--------------------------- Title: FSCA and WESCA: The Florida and Pennsylvania Wiretapping Laws Catching Website Owners Off Guard URL: https://usercentrics.com/us/knowledge-hub/fsca-wesca-website-tracking-laws/ --------------------------- # FSCA and WESCA: The Florida and Pennsylvania Wiretapping Laws Catching Website Owners Off Guard If your website has visitors in Florida or Pennsylvania, two old wiretapping laws, FSCA and WESCA, which are similar to California’s CIPA, may already apply to the tracking pixels, chat tools, and analytics scripts running on your site. This guide breaks down what each law covers, what's driving the current wave of lawsuits, and the practical steps that reduce your risk. ### At a Glance - Two state wiretapping laws written before the internet existed, Florida's FSCA and Pennsylvania's WESCA, are now being used against websites over tracking pixels, chat widgets, and session replay tools. - Both states require consent from every party to a "communication" before it can be intercepted, which plaintiffs argue includes a website visitor's interactions with tracking scripts. - Recent court rulings in both states let these claims move forward, and a Pennsylvania decision means out-of-state site owners can be sued just because Pennsylvania residents visited their website. - Statutory damages run up to $1,000 per violation (or $100 per day) in both states, and lawsuits are increasingly filed as class actions. - This follows the same pattern that made California's CIPA a household name in privacy litigation, and the fix is largely the same: control what loads on your site before a visitor consents. - A cookie consent tool that blocks trackers until visitors say yes helps close the gap these lawsuits are built on. Two of the busiest state-level privacy lawsuits in the country right now aren't built on new privacy law at all. Florida's Security of Communications Act (FSCA) and Pennsylvania's Wiretapping and Electronic Surveillance Control Act (WESCA) were both written to stop people tapping phone lines, decades before anyone had a website to worry about. Plaintiffs' attorneys have found a way to apply them anyway, and courts in both states have let the claims proceed. The template for this comes from California. Attorneys began applying the [California Invasion of Privacy Act (CIPA)](https://usercentrics.com/us/us/knowledge-hub/california-invasion-of-privacy-act-cipa/), a 1967 telephone wiretapping law, to website cookies and pixels, producing a wave of [CIPA demand letters](https://usercentrics.com/us/us/knowledge-hub/cipa-demand-letter/) that caught thousands of businesses off guard. Are these laws Florida’s CIPA and Pennsylvania’s CIPA? Quite similar. FSCA and WESCA are now running the same playbook in their own states, with their own courts and their own damages figures. Here's how each one works, and what you can do to reduce your exposure. ## Why Old Wiretapping Laws Keep Showing Up in Website Lawsuits FSCA, WESCA, and CIPA all share the same basic setup. They were written decades ago to stop people from tapping phone lines without permission. All three require consent from every party involved in a communication before it can legally be recorded or intercepted. That's stricter than the "one-party consent" rule that applies under U.S. federal law and in most states, where only one person on a call needs to agree to a recording. Plaintiffs' lawyers have found a way to stretch that old framework onto modern websites. They argue that a visitor interacting with your site is a "party" to a communication, and that a chat tool, tracking pixel, or session recorder capturing that interaction without disclosed consent counts as an illegal interception. It's a creative reading of 50-plus-year-old laws, but courts in both Florida and Pennsylvania have let these claims proceed far enough to make them a real cost of doing business online. ## Florida's Security of Communications Act (FSCA) Florida's law, found at [Chapter 934 of the Florida Statutes](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0900-0999/0934/0934.html), dates to 1969 and hasn't changed much since amendments in 1988 and 2002. For decades it was mostly irrelevant to businesses that weren't literally tapping phones, but that changed in 2025. ### What Triggered the Florida Lawsuit Wave A federal court hearing [*W.W. v. Orlando Health*](https://natlawreview.com/article/white-coat-didnt-betray-you-pixel-did-judge-keeps-florida-wiretap-case-against) let most of the plaintiff's claims move forward, rejecting the idea that website tracking tools only ever collect harmless metadata. The court found that tracking tools capturing substantive information, like form entries or search terms, could count as intercepting