Did someone intentionally intercept, disclose, or use the communication, or procure another person to intercept it?
The script the site loaded, its initiator, the recipient endpoint, request timing, and the payload sent from the browser.
CIPA / ECPA / VPPA / WESCA / FSCA
got pixels?
WESCA lawsuits and demand letters
Preserve what the visitor could see before the tracker fired.
Whether a Pennsylvania Wiretapping and Electronic Surveillance Control Act claim arrives as a demand letter or a lawsuit, preserve the consent path, the privacy-policy link as it appeared, and the contents, recipients, and timing of each request from a Pennsylvania browser.
Try it yourself. Open the app.
byPapaya Privacy Co.General product and technical information. Not legal advice.
Matter-specific evidence question
What did third parties receive from a Pennsylvania visitor, and was the disclosure visible first?
LocationPennsylvania browser
ConsentBanner + policy link
ContentsSearch + form values
RecipientThird-party endpoint
TimingBefore vs. after choice
The short answer
WESCA evidence to preserve
For a WESCA website-tracking claim, preserve the visitor's Pennsylvania location, the consent banner and privacy-policy link as they appeared, the requests that fired before and after any choice, each recipient, and whether payloads carried searches, form entries, or other contents. Keep screenshots that show where the disclosure sat on each page.
WESCA gives a civil action against anyone who intercepts, discloses, or uses a communication, or procures another person to do so (18 Pa.C.S. § 5725). Interception is allowed when all parties have given prior consent (§ 5704(4)). In Popa v. Harriet Carter Gifts, the Third Circuit held that tracking code intercepts where it routes communications to the vendor, at the visitor's browser.
On October 23, 2026, the Pennsylvania Superior Court held in Thompson v. C. & J. Clark America that a privacy policy can supply implied consent if it discloses the interception to a reasonable reader and is reasonably conspicuous. It vacated summary judgment because the record lacked evidence, such as a screenshot, of where the link appeared. A browser run preserves that record for the site as it is today. It does not decide consent.
Evidence ledger
WESCA evidence checklist
Consent questions under WESCA turn on what the visitor could see. The record should show the page as rendered, not only the network log.
Location
Browser location and region for the run, since Popa places the interception where the browser routes data to the vendor.
Consent interface
Banner copy, available choices, the choice made, and screenshots of the page before and after it.
Policy visibility
Where the privacy-policy link sits on each tested page, its label and contrast, and the policy text describing third-party collection.
Contents vs. record data
Search terms, form values, product selections, and chat text, separated from URLs, cookies, IP addresses, and device identifiers.
Recipients
Each third-party endpoint, the initiating script, request method, timestamp, and payload.
Repeatability
Screenshots, agent steps, network logs, and a saved workflow for controlled reruns.
Controlled browser workflow
Test from Pennsylvania
Controlled runs separate what the visitor saw from what the trackers sent.
Set the Pennsylvania context
Run the browser from Pennsylvania and record the starting page, cookies, and consent state.
Capture the disclosure as shown
Screenshot the banner and the privacy-policy link on each page state before any interaction.
Run the alleged journey
Reproduce the search, product view, form, or chat the letter describes, and record each request, recipient, and payload.
Compare consent states
Repeat with no choice, accept, and reject. State which requests changed and what remained unknown.
Limits and defenses
WESCA test limitations
The record documents present, absent, and inconclusive facts without turning them into a statutory result.
01
A present-day run cannot show where the policy link sat or what fired on the date in the letter. Archived captures and site records fill that gap, and counsel weighs them.
02
Whether a field is contents is a legal question. The record separates search terms and form values from routing and identifier data without deciding it.
03
A visible privacy link is not automatically consent. Thompson requires adequate disclosure and reasonable conspicuousness, proved on the evidence.
04
Standing and forum questions, such as those in Cook v. GameStop, sit outside the browser record.
05
A run from one Pennsylvania location does not cover every browser, device, account state, or consent configuration.
Questions counsel ask
WESCA demand letter and lawsuit FAQ
Direct answers about the evidence record. Legal conclusions still depend on the statute, jurisdiction, parties, exceptions, defenses, and current authority.
What should we test after receiving a WESCA demand letter?
Before changing the site, record what it does now. Reproduce the interaction the letter describes, such as a search, product view, or form, from a Pennsylvania browser under no-choice, accept, and reject paths. Capture where the privacy-policy link sits on each page, and preserve the requests, recipients, payloads, timing, and screenshots. A present-day run does not show the site's behavior on the date in the letter, and counsel decides how to respond.
Does a privacy policy count as consent under WESCA?
It can. In Thompson v. C. & J. Clark America (Pa. Super. Ct., Oct. 23, 2026), the court held that a privacy policy can supply implied consent if it discloses the nature of the interception to a reasonable reader and is reasonably conspicuous. It vacated summary judgment because the record did not show where the policy link appeared or how visible it was. Counsel decides whether a given policy meets that standard.
What damages does WESCA allow?
Section 5725(a) allows actual damages, but not less than liquidated damages of $100 a day for each day of violation or $1,000, whichever is higher, plus punitive damages and reasonable attorney's fees and litigation costs. Amounts in a demand letter are the sender's figures, not statutory amounts.
Is the website operator exempt because it is a party to the communication?
Not automatically. In Popa v. Harriet Carter Gifts (3d Cir. 2022), the court predicted that Pennsylvania has no sweeping direct-party exception, because one would erase the all-party consent requirement. Section 5725 also reaches anyone who procures another person to intercept, which is how site operators are named alongside tracking vendors.
Can a WESCA claim over ordinary browsing proceed in federal court?
The Third Circuit held in Cook v. GameStop (2025) that a plaintiff whose session replay data showed only retail browsing, with no sensitive or personal information, lacked Article III standing. That is a federal jurisdiction ruling, not a ruling on WESCA's merits. Popa's own case was later sent back to state court on the same ground, and Thompson was decided in state court.
Continue the evidence review
Related pixel litigation guides
Pillar guidePixel litigation evidence guideCompare the evidence questions behind WESCA, CIPA, ECPA, VPPA, FSCA, and health-data theories.FloridaFSCA lawsuits and demand lettersAnother all-party consent state. Separate contents from record data and preserve what fired before consent.CaliforniaCIPA lawsuits and demand lettersSeparate Sections 631, 632, and 638.51 and map each theory to testable browser facts.
See the software in action
Watch Got Pixels test a browser journey relevant to your work.
Got Pixels
Build and rerun journey tests.
Set the user path once, inspect what fires along the way, and reuse the workflow when the site changes. Start in the app.
- Set a site, jurisdiction, consent choice, and journey
- Reuse the journey across consent states and site changes
- Inspect requests, payloads, and screenshots
- Share the report for legal review
Product findings support legal analysis. The software does not determine liability or compliance.
Product demo
See a WESCA workflow in the software.
Book a demo and bring a Pennsylvania journey, consent state, or demand letter question relevant to your work. We'll show how Got Pixels runs the browser test and presents the disclosure screenshots, third-party requests, contents, and limitations.
- A product walkthrough using the tracker or legal theory you choose
- How to set the consent state and browser journey in Composer
- Where the resulting requests, authority, defenses, and limitations appear