Privacy laws behind website tracking cases: wiretap, video, health and cookie rules
Most tracking claims rest on a short list of laws, many written long before the web: state wiretap acts, the 1988 Video Privacy Protection Act, health privacy statutes and the EU's cookie consent rule. These 15 pages explain how each one is used against websites and apps, and which cases in the library rely on it.
- Source review
- 26 October 2026
How the law pages work
Each of these 15 pages explains one law or doctrine as it is used against websites and apps: what the text says, who can bring a claim and what they can recover, how courts have ruled, what is changing, and which cases in the library rely on it.
The same tracking set-up can be challenged under several laws at once, so a single case often appears on more than one page. To start from the failure rather than the statute, see the issue pages.
California
Most website tracking lawsuits in the library are brought under California law.
- CIPA §631: California's 1967 wiretap statute, as courts apply it to pixels, chat widgets and session replay.
- CIPA §632 and §632.7: Recording a confidential communication without everyone's consent, applied to health apps, therapy chat and AI notetakers.
- CIPA §638.51: The pen register theory against tags that receive a visitor's IP address, the rulings, and what SB 690 changes.
- California CMIA: When a pixel on a health site or app discloses "medical information" without authorisation.
- CCPA: Opt-outs, Global Privacy Control and the opt-out failures California regulators have fined.
Other US states
State wiretap and privacy statutes that plaintiffs use outside California.
- Pennsylvania WESCA: All-party consent, interception at the browser and the standing hurdle.
- Florida Security of Communications Act: All-party consent and how it applies to pixels, chat and session replay.
- Massachusetts wiretap act: Why web browsing is not a "communication" after the Vita decision.
- Washington Privacy Act and My Health My Data Act: RCW 9.73 after Baker, and the 2023 health data law.
- Arizona TUCSRA: The email tracking pixel theory, and why it failed on appeal.
US federal law
Federal statutes and the FTC's enforcement powers.
- Federal Wiretap Act: One-party consent and the crime-tort exception in pixel cases.
- Video Privacy Protection Act: Pixels on video pages, and the Supreme Court case on who counts as a consumer.
- FTC Act Section 5 and the Health Breach Notification Rule: Health data, pixels and broken privacy promises.
- Standing in tracking cases: How TransUnion, Popa and Cook ended federal suits before the merits.
European Union
Consent rules for storing and reading data on a device.
- GDPR and ePrivacy cookie rules: How the CNIL enforces Article 82, and the fines on record.
Sources and limits
Each law page cites the statute and the decisions it relies on. The sources for each case are on its case page. Read how to use the library.
Source review: 26 October 2026. This page indexes the law pages in the Enforcement library. It is not legal advice, and it cannot decide which laws apply to your site.
Questions about the law pages
Short answers drawn from the pages above.
Most of the lawsuits in the library are brought under US state wiretap and privacy statutes, especially California’s. The EU’s cookie consent rule is covered on the GDPR and ePrivacy page, and each European and UK case page explains the rules it applied.
No. Each page summarises the statute and the cited decisions at their procedural stage. Inth’s checks can show what your site does, not which laws apply.
The issue pages group the same cases by what went wrong, such as tags firing before consent or ignored opt-out signals.
Teams that use Inth or c15t
- Expo
- Zed
- Infisical
- Unkey
- Chelsea Piers
- Mario Testino
- Roboto Studio
- Cal.com
- Mastra