the actual "contents" of a communication, not just background data like IP addresses or click counts. That distinction between contents and metadata is now the main thing that decides whether an FSCA case against a website survives. The Orlando Health case itself was jointly dismissed in February 2026, before any ruling on liability, but the reasoning stuck, and Florida quickly became the second most active state for these lawsuits after California. In April 2026, a Florida state court preliminarily approved a USD 5 million class settlement in [*Cumor v. European Wax Center*](https://www.classaction.org/news/up-to-5m-european-wax-center-settlement-ends-class-action-lawsuit-over-alleged-pixel-data-tracking), a case that pleaded Florida Security of Communications Act claims alongside federal and California wiretap claims over website tracking pixels. European Wax Center denied wrongdoing. ## What FSCA Covers FSCA is part of Florida's broader wiretapping statute, Chapter 934 of the Florida Statutes, and three sections do most of the work in the current lawsuits. ### FSCA Section 934.03: Prohibition [Section 934.03](https://www.flsenate.gov/laws/statutes/2012/934.03) bans intercepting wire, oral, or electronic communications without consent from everyone involved. This is the core prohibition, and it's the section plaintiffs point to when arguing that a tracking script "intercepted" a visitor's interaction with a site. ### FSCA Section 934.10: Remedies [Section 934.10](https://www.flsenate.gov/laws/statutes/2012/934.10) is the civil remedies provision, and it's what lets an individual sue over a 934.03 violation rather than leaving enforcement to prosecutors. It sets the damages figure discussed below and also allows for injunctive relief, meaning a court could order a business to stop a tracking practice altogether, not just pay for past use. ### FSCA Section 934.31: Devices [Section 934.31](https://www.flsenate.gov/laws/statutes/2012/934.31) covers "pen registers" and "trap and trace" devices, a concept written for physical phone-tapping hardware that captured call routing information. Plaintiffs' firms have stretched this to argue that website analytics scripts, ad pixels, and fingerprinting tools function the same way when they capture and transmit visitor identifiers. This is the most aggressive theory in the current wave of FSCA claims, and the one most directly aimed at ordinary marketing technology rather than anything resembling wiretapping in the traditional sense. ## FSCA Penalties If a court finds a violation, damages are set at USD 1,000 per violation or USD 100 per day, whichever is more, plus any actual damages, attorneys' fees, and possibly punitive damages on top. ## Do you know what your website is tracking? Scan your website for free and learn what cookies and trackers are active and collecting data. Get your custom report and compliance risk level in minutes. ## Pennsylvania's Wiretapping and Electronic Surveillance Control Act (WESCA) WESCA has been on the books since 1978, but the case that put it on every privacy lawyer's radar came in 2022. ### The Ruling That Changed Everything: Popa v. Harriet Carter Gifts In [*Popa v. Harriet Carter Gifts*](https://natlawreview.com/article/hotly-litigated-pennsylvania-court-finds-plaintiff-implicitly-consented-third-party), federal appeals court ruled that a marketing vendor receiving data from a website visitor's interactions could count as an illegal "interceptor" under [WESCA](https://www.palegis.us/statutes/consolidated/view-statute?txtType=HTM&ttl=18&div=0&chpt=57). The vendor wasn't a stranger to the transaction, however, it was a company the site had chosen to work with. The court also said something that made this especially risky for businesses everywhere: the interception is treated as happening at the visitor's browser, in Pennsylvania. That means it doesn't matter where your business is based. If someone in Pennsylvania visits your site and your tracking setup gets flagged, you can be sued there. This isn't a quirk unique to WESCA. FSCA works the same way, as does [GDPR](https://usercentrics.com/us/knowledge-hub/the-eu-general-data-protection-regulation/), which follows the data subject rather than the company, and most [U.S. state privacy laws](https://usercentrics.com/us/us/knowledge-hub/us-data-privacy-laws-by-state/), which apply based on where the affected resident lives. Jurisdiction following the person, not the business, is the norm in privacy law, not the exception. That ruling opened the floodgates for class actions over chat widgets, session replay tools, and tracking pixels, and Pennsylvania has stayed a steady source of these filings ever since. ### The Good News for WESCA Defendants It's not one-sided. Some courts