Was a communication intentionally intercepted, used, or disclosed?
The initiating script, recipient endpoint, request timing, and the payload sent from the browser.
CIPA / ECPA / VPPA / WESCA / FSCA
got pixels?
FSCA lawsuits and demand letters
Separate the contents from the clicks.
Whether a Florida Security of Communications Act claim arrives as a demand letter or a lawsuit, preserve what fired before consent, which requests carried searches, form text, or chat messages, and who received them, from a Florida browser.
Try it yourself. Open the app.
byPapaya Privacy Co.General product and technical information. Not legal advice.
Matter-specific evidence question
Did a third party receive the substance of a Florida visitor's communication before consent?
LocationFlorida browser
ConsentBefore vs. after choice
ContentsSearch, form, chat text
Record dataURL, IP, device ID
RecipientThird-party endpoint
The short answer
FSCA evidence to preserve
For an FSCA website claim, preserve which scripts loaded before the visitor made any choice, which requests carried contents such as searches, form text, or chat messages, which carried only record data such as URLs, IP addresses, and device identifiers, and every recipient. Record the consent interface and the requests before and after each choice.
Section 934.03 prohibits intentional interception, use, or disclosure of electronic communications, and § 934.03(2)(d) allows interception when all parties have given prior consent. Section 934.10 gives a civil action for violations of §§ 934.03 to 934.09, with actual damages but not less than $100 a day or $1,000, whichever is higher, plus possible punitive damages and fees.
Florida rulings split by technology. Session replay that captured clicks and page views was dismissed for lacking contents (Goldstein v. Costco, S.D. Fla. 2021). Healthcare pixels that allegedly sent medical searches and appointment details survived dismissal (W.W. v. Orlando Health, M.D. Fla. 2025; Crespi v. BayCare, M.D. Fla. 2026). Those are pleading-stage rulings, not findings on the merits.
Evidence ledger
FSCA evidence checklist
Florida cases have turned on whether the data carried the substance of a communication. The record should keep contents and record data apart.
Location
Browser location and region for the run, recorded with each capture.
Pre-consent activity
Every script and request that fired after page load and before any banner choice, with timestamps.
Contents
Search terms, form text, chat messages, and health or account details that appear in payloads.
Record data
URLs, IP addresses, cookies, and device or advertising identifiers, kept apart from contents.
Chat
Whether a chat widget records messages, where transcripts are sent, and which vendor receives them.
Recipients
Each third-party endpoint, the initiating script, request method, timestamp, and payload.
Controlled browser workflow
Test from Florida
Controlled runs separate pre-consent activity from what the visitor typed or chose.
Set the Florida context
Run the browser from Florida and record the starting page, cookies, and consent state.
Capture before any choice
Record every request that fires on load, before the visitor touches the banner.
Run the alleged journey
Reproduce the search, form, or chat the letter describes, and record each request, recipient, and payload.
Compare consent states
Repeat with no choice, accept, and reject. State which requests changed and what remained unknown.
Limits and defenses
FSCA test limitations
The record documents present, absent, and inconclusive facts without turning them into a statutory result.
01
Whether a field is contents under § 934.02 is a legal question. The record separates contents from record data without deciding it.
02
Orlando Health and Crespi involved healthcare sites and medical searches. They do not settle how courts treat ordinary retail browsing.
03
The § 934.31 pen-register theory is pleaded but untested, and § 934.10 does not expressly cover it.
04
Chat claims raise separate party and consent questions from pixel claims.
05
A present-day run cannot prove what fired on the date in the letter or cover every browser, device, and consent configuration.
Questions counsel ask
FSCA demand letter and lawsuit FAQ
Direct answers about the evidence record. Legal conclusions still depend on the statute, jurisdiction, parties, exceptions, defenses, and current authority.
What should we test after receiving an FSCA demand letter?
Before changing the site, record what it does now. Reproduce the interaction the letter describes, such as a search, form submission, or chat message, from a Florida browser under no-choice, accept, and reject paths. Preserve the requests, recipients, payloads, timing, and screenshots, starting before any banner choice. A present-day run does not show the site's behavior on the date in the letter, and counsel decides how to respond.
What damages does the FSCA allow?
Section 934.10(1) allows equitable or declaratory relief, actual damages but not less than liquidated damages of $100 a day for each day of violation or $1,000, whichever is higher, punitive damages, and reasonable attorney's fees and litigation costs. Amounts in a demand letter are the sender's figures, not statutory amounts.
Can a private plaintiff sue under the FSCA pen-register section?
That is unsettled. Some Florida complaints plead § 934.31 against IP-address and identity-resolution scripts. The civil-remedy section, § 934.10, covers violations of §§ 934.03 to 934.09 and does not expressly cover § 934.31, and as of October 2026 courts had not ruled on whether a private plaintiff can sue under it.
How have Florida courts treated session replay versus pixels?
Goldstein v. Costco (S.D. Fla. 2021) dismissed a session replay claim because clicks, mouse movements, and page views were not contents. W.W. v. Orlando Health (M.D. Fla. 2025) and Crespi v. BayCare (M.D. Fla. 2026) let claims proceed where healthcare pixels allegedly sent medical searches and appointment details. All three are pleading-stage rulings, not findings on the merits.
Is there a deadline to bring an FSCA claim?
Section 934.10(3) requires a civil action within two years after the claimant first has a reasonable opportunity to discover the violation. Counsel evaluates how that applies to a given letter.
Continue the evidence review
Related pixel litigation guides
Pillar guidePixel litigation evidence guideCompare the evidence questions behind FSCA, CIPA, ECPA, VPPA, WESCA, and health-data theories.PennsylvaniaWESCA lawsuits and demand lettersAnother all-party consent state. Preserve the consent path and where the privacy-policy link appeared.CaliforniaCIPA lawsuits and demand lettersSeparate Sections 631, 632, and 638.51 and map each theory to testable browser facts.
See the software in action
Watch Got Pixels test a browser journey relevant to your work.
Got Pixels
Build and rerun journey tests.
Set the user path once, inspect what fires along the way, and reuse the workflow when the site changes. Start in the app.
- Set a site, jurisdiction, consent choice, and journey
- Reuse the journey across consent states and site changes
- Inspect requests, payloads, and screenshots
- Share the report for legal review
Product findings support legal analysis. The software does not determine liability or compliance.
Product demo
See an FSCA workflow in the software.
Book a demo and bring a Florida journey, chat widget, consent state, or demand letter question relevant to your work. We'll show how Got Pixels runs the browser test and separates contents, record data, recipients, and limitations.
- A product walkthrough using the tracker or legal theory you choose
- How to set the consent state and browser journey in Composer
- Where the resulting requests, authority, defenses, and limitations appear