CIPA
Cal. Penal Code §§ 631, 632, 638.51
Interception, confidential communications, and pen-register theories
Consent state, timing, request initiator, third-party role, contents, addressing or signaling data
CIPA / ECPA / VPPA / WESCA / FSCA
got pixels?
Pixel litigation evidence
A cross-statute checklist for defense counsel.
Compare CIPA, ECPA, VPPA, WESCA, FSCA, and related health-data theories. Identify the browser facts each requires, then preserve the consent path, transmission, recipient, and limits.
Try it yourself. Open the app.
byPapaya Privacy Co.General product and technical information. Not legal advice.
Assessment structure
Which pixel-litigation theory fits the reproduced browser facts?
JurisdictionState + federal law
JourneySearch, video, chat, form
AssessmentResult + risk level
AuthorityStatutes + case law
LimitsDefenses + open questions
The short answer
What is pixel litigation?
Pixel litigation challenges whether website tracking tools unlawfully intercepted, recorded, or disclosed a visitor's communications. Pixel litigation evidence shows what was transmitted, when it fired, which third party received it, and the consent state and user journey that produced the request.
The theory may depend on whether a communication was acquired in transit, whether video-viewing information was disclosed with an identifier, whether a tracker captured the contents of a substantive interaction, or whether health information reached a third party without the required permission.
Got Pixels runs defined browser journeys and turns the factual record into a jurisdiction-specific assessment. Each tested theory can include a result, risk level, technical evidence, supporting authority, defenses, limitations, and open questions.
The assessment supports counsel's analysis. It does not determine liability or replace legal judgment.
FrameworkAuthorityCore issueBrowser evidence
ECPA
18 U.S.C. §§ 2511, 2520
Intentional interception, use, or disclosure, subject to statutory exceptions
Contemporaneous acquisition, contents, recipient, party roles, consent, service-provider facts
VPPA
18 U.S.C. § 2710
Knowing disclosure of identifiable video-viewing information concerning a consumer
Video title or URL, watch event, account or device identifier, recipient, consent record
WESCA
18 Pa.C.S. § 5703
Interception, disclosure, or use of electronic communications
Pennsylvania user context, timing, contents, consent, tracker and website roles
FSCA
Fla. Stat. §§ 934.03, 934.10
Interception, use, or disclosure of substantive electronic communications
Search terms, health details, form fields, chat text, consent state, third-party requests
Health data
HIPAA, FTC/HBNR, RCW 19.373
Collection, sharing, authorization, or disclosure of sensitive health information
Health-related journeys, inputs, custom events, identifiers, recipients, authorization, privacy notices
Inside a report
Evidence, risk analysis, and authority in one record.
The public sample follows a Pennsylvania shopping journey on Gymshark after the visitor selected “Accept only essential cookies.” It preserves checkpoints before the choice, after reload, and after a product-to-checkout journey. The report assesses WESCA and ECPA theories and states that no personal, shipping, or payment fields were entered.
View the sample reportPennsylvania assessment
Sample risk matrix
Gymshark.com · essential-only choice
WESCA all-party consent
Mixed
High
The visitor chose essential-only cookies. Analytics and ad requests continued after reload. The report discusses the visible banner as a possible notice defense rather than assuming consent was absent.
WESCA contents interception
Elevated
High
Post-choice requests carried product, selected size, add-to-cart, SKU, and value data. The run did not show typed checkout or payment fields being transmitted.
ECPA crime-tort exception
Unclear
Medium
The report notes that analytics collection after rejection does not itself establish a separate criminal or tortious purpose. The federal theory needs more evidence.
The report preserves screenshots, request counts, tracker domains, cookies, browser steps, cited authority, defenses, and factual limitations. These are the sample report’s assessments, not legal conclusions.
Statute families
Which statutes apply to pixel litigation?
CIPA website cases can involve distinct provisions. Section 631 addresses wiretapping and unauthorized interception or learning of a communication's contents or meaning. Section 632 addresses recording or eavesdropping on confidential communications. Section 638.51 restricts pen registers and trap-and-trace devices, subject to statutory exceptions that include user consent.
The browser test must match the theory. A chatbot exchange presents different facts from a page view. A search term or form value differs from routing or device data. Timing may matter when counsel evaluates whether a third party acquired a communication in transit.
- Test before consent, after accept, after reject, and with GPC where relevant.
- Preserve the sequence between the user action and the outgoing request.
- Identify the request initiator, recipient, third-party role, contents, identifiers, and addressing signals.
Title 18 U.S.C. section 2511 prohibits intentional interception, use, or disclosure of wire, oral, or electronic communications, subject to statutory exceptions. Section 2520 authorizes civil recovery for a person whose communication was intercepted, disclosed, or intentionally used in violation of the chapter.
Website disputes can turn on contemporaneous acquisition, contents, party or service-provider exceptions, purpose, and consent. A browser audit cannot resolve those questions by itself, but it can show exactly when the request occurred, what it carried, and which party received it.
- Tie the request timestamp to the user action and script execution.
- Separate substantive contents from routing, device, and ad-delivery metadata.
- Preserve the recipient, request initiator, consent state, and facts relevant to party or provider arguments.
The VPPA restricts knowing disclosure by a video tape service provider of personally identifiable information concerning a consumer, subject to statutory exceptions. A pixel allegation can therefore raise separate provider, consumer, video-information, identification, disclosure, and consent questions.