have pushed back, ruling that simply pointing to a technical statutory violation isn't enough to get into federal court unless the plaintiff can show something more concrete was collected, like sensitive or embarrassing information. That doesn't mean the underlying claim goes away entirely (plaintiffs can often refile in state court instead), but it has raised the bar somewhat. Separately, at least one Pennsylvania court has dismissed a claim where the business had clearly disclosed its tracking practices in its Terms of Use and Privacy Notice, which is a strong argument for keeping your own disclosures clear and easy to find. ## WESCA Penalties Individuals can sue for actual damages, or liquidated damages of up to USD 1,000, whichever is higher, plus punitive damages and attorneys' fees. ## CIPA, FSCA, and WESCA Compared **Aspect****CIPA (California)****FSCA (Florida)****WESCA (Pennsylvania)****Year passed**196719691978**Consent required from**Everyone in the communicationEveryone in the communicationEveryone in the communication**The case that started it**Multiple cases over cookies as "pen registers"W.W. v. Orlando Health (2025)Popa v. Harriet Carter Gifts (2022)**Damages per violation**$5,000, or 3x actual damages$1,000, or $100/day$1,000, or $100/day**Where the defense is winning**Pending SB 690 reform, narrow scopeArguing "metadata," not "contents," was collectedChallenging standing to sue in federal court ## Beyond FSCA and WESCA: The Federal Angle It's not just state laws, either. Plaintiffs increasingly pair FSCA, WESCA, and CIPA claims with the federal [Electronic Communications Privacy Act (ECPA)](https://usercentrics.com/us/us/knowledge-hub/electronic-communications-privacy-act-ecpa/), the federal wiretap statute at 18 U.S.C. § 2511. Unlike the state laws above, ECPA is a "one-party consent" statute, so a website, as a party to its own visitor's interaction, can typically consent to its own tracking. Plaintiffs work around that with the "crime-tort exception," arguing the business's own privacy practices were unlawful enough to strip that defense. The theory is genuinely unsettled, and a federal appeals court is currently weighing the exact question of website tracking liability under it. ECPA damages run USD 100 per day of violation or USD 10,000, whichever is greater, and because it's federal law, a claim can be filed in any state, not just the handful with all-party consent wiretapping statutes. A related but separate law, the [Video Privacy Protection Act (VPPA)](https://usercentrics.com/us/us/knowledge-hub/video-privacy-protection-act-vppa/), targets a narrower slice of the same problem: tracking pixels that transmit a visitor's identity alongside the video content they watched, without consent. VPPA damages are USD 2,500 per violation, and the U.S. Supreme Court has agreed to resolve a split over who counts as a protected "consumer" under the statute, a decision still pending. If your site embeds video anywhere near a tracking script, VPPA is worth understanding on its own terms, separately from the wiretapping laws above. > Learn more: [Stop CIPA/VPPA Claims Before They Start — Usercentrics CIPA Consent Template](https://usercentrics.com/us/us/cipa-vppa-template/) ## What Website Owners Can Actually Do About It The good news is that the fix for all three of these laws looks pretty much the same, because the underlying problem is the same. A tracking tool fires before your visitor has agreed to anything, and it sends their data somewhere else. ### Stop non-essential trackers Non-essential tracking tools like pixels, chat tools, and session recorders should not load until a visitor has actively consented. ### Say clearly, upfront, what you're tracking Also notify visitors about how the data is used, and who gets it, rather than burying it in a privacy policy nobody reads. ### Run a full audit of every script currently loading on your site Marketing tools get added over time, and it’s common for teams to lose track of what’s actually running. The more often your site changes, the more often you should run scans. ### Keep your Terms of Use and privacy disclosures clear and current Courts in both Florida and Pennsylvania have pointed directly to disclosure quality when deciding whether to dismiss a case. Our Privacy Policy Generator can help you create a customized, up-to-date privacy policy in minutes. ### Keep a record of when and how your consent settings changed Your consent records should include all consent choices over time. It’s useful evidence if a claim ever lands on your desk, or if regulators make inquiries. A cookie consent tool that blocks tracking scripts until visitors give their consent addresses the exact pattern these lawsuits are built around. It won't make you lawsuit-proof — no tool can promise that, and it's always worth talking to a lawyer about your specific business operations, regulatory obligations, and legal exposure — but a properly configured setup gives you a much stronger position if a demand letter shows up. *Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding litigation exposure, regulatory compliance, and data privacy and protection issues and operations.