Wiretap litigation and consent banners: are your controls keeping up?

TL;DR: Osano explains why US privacy compliance can still produce roughly 4,000 wiretap lawsuit filings since 2022: two-party consent states let plaintiffs target pre-consent trackers, session replay, pixels and chat tools under decades-old wiretapping laws. Opt-out banners alone are not enough when scripts fire before consent.

Editorial analysis by NHI Mgmt Group, based on content published by Osano: “Florida's CIPA? FSCA Wiretap Lawsuits and Demand Letters Explained”.

By the numbers:

• Over 20 states have active comprehensive data privacy laws.
• approximately 4,000 privacy litigation filings since 2022
• California California Invasion of Privacy Act 3,135 cases filed

Key questions

Q: What should teams do first when they receive a wiretap demand letter about website tracking?

A: Pause any direct reply, involve counsel immediately, and preserve the consent banner state, tag configuration, and tracker logs that existed on the dates cited in the letter.

Q: Why do pre-consent trackers create wiretap risk even when a site uses a privacy banner?

A: Because the legal theory does not focus on the banner itself, but on whether non-essential collection started before the user made a consent decision.

Q: What are the signs that a consent and preference programme is failing?

A: A consent and preference programme is failing when customer communications become inconsistent, users receive content they did not expect, and records do not stay aligned across channels.

Practitioner guidance

• Bring legal counsel into the first response path Do not answer a demand letter or negotiate payment before counsel reviews the alleged trackers, the cited statutes, and the dates in scope.
• Preserve consent state and tag evidence Export the consent records, banner settings, and tag configuration that were active on the dates cited so counsel can compare them with what actually executed.
• Scan for pre-consent tracker execution Identify which analytics, replay, pixel, and chat scripts fire before consent on current pages, then reconcile that list against the alleged offending trackers.

Bottom line: Wiretap litigation is exploiting the gap between opt-out privacy law and older all-party consent statutes, especially when trackers execute before consent.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →