Can My Startup Be Sued Over Tracking Pixels and Chat Tools? Cookie Banners, Consent and Wiretap Claims

By Kyle Westaway · Last updated October 15, 2026

Yes. Plaintiffs’ lawyers sue companies of every size under old wiretap and video privacy statutes, arguing that tools like the Meta Pixel, session replay software and third-party chat widgets let a vendor listen in on your visitors without consent. These laws have no size thresholds and carry statutory damages, $5,000 per violation under California’s wiretap law, so a seed-stage startup running ordinary marketing tags can get a demand letter. The fix is mostly operational: know every tag on your site, get consent before the risky ones fire, keep them off sensitive pages, and make your vendor contracts and privacy policy match what actually happens.

Key takeaways

• Wiretap and video privacy claims don’t depend on your size. A startup below every state privacy law threshold can still be sued.
• California’s SB 690, signed September 30, 2026, ends private “pen register” suits over website and app trackers from January 1, 2027. Wiretapping claims over session replay, chat and pixels remain.
• The Supreme Court heard argument on October 14, 2026 on who counts as a “consumer” under the Video Privacy Protection Act. Until it rules, a video on a page with an ad pixel is a live risk.
• At least twelve states require businesses their privacy laws cover to honor the Global Privacy Control signal, and regulators test whether it works.
• No US law requires a cookie banner as such, but a banner that blocks non-essential tags until the visitor agrees is the strongest defense to wiretap claims over the tags you keep.
• Pages that reveal health information are the riskiest place for any tracker.

Why are startups being sued over ordinary website tools?

Most tracking tools send data from the visitor’s browser straight to a third party, such as Meta, Google or a session replay or chat vendor, in real time. Plaintiffs call that a wiretap by the vendor, aided by you. The statutes date from 1967 and 1988, but courts have let many of these claims proceed.

Unlike the state privacy laws, these statutes have no size threshold, set damages per violation without proof of loss, and are cheap to investigate: anyone can open a browser’s developer tools and see which tags fire on your site and what they send.

Which laws do these claims use?

How do California wiretapping claims work?

CIPA Section 631 prohibits reading or learning the contents of a communication in transit without the consent of all parties, and reaches anyone who helps someone else do it. Section 632 covers recording confidential communications. Section 637.2 allows $5,000 per violation or three times actual damages, whichever is greater. The theory is that the vendor eavesdropped and you aided it.

Session replay is the classic target. In Mikulsky v. Bloomingdale’s (June 2025), the Ninth Circuit revived a claim that session replay software captured names, addresses and payment details as the visitor typed them, which can be the “contents” of a communication. Chat is less settled. In Gutierrez v. Converse (July 2025), an unpublished Ninth Circuit decision affirmed judgment for the company because there was no evidence the chat vendor actually read messages in transit. AI tools are the newest target. In Taylor v. ConverseNow (August 2025), a federal court let claims proceed against an AI ordering assistant because the vendor allegedly used customer conversations to improve its own products.

That last point is the trap founders miss. A website can’t wiretap its own conversation, and a vendor that acts purely as your tool is often treated as an extension of you. But many courts now ask whether the vendor is capable of using the data for its own purposes, whether or not it does. A vendor whose terms let it train models or build ad profiles on your visitors’ data looks like a third party. Read every vendor’s data-use clause.

Consent must come first. The Ninth Circuit held in Javier v. Assurance IQ (2022) that agreeing to a privacy policy after a session was recorded doesn’t count. A footer link is notice, not consent.

Standing is the main federal defense. In Popa v. Microsoft (August 2025), the Ninth Circuit dismissed a session replay suit because recording ordinary shopping behavior wasn’t a concrete injury, while noting that sensitive medical or financial information could be different. Plaintiffs now plead sensitive data or file in state court.

What did California’s SB 690 change?

Section 638.51 prohibits using a “pen register” or “trap and trace device” without a court order. Plaintiffs argued that trackers collecting IP addresses qualify, and these became California’s most common website claims. Courts split, and a tentative August 2026 Court of Appeal ruling in Variety Media v. Superior Court, which is not final, said the statute can reach online tools but that collecting an IP address alone isn’t enough.

