Website Tracking Class Actions: Courts and Legislatures Push Back, but Risks Remain
Common website technologies have become the target of rapidly increasing class action litigation in recent years. More than 5,700 ‘wiretapping’ cases have been filed to date. Companies that deploy tracking pixels, analytics tools, chatbots, session replay software, and similar technologies increasingly face demand letters and class action lawsuits.
Over the past month, courts and legislatures took critical steps to help stem the recent wave of class action litigation targeting websites with wiretapping claims. First, California passed Senate Bill 690, which would limit private lawsuits based on website tracking if signed into law by Governor Gavin Newsom by the September 30, 2026 deadline.
Second, the Business Litigation Session of the Suffolk Superior Court recently enforced a Massachusetts choice-of-law provision contained in a website’s terms of use and dismissed a California plaintiff’s CIPA claim. The decision builds on the Massachusetts Supreme Judicial Court’s earlier holding that the Massachusetts Wiretap Act does not extend to ordinary website browsing activity.
These recent developments provide much-needed reform and clarity, but do not eliminate litigation risk for Massachusetts-based companies. Businesses with websites accessible across state lines may still face claims under federal law and broader state wiretapping statutes, particularly CIPA. Courts remain divided on many key issues, and the law continues to evolve rapidly. As these lawsuits proliferate nationwide, businesses across New England should carefully evaluate their website technologies and related compliance practices.
How Plaintiffs Use Wiretapping Laws to Challenge Website Tracking
Plaintiffs have increasingly sought to apply decades-old federal and state wiretapping statutes to commonplace website technologies that collect and transmit user interaction data.
The targets are familiar digital tools used by businesses across virtually every industry, including:
- Tracking pixels and cookies
- Session replay technologies
- Online chat and customer service tools
- AI-powered technologies
Plaintiffs generally allege that these technologies permit third-party vendors such as Meta, Google, TikTok, or LinkedIn to unlawfully intercept electronic communications between website visitors and operators without consent. The claims are often framed as unlawful "eavesdropping" or "interception" of electronic communications in violation of federal and state wiretapping laws.
Federal and State Wiretapping Laws: CIPA, ECPA and the Massachusetts Wiretap Act
The federal Electronic Communications Privacy Act (“ECPA”) prohibits the intentional interception of wire, oral, or electronic communications unless at least one party consents. Several states, including Massachusetts, impose more restrictive consent requirements. Critically, in Vita v. New England Baptist Hospital, Massachusetts’s highest court held that general web browsing is not a protected "communication" under the Massachusetts Wiretap Act.
The California Invasion of Privacy Act (“CIPA”), an all-party consent statute, has become one of the primary tools for website tracking litigation. Plaintiffs have relied on several provisions of the California statute, including:
- CIPA Section 631, which prohibits the intentional interception of communications in transit without the consent of all parties;
- CIPA Section 632, which addresses recording or eavesdropping on confidential communications; and
- CIPA Section 638.51, which regulates the use of pen registers and trap-and-trace devices.
Notably, CIPA Section 637.2 authorizes statutory damages of $5,000 per violation or three times actual damages, whichever is greater, creating potentially substantial exposure in putative class actions. Plaintiffs have brought CIPA claims nationwide challenging the use of website tracking technologies. Plaintiffs also bring ECPA claims, including in Massachusetts federal courts, arguing that the statute’s consent exception does not apply where an interception is undertaken for the purpose of committing a criminal or tortious act. The First Circuit is poised to weigh in on that interpretation in Goulart v. Cape Cod Healthcare, Inc.
California SB 690 Could Reshape CIPA Website Tracking Claims
If signed into law by Governor Newsom before October, SB 690 would materially narrow one of the principal theories underlying recent CIPA website-tracking litigation. SB 690 would apply retroactively and eliminate the private right of action, and only the California Attorney General would be empowered to bring a Section 638.51 claim based on website or app tracking. However, SB 690 does not restrict the ability of private litigants to bring Section 631 and 632 interception claims. If signed and once in effect, SB 690 should nonetheless reduce new private website tracking claims and result in the dismissal of Section 638.51 claims filed two or fewer years earlier.
Massachusetts Courts Develop Defenses to Website Tracking Claims
Recent Massachusetts decisions have also developed potentially significant defenses. Federal judges have divided over the application of ECPA’s crime-tort exception, while the Business Litigation Session recently enforced a website’s Massachusetts choice-of-law provision to dismiss a California plaintiff’s CIPA claim.
Unresolved Questions and Emerging Threats: AI Notetakers as the Next Wiretapping Risk
Despite these promising developments, significant uncertainty remains. It is unclear whether SB 690 will substantially stem wiretapping claims or merely refocus them on other CIPA sections. It also remains uncertain how the First Circuit’s decision in Goulart will affect ECPA website-tracking claims in New England federal courts.
AI tools are also generating new applications of traditional wiretapping statutes. In re Otter.AI Privacy Litigation is notable; in August 2026, a federal court allowed ECPA and CIPA claims against AI meeting-assistant provider Otter.ai to proceed based on allegations that its tool recorded and processed virtual meeting communications without sufficient consent. The decision signals heightened litigation risk for companies deploying AI tools that record, transcribe, or process communications.
What Businesses Can Do Now
Despite recent legislative and judicial developments, federal and state wiretapping statutes continue to present litigation risk for businesses across industries and jurisdictions.
Particularly pending the enactment of SB 690 and issuance of the Goulart decision, businesses should consider the following steps:
- Inventory pending CIPA claims. For suits brought under CIPA Section 638.51 within the past two years, assess for potential dismissal after SB 690 becomes operative.
- Conduct a risk assessment of website functionality, tracking technologies and consent mechanisms. Inventory website tracking technologies, analytics tools, chatbots, note-taking and other third-party services; identify what data they collect and transmit; and evaluate applicable consent requirements, including potential CIPA Section 631 exposure.
- Update website terms of use and privacy disclosures. Review consent and contract-formation mechanisms, tracking disclosures, choice-of-law provisions, and appropriate arbitration and class-action-waiver provisions.
- Monitor legal developments. Businesses should continue to monitor developments under the CIPA, ECPA, and similar state privacy and wiretapping laws, as this area of law continues to evolve rapidly.
For the above steps or a broader privacy risk checkup, our team can help assess exposure, prepare responses, and harden your data flows and disclosures against the next wave of plaintiff demands. If you have questions on this topic, or any other concern related to privacy compliance in your organization, please contact Melanie Conroy, Vivek Rao, Kathleen Hamann, Ariel Pardee or Samih Eloubeidi. Thank you to firm summer associate Jessica Galego for her contribution to this alert.