The browser record should connect a viewing action to a transmission without assuming the legal result. Courts have not treated every video event and identifier combination alike, so the assessment must show what was present and what was missing.
- Preserve the video title or URL and the specific watch or playback event.
- Identify account, advertising, device, or other person-linked identifiers sent with the event.
- Record the recipient, consent interface, account state, and evidence of any subscriber relationship.
Pennsylvania and Florida
WESCA and FSCA
Pennsylvania WESCA prohibits intentional interception, disclosure, or use of covered communications, subject to statutory exceptions. Florida FSCA addresses intentional interception, use, or disclosure and can turn on whether the transmitted data contained the substance of a communication rather than generic navigation.
Preserve the user location, consent state, communication contents, timing, tracker role, searches, form fields, chat text, health details, and third-party requests.
Health information
HIPAA, FTC, HBNR, and state health-data laws
Health-related tracking can raise regulatory and state-law questions that are not interchangeable with a private wiretap claim. HHS states that the HIPAA Rules apply when covered entities or business associates use tracking technologies that collect or disclose protected health information.
Capture the health-related page or journey, search or form input, event name, identifier, third-party recipient, authorization or consent state, privacy notice, and full payload.
Other state laws
Website tracking allegations also appear under statutes in Maryland, Washington, Illinois, Massachusetts, and other states. Definitions, consent rules, exceptions, remedies, and judicial interpretations differ. Capture the jurisdictional inputs instead of applying one universal label. Massachusetts is one example of why qualification matters. The state's highest court narrowed the application of its wiretap statute to ordinary web browsing in Vita v. New England Baptist Hospital, while other theories remained outside that specific holding.
Browser evidence checklist
Pixel evidence checklist
Preserve jurisdiction, consent, communication, timing, contents, identifiers, recipients, repeatability, and evidence. Record what was absent or inconclusive. Each statute requires its own analysis.
Jurisdiction
Relevant user location and the website journey tested
Consent
Before consent, after accept, after reject, and applicable opt-out signals
Communication
Page view, video watch, search, chat, form submission, or checkout interaction
Timing
Sequence between the user action, script execution, and network request
Contents
URLs, event names, payload fields, form values, searches, video data, and cookies
Identifiers
Account, device, advertising, session, and other identifiers sent with the event
Recipient
Each third party that received the request and the initiator that sent it
Repeatability
The same journey rerun under controlled consent and user states
Evidence
Request details, screenshots, page state, timestamps, and reproduction steps
Questions counsel ask
Pixel litigation evidence FAQ
Direct answers about the browser record. The legal result still depends on the statute, jurisdiction, parties, defenses, and current authority.
What is pixel litigation?
Pixel litigation challenges whether website tracking tools unlawfully intercepted, recorded, or disclosed a visitor's communications. The applicable theory depends on the statute, jurisdiction, consent state, communication, recipient, timing, and data transmitted.
What should a pixel litigation evidence checklist include?
For defense counsel, the checklist should include jurisdiction, consent state, communication or user action, request timing, payload contents, identifiers, recipients, repeatable browser steps, and preserved screenshots and network logs. Record absent and inconclusive facts as well as observed transmissions. The relevant record depends on the statute, claim, or defense being evaluated.
Can a present-day browser audit prove historical tracking behavior?
No. A present-day audit documents the tested site's behavior at the time of the run. It does not by itself establish what happened to a past visitor or under an earlier site configuration. Preserve run timestamps and reproduction steps, and distinguish that record from historical logs, configuration records, and other matter evidence.
How do Meta Pixel lawsuits fit into pixel litigation?
Meta Pixel lawsuits are one part of the broader pixel litigation category. Depending on the facts, allegations may invoke the VPPA, CIPA, ECPA, state wiretap laws, health-data rules, or consumer-protection theories. Browser evidence documents the transmission; it does not determine liability.
Continue the evidence review
Related pixel litigation guides
TrackerMeta Pixel lawsuits and demand lettersTie the consent state and browser journey to the exact Meta request, payload, identifiers, and recipient.CaliforniaCIPA lawsuits and demand lettersSeparate Sections 631, 632, and 638.51 before preserving the provision-specific browser facts.VideoVPPA pixel lawsuits and demand lettersPreserve the video, consumer, identifier, disclosure, recipient, and consent record.PennsylvaniaWESCA lawsuits and demand lettersPreserve the consent path, where the privacy-policy link appeared, and what each request carried.FloridaFSCA lawsuits and demand lettersSeparate pre-consent requests, contents, record data, and chat before preserving recipients.
See the software in action
Watch Got Pixels test a browser journey relevant to your work.
Got Pixels
Build and rerun journey tests.
Composer turns the legal question into a browser audit suite. Change the jurisdiction, consent state, journey, or tracker, then compare the resulting report matrices.
- Jurisdiction-specific result and risk matrices
- Linked statutes and matching case law
- Full search, video, chat, checkout, and form journeys
- Technical evidence, defenses, limitations, and open questions
Product findings support legal analysis. The software does not determine liability or compliance.
Product demo
See a statute-specific audit in the product.
Book a demo with a jurisdiction, website, consent state, or user journey you want to test. We'll show how Got Pixels builds the workflow and organizes the results into evidence, authority, risk levels, defenses, and stated limitations.
- A walkthrough using your site and user journey
- The consent path, jurisdiction, and tracker you choose
- How to inspect requests, screenshots, and limitations