* ## Manage your CIPA, FSCA, and WESCA exposure Usercentrics CMP blocks non-essential tracking on your site until visitors actively consent, addressing the exact gap behind CIPA, FSCA, and WESCA claims. Try it free for 14 days. --- ## Footer ### Products - [Usercentrics Web CMP](https://usercentrics.com/us/website-consent-management/) - [Usercentrics App CMP](https://usercentrics.com/us/in-app-sdk/) - [Usercentrics CTV CMP](https://usercentrics.com/us/usercentrics-ctv-cmp/) - [Usercentrics Privacy Policy Generator](https://usercentrics.com/us/privacy-policy-generator/) - [Server-side Tagging Solution](https://usercentrics.com/us/server-side-tracking-solution/) - [Integrations](https://usercentrics.com/us/integrations/) - [Web compliance scan](https://usercentrics.com/us/privacy-compliance-scanner/) - [App compliance scan](https://usercentrics.com/us/app-data-privacy-audit/) - [ROAS calculator](https://usercentrics.com/us/roas-calculator/) ### Solutions - [Data Privacy Regulatory Compliance](https://usercentrics.com/us/data-privacy-regulatory-compliance/) - [Marketing Performance Optimization](https://usercentrics.com/us/marketing-performance-optimization/) - [Migration](https://usercentrics.com/us/migration/) - [Media & Publishing](https://usercentrics.com/us/media-publishing/) - [Retail & Ecommerce](https://usercentrics.com/us/retail-ecommerce/) - [Banking, Finance & Insurance](https://usercentrics.com/us/banking-finance-insurance/) - [Healthcare & Pharmaceuticals](https://usercentrics.com/us/healthcare-pharmaceuticals/) - [Gaming](https://usercentrics.com/us/gaming/) - [Education](https://usercentrics.com/us/education/) - [Automotive](https://usercentrics.com/us/automotive/) - [Travel & Hospitality](https://usercentrics.com/us/travel/) ### Regulations - [CCPA (California)](https://usercentrics.com/us/ccpa/) - [GDPR (EU)](https://usercentrics.com/us/gdpr/) - [CPRA (California)](https://usercentrics.com/us/cpra) - [CPA (Colorado)](https://usercentrics.com/us/cpa/) - [DMA (EU)](https://usercentrics.com/us/digital-markets-act-dma/) - [FADP (Switzerland)](https://usercentrics.com/us/fadp/) - [PIPEDA (Canada)](https://usercentrics.com/us/pipeda/) - [TCF v2.4 (IAB)](https://usercentrics.com/us/cmp-for-publishers/) - [Google Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-google-consent-mode-v2/) - [Microsoft UET Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-microsoft-consent-mode/) - [View all regulations](https://usercentrics.com/us/regulations-and-frameworks/) ### Resources - [Blog](https://usercentrics.com/us/knowledge-hub/) - [Whitepapers](https://usercentrics.com/us/whitepapers/) - [Checklists](https://usercentrics.com/us/checklists/) - [Courses](https://courses.usercentrics.com) - [Customer stories](https://usercentrics.com/us/customer-stories/) - [Privacy-Led Marketing](https://usercentrics.com/us/privacy-led-marketing/) - [Events](https://usercentrics.com/us/webinar/) - [CONSENTED podcast](https://usercentrics.com/us/consented/) - [Guides](https://usercentrics.com/us/guides/) - [Release notes](https://releases.usercentrics.com/en) - [Developer documentation](https://usercentrics.com/docs/) - [RFI template](https://usercentrics.com/us/resources/usercentrics-rfi-template/) - [Customer directory](https://usercentrics.com/us/usercentrics-customer-directory/) ### Company - [About us](https://usercentrics.com/us/about-us/) - [Press](https://usercentrics.com/us/press/) - [Our offices](https://usercentrics.com/us/contact/) - [Trust center](https://trust.usercentrics.com/) - [Careers](https://usercentrics.com/us/career/) - [Open positions](https://apply.workable.com/usercentrics/) - [Diversity and inclusion](https://usercentrics.com/us/dei/) ### Support - [General support](https://support.usercentrics.com/hc/en-us) - [Contact sales](https://usercentrics.com/us/book-a-consultation/) - [Technical support](https://support.usercentrics.com/hc/en-us/requests/new) - [Billing and account](https://support.usercentrics.com/hc/en-us/categories/12253804608156-Account-and-billing) - [Suggest a feature](https://support.usercentrics.com/hc/en-us/requests/new?ticket_form_id=10610312381340) - [Partner login](https://partnerportal.usercentrics.com/) - [Partner program](https://usercentrics.com/us/partner-program-overview/) - [Affiliate program](https://usercentrics.com/us/affiliates/)