SB 690 was signed on September 30, 2026 and takes effect January 1, 2027. It doesn’t make trackers lawful. It provides that a Section 638.51 claim arising from a website or app may be brought only by the California Attorney General, and it applies to pending claims in suits filed on or after January 1, 2025, a reach plaintiffs may challenge. A broader exemption for any “commercial business purpose,” which would have covered wiretapping claims too, was dropped in July 2026. Sections 631 and 632 are untouched, and plaintiffs are shifting their claims there. The Governor asked the Legislature to revisit CIPA in 2027.

Can a video on my site create liability?

Yes. The Video Privacy Protection Act (VPPA) bars a “video tape service provider” from knowingly disclosing personally identifiable information about what a consumer watched, with damages of at least $2,500 per person. The modern claim: your page plays a video, the Meta Pixel sends the video’s title and the visitor’s Facebook ID to Meta, and the visitor never consented.

Courts disagree about who counts as a “consumer.” The Second Circuit (Salazar v. NBA, 2024) and the Seventh Circuit (Gardner v. Me-TV, 2025) say anyone who subscribes to any of the provider’s goods or services qualifies, including a free newsletter subscriber. The Sixth Circuit (Salazar v. Paramount Global, 2025) and the D.C. Circuit (Pileggi, 2025) require a subscription to audiovisual goods or services. The Supreme Court declined the NBA case in December 2025, took the Paramount case in January 2026 and heard argument on October 14, 2026. Reports of the argument suggest the justices may adopt the broader reading, though several questioned whether a sports news site is a video tape service provider at all.

Other defenses remain. The Second Circuit held in Solomon v. Flipps Media (May 2025) that information is “personally identifiable” only if an ordinary person could use it to learn what someone watched, which defeats many pixel claims there. If video is central to your product, get consent in the form the statute requires: informed, written (electronic is fine), separate from your terms and good for no more than two years. Otherwise, keep ad pixels off pages with video, or stop sending them video titles.

What about other states and health data?

Federal Wiretap Act. Federal law requires only one party’s consent, and the website is a party, so claims usually fail unless the interception was for a criminal or tortious purpose. Plaintiffs argue that sending health information to an ad platform is that purpose. Courts are split, and in March 2026 a Massachusetts federal court dismissed a hospital pixel claim because the complaint didn’t show the hospital meant to commit a crime.

Other state wiretap laws. Pennsylvania requires all-party consent, and the Third Circuit held in 2022 that a vendor capturing data from a visitor’s browser isn’t a party to the communication. But in Cook v. GameStop (August 2025) it dismissed a session replay suit because the plaintiff entered nothing sensitive or identifying. Massachusetts’ highest court held in Vita v. New England Baptist Hospital (October 2024) that its wiretap act doesn’t cover tracking of browsing on public web pages, and in October 2026 Washington’s reached a similar result for a hospital’s Meta Pixel in Baker v. Seattle Children’s Hospital. Florida’s all-party consent statute is increasingly used for California-style claims.

Washington’s My Health My Data Act. It applies to businesses of any size that collect “consumer health data” from Washington consumers, a term broad enough to reach fitness and wellness apps. Beyond what’s needed to provide the requested service, it requires consent to collect that data, separate consent to share it and a signed authorization to sell it. Consumers can sue. The first class action was filed against Amazon in February 2025, and the law remains largely untested. Nevada and Connecticut have similar rules.

HIPAA and the FTC. For HIPAA covered entities and business associates, HHS guidance on trackers still applies to authenticated pages such as patient portals, though in June 2024 a court vacated the part treating an IP address plus a visit to a public page about a health condition as protected health information, and HHS dropped its appeal. Outside HIPAA, the FTC pursues health data sent through pixels: in July 2026 it sued Hims & Hers with California and Utah, alleging the company sent sensitive health data to ad platforms after promising otherwise. Turn off ad pixels and session replay on any page that reveals a health condition, appointment or prescription.

What do state privacy laws require for pixels and cookies?

Once a state comprehensive privacy law covers you, sending data to ad platforms through pixels is generally a “sale,” “sharing” or “targeted advertising,” and you must let consumers opt out. At least twelve states (California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas) also require you to treat a browser’s Global Privacy Control signal as a valid opt-out. Since January 1, 2026, California requires covered businesses to show visitors whether their signal was honored, and from January 1, 2027 browsers must offer Californians a built-in signal.

