, oral, or electronic communication. It was enacted in 1969 and modeled on the federal Wiretap Act, which is part of the Electronic Communications Privacy Act (ECPA). Florida courts often look to federal decisions when they interpret the provisions the two laws share. Plaintiffs argue that it covers what visitors send to websites, such as searches, form entries, and chat messages.

CIPA is the California wiretapping law that plaintiffs have used against website tracking for years. Like CIPA, the FSCA is an all-party consent law. It makes an interception lawful when "all of the parties to the communication have given prior consent," according to section 934.03. In contrast, the federal Wiretap Act requires the consent of only one party, which, in web tracking cases, is usually the website itself.

The FSCA lets individuals sue for actual damages, with a minimum of $100 a day for each day of violation or $1,000, whichever is higher. Section 934.10 also allows punitive damages and a "reasonable attorney's fee." A claim must be filed within two years after the plaintiff first has a reasonable opportunity to discover the violation.

How Does Florida's Law Compare to CIPA and the ECPA?

Plaintiffs often cite more than one of these laws in the same complaint. The table compares the provisions that most affect website tracking claims:

Based on the Florida, California, and federal statutes, as of October 2026.

The biggest difference for website claims involves pen registers, which record addressing information, such as an IP address, rather than the contents of a communication. Florida's pen register law and its federal counterpart make using one without a court order a crime, but neither lets individuals sue over it. Many recent California lawsuits rely on CIPA's pen register claim. SB 690 will leave that claim to the California Attorney General starting January 1, 2027.

This means that Florida claims have to allege that the contents of a communication were intercepted. Private CIPA claims will largely depend on the same requirement once SB 690 takes effect, so the two states' litigation may start to look more alike. SB 690 itself does not change Florida law.

Florida's statutory damages are usually lower than CIPA's $5,000 per violation. However, the FSCA adds punitive damages and attorney fees, which CIPA's damages provision does not include. Fee awards may make smaller individual claims worth filing.

How Have Florida Courts Ruled on Website Tracking?

An earlier wave of Florida website claims, in 2021, targeted session replay tools, which record how visitors move through websites. A Florida state court dismissed one of these claims in June 2021, finding that mouse clicks, keystrokes, and pages viewed did "not convey the substance or meaning of any message," as a later federal order summarized. Several federal courts in Florida later applied the same reasoning.

Claims over advertising and analytics tools on healthcare websites have fared better in two recent federal rulings. In March 2025, a federal judge in Orlando allowed a patient's FSCA claim against a health system to proceed. The order distinguished the session replay cases, because the patient alleged that Meta and Google tools received her searches and information about her health conditions, desired treatments, and preferred physicians.

Her federal Wiretap Act claim also proceeded under the crime-tort exception. That exception removes the website's one-party consent defense when an interception is meant to commit a crime or tort. She based it on alleged violations of both the FSCA and HIPAA.

In August 2026, a federal judge in Tampa reached the same result for a health system's use of Google Analytics 4 and Google's DoubleClick advertising tracker. He found that the patients' searches for physicians, conditions, and treatments "plausibly describe the contents" of their communications. He also rejected the 2021 state court's view that website visitors have to show a reasonable expectation of privacy, finding that it applies only to oral communications.

Where Are the New Florida Cases Coming From?

Website tracking complaints under the FSCA have increased in Florida's federal courts in 2026, based on the filings available on CourtListener. Most of those complaints target healthcare or other health-related websites in areas such as dentistry, orthopedics, telehealth, addiction treatment, and hospital care. Others target a restaurant chain, a consumer brand, a real estate website, and a chat software provider. Many pair the FSCA with the federal Wiretap Act.

Florida state courts also hear class actions over website tracking. Earlier in 2026, a national med spa chain and a national waxing chain agreed to settlements of $3.5 million and up to $5 million in cases filed in Hillsborough County over tracking tools that ran on their websites.

Other state court cases are smaller and more numerous. In June 2026, WPBF reported that one plaintiff's attorneys had filed 160 lawsuits since July 2025 alleging that businesses' website chatbots recorded conversations without consent. The attorneys were "at times filing as many as 10 lawsuits in a single day," according to the report. Most of those cases closed without going to trial.

Demand letters have followed the lawsuits. A national defense firm reported in January 2026 that businesses have started to receive letters threatening class actions under Florida's wiretapping law. It also described hundreds of nearly identical small claims suits over website chats, which require a court appearance within a week or two of service. The firm wrote that this pressures businesses "into quick and relatively cheap settlements regardless of the merits."

What Does This Mean for Businesses?

Florida claims depend on whether the contents of a communication were intercepted. That puts the focus on the information that visitors type or search for, such as search terms, form entries, and chat messages, rather than on the presence of a tracking tool alone. The rulings so far involve healthcare websites, where searches can reveal conditions and treatments. Searches on other websites can be just as sensitive, such as a bank customer searching for help with bankruptcy, so the same reasoning can extend to a search bar on many websites.

Many businesses with California visitors already review their websites against CIPA. Both laws require every party's consent before a communication is intercepted, so that review covers much of what Florida claims test. I recommend confirming that the review checks which tools receive search terms, form entries, and chat messages, and whether visitors are told about those tools before they use those features. Search bars, forms, and chat tools that could capture sensitive details deserve the closest attention.