California’s Attorney General settled with Disney for $2.75 million in February 2026, partly because opt-outs and the signal didn’t carry across services and devices. In March 2026 the state privacy agency fined a ticketing company $1.1 million for, among other things, ignoring the signal and offering no opt-out of its own.

Sensitive data is different. Most state laws require opt-in consent before you process health, biometric, precise location and similar data, and California gives consumers a right to limit its use. For whether these laws cover you yet, see US Data Privacy Laws. The wiretap claims apply either way.

Do US startups need a cookie banner?

No US statute requires one as such. For ordinary ad and analytics tags, the state privacy laws use an opt-out model: an accurate privacy policy, a “Do Not Sell or Share My Personal Information” or similar link, and working Global Privacy Control handling. Sensitive data, including health data, generally needs opt-in consent, and knowingly collecting data from children under 13 needs parental consent under COPPA. EU and UK visitors are different: you need their opt-in consent before non-essential cookies fire. See GDPR Basics.

The wiretap cases change the calculation. Because they turn on consent given before data leaves the browser, a banner that actually blocks the pixel, session replay script or third-party chat until the visitor agrees is the strongest consent defense available. A “we use cookies” notice shown after the tags fired is not consent. If you add a banner, make declining as easy as accepting. California’s March 2026 fine faulted a banner visitors couldn’t close without agreeing. If you run ad pixels, session replay or a third-party chat tool and have meaningful California traffic, an opt-in banner for California visitors is usually worth the analytics you lose. If you run only first-party analytics and no ad pixels, you can usually skip it.

How do these claims reach small companies?

Usually as a demand letter. Plaintiffs’ firms and some self-represented serial plaintiffs scan sites for common tags, then send a draft complaint and screenshots of what the tags sent, asking for a settlement priced below the cost of a defense. Others file template complaints or arbitration demands.

Your terms of service arbitration clause helps less than founders expect. It binds only people who agreed to the terms, usually by clicking to accept at signup, so it doesn’t reach anonymous visitors, who are most wiretap plaintiffs. Where it does apply, plaintiffs’ firms can file hundreds or thousands of individual arbitrations at once, and the company pays most of each case’s fees. California treats a drafting company’s failure to pay those fees within 30 days of the due date as a breach that can cost it the right to arbitrate, though the California Supreme Court held in August 2025 that a good-faith mistake doesn’t. If you use arbitration, adopt your provider’s mass arbitration rules, carve out small claims court and get real click-to-accept assent. See How to Draft Terms of Service for a Startup.

If you get a letter, don’t ignore it or remove tags before saving the tag configuration, consent logs and vendor contracts that show what actually happened. Check whether your insurance covers statutory privacy claims, since some policies exclude them. Some demands wouldn’t survive a standing challenge, so have the claim analyzed before you pay.

Checklist: a practical tracking program

• Inventory. List every tag, pixel, SDK, session replay tool and chat widget, including ones added through a tag manager or by an agency, with what each collects and where it goes. Rescan quarterly.
• Consent management. Use a tool that blocks non-essential tags until consent where you need it, honors Global Privacy Control and logs every choice.
• Sensitive pages. Turn off ad pixels and session replay on checkout, login, account, health and form pages, and mask form fields in session replay.
• Chat. Before the first message, disclose that a third-party vendor or an AI runs the chat and may record it.
• Video. Keep ad pixels off video pages, or get VPPA-compliant consent.
• Vendor contracts. Make each vendor a “service provider” or “processor” that uses the data only to serve you, not for its own advertising or model training, and flows those limits to its subprocessors. This also helps show the vendor isn’t a third party under the wiretap laws.
• Privacy policy. Disclose each category of tracker, the third parties behind them, chat recording and how to opt out. See Does My Startup Need a Privacy Policy?
• Terms of service. Use click-to-accept assent, a mass arbitration procedure and a small claims carve-out.

For more, see What Are the Startup Best Practices for Data Privacy? and Data Breach Response for Startups.

If you’ve received a demand letter or want your site’s tracking reviewed, contact us.